Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: GVU 2.07 trojaner

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 04.08.2012, 07:34   #1
artist91
 
GVU 2.07 trojaner - Standard

GVU 2.07 trojaner



Ich habe alles soweit wie hier im forum versucht durchzuarbeiten. Nun eine Frage von mir ist das jetzt so in Ordnung :
Zitat:
All processes killed
========== OTL ==========
Service WDICA stopped successfully!
Service WDICA deleted successfully!
Service PDRFRAME stopped successfully!
Service PDRFRAME deleted successfully!
Service PDRELI stopped successfully!
Service PDRELI deleted successfully!
Service PDFRAME stopped successfully!
Service PDFRAME deleted successfully!
Service PDCOMP stopped successfully!
Service PDCOMP deleted successfully!
Service PCIDump stopped successfully!
Service PCIDump deleted successfully!
Service lbrtfdc stopped successfully!
Service lbrtfdc deleted successfully!
Service i2omgmt stopped successfully!
Service i2omgmt deleted successfully!
Service Changer stopped successfully!
Service Changer deleted successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
Prefs.js: 0 removed from network.proxy.type
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HonorAutoRunSetting deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\AUTOEXEC.BAT moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{48412bc2-a3bd-11df-9b93-c9942e313d71}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48412bc2-a3bd-11df-9b93-c9942e313d71}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{48412bc2-a3bd-11df-9b93-c9942e313d71}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48412bc2-a3bd-11df-9b93-c9942e313d71}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{48412bc2-a3bd-11df-9b93-c9942e313d71}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48412bc2-a3bd-11df-9b93-c9942e313d71}\ not found.
File J:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{48412bc6-a3bd-11df-9b93-c9942e313d71}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48412bc6-a3bd-11df-9b93-c9942e313d71}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{48412bc6-a3bd-11df-9b93-c9942e313d71}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48412bc6-a3bd-11df-9b93-c9942e313d71}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{48412bc6-a3bd-11df-9b93-c9942e313d71}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48412bc6-a3bd-11df-9b93-c9942e313d71}\ not found.
File J:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{48412bca-a3bd-11df-9b93-e931f1f1fa94}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48412bca-a3bd-11df-9b93-e931f1f1fa94}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{48412bca-a3bd-11df-9b93-e931f1f1fa94}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48412bca-a3bd-11df-9b93-e931f1f1fa94}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{48412bca-a3bd-11df-9b93-e931f1f1fa94}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48412bca-a3bd-11df-9b93-e931f1f1fa94}\ not found.
File J:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5fe1641f-5e1f-11e0-9c2c-bbff7ea5f3f7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5fe1641f-5e1f-11e0-9c2c-bbff7ea5f3f7}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5fe1641f-5e1f-11e0-9c2c-bbff7ea5f3f7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5fe1641f-5e1f-11e0-9c2c-bbff7ea5f3f7}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5fe1641f-5e1f-11e0-9c2c-bbff7ea5f3f7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5fe1641f-5e1f-11e0-9c2c-bbff7ea5f3f7}\ not found.
File J:\setup_vmc_lite.exe /checkApplicationPresence not found.
File C:\Dokumente und Einstellungen\Torabian\Desktop\mbam-setup-1.62.0.1300.exe not found.
C:\WINDOWS\System32\ConduitEngine.tmp deleted successfully.
C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
C:\WINDOWS\System32\REN446.tmp deleted successfully.
File C:\WINDOWS\System32\ADW.exe not found.
C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\bing.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ras_0oed.pad moved successfully.
File C:\Dokumente und Einstellungen\Torabian\Startmenü\Programme\Autostart\ctfmon.lnk not found.
========== FILES ==========
< ipconfig /flushdns /c >
No captured output from command...
C:\Dokumente und Einstellungen\Türkyilmaz\Desktop\cmd.bat deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56478 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 196608 bytes
->Temporary Internet Files folder emptied: 1696231 bytes

User: Türkyilmaz
->Temp folder emptied: 5374595541 bytes
->Temporary Internet Files folder emptied: 299409204 bytes
->Java cache emptied: 3755778 bytes
->FireFox cache emptied: 166724915 bytes
->Google Chrome cache emptied: 403125716 bytes
->Apple Safari cache emptied: 894976 bytes
->Flash cache emptied: 58617 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 1258715 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 166332759 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 6.121,00 mb


[EMPTYFLASH]

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService

User: Türkyilmaz
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0,00 mb


OTL by OldTimer - Version 3.2.43.0 log created on 08042012_080358

Files\Folders moved on Reboot...
File\Folder C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Temp\Perflib_Perfdata_7c.dat not found!
File\Folder C:\Dokumente und Einstellungen\Türkyilmaz\Lokale Einstellungen\Temp\div4C2.tmp\div7CD.tmp not found!
C:\Dokumente und Einstellungen\Türkyilmaz\Lokale Einstellungen\Temp\deo0_sar.exe moved successfully.
C:\Dokumente und Einstellungen\Türkyilmaz\Lokale Einstellungen\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.

Registry entries deleted on Reboot...

Alt 04.08.2012, 16:19   #2
t'john
/// Helfer-Team
 
GVU 2.07 trojaner - Standard

GVU 2.07 trojaner





1. Schritt

Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktualisiere die Datenbank!
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".

2. Schritt
Systemscan mit OTL (bebilderte Anleitung)

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden)- Doppelklick auf die OTL.exe

  • Vista und Win7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Wähle Scanne Alle Benuzer
  • Oben findest Du ein Kästchen mit Ausgabe. Wähle bitte Minimale Ausgabe
  • Unter Extra Registrierung, wähle bitte Benutze SafeList
  • Klicke nun auf Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles hier in den Thread.
__________________

__________________

Alt 05.08.2012, 10:24   #3
artist91
 
GVU 2.07 trojaner - Standard

GVU 2.07 trojaner



Das sind die drei Logs
Zitat:
Malwarebytes Anti-Malware (Test) 1.62.0.1300
Malwarebytes : Free Anti-Malware download

Datenbank Version: v2012.08.04.07

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Türkyilmaz :: TÜRKYILMAZ [Administrator]

Schutz: Aktiviert

05.08.2012 06:04:01
mbam-log-2012-08-05 (11-23-18).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 411172
Laufzeit: 2 Stunde(n), 20 Minute(n), 8 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 6
C:\Dokumente und Einstellungen\Türkyilmaz\Eigene Dateien\Downloads\SoftonicDownloader_fuer_java-se-development-kit-jdk.exe (PUP.OfferBundler.ST) -> Keine Aktion durchgeführt.
C:\Dokumente und Einstellungen\Türkyilmaz\Eigene Dateien\Downloads\Delphi 7\KEYGEN\KEYGEN.EXE (RiskWare.Tool.CK) -> Keine Aktion durchgeführt.
C:\Dokumente und Einstellungen\Türkyilmaz\Eigene Dateien\Ünal\FlyingWorld - 2012\FlyingWorld.exe (RiskWare.Tool.CK) -> Keine Aktion durchgeführt.
C:\TEMP\Delphi7\keygen\keygen.exe (RiskWare.Tool.CK) -> Keine Aktion durchgeführt.
C:\_OTL\MovedFiles\08042012_080358\C_Dokumente und Einstellungen\Türkyilmaz\Lokale Einstellungen\Temp\deo0_sar.exe (Spyware.Zeus) -> Keine Aktion durchgeführt.
C:\Dokumente und Einstellungen\Türkyilmaz\Startmenü\Programme\Autostart\ctfmon.lnk (Trojan.Ransom.Gen) -> Keine Aktion durchgeführt.

(Ende)
OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 05.08.2012 07:26:48 - Run 1
OTL by OldTimer - Version 3.2.56.0     Folder = C:\Dokumente und Einstellungen\Türkyilmaz\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 0,90 Gb Available Physical Memory | 44,91% Memory free
3,85 Gb Paging File | 2,68 Gb Available in Paging File | 69,63% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 345,56 Gb Total Space | 225,95 Gb Free Space | 65,38% Space Free | Partition Type: NTFS
Drive D: | 292,97 Gb Total Space | 285,06 Gb Free Space | 97,30% Space Free | Partition Type: NTFS
Drive E: | 292,97 Gb Total Space | 286,43 Gb Free Space | 97,77% Space Free | Partition Type: NTFS
Drive H: | 1003,00 Mb Total Space | 873,94 Mb Free Space | 87,13% Space Free | Partition Type: FAT
 
Computer Name: TÜRKYILMAZ | User Name: Türkyilmaz | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\Türkyilmaz\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Yuna Software\Messenger Plus!\PlusService.exe (Yuna Software)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Java\jre7\bin\jqs.exe (Oracle Corporation)
PRC - C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Programme\Trillian\trillian.exe (Cerulean Studios)
PRC - D:\CDBurnerXP\NMSAccessU.exe ()
PRC - C:\Programme\Gemeinsame Dateien\Siemens\S7UBTOOX\S7ubTstx.exe (SIEMENS AG)
PRC - C:\Programme\Siemens\Step7\S7BIN\s7asysvx.exe (SIEMENS AG)
PRC - C:\Programme\Gemeinsame Dateien\Siemens\S7IEPG\s7oiehsx.exe (SIEMENS AG)
PRC - C:\Programme\Gemeinsame Dateien\Siemens\Automation\TraceEngine\bin\S7TraceServiceX.exe (SIEMENS AG)
PRC - C:\Programme\Gemeinsame Dateien\Siemens\SWS\almsrv\almsrvx.exe (SIEMENS AG)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\RALINK\Common\RaUI.exe (Ralink Technology, Corp.)
PRC - C:\Programme\Mouse Driver\KMWDSrv.exe (UASSOFT.COM)
PRC - C:\Programme\Mouse Driver\KMProcess.exe (UASSOFT.COM)
PRC - C:\Programme\Gemeinsame Dateien\Siemens\SQLANY\dbsrv9.exe (iAnywhere Solutions, Inc.)
PRC - C:\Programme\Mouse Driver\KMCONFIG.exe (UASSOFT.COM)
PRC - C:\Programme\Mouse Driver\StartAutorun.exe (UASSOFT.COM)
PRC - C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
PRC - C:\WINDOWS\system32\LVCOMSX.EXE (Logitech Inc.)
PRC - C:\Programme\Logitech\Video\LogiTray.exe (Logitech Inc.)
PRC - C:\Programme\Logitech\Video\FxSvr2.exe (Logitech Inc.)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_270.dll ()
MOD - C:\Programme\Mozilla Firefox\mozjs.dll ()
MOD - C:\Programme\Avira\AntiVir Desktop\sqlite3.dll ()
MOD - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU ()
MOD - C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Programme\Yuna Software\Messenger Plus!\Detour32.dll ()
MOD - C:\Programme\DivX\DivX Update\DivXUpdateCheck.dll ()
MOD - C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
MOD - C:\WINDOWS\system32\sbe.dll ()
MOD - C:\Programme\Trillian\libpng13.dll ()
MOD - C:\Programme\Trillian\libungif.dll ()
MOD - C:\Programme\Trillian\zlib1.dll ()
MOD - c:\Programme\Trillian\languages\en\trillian.dll ()
MOD - c:\Programme\Trillian\languages\en\events.dll ()
MOD - c:\Programme\Trillian\languages\en\buddy.dll ()
MOD - c:\Programme\Trillian\languages\en\talk.dll ()
MOD - c:\Programme\Trillian\languages\en\irc.dll ()
MOD - c:\Programme\Trillian\languages\en\proxy.dll ()
MOD - c:\Programme\Trillian\languages\en\toolkit.dll ()
MOD - D:\CDBurnerXP\NMSAccessU.exe ()
MOD - C:\WINDOWS\system32\msdmo.dll ()
MOD - C:\Programme\Gemeinsame Dateien\Siemens\SWS\plugins\scp\scpwin32.dll ()
MOD - C:\WINDOWS\system32\msjetoledb40.dll ()
MOD - C:\Programme\Mouse Driver\keydll.dll ()
MOD - C:\Programme\RALINK\Common\acAuth.dll ()
MOD - C:\Programme\Mouse Driver\MouseHook.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (MBAMService) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (SkypeUpdate) -- C:\Programme\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (Apple Mobile Device) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (JavaQuickStarterService) -- C:\Programme\Java\jre7\bin\jqs.exe (Oracle Corporation)
SRV - (odserv) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (npggsvc) -- C:\WINDOWS\system32\GameMon.des (INCA Internet Co., Ltd.)
SRV - (ServiceLayer) -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (NMSAccess) -- D:\CDBurnerXP\NMSAccessU.exe ()
SRV - (s7asysvx) -- C:\Programme\Siemens\Step7\S7BIN\s7asysvx.exe (SIEMENS AG)
SRV - (s7oiehsx) -- C:\Programme\Gemeinsame Dateien\Siemens\S7IEPG\s7oiehsx.exe (SIEMENS AG)
SRV - (S7TraceServiceX) -- C:\Programme\Gemeinsame Dateien\Siemens\Automation\TraceEngine\bin\S7TraceServiceX.exe (SIEMENS AG)
SRV - (almservice) -- C:\Programme\Gemeinsame Dateien\Siemens\SWS\almsrv\almsrvx.exe (SIEMENS AG)
SRV - (KMWDSERVICE) -- C:\Programme\Mouse Driver\KMWDSrv.exe (UASSOFT.COM)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (XDva360) -- C:\WINDOWS\system32\XDva360.sys File not found
DRV - (EagleXNt) -- C:\WINDOWS\system32\drivers\EagleXNt.sys File not found
DRV - (EagleNT) -- C:\WINDOWS\system32\drivers\EagleNT.sys File not found
DRV - (MBAMSwissArmy) -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (MBAMProtector) -- C:\WINDOWS\system32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (atksgt) -- C:\WINDOWS\system32\drivers\atksgt.sys ()
DRV - (lirsgt) -- C:\WINDOWS\system32\drivers\lirsgt.sys ()
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (dtsoftbus01) -- C:\WINDOWS\system32\drivers\dtsoftbus01.sys (DT Soft Ltd)
DRV - (avkmgr) -- C:\WINDOWS\system32\drivers\avkmgr.sys (Avira GmbH)
DRV - (UsbserFilt) -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (upperdev) -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) -- C:\WINDOWS\system32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) -- C:\WINDOWS\system32\drivers\ccdcmb.sys (Nokia)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (StarOpen) -- C:\WINDOWS\System32\drivers\StarOpen.sys ()
DRV - (NVHDA) -- C:\WINDOWS\system32\drivers\nvhda32.sys (NVIDIA Corporation)
DRV - (hamachi) -- C:\WINDOWS\system32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (pccsmcfd) -- C:\WINDOWS\system32\drivers\pccsmcfd.sys (Nokia)
DRV - (S7opcsrtx) -- C:\WINDOWS\system32\drivers\s7opcsrtx.sys (SIEMENS AG)
DRV - (SNTIE) -- C:\WINDOWS\system32\drivers\SNTIE.SYS (SIEMENS AG)
DRV - (s7snsrtx) -- C:\WINDOWS\system32\drivers\s7snsrtx.sys (SIEMENS AG)
DRV - (RT80x86) -- C:\WINDOWS\system32\drivers\rt2860.sys (Ralink Technology, Corp.)
DRV - (Dpmtrcdd) -- C:\WINDOWS\system32\drivers\dpmtrcdd.sys (SIEMENS AG)
DRV - (PDNMp50) -- C:\WINDOWS\system32\drivers\PDNMp50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (PDNSp50) -- C:\WINDOWS\system32\drivers\PDNSp50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (STHDA) -- C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (AmdK8) -- C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (bcm4sbxp) -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys (Broadcom Corporation)
DRV - (LVUSBSta) -- C:\WINDOWS\system32\drivers\LVUSBSta.sys (Logitech Inc.)
DRV - (PID_0920) -- C:\WINDOWS\system32\drivers\LV532AV.SYS ()
DRV - (s7oefs_x) -- C:\WINDOWS\system32\drivers\s7oefs_x.sys (SIEMENS AG)
DRV - (msloop) -- C:\WINDOWS\system32\drivers\loop.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1343024091-688789844-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Babylon Search
IE - HKU\S-1-5-21-1343024091-688789844-725345543-1003\..\URLSearchHook:  - No CLSID value found
IE - HKU\S-1-5-21-1343024091-688789844-725345543-1003\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgHelper.dll (SweetIM Technologies Ltd.)
IE - HKU\S-1-5-21-1343024091-688789844-725345543-1003\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-1343024091-688789844-725345543-1003\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=110819&tt=100512_3_&babsrc=SP_ss&mntrId=b48d49d8000000000000001f1f6bf1b4
IE - HKU\S-1-5-21-1343024091-688789844-725345543-1003\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GGLL_de
IE - HKU\S-1-5-21-1343024091-688789844-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1343024091-688789844-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Search the web"
FF - prefs.js..browser.search.defaultthis.engineName: "WiseConvert 2.2 Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3208939&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Search the web"
FF - prefs.js..browser.search.selectedEngine: "Search the web"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f}:2.5.8.6
FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:3.3.3.2
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6778
FF - prefs.js..extensions.enabledItems: vshare@toolbar:1.0.0
FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2
FF - prefs.js..extensions.enabledItems: 5
FF - prefs.js..extensions.enabledItems: 3
FF - prefs.js..extensions.enabledItems: 1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: bkmrksync@nokia.com:1.0.0.736
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2
FF - prefs.js..keyword.URL: "hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q="
 
FF - user.js..browser.search.selectedEngine: "Search the web"
FF - user.js..browser.search.order.1: "Search the web"
FF - user.js..browser.search.defaultenginename: "Search the web"
FF - user.js..keyword.URL: "hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q="
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_270.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Programme\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.3.1: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.3.1: C:\Programme\Oracle\JavaFX 2.0 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Programme\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Programme\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@ngm.nexoneu.com/NxGame: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NexonEU\NGM\npNxGameeu.dll (Nexon)
FF - HKLM\Software\MozillaPlugins\@pages.tvunetworks.com/WebPlayer: C:\WINDOWS\system32\TVUAx\npTVUAx.dll (TVU networks)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Programme\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@soe.sony.com/installer,version=1.0.3: C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\Sony Online Entertainment\npsoe.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@veetle.com/vbp;version=0.9.17: C:\Programme\Veetle\VLCBroadcast\npvbp.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Programme\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Programme\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Dokumente und Einstellungen\Türkyilmaz\Lokale Einstellungen\Anwendungsdaten\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Programme\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\bkmrksync@nokia.com: C:\Programme\Nokia\Nokia PC Suite 7\bkmrksync\ [2011.04.04 15:41:01 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Programme\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.07.01 11:13:00 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.07.19 08:54:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.05.19 12:17:33 | 000,000,000 | ---D | M]
 
[2010.05.08 09:35:44 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\Mozilla\Extensions
[2012.08.02 18:56:42 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\Mozilla\Firefox\Profiles\j2jd8xd4.default\extensions
[2010.08.20 16:39:57 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\Mozilla\Firefox\Profiles\j2jd8xd4.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.05.08 15:20:16 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\Mozilla\Firefox\Profiles\j2jd8xd4.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2012.07.25 17:40:06 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\Mozilla\Firefox\Profiles\j2jd8xd4.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.07.12 17:35:54 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\Mozilla\Firefox\Profiles\j2jd8xd4.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.08.02 18:56:42 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\Mozilla\Firefox\Profiles\j2jd8xd4.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2010.05.31 19:36:51 | 000,000,000 | ---D | M] (DVDVideoSoft Toolbar) -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\Mozilla\Firefox\Profiles\j2jd8xd4.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}
[2011.03.28 18:54:53 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\Mozilla\Firefox\Profiles\j2jd8xd4.default\extensions\engine@conduit.com
[2010.11.17 21:33:29 | 000,000,000 | ---D | M] (TVU Web Player) -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\Mozilla\Firefox\Profiles\j2jd8xd4.default\extensions\firefox@tvunetworks.com
[2011.11.29 23:07:05 | 000,000,000 | ---D | M] (toolplugin) -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\Mozilla\Firefox\Profiles\j2jd8xd4.default\extensions\welcome@toolmin.com
[2012.05.17 00:26:00 | 000,000,933 | ---- | M] () -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\Mozilla\Firefox\Profiles\j2jd8xd4.default\searchplugins\conduit.xml
[2012.07.02 12:01:04 | 000,003,915 | ---- | M] () -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\Mozilla\Firefox\Profiles\j2jd8xd4.default\searchplugins\sweetim.xml
[2012.02.03 21:24:44 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.05.08 09:35:44 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2011.01.20 20:38:23 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
File not found (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\TüRKYILMAZ\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\J2JD8XD4.DEFAULT\EXTENSIONS\{ACAA314B-EEBA-48E4-AD47-84E31C44796C}
File not found (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\TüRKYILMAZ\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\J2JD8XD4.DEFAULT\EXTENSIONS\{E4A8A97B-F2ED-450B-B12D-EE082BA24781}
File not found (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\TüRKYILMAZ\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\J2JD8XD4.DEFAULT\EXTENSIONS\WELCOME@TOOLMIN.COM
[2012.07.01 11:13:00 | 000,000,000 | ---D | M] (DivX Plus Web Player HTML5 &lt;video&gt;) -- C:\PROGRAMME\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\DIVXHTML5
[2012.07.19 08:54:50 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2012.05.19 00:59:57 | 000,002,352 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\babylon.xml
[2011.11.29 23:07:05 | 000,000,158 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\Search the web.src
 
========== Chrome  ==========
 
CHR - homepage: Google
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: Google
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Programme\Google\Chrome\Application\20.0.1132.57\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Programme\Google\Chrome\Application\20.0.1132.57\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Programme\Google\Chrome\Application\20.0.1132.57\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Dokumente und Einstellungen\T\u00FCrkyilmaz\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Programme\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Programme\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Programme\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Programme\Microsoft\Office Live\npOLW.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Nexon Game Controller (Enabled) = C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NexonEU\NGM\npNxGameeu.dll
CHR - plugin: Unity Player (Enabled) = C:\Dokumente und Einstellungen\T\u00FCrkyilmaz\Lokale Einstellungen\Anwendungsdaten\Unity\WebPlayer\loader\npUnity3D32.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Programme\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: DivX Plus Web Player (Enabled) = C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Programme\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Programme\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Programme\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - plugin: Java(TM) Platform SE 7 U3 (Enabled) = C:\Programme\Oracle\JavaFX 2.0 Runtime\bin\plugin2\npjp2.dll
CHR - plugin: Java Deployment Toolkit 7.0.30.255 (Enabled) = C:\WINDOWS\system32\npDeployJava1.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Programme\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: Veetle TV Player (Enabled) = C:\Programme\Veetle\Player\npvlc.dll
CHR - plugin: Veetle Broadcaster Plugin (Enabled) = C:\Programme\Veetle\VLCBroadcast\npvbp.dll
CHR - plugin: Veetle TV Core (Enabled) = C:\Programme\Veetle\plugins\npVeetle.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Programme\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\WINDOWS\system32\Adobe\Director\np32dsw.dll
CHR - plugin: TVU Web Player for FireFox (Enabled) = C:\WINDOWS\system32\TVUAx\npTVUAx.dll
CHR - Extension: YouTube = C:\Dokumente und Einstellungen\Türkyilmaz\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Dokumente und Einstellungen\Türkyilmaz\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: SweetIM for Facebook = C:\Dokumente und Einstellungen\Türkyilmaz\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.0.0.0_0\Copy of 
CHR - Extension: SweetIM for Facebook = C:\Dokumente und Einstellungen\Türkyilmaz\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.0.0.0_0\
CHR - Extension: Mehr Leistung und Videoformate f\u00FCr dein HTML5 \u003Cvideo\u003E = C:\Dokumente und Einstellungen\Türkyilmaz\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\
CHR - Extension: Google Mail = C:\Dokumente und Einstellungen\Türkyilmaz\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
CHR - Extension: YouTube = C:\Dokumente und Einstellungen\Türkyilmaz\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Dokumente und Einstellungen\Türkyilmaz\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: SweetIM for Facebook = C:\Dokumente und Einstellungen\Türkyilmaz\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.0.0.0_0\Copy of 
CHR - Extension: SweetIM for Facebook = C:\Dokumente und Einstellungen\Türkyilmaz\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.0.0.0_0\
CHR - Extension: Mehr Leistung und Videoformate f\u00FCr dein HTML5 \u003Cvideo\u003E = C:\Dokumente und Einstellungen\Türkyilmaz\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\
CHR - Extension: Google Mail = C:\Dokumente und Einstellungen\Türkyilmaz\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2011.03.14 16:37:11 | 000,000,830 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts:       
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll (Google Inc.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (SweetPacks Browser Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (toolplugin) - {DFEFCDEE-CF1A-4FC8-89AF-189327213627} - C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\toolplugin\toolbar.dll File not found
O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKU\S-1-5-21-1343024091-688789844-725345543-1003\..\Toolbar\WebBrowser: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [DivXUpdate] C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [Intel Driver Control] C:\WINDOWS\system32\igfxcf32.exe File not found
O4 - HKLM..\Run: [KMCONFIG] C:\Programme\Mouse Driver\StartAutorun.exe KMConfig.exe File not found
O4 - HKLM..\Run: [LogitechVideoRepair] C:\Programme\Logitech\Video\ISStart.exe (Logitech Inc.)
O4 - HKLM..\Run: [LogitechVideoTray] C:\Programme\Logitech\Video\LogiTray.exe (Logitech Inc.)
O4 - HKLM..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE (Logitech Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\Programme\NVIDIA Corporation\nView\nwiz.exe ()
O4 - HKLM..\Run: [PlusService] C:\Programme\Yuna Software\Messenger Plus!\PlusService.exe (Yuna Software)
O4 - HKLM..\Run: [S7UB Start] C:\Programme\Gemeinsame Dateien\Siemens\S7ubtoox\s7ubtstx.exe (SIEMENS AG)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)
O4 - HKU\S-1-5-21-1343024091-688789844-725345543-1003..\Run: [DAEMON Tools Pro Agent] C:\Programme\DAEMON Tools Pro\DTAgent.exe (DT Soft Ltd)
O4 - HKU\S-1-5-21-1343024091-688789844-725345543-1003..\Run: [ICQ] "C:\Programme\ICQ7.4\ICQ.exe" silent loginmode=4 File not found
O4 - HKU\S-1-5-21-1343024091-688789844-725345543-1003..\Run: [LogitechSoftwareUpdate] C:\Programme\Logitech\Video\ManifestEngine.exe (Logitech Inc.)
O4 - HKU\S-1-5-21-1343024091-688789844-725345543-1003..\Run: [Pando Media Booster] C:\Programme\Pando Networks\Media Booster\PMB.exe ()
O4 - HKU\S-1-5-21-1343024091-688789844-725345543-1003..\Run: [uTorrent] C:\Programme\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Ralink Wireless Utility.lnk = C:\Programme\RALINK\Common\RaUI.exe (Ralink Technology, Corp.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Free YouTube Download - C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Google Sidewiki... - res://C:\Programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html File not found
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKU\S-1-5-19\..Trusted Domains: clonewarsadventures.com ([]* in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-19\..Trusted Domains: freerealms.com ([]* in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-19\..Trusted Domains: soe.com ([]* in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-19\..Trusted Domains: sony.com ([]* in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-1343024091-688789844-725345543-1003\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-1343024091-688789844-725345543-1003\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-1343024091-688789844-725345543-1003\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-1343024091-688789844-725345543-1003\..Trusted Domains: sony.com ([]* in Trusted sites)
O16 - DPF: {82E5DF24-51E8-47CD-864A-F4BD5005AA73} https://www.icloud.com/system/iCloud.cab (iCloud Web App Plugin)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8D845AB8-B349-45C0-BD9F-F1071C9D42D4}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Türkyilmaz\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Türkyilmaz\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{18da2274-fd8c-11e0-8ad9-001f1f6bf1b4}\Shell - "" = AutoRun
O33 - MountPoints2\{18da2274-fd8c-11e0-8ad9-001f1f6bf1b4}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{18da2274-fd8c-11e0-8ad9-001f1f6bf1b4}\Shell\AutoRun\command - "" = H:\KODAK_Camera_Setup_App.exe
O33 - MountPoints2\{b0fdd6aa-b46c-11e1-8c09-001f1f6bf1b4}\Shell - "" = AutoRun
O33 - MountPoints2\{b0fdd6aa-b46c-11e1-8c09-001f1f6bf1b4}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{b0fdd6aa-b46c-11e1-8c09-001f1f6bf1b4}\Shell\AutoRun\command - "" = L:\Autorun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.05 06:30:44 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Türkyilmaz\Desktop\OTL.exe
[2012.08.04 20:19:12 | 000,040,776 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2012.08.04 20:19:11 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\Malwarebytes
[2012.08.04 20:19:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2012.08.04 20:19:00 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.08.04 20:19:00 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2012.08.04 20:19:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2012.08.04 20:18:11 | 010,652,120 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Dokumente und Einstellungen\Türkyilmaz\Desktop\mbam-setup-1.62.0.1300.exe
[2012.08.04 09:32:52 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0
[2012.08.04 08:03:58 | 000,000,000 | ---D | C] -- C:\_OTL
[2012.08.01 15:55:13 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Türkyilmaz\Eigene Dateien\MegaCloud
[2012.08.01 15:54:29 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\MegaCloud
[2012.08.01 15:54:17 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Web Installer
[2012.07.29 22:04:17 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Türkyilmaz\Desktop\özi
[2012.07.24 07:07:22 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Türkyilmaz\Startmenü\Programme\Spiele
[2012.07.23 07:22:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\Sony Online Entertainment
[2012.07.23 07:22:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Türkyilmaz\Lokale Einstellungen\Anwendungsdaten\SCE
[2012.07.23 07:22:02 | 000,000,000 | ---D | C] -- C:\Crash
[2012.07.23 07:20:14 | 000,000,000 | ---D | C] -- C:\Programme\Sony Online Entertainment
[2012.07.21 21:08:04 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Türkyilmaz\Desktop\Neuer Ordner (2)
[2012.07.21 20:36:07 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Türkyilmaz\Desktop\Alles
[2012.07.20 11:34:43 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ulead Systems
[2012.07.20 00:04:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Türkyilmaz\Lokale Einstellungen\Anwendungsdaten\Help
[2012.07.20 00:04:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\Help
[2012.07.19 23:32:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\Trillian
[2012.07.19 23:31:34 | 000,000,000 | ---D | C] -- C:\Programme\Trillian
 
========== Files - Modified Within 30 Days ==========
 
[2012.08.05 09:32:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012.08.05 08:59:00 | 000,001,098 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012.08.05 06:30:45 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Türkyilmaz\Desktop\OTL.exe
[2012.08.05 05:59:50 | 000,040,776 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2012.08.05 05:58:24 | 000,001,094 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012.08.05 05:58:21 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.08.04 20:19:01 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.04 20:18:17 | 010,652,120 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Dokumente und Einstellungen\Türkyilmaz\Desktop\mbam-setup-1.62.0.1300.exe
[2012.08.04 08:41:01 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2012.08.04 07:11:55 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012.08.03 16:32:09 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2012.08.03 16:32:09 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012.08.01 15:03:10 | 000,001,777 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Google Chrome.lnk
[2012.07.31 22:09:53 | 000,002,243 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Skype.lnk
[2012.07.29 22:11:48 | 001,257,473 | ---- | M] () -- C:\Dokumente und Einstellungen\Türkyilmaz\Desktop\bilder 002.jpg
[2012.07.29 22:06:31 | 000,520,680 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012.07.29 22:06:31 | 000,491,976 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.07.29 22:06:31 | 000,110,238 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012.07.29 22:06:31 | 000,090,786 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.07.29 20:24:51 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.07.28 22:05:37 | 000,002,162 | ---- | M] () -- C:\Dokumente und Einstellungen\Türkyilmaz\Desktop\DC Universe Online Live.lnk
[2012.07.28 17:43:21 | 000,000,040 | ---- | M] () -- C:\Dokumente und Einstellungen\Türkyilmaz\jagex_cl_runescape_LIVE.dat
[2012.07.23 13:49:54 | 000,333,072 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.07.21 21:12:54 | 000,000,726 | ---- | M] () -- C:\Dokumente und Einstellungen\Türkyilmaz\Desktop\Trillian.lnk
[2012.07.11 11:59:59 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
 
========== Files Created - No Company Name ==========
 
[2012.08.04 20:19:01 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.04 07:11:55 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012.08.04 07:02:08 | 000,001,616 | ---- | C] () -- C:\Dokumente und Einstellungen\Türkyilmaz\Startmenü\Programme\Autostart\ctfmon.lnk
[2012.07.29 22:20:06 | 001,257,473 | ---- | C] () -- C:\Dokumente und Einstellungen\Türkyilmaz\Desktop\bilder 002.jpg
[2012.07.24 07:07:22 | 000,002,162 | ---- | C] () -- C:\Dokumente und Einstellungen\Türkyilmaz\Desktop\DC Universe Online Live.lnk
[2012.07.23 07:20:17 | 000,002,032 | ---- | C] () -- C:\Dokumente und Einstellungen\Türkyilmaz\Startmenü\Programme\DC Universe Online Live.lnk
[2012.07.21 21:12:54 | 000,000,732 | ---- | C] () -- C:\Dokumente und Einstellungen\Türkyilmaz\Startmenü\Programme\Trillian.lnk
[2012.07.21 21:12:54 | 000,000,726 | ---- | C] () -- C:\Dokumente und Einstellungen\Türkyilmaz\Desktop\Trillian.lnk
[2012.06.24 19:56:29 | 000,000,052 | ---- | C] () -- C:\WINDOWS\seumain.INI
[2012.06.24 19:51:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\KHKSManC.INI
[2012.06.12 19:23:09 | 000,000,000 | ---- | C] () -- C:\WINDOWS\PowerReg.dat
[2012.06.09 23:21:49 | 000,271,360 | ---- | C] () -- C:\WINDOWS\System32\drivers\atksgt.sys
[2012.06.09 23:21:49 | 000,018,048 | ---- | C] () -- C:\WINDOWS\System32\drivers\lirsgt.sys
[2012.06.09 20:47:37 | 000,233,472 | R--- | C] () -- C:\WINDOWS\System32\MafiaSetup.exe
[2012.06.09 20:06:04 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt03.dll
[2012.03.06 21:43:21 | 000,000,040 | ---- | C] () -- C:\Dokumente und Einstellungen\Türkyilmaz\jagex_cl_runescape_LIVE.dat
[2012.02.15 17:58:14 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011.08.14 01:25:13 | 000,045,573 | -H-- | C] () -- C:\Dokumente und Einstellungen\Türkyilmaz\userdiff.sav
[2011.06.08 15:34:04 | 000,000,600 | ---- | C] () -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\PUTTY.RND
[2011.06.08 01:08:37 | 000,000,600 | ---- | C] () -- C:\Dokumente und Einstellungen\Türkyilmaz\Lokale Einstellungen\Anwendungsdaten\PUTTY.RND
[2011.06.06 13:36:02 | 001,589,248 | ---- | C] () -- C:\WINDOWS\System32\libmysql_d.dll
[2011.04.05 14:16:40 | 000,000,600 | ---- | C] () -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\winscp.rnd
[2010.11.22 16:31:59 | 000,007,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2010.10.29 18:03:14 | 000,233,812 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb0.bin
[2010.10.29 18:03:08 | 000,233,804 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb1.bin
[2010.10.29 18:03:08 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32\nvdrssel.bin
[2010.09.18 19:19:42 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Türkyilmaz\jagex__preferences3.dat
[2010.09.18 19:17:40 | 000,000,099 | ---- | C] () -- C:\Dokumente und Einstellungen\Türkyilmaz\jagex_runescape_preferences2.dat
[2010.09.18 19:16:02 | 000,000,046 | ---- | C] () -- C:\Dokumente und Einstellungen\Türkyilmaz\jagex_runescape_preferences.dat
[2010.06.18 16:29:19 | 000,017,920 | ---- | C] () -- C:\Dokumente und Einstellungen\Türkyilmaz\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.05.08 22:36:18 | 000,000,140 | ---- | C] () -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\default.rss
[2010.05.08 02:03:52 | 000,000,143 | ---- | C] () -- C:\Dokumente und Einstellungen\Türkyilmaz\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
 
========== LOP Check ==========
 
[2012.05.19 00:59:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon
[2010.11.22 16:32:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Canneverbe Limited
[2012.05.06 20:52:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Pro
[2010.10.29 16:55:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\EA Core
[2010.10.29 16:55:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Electronic Arts
[2010.05.08 09:35:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ
[2011.04.04 14:53:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Installations
[2011.08.06 16:39:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\install_clap
[2012.02.18 16:59:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Messenger Plus!
[2010.08.21 15:12:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nexon
[2010.08.21 11:32:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NexonEU
[2010.05.08 14:23:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite
[2011.07.09 17:36:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PDVD
[2010.09.18 19:40:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PMB Files
[2012.05.18 15:51:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ralink
[2012.06.24 20:00:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sage
[2010.05.08 15:44:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ScanSoft
[2011.11.02 00:10:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Siemens
[2010.10.29 16:32:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Solidshield
[2012.07.02 12:40:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SweetIM
[2011.07.09 17:33:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Temp
[2012.07.23 13:44:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ulead Systems
[2012.08.01 15:54:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Web Installer
[2012.02.02 20:25:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WinZip
[2010.05.18 22:12:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2012.02.10 15:49:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\.minecraft
[2012.05.19 00:59:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\Babylon
[2012.05.23 17:33:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\BabylonToolbar
[2010.11.22 16:32:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\Canneverbe Limited
[2012.05.06 20:54:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\DAEMON Tools Pro
[2012.07.04 00:02:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\DDMSettings
[2010.09.27 18:51:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\de.3m5.wendel.flcd.FLCDB.4E7DF207D694E815646D9C9DD7DC91A41EB7FD23.1
[2011.07.31 15:47:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\DVDVideoSoft
[2011.07.31 15:47:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\DVDVideoSoftIEHelpers
[2011.06.08 20:40:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\FileZilla
[2010.10.09 11:30:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\GameRanger
[2012.02.01 00:16:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\ICQ
[2011.10.17 18:43:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\JavaEditor
[2012.08.01 15:55:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\MegaCloud
[2011.03.21 13:24:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\Nokia
[2011.02.27 19:16:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\OpenOffice.org
[2012.02.18 19:28:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\Oracle
[2011.09.12 20:06:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\PC Suite
[2012.01.07 02:35:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\Process Hacker 2
[2010.05.08 15:54:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\ScanSoft
[2012.07.23 07:22:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\Sony Online Entertainment
[2010.12.30 19:09:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\TeamViewer
[2012.01.17 16:41:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\toolplugin
[2012.07.21 21:04:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\Trillian
[2012.06.28 14:02:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\TS3Client
[2011.07.23 13:52:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\Unity
[2012.08.05 05:59:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\uTorrent
 
========== Purity Check ==========
 
 

< End of report >
         
--- --- ---

OTL Logfile:
Code:
ATTFilter
OTL Extras logfile created on: 05.08.2012 07:26:48 - Run 1
OTL by OldTimer - Version 3.2.56.0     Folder = C:\Dokumente und Einstellungen\Türkyilmaz\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 0,90 Gb Available Physical Memory | 44,91% Memory free
3,85 Gb Paging File | 2,68 Gb Available in Paging File | 69,63% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 345,56 Gb Total Space | 225,95 Gb Free Space | 65,38% Space Free | Partition Type: NTFS
Drive D: | 292,97 Gb Total Space | 285,06 Gb Free Space | 97,30% Space Free | Partition Type: NTFS
Drive E: | 292,97 Gb Total Space | 286,43 Gb Free Space | 97,77% Space Free | Partition Type: NTFS
Drive H: | 1003,00 Mb Total Space | 873,94 Mb Free Space | 87,13% Space Free | Partition Type: FAT
 
Computer Name: TÜRKYILMAZ | User Name: Türkyilmaz | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
 
[HKEY_USERS\S-1-5-21-1343024091-688789844-725345543-1003\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"58348:TCP" = 58348:TCP:*:Enabled:Pando Media Booster
"58348:UDP" = 58348:UDP:*:Enabled:Pando Media Booster
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"4410:TCP" = 4410:TCP:LocalSubNet:Enabled:Automation License Management
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"58348:TCP" = 58348:TCP:*:Enabled:Pando Media Booster
"58348:UDP" = 58348:UDP:*:Enabled:Pando Media Booster
"139:TCP" = 139:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22002
"4410:TCP" = 4410:TCP:LocalSubNet:Enabled:Automation License Management
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Nexon\Combat Arms EU\CombatArms.exe" = C:\Nexon\Combat Arms EU\CombatArms.exe:*Enabled:CombatArms.exe
"C:\Nexon\Combat Arms EU\Engine.exe" = C:\Nexon\Combat Arms EU\Engine.exe:*Enabled:Engine.exe
"C:\Programme\Pando Networks\Media Booster\PMB.exe" = C:\Programme\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster -- ()
"C:\Programme\ICQ7.5\ICQ.exe" = C:\Programme\ICQ7.5\ICQ.exe:*:Enabled:ICQ7.5 -- (ICQ, LLC.)
"C:\WINDOWS\system32\igfxcf32.exe" = C:\WINDOWS\system32\igfxcf32.exe:*:Enabled:xLAN
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\ICQ6.5\ICQ.exe" = C:\Programme\ICQ6.5\ICQ.exe:*:Enabled:ICQ6
"C:\Programme\Skype\Plugin Manager\skypePM.exe" = C:\Programme\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager
"D:\Metin2\metin2client.bin" = D:\Metin2\metin2client.bin:*:Enabled:metin2client
"C:\Programme\Mozilla Firefox\firefox.exe" = C:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"E:\Metin2\metin2.bin" = E:\Metin2\metin2.bin:*:Enabled:metin2
"C:\Nexon\NEXON_EU_Downloader\NEXON_EU_Downloader_Engine.exe" = C:\Nexon\NEXON_EU_Downloader\NEXON_EU_Downloader_Engine.exe:*:Enabled:NEXON_EU_Downloader_Engine -- ()
"C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NexonEU\NGM\NGM.exe" = C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NexonEU\NGM\NGM.exe:*:Enabled:Nexon Game Manager -- (Nexon)
"C:\Nexon\Combat Arms EU\CombatArms.exe" = C:\Nexon\Combat Arms EU\CombatArms.exe:*Enabled:CombatArms.exe
"C:\Nexon\Combat Arms EU\Engine.exe" = C:\Nexon\Combat Arms EU\Engine.exe:*Enabled:Engine.exe
"C:\Nexon\Combat Arms EU\NMService.exe" = C:\Nexon\Combat Arms EU\NMService.exe:*:Enabled:Nexon Messenger Core
"E:\Metin2\Lead-Rain2.exe" = E:\Metin2\Lead-Rain2.exe:*:Enabled:Lead-Rain2
"E:\Metin2\infected2.bin" = E:\Metin2\infected2.bin:*:Enabled:infected2
"E:\lead-rain2 m2 p server\Lead-Rain2.exe" = E:\lead-rain2 m2 p server\Lead-Rain2.exe:*:Enabled:Lead-Rain2
"C:\Programme\Pando Networks\Media Booster\PMB.exe" = C:\Programme\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster -- ()
"C:\Programme\Google\Google Earth\client\googleearth.exe" = C:\Programme\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth -- (Google)
"C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\GameRanger\GameRanger\GameRanger.exe" = C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\GameRanger\GameRanger\GameRanger.exe:*:Enabled:GameRanger -- (GameRanger Technologies)
"E:\XtremeMt2\XtremeMt2.exe" = E:\XtremeMt2\XtremeMt2.exe:*:Enabled:XtremeMt2
"E:\Lead-Rain2\Lead-Rain2.exe" = E:\Lead-Rain2\Lead-Rain2.exe:*:Enabled:Lead-Rain2
"E:\,,,\metin2.bin" = E:\,,,\metin2.bin:*:Enabled:iMetin Client Helper
"E:\P-server\Blacknight-mt2 client 1.2\lib\game\Game.exe" = E:\P-server\Blacknight-mt2 client 1.2\lib\game\Game.exe:*:Enabled:Game
"E:\P-server\ParanoiaMt2\metin2client.bin" = E:\P-server\ParanoiaMt2\metin2client.bin:*:Enabled:metin2client
"E:\world of revenge\World of Revenge client\WorldofRevenge.exe" = E:\world of revenge\World of Revenge client\WorldofRevenge.exe:*:Enabled:WorldofRevenge
"C:\Casino\bwin Casino\casino.exe" = C:\Casino\bwin Casino\casino.exe:*:Enabled:casino -- ()
"C:\WINDOWS\system32\dplaysvr.exe" = C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper -- (Microsoft Corporation)
"C:\Dokumente und Einstellungen\Türkyilmaz\Desktop\Sachen\Age of Empires II\age2_x1\age2_x1.exe" = C:\Dokumente und Einstellungen\Türkyilmaz\Desktop\Sachen\Age of Empires II\age2_x1\age2_x1.exe:*:Enabled:Age of Empires II Expansion
"C:\Dokumente und Einstellungen\Türkyilmaz\Desktop\Sachen\Age of Empires II\EMPIRES2.EXE" = C:\Dokumente und Einstellungen\Türkyilmaz\Desktop\Sachen\Age of Empires II\EMPIRES2.EXE:*:Enabled:Age of Empires II
"E:\XtremeMt2\metin2client.bin" = E:\XtremeMt2\metin2client.bin:*:Enabled:metin2client
"E:\WoR\WorldofRevenge.exe" = E:\WoR\WorldofRevenge.exe:*:Enabled:WorldofRevenge
"E:\World of Revenge client\WorldofRevenge.exe" = E:\World of Revenge client\WorldofRevenge.exe:*:Enabled:WorldofRevenge
"E:\world of revenge\tada\World of Revenge client\WorldofRevenge.exe" = E:\world of revenge\tada\World of Revenge client\WorldofRevenge.exe:*:Enabled:WorldofRevenge
"E:\world of revenge\WoR\WorldofRevenge.exe" = E:\world of revenge\WoR\WorldofRevenge.exe:*:Enabled:WorldofRevenge
"E:\Metin2\metin2.exe" = E:\Metin2\metin2.exe:*:Enabled:metin2
"E:\Metin2\metin2client.bin" = E:\Metin2\metin2client.bin:*:Enabled:metin2client
"E:\mt-reloaded\Metin2start.exe" = E:\mt-reloaded\Metin2start.exe:*:Enabled:Metin2start
"E:\Nightforge\Nightforge-Network.exe" = E:\Nightforge\Nightforge-Network.exe:*:Enabled:MidNightMt2 Client Launcher
"C:\Programme\ICQ7.5\ICQ.exe" = C:\Programme\ICQ7.5\ICQ.exe:*:Enabled:ICQ7.5 -- (ICQ, LLC.)
"C:\Programme\Metin2\metin2client.bin" = C:\Programme\Metin2\metin2client.bin:*:Enabled:metin2client
"C:\Dokumente und Einstellungen\Türkyilmaz\Desktop\PortMap\PortMap.exe" = C:\Dokumente und Einstellungen\Türkyilmaz\Desktop\PortMap\PortMap.exe:*:Enabled:PortMap
"E:\Mt2\Modified-Client\mc.exe" = E:\Mt2\Modified-Client\mc.exe:*:Enabled:mc
"E:\Mt2\Modified-Client\metin2client.bin" = E:\Mt2\Modified-Client\metin2client.bin:*:Enabled:metin2client
"E:\Modified-Client\mc.exe" = E:\Modified-Client\mc.exe:*:Enabled:mc
"E:\PortMap\PortMap.exe" = E:\PortMap\PortMap.exe:*:Enabled:PortMap
"C:\Programme\TeamViewer\Version6\TeamViewer.exe" = C:\Programme\TeamViewer\Version6\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application -- (TeamViewer GmbH)
"C:\Programme\TeamViewer\Version6\TeamViewer_Service.exe" = C:\Programme\TeamViewer\Version6\TeamViewer_Service.exe:*:Enabled:Teamviewer Remote Control Service -- (TeamViewer GmbH)
"E:\Holy-Network\metin2.bin" = E:\Holy-Network\metin2.bin:*:Enabled:Customizable 2010 Client Launcher
"C:\Programme\Java\jre6\bin\java.exe" = C:\Programme\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary
"E:\AwesomeWorld2v2\sysclt.dll" = E:\AwesomeWorld2v2\sysclt.dll:*:Enabled:Customizable 2010 Client Launcher
"E:\WoR-Patcher 26.07.2011\mscoreed.dll" = E:\WoR-Patcher 26.07.2011\mscoreed.dll:*:Enabled:Client Launcher by [tim66613@e*pvp]
"C:\Programme\[No-Steam] Counter-Strike 1.6\hl.exe" = C:\Programme\[No-Steam] Counter-Strike 1.6\hl.exe:*:Enabled:Half-Life Launcher
"C:\Programme\[No-Steam] Counter-Strike 1.6\hlds.exe" = C:\Programme\[No-Steam] Counter-Strike 1.6\hlds.exe:*:Enabled:HLDS Launcher
"E:\WoR-Patcher27.07.2011\WoR-Patcher 26.07.2011\metin2client.bin" = E:\WoR-Patcher27.07.2011\WoR-Patcher 26.07.2011\metin2client.bin:*:Enabled:Customizable 2010 Client Launcher
"E:\WoR-Patcher27.07.2011\WoR-Patcher 26.07.2011\World of Revenge.exe" = E:\WoR-Patcher27.07.2011\WoR-Patcher 26.07.2011\World of Revenge.exe:*:Enabled:Customizable 2010 Client Launcher
"C:\WINDOWS\system32\igfxcf32.exe" = C:\WINDOWS\system32\igfxcf32.exe:*:Enabled:xLAN
"E:\Shinyoki\Shinyoki Client (Version 1.0)\Metin2Client.exe" = E:\Shinyoki\Shinyoki Client (Version 1.0)\Metin2Client.exe:*:Enabled:Metin2Client
"C:\Programme\Gemeinsame Dateien\Siemens\SQLANY\dbsrv9.exe" = C:\Programme\Gemeinsame Dateien\Siemens\SQLANY\dbsrv9.exe:*:Enabled:Adaptive Server Anywhere Network Server -- (iAnywhere Solutions, Inc.)
"C:\Programme\Siemens\Step7\S7BIN\S7tgtopx.exe" = C:\Programme\Siemens\Step7\S7BIN\S7tgtopx.exe:*:Enabled:SIEMENS STEP7 SIMATIC Manager -- (SIEMENS AG)
"C:\Programme\Siemens\Step7\S7INF\S7usiapx.exe" = C:\Programme\Siemens\Step7\S7INF\S7usiapx.exe:*:Enabled:SIEMENS STEP7 S7InfoBox -- (SIEMENS AG)
"C:\WINDOWS\system32\s7otbxsx.exe" = C:\WINDOWS\system32\s7otbxsx.exe:*:Enabled:SIEMENS STEP7 Block Administration -- (SIEMENS AG)
"C:\Dokumente und Einstellungen\Türkyilmaz\Eigene Dateien\Ünal\WoR-Patcher27.07.2011\WoR-Patcher 26.07.2011\World of Revenge.exe" = C:\Dokumente und Einstellungen\Türkyilmaz\Eigene Dateien\Ünal\WoR-Patcher27.07.2011\WoR-Patcher 26.07.2011\World of Revenge.exe:*:Enabled:Customizable 2010 Client Launcher
"C:\Dokumente und Einstellungen\Türkyilmaz\Eigene Dateien\Ünal\RoyalStarsMT2 - Unbelievable V1\RoyalStarsMT2.exe" = C:\Dokumente und Einstellungen\Türkyilmaz\Eigene Dateien\Ünal\RoyalStarsMT2 - Unbelievable V1\RoyalStarsMT2.exe:*:Enabled:RoyalStarsMT2
"E:\KiLLzOneMT2\metin2client.bin" = E:\KiLLzOneMT2\metin2client.bin:*:Enabled:metin2client
"E:\Zephion Client 18.12.2011\metin2client.exe" = E:\Zephion Client 18.12.2011\metin2client.exe:*:Enabled:metin2client
"E:\metin2client.bin" = E:\metin2client.bin:*:Enabled:Customizable 2010 Client Launcher
"C:\Dokumente und Einstellungen\Türkyilmaz\Eigene Dateien\Ünal\blubb\Dark-Fusion2    Neuer Client\metin2client.bin" = C:\Dokumente und Einstellungen\Türkyilmaz\Eigene Dateien\Ünal\blubb\Dark-Fusion2    Neuer Client\metin2client.bin:*:Enabled:metin2client
"C:\Programme\Heroes of Newerth\hon.exe" = C:\Programme\Heroes of Newerth\hon.exe:*:Enabled:Heroes of Newerth -- (S2 Games)
"C:\Programme\uTorrent\uTorrent.exe" = C:\Programme\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"D:\Rockstar Games Social Club\RGSCLauncher.exe" = D:\Rockstar Games Social Club\RGSCLauncher.exe:*:Enabled:Rockstar Games Social Club -- (Take-Two Interactive Software, Inc.)
"C:\Programme\Java\jre7\bin\java.exe" = C:\Programme\Java\jre7\bin\java.exe:*:Enabled:Java(TM) Platform SE binary -- (Oracle Corporation)
"C:\Dokumente und Einstellungen\Türkyilmaz\Eigene Dateien\Ünal\Stranglehold\Binaries\Retail-Stranglehold.exe" = C:\Dokumente und Einstellungen\Türkyilmaz\Eigene Dateien\Ünal\Stranglehold\Binaries\Retail-Stranglehold.exe:*:Enabled:Stranglehold
"C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\WebKit2WebProcess.exe" = C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit -- (Apple Inc.)
"C:\Dokumente und Einstellungen\Türkyilmaz\Eigene Dateien\Ünal\Left 4 Dead 2  V2.0.2.7  Full-Rip  {blaze69}\Left 4 Dead 2\left4dead2.exe" = C:\Dokumente und Einstellungen\Türkyilmaz\Eigene Dateien\Ünal\Left 4 Dead 2  V2.0.2.7  Full-Rip  {blaze69}\Left 4 Dead 2\left4dead2.exe:*:Enabled:left4dead2
"C:\Dokumente und Einstellungen\Türkyilmaz\Eigene Dateien\Ünal\WOR\World of Revenge.exe" = C:\Dokumente und Einstellungen\Türkyilmaz\Eigene Dateien\Ünal\WOR\World of Revenge.exe:*:Enabled:World of Revenge
"C:\Dokumente und Einstellungen\Türkyilmaz\Eigene Dateien\Ünal\Hardcore\Hardcore RELOADED\.Hardcore RELOADED.exe" = C:\Dokumente und Einstellungen\Türkyilmaz\Eigene Dateien\Ünal\Hardcore\Hardcore RELOADED\.Hardcore RELOADED.exe:*:Enabled:.Hardcore RELOADED
"C:\Dokumente und Einstellungen\Türkyilmaz\Eigene Dateien\Ünal\CL2-Revolution New Client\CL2-Revolution.exe.exe" = C:\Dokumente und Einstellungen\Türkyilmaz\Eigene Dateien\Ünal\CL2-Revolution New Client\CL2-Revolution.exe.exe:*:Enabled:CL2-Revolution.exe
"C:\Dokumente und Einstellungen\Türkyilmaz\Eigene Dateien\Ünal\FlyingWorld - 2012\FlyingWorld.exe" = C:\Dokumente und Einstellungen\Türkyilmaz\Eigene Dateien\Ünal\FlyingWorld - 2012\FlyingWorld.exe:*:Enabled:FlyingWorld
"C:\Dokumente und Einstellungen\Türkyilmaz\Eigene Dateien\Ünal\Neuer Ordner\World of Revenge.exe" = C:\Dokumente und Einstellungen\Türkyilmaz\Eigene Dateien\Ünal\Neuer Ordner\World of Revenge.exe:*:Enabled:World of Revenge
"C:\Programme\SweetIM\Communicator\SweetPacksUpdateManager.exe" = C:\Programme\SweetIM\Communicator\SweetPacksUpdateManager.exe:*:Enabled:SweetPacksUpdateManager
"C:\Program Files\mIRC\mirc.exe" = C:\Program Files\mIRC\mirc.exe:*:Enabled:mIRC
"C:\Programme\Trillian\trillian.exe" = C:\Programme\Trillian\trillian.exe:*:Enabled:Trillian -- (Cerulean Studios)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00BA866C-F2A2-4BB9-A308-3DFA695B6F7C}" = Java DB 10.5.3.0
"{028ED9C4-25EE-4DEE-9CF4-91034BC89B18}" = Microsoft SQL Server 2005 Express Edition (SQLEXPRESS)
"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
"{07FCBED5-94C3-4F94-B9D3-360FA27C7B06}" = Microsoft Windows SDK for Visual Studio 2008 Express Tools for Win32
"{08B3869E-D282-424C-9AFC-870E04A4BA14}" = Rockstar Games Social Club
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{1111706F-666A-4037-7777-203328764D10}" = JavaFX 2.0.3
"{122ADF8C-DDA1-480C-9936-C88F2825B265}" = Apple Application Support
"{1545207E-C6F3-31D7-9918-BDBB65075FBF}" = Microsoft .NET Framework 3.5 Language Pack - deu
"{159098AF-4EB8-4C10-B0C6-24CDA32B45F9}" = Microsoft SQL Server Compact 3.5 DEU
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83217003FF}" = Java(TM) 7 Update 3
"{2BC2781A-F7F6-452E-95EB-018A522F1B2C}" = PaperPort Image Printer
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{32A3A4F4-B792-11D6-A78A-00B0D0160200}" = Java(TM) SE Development Kit 6 Update 20
"{32A3A4F4-B792-11D6-A78A-00B0D0170000}" = Java(TM) SE Development Kit 7
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{36CDA33B-909B-4719-97D1-C4B99309BDC7}" = ATI Parental Control & Encoder
"{39930321-4C58-4B8B-BCBF-342698C9801D}" = Max Payne
"{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}" = NVIDIA PhysX
"{4216D328-0FE8-48B8-85B8-BD300E6F080F}" = Nokia Connectivity Cable Driver
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{52061908-F94F-3D78-AA50-B956039C845D}" = Microsoft Visual C# 2008 Express Edition - DEU
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{55BFC356-5A7B-482F-A213-9ACFDDFF6037}" = Mouse Driver
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{59E4543A-D49D-4489-B445-473D763C79AF}" = Microsoft Games for Windows - LIVE Redistributable
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{65CB4C08-C47B-4A7E-A6A4-50C06ADA5FC6}" = Adobe AIR
"{68A35043-C55A-4237-88C9-37EE1C63ED71}" = Microsoft Visual J# 2.0 Redistributable Package
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6AD9F5F3-5BD0-4000-BD9C-B536CF86D988}" = iTunes
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7578ADEA-D65F-4C89-A249-B1C88B6FFC20}" = ICQ7.5
"{774C0434-9948-4DEE-A14E-69CDD316E36C}" = Internet Explorer Toolbar 4.6 by SweetPacks
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7A8FF745-BBC5-482B-88E4-18D3178249A9}" = ScanSoft PaperPort 11
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{7F2120EB-3337-45DC-B5C3-D4DED4F0A0BA}" = SIMATIC  STEP 7 V5.4 + SP4 Professional 2006 SR5  
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83AA2913-C123-4146-85BD-AD8F93971D39}" = BabylonObjectInstaller
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8709DD83-A73F-46F8-BCA1-234A7E04D82C}" = Siemens Automation License Manager V4.0 Professional  
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{8F1ADE4D-EFAC-4F5A-B346-23C2687FAF50}" = Apple Mobile Device Support
"{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}" = Ralink Wireless LAN
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders  (German) 12
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{9309DD7E-EBFE-3C95-8B47-30D3A012F606}" = Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - DEU
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{96F139DE-C33E-4FCC-A72B-684BF899F679}" = SIMATIC S7-SCL V5.3 + SP5 Professional 2006 SR5  
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9941F0AA-B903-4AF4-A055-83A9815CC011}" = Sonic Encoders
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C9D0F85-5658-4A5E-95A9-65F7DB2916EE}" = Broadcom 440x 10/100 Integrated Controller
"{A1071AEB-B0EF-3F5F-BC84-83A270EBE496}" = Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - DEU
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{B3C2952E-B9E6-4C3E-A1B3-8087654A15F4}" = SIMATIC S7-PLCSIM V5.4 + SP2 Professional 2006 SR5  
"{BBAAAD82-6242-420F-86D4-BD72BB5E6C86}" = Tools für Microsoft SQL Server 2005 Express Edition
"{C07B8BC4-AFD9-3AA4-BDF5-330A07591FDE}" = Microsoft Windows SDK for Visual Studio 2008 Express Tools for .NET Framework
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C151CE54-E7EA-4804-854B-F515368B0798}" = Athlon 64 Processor Driver
"{C252EB7B-7AE0-46DE-9BEE-DF681B885F13}" = Modem-Diagnose-Tool
"{C43048A9-742C-4DAD-90D2-E3B53C9DB825}" = Logitech QuickCam-Software
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{C6579A65-9CAE-4B31-8B6B-3306E0630A66}" = Apple Software Update
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D4AEC53C-1720-41D9-B6D7-6A60DE62D444}" = PC Connectivity Solution
"{D922EF97-6657-3075-BC93-A6CF59444E84}" = MSDN Library for Microsoft Visual Studio 2008 Express Editions
"{E2A91BF5-FE48-46CF-A1BE-F639D21D06C2}" = SIMATIC S7-GRAPH V5.3 + SP6 Professional 2006 SR5  
"{E32260E7-0B10-43C7-9B77-AB9F4184676D}" = Microsoft SQL Server Compact 3.5 Design Tools DEU
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F38FD0E4-B991-462B-873D-F2115EADD093}" = Nokia PC Suite
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F46E21DF-5BE1-48E2-8390-5EEA8B25E36A}" = Microsoft SQL Server Native Client
"{F9D54D77-01A4-7D34-6F3C-EDC9F8F466E3}" = Fragen-Lern-CD 4.0
"{FB64BF25-3593-4E4E-AA85-84AEF1D1475F}" = Broadcom Management Programs
"{FCD9CD52-7222-4672-94A0-A722BA702FD0}" = Dell Resource CD
"{FDE96E86-7780-431C-92F7-679C6A7CEC51}" = Microsoft SQL Server VSS Writer
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"6DA48AFDE796708D5A4C9121A83E7617A63A9A15" = Windows-Treiberpaket - Nokia Modem  (10/07/2010 4.6)
"7A1E1C4F-CC6F-4BF0-BB81-7CFC3F655564" = GemMaster Mystic
"7-Zip" = 7-Zip 9.20
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Avira AntiVir Desktop" = Avira Free Antivirus
"BabylonToolbar" = Babylon toolbar on IE
"bwin Poker_is1" = bwin Poker
"DAEMON Tools Pro" = DAEMON Tools Pro
"DAO 3.5" = DAO 3.5
"de.3m5.wendel.flcd.FLCDB.4E7DF207D694E815646D9C9DD7DC91A41EB7FD23.1" = Fragen-Lern-CD 4.0
"DivX Setup" = DivX-Setup
"E5372C32E8562C76C24DBA6525002B1031495F34" = Windows-Treiberpaket - Nokia Modem  (06/09/2010 7.01.0.8)
"EAX Unified" = EAX Unified
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.7
"Free Studio_is1" = Free Studio version 5.1.5
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.9.35.324
"Google Chrome" = Google Chrome
"hon" = Heroes of Newerth
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{55BFC356-5A7B-482F-A213-9ACFDDFF6037}" = Mouse Driver
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Messenger Plus!" = Messenger Plus! 5
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack - deu" = Microsoft .NET Framework 3.5 Language Pack - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Microsoft Visual C# 2008 Express Edition - DEU" = Microsoft Visual C# 2008 Express Edition - DEU
"Microsoft Visual J# 2.0 Redistributable Package" = Microsoft Visual J# 2.0 Redistributable Package
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MSDN Library for Microsoft Visual Studio 2008 Express Editions" = MSDN Library für Microsoft Visual Studio 2008 Express Editions
"Multisim2001" = Multisim 2001
"NetConnect" = NetConnect deinstallieren
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Nokia PC Suite" = Nokia PC Suite
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"Process_Hacker2_is1" = Process Hacker 2.27 (r4957)
"QcDrv" = Logitech® Camera-Treiber
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"TeamViewer 6" = TeamViewer 6
"toolplugin" = toolplugin
"Trillian" = Trillian
"Uninstall_is1" = Uninstall 1.0.0.1
"uTorrent" = µTorrent
"Veetle TV" = Veetle TV 0.9.18
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
"WMFDist11" = Windows Media Format 11 runtime
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-1343024091-688789844-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"GameRanger" = GameRanger
"SOE-DC Universe Online Live" = DC Universe Online Live
"SOE-DC Universe Online Live PSG" = DC Universe Online Live
"UnityWebPlayer" = Unity Web Player
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 04.08.2012 06:51:14 | Computer Name = TÜRKYILMAZ | Source = VSS | ID = 5013
Description = Volumeschattenkopie-Dienstfehler: Von Schattenkopieautor "RemovableStorageManager"
 aufgerufene Routine "OpenNtmsSessionW" ist mit Status "0x80070422" (konvertiert
 in 0x800423f4) fehlgeschlagen.
 
Error - 04.08.2012 07:03:43 | Computer Name = TÜRKYILMAZ | Source = VSS | ID = 5013
Description = Volumeschattenkopie-Dienstfehler: Von Schattenkopieautor "RemovableStorageManager"
 aufgerufene Routine "OpenNtmsSessionW" ist mit Status "0x80070422" (konvertiert
 in 0x800423f4) fehlgeschlagen.
 
Error - 04.08.2012 07:14:22 | Computer Name = TÜRKYILMAZ | Source = VSS | ID = 5013
Description = Volumeschattenkopie-Dienstfehler: Von Schattenkopieautor "RemovableStorageManager"
 aufgerufene Routine "OpenNtmsSessionW" ist mit Status "0x80070422" (konvertiert
 in 0x800423f4) fehlgeschlagen.
 
Error - 04.08.2012 07:14:37 | Computer Name = TÜRKYILMAZ | Source = VSS | ID = 5013
Description = Volumeschattenkopie-Dienstfehler: Von Schattenkopieautor "RemovableStorageManager"
 aufgerufene Routine "OpenNtmsSessionW" ist mit Status "0x80070422" (konvertiert
 in 0x800423f4) fehlgeschlagen.
 
Error - 04.08.2012 07:20:45 | Computer Name = TÜRKYILMAZ | Source = VSS | ID = 5013
Description = Volumeschattenkopie-Dienstfehler: Von Schattenkopieautor "RemovableStorageManager"
 aufgerufene Routine "OpenNtmsSessionW" ist mit Status "0x80070422" (konvertiert
 in 0x800423f4) fehlgeschlagen.
 
Error - 04.08.2012 07:29:19 | Computer Name = TÜRKYILMAZ | Source = VSS | ID = 5013
Description = Volumeschattenkopie-Dienstfehler: Von Schattenkopieautor "RemovableStorageManager"
 aufgerufene Routine "OpenNtmsSessionW" ist mit Status "0x80070422" (konvertiert
 in 0x800423f4) fehlgeschlagen.
 
Error - 04.08.2012 09:04:57 | Computer Name = TÜRKYILMAZ | Source = VSS | ID = 5013
Description = Volumeschattenkopie-Dienstfehler: Von Schattenkopieautor "RemovableStorageManager"
 aufgerufene Routine "OpenNtmsSessionW" ist mit Status "0x80070422" (konvertiert
 in 0x800423f4) fehlgeschlagen.
 
Error - 04.08.2012 09:45:05 | Computer Name = TÜRKYILMAZ | Source = VSS | ID = 5013
Description = Volumeschattenkopie-Dienstfehler: Von Schattenkopieautor "RemovableStorageManager"
 aufgerufene Routine "OpenNtmsSessionW" ist mit Status "0x80070422" (konvertiert
 in 0x800423f4) fehlgeschlagen.
 
Error - 04.08.2012 09:49:24 | Computer Name = TÜRKYILMAZ | Source = VSS | ID = 5013
Description = Volumeschattenkopie-Dienstfehler: Von Schattenkopieautor "RemovableStorageManager"
 aufgerufene Routine "OpenNtmsSessionW" ist mit Status "0x80070422" (konvertiert
 in 0x800423f4) fehlgeschlagen.
 
Error - 04.08.2012 09:50:33 | Computer Name = TÜRKYILMAZ | Source = VSS | ID = 5013
Description = Volumeschattenkopie-Dienstfehler: Von Schattenkopieautor "RemovableStorageManager"
 aufgerufene Routine "OpenNtmsSessionW" ist mit Status "0x80070422" (konvertiert
 in 0x800423f4) fehlgeschlagen.
 
[ System Events ]
Error - 04.08.2012 06:51:13 | Computer Name = TÜRKYILMAZ | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "ntmssvc"
 mit den Argumenten "-Service"  gestartet wurde, um den folgenden Server zu verwenden:
{D61A27C6-8F53-11D0-BFA0-00A024151983}
 
Error - 04.08.2012 07:03:42 | Computer Name = TÜRKYILMAZ | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "ntmssvc"
 mit den Argumenten "-Service"  gestartet wurde, um den folgenden Server zu verwenden:
{D61A27C6-8F53-11D0-BFA0-00A024151983}
 
Error - 04.08.2012 07:14:21 | Computer Name = TÜRKYILMAZ | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "ntmssvc"
 mit den Argumenten "-Service"  gestartet wurde, um den folgenden Server zu verwenden:
{D61A27C6-8F53-11D0-BFA0-00A024151983}
 
Error - 04.08.2012 07:14:36 | Computer Name = TÜRKYILMAZ | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "ntmssvc"
 mit den Argumenten "-Service"  gestartet wurde, um den folgenden Server zu verwenden:
{D61A27C6-8F53-11D0-BFA0-00A024151983}
 
Error - 04.08.2012 07:20:44 | Computer Name = TÜRKYILMAZ | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "ntmssvc"
 mit den Argumenten "-Service"  gestartet wurde, um den folgenden Server zu verwenden:
{D61A27C6-8F53-11D0-BFA0-00A024151983}
 
Error - 04.08.2012 07:29:18 | Computer Name = TÜRKYILMAZ | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "ntmssvc"
 mit den Argumenten "-Service"  gestartet wurde, um den folgenden Server zu verwenden:
{D61A27C6-8F53-11D0-BFA0-00A024151983}
 
Error - 04.08.2012 09:04:56 | Computer Name = TÜRKYILMAZ | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "ntmssvc"
 mit den Argumenten "-Service"  gestartet wurde, um den folgenden Server zu verwenden:
{D61A27C6-8F53-11D0-BFA0-00A024151983}
 
Error - 04.08.2012 09:45:04 | Computer Name = TÜRKYILMAZ | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "ntmssvc"
 mit den Argumenten "-Service"  gestartet wurde, um den folgenden Server zu verwenden:
{D61A27C6-8F53-11D0-BFA0-00A024151983}
 
Error - 04.08.2012 09:49:23 | Computer Name = TÜRKYILMAZ | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "ntmssvc"
 mit den Argumenten "-Service"  gestartet wurde, um den folgenden Server zu verwenden:
{D61A27C6-8F53-11D0-BFA0-00A024151983}
 
Error - 04.08.2012 09:50:32 | Computer Name = TÜRKYILMAZ | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "ntmssvc"
 mit den Argumenten "-Service"  gestartet wurde, um den folgenden Server zu verwenden:
{D61A27C6-8F53-11D0-BFA0-00A024151983}
 
 
< End of report >
         
--- --- ---


Zu Malware nochmal das :
Zitat:
Malwarebytes Anti-Malware (Test) 1.62.0.1300
Malwarebytes : Free Anti-Malware download

Datenbank Version: v2012.08.04.07

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Türkyilmaz :: TÜRKYILMAZ [Administrator]

Schutz: Aktiviert

05.08.2012 06:04:01
mbam-log-2012-08-05 (06-04-01).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 411172
Laufzeit: 2 Stunde(n), 20 Minute(n), 8 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 5
C:\Dokumente und Einstellungen\Türkyilmaz\Eigene Dateien\Downloads\SoftonicDownloader_fuer_java-se-development-kit-jdk.exe (PUP.OfferBundler.ST) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Dokumente und Einstellungen\Türkyilmaz\Eigene Dateien\Downloads\Delphi 7\KEYGEN\KEYGEN.EXE (RiskWare.Tool.CK) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\TEMP\Delphi7\keygen\keygen.exe (RiskWare.Tool.CK) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\08042012_080358\C_Dokumente und Einstellungen\Türkyilmaz\Lokale Einstellungen\Temp\deo0_sar.exe (Spyware.Zeus) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Dokumente und Einstellungen\Türkyilmaz\Startmenü\Programme\Autostart\ctfmon.lnk (Trojan.Ransom.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
__________________

Geändert von artist91 (05.08.2012 um 10:33 Uhr)

Alt 05.08.2012, 12:03   #4
t'john
/// Helfer-Team
 
GVU 2.07 trojaner - Standard

GVU 2.07 trojaner





Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

  • Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
  • Starte die OTL.exe.
    Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
  • Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:


Code:
ATTFilter
:OTL
DRV - (XDva360) -- C:\WINDOWS\system32\XDva360.sys File not found 
DRV - (EagleXNt) -- C:\WINDOWS\system32\drivers\EagleXNt.sys File not found 
DRV - (EagleNT) -- C:\WINDOWS\system32\drivers\EagleNT.sys File not found 
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\S-1-5-21-1343024091-688789844-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Babylon Search 
IE - HKU\S-1-5-21-1343024091-688789844-725345543-1003\..\URLSearchHook: - No CLSID value found 
IE - HKU\S-1-5-21-1343024091-688789844-725345543-1003\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgHelper.dll (SweetIM Technologies Ltd.) 
IE - HKU\S-1-5-21-1343024091-688789844-725345543-1003\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} 
IE - HKU\S-1-5-21-1343024091-688789844-725345543-1003\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}&affID=110819&tt=100512_3_&babsrc=SP_ss&mntrId=b48d49d8000000000000001f1f6bf1b4 
IE - HKU\S-1-5-21-1343024091-688789844-725345543-1003\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GGLL_de 
IE - HKU\S-1-5-21-1343024091-688789844-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\S-1-5-21-1343024091-688789844-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local 
FF - prefs.js..browser.search.defaultenginename: "Search the web" 
FF - prefs.js..browser.search.defaultthis.engineName: "WiseConvert 2.2 Customized Web Search" 
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT3208939&SearchSource=3&q={searchTerms}" 
FF - prefs.js..browser.search.order.1: "Search the web" 
FF - prefs.js..browser.search.selectedEngine: "Search the web" 
FF - prefs.js..browser.search.useDBForOrder: true 
FF - prefs.js..browser.startup.homepage: "http://www.google.de/" 
FF - prefs.js..extensions.enabledItems: bkmrksync@nokia.com:1.0.0.736 
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2 
FF - prefs.js..keyword.URL: "http://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q=" 
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found 
File not found (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\TüRKYILMAZ\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\J2JD8XD4.DEFAULT\EXTENSIONS\{ACAA314B-EEBA-48E4-AD47-84E31C44796C} 
File not found (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\TüRKYILMAZ\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\J2JD8XD4.DEFAULT\EXTENSIONS\{E4A8A97B-F2ED-450B-B12D-EE082BA24781} 
File not found (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\TüRKYILMAZ\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\J2JD8XD4.DEFAULT\EXTENSIONS\WELCOME@TOOLMIN.COM 
CHR - Extension: SweetIM for Facebook = C:\Dokumente und Einstellungen\Türkyilmaz\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.0.0.0_0\Copy of 
CHR - Extension: SweetIM for Facebook = C:\Dokumente und Einstellungen\Türkyilmaz\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.0.0.0_0\ 
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) 
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO) 
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. 
O2 - BHO: (SweetPacks Browser Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) 
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.) 
O3 - HKLM\..\Toolbar: (toolplugin) - {DFEFCDEE-CF1A-4FC8-89AF-189327213627} - C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\toolplugin\toolbar.dll File not found 
O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) 
O3 - HKU\S-1-5-21-1343024091-688789844-725345543-1003\..\Toolbar\WebBrowser: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) 
O4 - HKLM..\Run: [DivXUpdate] C:\Programme\DivX\DivX Update\DivXUpdate.exe () 
O4 - HKLM..\Run: [Intel Driver Control] C:\WINDOWS\system32\igfxcf32.exe File not found 
O4 - HKLM..\Run: [KMCONFIG] C:\Programme\Mouse Driver\StartAutorun.exe KMConfig.exe File not found 
O4 - HKU\S-1-5-21-1343024091-688789844-725345543-1003..\Run: [ICQ] "C:\Programme\ICQ7.4\ICQ.exe" silent loginmode=4 File not found 
O4 - HKU\S-1-5-21-1343024091-688789844-725345543-1003..\Run: [Pando Media Booster] C:\Programme\Pando Networks\Media Booster\PMB.exe () 
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 
O8 - Extra context menu item: Google Sidewiki... - res://C:\Programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html File not found 
O15 - HKU\S-1-5-21-1343024091-688789844-725345543-1003\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites) 
O15 - HKU\S-1-5-21-1343024091-688789844-725345543-1003\..Trusted Domains: freerealms.com ([]* in Trusted sites) 
O15 - HKU\S-1-5-21-1343024091-688789844-725345543-1003\..Trusted Domains: soe.com ([]* in Trusted sites) 
O15 - HKU\S-1-5-21-1343024091-688789844-725345543-1003\..Trusted Domains: sony.com ([]* in Trusted sites) 
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03) 
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Java Plug-in 1.5.0_06) 
O16 - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03) 
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03) 
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) 
O32 - HKLM CDRom: AutoRun - 1 
O33 - MountPoints2\{18da2274-fd8c-11e0-8ad9-001f1f6bf1b4}\Shell - "" = AutoRun 
O33 - MountPoints2\{18da2274-fd8c-11e0-8ad9-001f1f6bf1b4}\Shell\AutoRun - "" = Auto&Play 
O33 - MountPoints2\{18da2274-fd8c-11e0-8ad9-001f1f6bf1b4}\Shell\AutoRun\command - "" = H:\KODAK_Camera_Setup_App.exe 
O33 - MountPoints2\{b0fdd6aa-b46c-11e1-8c09-001f1f6bf1b4}\Shell - "" = AutoRun 
O33 - MountPoints2\{b0fdd6aa-b46c-11e1-8c09-001f1f6bf1b4}\Shell\AutoRun - "" = Auto&Play 
O33 - MountPoints2\{b0fdd6aa-b46c-11e1-8c09-001f1f6bf1b4}\Shell\AutoRun\command - "" = L:\Autorun.exe 


[2012.05.19 00:59:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon 
[2012.05.19 00:59:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\Babylon 
[2011.11.29 23:07:05 | 000,000,000 | ---D | M] (toolplugin) -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\Mozilla\Firefox\Profiles\j2jd8xd4.default\extensions\welcome@toolmin.com 


[2012.08.05 09:32:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job 
[2012.08.05 08:59:00 | 000,001,098 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job 
[2012.08.05 05:58:24 | 000,001,094 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job 


[2012.08.04 08:41:01 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job 
[2012.08.04 07:02:08 | 000,001,616 | ---- | C] () -- C:\Dokumente und Einstellungen\Türkyilmaz\Startmenü\Programme\Autostart\ctfmon.lnk 
[2012.07.02 12:40:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SweetIM 
[2012.05.23 17:33:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\BabylonToolbar 
:Files
C:\TEMP\*
C:\Programme\DivX\DivX Update\DivXUpdate.exe
C:\Dokumente und Einstellungen\Türkyilmaz\Startmenü\Programme\Autostart\ctfmon.lnk
C:\Dokumente und Einstellungen\Türkyilmaz\Eigene Dateien\Downloads\Delphi 7\*
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[emptyflash]
         
  • Schließe alle Programme.
  • Klicke auf den Fix Button.
  • Wenn OTL einen Neustart verlangt, bitte zulassen.
  • Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
    Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!
__________________
Mfg, t'john
Das TB unterstützen

Alt 05.08.2012, 14:18   #5
artist91
 
GVU 2.07 trojaner - Standard

GVU 2.07 trojaner



Wenn ich das mache bleibt mein Pc immer hängen ..


Alt 06.08.2012, 02:49   #6
t'john
/// Helfer-Team
 
GVU 2.07 trojaner - Standard

GVU 2.07 trojaner



Kannst du erkennen an welcher Stelle?
__________________
--> GVU 2.07 trojaner

Alt 06.08.2012, 04:08   #7
artist91
 
GVU 2.07 trojaner - Standard

GVU 2.07 trojaner



Direkt am Anfang wenn ich auf fix Drücke Steht da sofort oben auf der Leiste Keine Rückmeldung ich habe trotzdem mal 1 Stunde gewartet aber keine Reaktion .. leider bin ich da richtig am verzweifeln , da ich mich ja eigentlich mit Rechnern gut auskenne. Aber trotzdessen finde ich momentan keine Antwort zum Problem der zurzeit besteht ...


mit freundlichen Grüßen

Alt 06.08.2012, 04:27   #8
t'john
/// Helfer-Team
 
GVU 2.07 trojaner - Standard

GVU 2.07 trojaner



Mache zuerst diesen Fix:

Code:
ATTFilter
:OTL
[2012.05.19 00:59:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon 
[2012.05.19 00:59:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\Babylon 
[2011.11.29 23:07:05 | 000,000,000 | ---D | M] (toolplugin) -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\Mozilla\Firefox\Profiles\j2jd8xd4.default\extensions\welcome@toolmin.com 


[2012.08.05 09:32:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job 
[2012.08.05 08:59:00 | 000,001,098 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job 
[2012.08.05 05:58:24 | 000,001,094 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job 


[2012.08.04 08:41:01 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job 
[2012.08.04 07:02:08 | 000,001,616 | ---- | C] () -- C:\Dokumente und Einstellungen\Türkyilmaz\Startmenü\Programme\Autostart\ctfmon.lnk 
[2012.07.02 12:40:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SweetIM 
[2012.05.23 17:33:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\BabylonToolbar 
:Files
C:\TEMP\*
C:\Programme\DivX\DivX Update\DivXUpdate.exe
C:\Dokumente und Einstellungen\Türkyilmaz\Startmenü\Programme\Autostart\ctfmon.lnk
C:\Dokumente und Einstellungen\Türkyilmaz\Eigene Dateien\Downloads\Delphi 7\*
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[emptyflash]
         
__________________
Mfg, t'john
Das TB unterstützen

Alt 06.08.2012, 05:33   #9
artist91
 
GVU 2.07 trojaner - Standard

GVU 2.07 trojaner



Also sobald ich auf FIX drücke, geht bei mir unten die Leiste komplett weg.
Es bleibt nur diese OTL programm auf und unten in der leiste von OTL steht killing process. do not ....
Und dann nach 1 minute kommt sofort keine rückmeldung..
Also er fängt gar nicht erst an zu arbeiten..

Nach vielen versuchen hat es am Ende doch geklappt.
Zitat:
All processes killed
========== OTL ==========
Service XDva360 stopped successfully!
Service XDva360 deleted successfully!
File C:\WINDOWS\system32\XDva360.sys File not found not found.
Service EagleXNt stopped successfully!
Service EagleXNt deleted successfully!
File C:\WINDOWS\system32\drivers\EagleXNt.sys File not found not found.
Service EagleNT stopped successfully!
Service EagleNT deleted successfully!
File C:\WINDOWS\system32\drivers\EagleNT.sys File not found not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-21-1343024091-688789844-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-1343024091-688789844-725345543-1003\Software\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1343024091-688789844-725345543-1003\Software\Microsoft\Internet Explorer\URLSearchHooks\\{EEE6C35D-6118-11DC-9C72-001320C79847} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}\ deleted successfully.
C:\Programme\SweetIM\Toolbars\Internet Explorer\mgHelper.dll moved successfully.
HKEY_USERS\S-1-5-21-1343024091-688789844-725345543-1003\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-1343024091-688789844-725345543-1003\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
Registry key HKEY_USERS\S-1-5-21-1343024091-688789844-725345543-1003\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found.
HKU\S-1-5-21-1343024091-688789844-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-21-1343024091-688789844-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
Prefs.js: "Search the web" removed from browser.search.defaultenginename
Prefs.js: "WiseConvert 2.2 Customized Web Search" removed from browser.search.defaultthis.engineName
Prefs.js: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3208939&SearchSource=3&q={searchTerms}" removed from browser.search.defaulturl
Prefs.js: "Search the web" removed from browser.search.order.1
Prefs.js: "Search the web" removed from browser.search.selectedEngine
Prefs.js: true removed from browser.search.useDBForOrder
Prefs.js: "hxxp://www.google.de/" removed from browser.startup.homepage
Prefs.js: bkmrksync@nokia.com:1.0.0.736 removed from extensions.enabledItems
Prefs.js: engine@conduit.com:3.3.3.2 removed from extensions.enabledItems
Prefs.js: "hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q=" removed from keyword.URL
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@Apple.com/iTunes,version=\ deleted successfully.
File C:\Dokumente und Einstellungen\Türkyilmaz\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.0.0.0_0\Copy of not found.
C:\Dokumente und Einstellungen\Türkyilmaz\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.0.0.0_0 folder moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\ deleted successfully.
File move failed. C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll scheduled to be moved on reboot.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EECD738-5844-4a99-B4B6-146BF802613B}\ deleted successfully.
C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}\ deleted successfully.
C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{98889811-442D-49dd-99D7-DC866BE87DBC} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{98889811-442D-49dd-99D7-DC866BE87DBC}\ deleted successfully.
C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{DFEFCDEE-CF1A-4FC8-89AF-189327213627} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DFEFCDEE-CF1A-4FC8-89AF-189327213627}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{EEE6C35B-6118-11DC-9C72-001320C79847} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}\ deleted successfully.
File C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll not found.
Registry value HKEY_USERS\S-1-5-21-1343024091-688789844-725345543-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EEE6C35B-6118-11DC-9C72-001320C79847} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}\ not found.
File C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\DivXUpdate deleted successfully.
C:\Programme\DivX\DivX Update\DivXUpdate.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Intel Driver Control deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\KMCONFIG deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1343024091-688789844-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\\ICQ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1343024091-688789844-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\\Pando Media Booster deleted successfully.
C:\Programme\Pando Networks\Media Booster\PMB.exe moved successfully.
Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.
Registry value HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Google Sidewiki...\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1343024091-688789844-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\clonewarsadventures.com\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1343024091-688789844-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\freerealms.com\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1343024091-688789844-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\soe.com\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1343024091-688789844-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\sony.com\ deleted successfully.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_USERS\.DEFAULT\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_USERS\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_USERS\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
C:\WINDOWS\Downloaded Program Files\gp.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{18da2274-fd8c-11e0-8ad9-001f1f6bf1b4}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{18da2274-fd8c-11e0-8ad9-001f1f6bf1b4}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{18da2274-fd8c-11e0-8ad9-001f1f6bf1b4}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{18da2274-fd8c-11e0-8ad9-001f1f6bf1b4}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{18da2274-fd8c-11e0-8ad9-001f1f6bf1b4}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{18da2274-fd8c-11e0-8ad9-001f1f6bf1b4}\ not found.
File H:\KODAK_Camera_Setup_App.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b0fdd6aa-b46c-11e1-8c09-001f1f6bf1b4}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b0fdd6aa-b46c-11e1-8c09-001f1f6bf1b4}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b0fdd6aa-b46c-11e1-8c09-001f1f6bf1b4}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b0fdd6aa-b46c-11e1-8c09-001f1f6bf1b4}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b0fdd6aa-b46c-11e1-8c09-001f1f6bf1b4}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b0fdd6aa-b46c-11e1-8c09-001f1f6bf1b4}\ not found.
File L:\Autorun.exe not found.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon folder moved successfully.
C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\Babylon folder moved successfully.
C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\Mozilla\Firefox\Profiles\j2jd8xd4.default\extensions\welcome@toolmin.com\chrome\content folder moved successfully.
C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\Mozilla\Firefox\Profiles\j2jd8xd4.default\extensions\welcome@toolmin.com\chrome folder moved successfully.
C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\Mozilla\Firefox\Profiles\j2jd8xd4.default\extensions\welcome@toolmin.com folder moved successfully.
C:\WINDOWS\tasks\Adobe Flash Player Updater.job moved successfully.
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job moved successfully.
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job moved successfully.
C:\WINDOWS\tasks\AppleSoftwareUpdate.job moved successfully.
File C:\Dokumente und Einstellungen\Türkyilmaz\Startmenü\Programme\Autostart\ctfmon.lnk not found.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SweetIM\Toolbars\Internet Explorer\cache folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SweetIM\Toolbars\Internet Explorer folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SweetIM\Toolbars folder moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SweetIM folder moved successfully.
C:\Dokumente und Einstellungen\Türkyilmaz\Anwendungsdaten\BabylonToolbar\BabylonToolbar folder moved successfully.
========== FILES ==========
C:\TEMP\Delphi7\Workshop folder moved successfully.
C:\TEMP\Delphi7\TeamSource folder moved successfully.
C:\TEMP\Delphi7\rdebug folder moved successfully.
C:\TEMP\Delphi7\ModelMaker folder moved successfully.
C:\TEMP\Delphi7\Mdac folder moved successfully.
C:\TEMP\Delphi7\keygen folder moved successfully.
C:\TEMP\Delphi7\ISxpress folder moved successfully.
C:\TEMP\Delphi7\Install\Temp folder moved successfully.
C:\TEMP\Delphi7\Install\System32 folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Source\Xml folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Source\WebSnap folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Source\WebMidas folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Source\Vcl folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Source\ToolsAPI folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Source\Soap folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Source\Samples folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Source\Rtl\Win folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Source\Rtl\Sys folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Source\Rtl\Corba45 folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Source\Rtl\Common folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Source\Rtl folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Source\Property Editors folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Source\IntraWeb folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Source\Internet folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Source\Indy folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Source\Decision Cube folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Source\Clx folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Source folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Rave5\Server folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Rave5\Lib folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Rave5\Help folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Rave5\Demos folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Rave5\DataLinks folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Rave5 folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Ocx\Vci\VSpell folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Ocx\Vci\Impress folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Ocx\Vci\Form1 folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Ocx\Vci folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Ocx\Servers folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Ocx\Isp folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Ocx\Chartfx folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Ocx folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Objrepos\Win2KApp folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Objrepos\SdiApp folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Objrepos\MdiApp folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Objrepos\LogoApp folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Objrepos\IntraWeb\StandAloneDM folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Objrepos\IntraWeb\StandAlone folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Objrepos\IntraWeb\PageForm folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Objrepos\IntraWeb\ISAPI folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Objrepos\IntraWeb\Icons folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Objrepos\IntraWeb\AppForm folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Objrepos\IntraWeb\Apache2 folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Objrepos\IntraWeb\Apache folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Objrepos\IntraWeb folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Objrepos\CLXMdiApp folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Objrepos folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\MergeModules folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Lib\IDL45 folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Lib\Delphi2 folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Lib\Debug\IDL45 folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Lib\Debug folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Lib folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Imports\Idl folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Imports folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Help\Tools folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Help\IntraWeb folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Help\Examples\Update folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Help\Examples\TabCntrl folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Help\Examples\Scrollba folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Help\Examples\RegIni folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Help\Examples\Prgrsbar folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Help\Examples\Menu2 folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Help\Examples\Menu folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Help\Examples\Jpeg folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Help\Examples\Combobox folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Help\Examples\Bitmap folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Help\Examples\BatchMv2 folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Help\Examples\BatchMv folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Help\Examples folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Help folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Doc folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebSnap\XSLProducer folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebSnap\XMLBuilder folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebSnap\XMLBiolife folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebSnap\WebMail folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebSnap\WebDispatcher folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebSnap\Util folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebSnap\Tutorials folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebSnap\TestSvrInfo folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebSnap\SimpleAdapter folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebSnap\SessionTest folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebSnap\ScriptObjectTest folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebSnap\ScriptObject folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebSnap\ProducerTemplates folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebSnap\PhotoGallery folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebSnap\MinApp folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebSnap\MasterDetail folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebSnap\LocateFileService folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebSnap\InternetExpress folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebSnap\Include folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebSnap\ImgBtnProducer folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebSnap\ImgBtnCountryEditor folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebSnap\Images folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebSnap\DumpModules folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebSnap\DispHandlers folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebSnap\DBExpress folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebSnap\CountryReport folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebSnap\CountryEditor folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebSnap\BioLife folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebSnap\ActionFieldTest folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebSnap\ActionField folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebSnap folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebServices\SOAPHeaders\server folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebServices\SOAPHeaders\client folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebServices\SOAPHeaders folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebServices\SOAPDataModule\Server folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebServices\SOAPDataModule\Data folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebServices\SOAPDataModule\Client folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebServices\SOAPDataModule folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebServices\SOAPAttachments\Server folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebServices\SOAPAttachments\Client folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebServices\SOAPAttachments folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebServices\PostTool folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebServices\IssuesSample folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebServices\EchoService\Server\Data folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebServices\EchoService\Server folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebServices\EchoService\Client folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebServices\EchoService folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebServices\DBServer folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\WebServices folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Virtual Listview folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\ToolsAPI\XPAppWiz folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\ToolsAPI\PackageDemo folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\ToolsAPI\INTAServices folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\ToolsAPI\Editor Keybinding\Emacs folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\ToolsAPI\Editor Keybinding folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\ToolsAPI\ActionServices folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\ToolsAPI folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Threads folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\TeeChart folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Swat folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\ShellControls folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\RichEdit\Fra folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\RichEdit\Enu folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\RichEdit\Deu folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\RichEdit folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\ResXplor folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Quickrpt\Qr3 folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Quickrpt\Qr2 folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Quickrpt folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\PropEdit folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Ownerlst folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Oracle8\OrTypes folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Oracle8 folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Midas\SharedConn folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Midas\SetParam folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Midas\Pooler folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Midas\MstrDtl folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Midas\Login folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Midas\Intrcpt folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Midas\InternetExpress\TroubleShoot folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Midas\InternetExpress\InetXCustom folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Midas\InternetExpress\InetXCenter folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Midas\InternetExpress\CustomerList folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Midas\InternetExpress folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Midas\EmpEdit folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Midas\Brfcase folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Midas\Alchtest folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Midas\Aggregate folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Midas\AdHoc folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Midas\Activefm folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Midas folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Ipcdemos folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\IntraWeb\WebSnapSurvey folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\IntraWeb\Phonetics Customer Profiler\Templates folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\IntraWeb\Phonetics Customer Profiler\Files folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\IntraWeb\Phonetics Customer Profiler folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\IntraWeb\GuessWB folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\IntraWeb\Guess folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\IntraWeb\FormData folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\IntraWeb\FishFactDM folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\IntraWeb\FishFact folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\IntraWeb\Features\Templates folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\IntraWeb\Features\Files folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\IntraWeb\Features\Downloads folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\IntraWeb\Features folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\IntraWeb folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Internet\XMLTransformProvider folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Internet\XMLTransformParam folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Internet\XMLTransformClient folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Internet\XMLTransform folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Internet\WebServ\IIS folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Internet\WebServ\Apache folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Internet\WebServ folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Internet\rexec folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Internet\NetChat folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Internet\CGIs\demo_src\WebRequestCGI folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Internet\CGIs\demo_src\PortScanner folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Internet\CGIs\demo_src\PageProducerCGI folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Internet\CGIs\demo_src folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Internet\CGIs\demo_html folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Internet\CGIs\demo_bin folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Internet\CGIs folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Internet\ApacheDSO\ModuleInit folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Internet\ApacheDSO\logging folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Internet\ApacheDSO\Hello folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Internet\ApacheDSO\DBModule folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Internet\ApacheDSO\Authorization folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Internet\ApacheDSO\Authentication folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Internet\ApacheDSO folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Internet\ApacheConfigEditor folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Internet folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Indy folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\ImagView folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Frames\Db folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Frames folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Football folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\EarthPng folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Docking folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Doc\TextEdit folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Doc\Graphex folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Doc\Filmanex folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Doc folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Demolbl folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\DbClx\mybasexplorer folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\DbClx\frames folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\DbClx\fishfact folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\DbClx folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Db\TextData folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Db\SQLClientDataset folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Db\MtsPool folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Db\MastApp folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Db\IBX\ThreadedIBX folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Db\IBX\SQLMonitor folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Db\IBX\IBXEvents folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Db\IBX\IBSilentInstall folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Db\IBX\CachedUp folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Db\IBX\Admin folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Db\IBX folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Db\IBMastApp folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Db\IBDemo folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Db\GdsDemo folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Db\FishFact folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Db\Filter folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Db\DbxExplorer folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Db\DbErrors folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Db\CtrlGrid folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Db\CsDemos folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Db\CacheDup folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Db\BkQuery folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Db folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\CustomDraw folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Cpl\Date folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Cpl folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\Unions folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\Structs folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\Single Inheritence folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\Sequences folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\NestedModules folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\Multiple Inheritence folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\Midas XML folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\Interface Arg folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\Exceptions folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\Event Service\Templates folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\Event Service\Push Demo folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\Event Service\Pull Demo folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\Event Service folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java\src\currencyconverter folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java\src folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java\classes\Generated Source\currencyconverter folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java\classes\Generated Source folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java\classes\dependency cache folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java\classes\currencyconverter folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java\classes folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\CosNaming40 folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\CosNaming folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\Callbacks folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\Attributes folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\Arrays folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\Any folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\Account GUI folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\Account DOS folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Corba\Idl2Pas folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Corba folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\CoolStuf folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\ConvertIt folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Clx\TextBrowser folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Clx\StopWatch folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Clx\QuickStart folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Clx\ClxExplorer folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Clx\BasicEd folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Clx folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\AppEvents folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Ado\Shape folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Ado\Rds folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Ado\Briefcase folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Ado\AdoTest folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Ado folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\ActiveX\TRegSvr folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\ActiveX\SvrExtra folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\ActiveX\ShellExt folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\ActiveX\OleCtnrs folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\ActiveX\OleAuto\Word8 folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\ActiveX\OleAuto\SrvComp\Word folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\ActiveX\OleAuto\SrvComp\PowerPoint folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\ActiveX\OleAuto\SrvComp folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\ActiveX\OleAuto\AutoServ folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\ActiveX\OleAuto\AutoCtrl folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\ActiveX\OleAuto folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\ActiveX\COM+Event\Subscriber folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\ActiveX\COM+Event\Publisher folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\ActiveX\COM+Event\Event folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\ActiveX\COM+Event folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\ActiveX folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\Actions folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\ActionBands\MRU folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\ActionBands\DynaActionBands folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\ActionBands\AlphaBlendMenus folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos\ActionBands folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Demos folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Bin\Netscp41 folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Bin\Netscp36 folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Bin\Netscp35 folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Bin\Netscap3 folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7\Bin folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland\Delphi7 folder moved successfully.
C:\TEMP\Delphi7\Install\program files\Borland folder moved successfully.
C:\TEMP\Delphi7\Install\program files folder moved successfully.
C:\TEMP\Delphi7\Install\Common\Borland Shared\SampleDictionary folder moved successfully.
C:\TEMP\Delphi7\Install\Common\Borland Shared\MSHelp folder moved successfully.
C:\TEMP\Delphi7\Install\Common\Borland Shared\Images\Splash\256Color folder moved successfully.
C:\TEMP\Delphi7\Install\Common\Borland Shared\Images\Splash\16Color folder moved successfully.
C:\TEMP\Delphi7\Install\Common\Borland Shared\Images\Splash folder moved successfully.
C:\TEMP\Delphi7\Install\Common\Borland Shared\Images\Icons folder moved successfully.
C:\TEMP\Delphi7\Install\Common\Borland Shared\Images\Default folder moved successfully.
C:\TEMP\Delphi7\Install\Common\Borland Shared\Images\Cursors folder moved successfully.
C:\TEMP\Delphi7\Install\Common\Borland Shared\Images\Buttons folder moved successfully.
C:\TEMP\Delphi7\Install\Common\Borland Shared\Images\Backgrnd folder moved successfully.
C:\TEMP\Delphi7\Install\Common\Borland Shared\Images folder moved successfully.
C:\TEMP\Delphi7\Install\Common\Borland Shared\Debugger folder moved successfully.
C:\TEMP\Delphi7\Install\Common\Borland Shared\DBExpress folder moved successfully.
C:\TEMP\Delphi7\Install\Common\Borland Shared\Database Desktop folder moved successfully.
C:\TEMP\Delphi7\Install\Common\Borland Shared\Data folder moved successfully.
C:\TEMP\Delphi7\Install\Common\Borland Shared\BDE folder moved successfully.
C:\TEMP\Delphi7\Install\Common\Borland Shared folder moved successfully.
C:\TEMP\Delphi7\Install\Common folder moved successfully.
C:\TEMP\Delphi7\Install folder moved successfully.
C:\TEMP\Delphi7\Info\Workgroups folder moved successfully.
C:\TEMP\Delphi7\Info\Extras\Zlib\Src folder moved successfully.
C:\TEMP\Delphi7\Info\Extras\Zlib folder moved successfully.
C:\TEMP\Delphi7\Info\Extras\visibroker45 folder moved successfully.
C:\TEMP\Delphi7\Info\Extras\Translation Mgr folder moved successfully.
C:\TEMP\Delphi7\Info\Extras\SendKeys folder moved successfully.
C:\TEMP\Delphi7\Info\Extras\RegFlip folder moved successfully.
C:\TEMP\Delphi7\Info\Extras\RegCleanUtility\Source folder moved successfully.
C:\TEMP\Delphi7\Info\Extras\RegCleanUtility folder moved successfully.
C:\TEMP\Delphi7\Info\Extras\Jpeg\test folder moved successfully.
C:\TEMP\Delphi7\Info\Extras\Jpeg\src folder moved successfully.
C:\TEMP\Delphi7\Info\Extras\Jpeg\obj folder moved successfully.
C:\TEMP\Delphi7\Info\Extras\Jpeg\debug folder moved successfully.
C:\TEMP\Delphi7\Info\Extras\Jpeg folder moved successfully.
C:\TEMP\Delphi7\Info\Extras\Comctl folder moved successfully.
C:\TEMP\Delphi7\Info\Extras folder moved successfully.
C:\TEMP\Delphi7\Info folder moved successfully.
C:\TEMP\Delphi7\ibdocs\DOC\TUTORIAL folder moved successfully.
C:\TEMP\Delphi7\ibdocs\DOC\SQLREF folder moved successfully.
C:\TEMP\Delphi7\ibdocs\DOC\OPGUIDE folder moved successfully.
C:\TEMP\Delphi7\ibdocs\DOC\GETSTART folder moved successfully.
C:\TEMP\Delphi7\ibdocs\DOC\FT3INDEX\WORK folder moved successfully.
C:\TEMP\Delphi7\ibdocs\DOC\FT3INDEX\TRANS folder moved successfully.
C:\TEMP\Delphi7\ibdocs\DOC\FT3INDEX\TOPICIDX folder moved successfully.
C:\TEMP\Delphi7\ibdocs\DOC\FT3INDEX\TEMP folder moved successfully.
C:\TEMP\Delphi7\ibdocs\DOC\FT3INDEX\STYLE folder moved successfully.
C:\TEMP\Delphi7\ibdocs\DOC\FT3INDEX\PDD folder moved successfully.
C:\TEMP\Delphi7\ibdocs\DOC\FT3INDEX\PARTS folder moved successfully.
C:\TEMP\Delphi7\ibdocs\DOC\FT3INDEX\MORGUE folder moved successfully.
C:\TEMP\Delphi7\ibdocs\DOC\FT3INDEX\ASSISTS folder moved successfully.
C:\TEMP\Delphi7\ibdocs\DOC\FT3INDEX folder moved successfully.
C:\TEMP\Delphi7\ibdocs\DOC folder moved successfully.
C:\TEMP\Delphi7\ibdocs folder moved successfully.
C:\TEMP\Delphi7\ib6.5\SERVER\UDF folder moved successfully.
C:\TEMP\Delphi7\ib6.5\SERVER\SDK\LIB_MS folder moved successfully.
C:\TEMP\Delphi7\ib6.5\SERVER\SDK\LIB folder moved successfully.
C:\TEMP\Delphi7\ib6.5\SERVER\SDK\INCLUDE folder moved successfully.
C:\TEMP\Delphi7\ib6.5\SERVER\SDK folder moved successfully.
C:\TEMP\Delphi7\ib6.5\SERVER\Microsoft folder moved successfully.
C:\TEMP\Delphi7\ib6.5\SERVER\INTL folder moved successfully.
C:\TEMP\Delphi7\ib6.5\SERVER\EXAMPLES\UDF folder moved successfully.
C:\TEMP\Delphi7\ib6.5\SERVER\EXAMPLES\SERVICES folder moved successfully.
C:\TEMP\Delphi7\ib6.5\SERVER\EXAMPLES\SECURITY folder moved successfully.
C:\TEMP\Delphi7\ib6.5\SERVER\EXAMPLES\RAD\DELPHI6\IBX\ThreadedIBX folder moved successfully.
C:\TEMP\Delphi7\ib6.5\SERVER\EXAMPLES\RAD\DELPHI6\IBX\SQLMonitor folder moved successfully.
C:\TEMP\Delphi7\ib6.5\SERVER\EXAMPLES\RAD\DELPHI6\IBX\IBXEvents folder moved successfully.
C:\TEMP\Delphi7\ib6.5\SERVER\EXAMPLES\RAD\DELPHI6\IBX\CACHEDUP folder moved successfully.
C:\TEMP\Delphi7\ib6.5\SERVER\EXAMPLES\RAD\DELPHI6\IBX\ADMIN folder moved successfully.
C:\TEMP\Delphi7\ib6.5\SERVER\EXAMPLES\RAD\DELPHI6\IBX folder moved successfully.
C:\TEMP\Delphi7\ib6.5\SERVER\EXAMPLES\RAD\DELPHI6\IBSilentInstall folder moved successfully.
C:\TEMP\Delphi7\ib6.5\SERVER\EXAMPLES\RAD\DELPHI6\IBMastApp folder moved successfully.
C:\TEMP\Delphi7\ib6.5\SERVER\EXAMPLES\RAD\DELPHI6\IBDEMO folder moved successfully.
C:\TEMP\Delphi7\ib6.5\SERVER\EXAMPLES\RAD\DELPHI6 folder moved successfully.
C:\TEMP\Delphi7\ib6.5\SERVER\EXAMPLES\RAD\CBuilder5\MastApp folder moved successfully.
C:\TEMP\Delphi7\ib6.5\SERVER\EXAMPLES\RAD\CBuilder5\IBDemo folder moved successfully.
C:\TEMP\Delphi7\ib6.5\SERVER\EXAMPLES\RAD\CBuilder5\CSDemos folder moved successfully.
C:\TEMP\Delphi7\ib6.5\SERVER\EXAMPLES\RAD\CBuilder5\BkQuery folder moved successfully.
C:\TEMP\Delphi7\ib6.5\SERVER\EXAMPLES\RAD\CBuilder5 folder moved successfully.
C:\TEMP\Delphi7\ib6.5\SERVER\EXAMPLES\RAD folder moved successfully.
C:\TEMP\Delphi7\ib6.5\SERVER\EXAMPLES\GPRE folder moved successfully.
C:\TEMP\Delphi7\ib6.5\SERVER\EXAMPLES\FILTER folder moved successfully.
C:\TEMP\Delphi7\ib6.5\SERVER\EXAMPLES\DATABASE folder moved successfully.
C:\TEMP\Delphi7\ib6.5\SERVER\EXAMPLES\API folder moved successfully.
C:\TEMP\Delphi7\ib6.5\SERVER\EXAMPLES folder moved successfully.
C:\TEMP\Delphi7\ib6.5\SERVER\DOC folder moved successfully.
C:\TEMP\Delphi7\ib6.5\SERVER\BIN folder moved successfully.
C:\TEMP\Delphi7\ib6.5\SERVER folder moved successfully.
C:\TEMP\Delphi7\ib6.5\ODBC folder moved successfully.
C:\TEMP\Delphi7\ib6.5\InterClient\jbuilder_help folder moved successfully.
C:\TEMP\Delphi7\ib6.5\InterClient\examples folder moved successfully.
C:\TEMP\Delphi7\ib6.5\InterClient\docs\specifications\interbase\interclient\utils folder moved successfully.
C:\TEMP\Delphi7\ib6.5\InterClient\docs\specifications\interbase\interclient folder moved successfully.
C:\TEMP\Delphi7\ib6.5\InterClient\docs\specifications\interbase folder moved successfully.
C:\TEMP\Delphi7\ib6.5\InterClient\docs\specifications folder moved successfully.
C:\TEMP\Delphi7\ib6.5\InterClient\docs\slide_show\images folder moved successfully.
C:\TEMP\Delphi7\ib6.5\InterClient\docs\slide_show folder moved successfully.
C:\TEMP\Delphi7\ib6.5\InterClient\docs\readmes folder moved successfully.
C:\TEMP\Delphi7\ib6.5\InterClient\docs\introduction\images folder moved successfully.
C:\TEMP\Delphi7\ib6.5\InterClient\docs\introduction folder moved successfully.
C:\TEMP\Delphi7\ib6.5\InterClient\docs\images folder moved successfully.
C:\TEMP\Delphi7\ib6.5\InterClient\docs\help folder moved successfully.
C:\TEMP\Delphi7\ib6.5\InterClient\docs\examples folder moved successfully.
C:\TEMP\Delphi7\ib6.5\InterClient\docs folder moved successfully.
C:\TEMP\Delphi7\ib6.5\InterClient\bin folder moved successfully.
C:\TEMP\Delphi7\ib6.5\InterClient folder moved successfully.
C:\TEMP\Delphi7\ib6.5\IBX folder moved successfully.
C:\TEMP\Delphi7\ib6.5\CLIENT\SDK\LIB_MS folder moved successfully.
C:\TEMP\Delphi7\ib6.5\CLIENT\SDK\LIB folder moved successfully.
C:\TEMP\Delphi7\ib6.5\CLIENT\SDK\INCLUDE folder moved successfully.
C:\TEMP\Delphi7\ib6.5\CLIENT\SDK folder moved successfully.
C:\TEMP\Delphi7\ib6.5\CLIENT\Microsoft folder moved successfully.
C:\TEMP\Delphi7\ib6.5\CLIENT\EXAMPLES\SERVICES folder moved successfully.
C:\TEMP\Delphi7\ib6.5\CLIENT\EXAMPLES\RAD\DELPHI6\IBX\ThreadedIBX folder moved successfully.
C:\TEMP\Delphi7\ib6.5\CLIENT\EXAMPLES\RAD\DELPHI6\IBX\SQLMonitor folder moved successfully.
C:\TEMP\Delphi7\ib6.5\CLIENT\EXAMPLES\RAD\DELPHI6\IBX\IBXEvents folder moved successfully.
C:\TEMP\Delphi7\ib6.5\CLIENT\EXAMPLES\RAD\DELPHI6\IBX\CACHEDUP folder moved successfully.
C:\TEMP\Delphi7\ib6.5\CLIENT\EXAMPLES\RAD\DELPHI6\IBX\ADMIN folder moved successfully.
C:\TEMP\Delphi7\ib6.5\CLIENT\EXAMPLES\RAD\DELPHI6\IBX folder moved successfully.
C:\TEMP\Delphi7\ib6.5\CLIENT\EXAMPLES\RAD\DELPHI6\IBSilentInstall folder moved successfully.
C:\TEMP\Delphi7\ib6.5\CLIENT\EXAMPLES\RAD\DELPHI6\IBMastApp folder moved successfully.
C:\TEMP\Delphi7\ib6.5\CLIENT\EXAMPLES\RAD\DELPHI6\IBDEMO folder moved successfully.
C:\TEMP\Delphi7\ib6.5\CLIENT\EXAMPLES\RAD\DELPHI6 folder moved successfully.
C:\TEMP\Delphi7\ib6.5\CLIENT\EXAMPLES\RAD\CBuilder5\MastApp folder moved successfully.
C:\TEMP\Delphi7\ib6.5\CLIENT\EXAMPLES\RAD\CBuilder5\IBDemo folder moved successfully.
C:\TEMP\Delphi7\ib6.5\CLIENT\EXAMPLES\RAD\CBuilder5\CSDemos folder moved successfully.
C:\TEMP\Delphi7\ib6.5\CLIENT\EXAMPLES\RAD\CBuilder5\BkQuery folder moved successfully.
C:\TEMP\Delphi7\ib6.5\CLIENT\EXAMPLES\RAD\CBuilder5 folder moved successfully.
C:\TEMP\Delphi7\ib6.5\CLIENT\EXAMPLES\RAD folder moved successfully.
C:\TEMP\Delphi7\ib6.5\CLIENT\EXAMPLES\GPRE folder moved successfully.
C:\TEMP\Delphi7\ib6.5\CLIENT\EXAMPLES\API folder moved successfully.
C:\TEMP\Delphi7\ib6.5\CLIENT\EXAMPLES folder moved successfully.
C:\TEMP\Delphi7\ib6.5\CLIENT\DOC folder moved successfully.
C:\TEMP\Delphi7\ib6.5\CLIENT\BIN folder moved successfully.
C:\TEMP\Delphi7\ib6.5\CLIENT folder moved successfully.
C:\TEMP\Delphi7\ib6.5\ADOBE folder moved successfully.
C:\TEMP\Delphi7\ib6.5 folder moved successfully.
C:\TEMP\Delphi7 folder moved successfully.
C:\TEMP\hamachi.log moved successfully.
C:\TEMP\log.txt moved successfully.
File\Folder C:\Programme\DivX\DivX Update\DivXUpdate.exe not found.
File\Folder C:\Dokumente und Einstellungen\Türkyilmaz\Startmenü\Programme\Autostart\ctfmon.lnk not found.
File\Folder C:\Dokumente und Einstellungen\Türkyilmaz\Eigene Dateien\Downloads\Delphi 7\* not found.
< ipconfig /flushdns /c >
No captured output from command...
C:\Dokumente und Einstellungen\Türkyilmaz\Desktop\cmd.bat deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 98304 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Türkyilmaz
->Temp folder emptied: 1325531 bytes
->Temporary Internet Files folder emptied: 2842378 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 68121140 bytes
->Google Chrome cache emptied: 7420966 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 1804 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 66016 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 76,00 mb


[EMPTYFLASH]

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService

User: Türkyilmaz
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0,00 mb


OTL by OldTimer - Version 3.2.56.0 log created on 08062012_070231

Files\Folders moved on Reboot...
C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll moved successfully.
File\Folder C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Temp\Perflib_Perfdata_104.dat not found!

PendingFileRenameOperations files...
File C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll not found!
File C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Temp\Perflib_Perfdata_104.dat not found!

Registry entries deleted on Reboot...

Alt 06.08.2012, 09:52   #10
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
GVU 2.07 trojaner - Standard

GVU 2.07 trojaner



Code:
ATTFilter
C:\Dokumente und Einstellungen\Türkyilmaz\Eigene Dateien\Downloads\Delphi 7\KEYGEN\KEYGEN.EXE (RiskWare.Tool.CK) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\TEMP\Delphi7\keygen\keygen.exe (RiskWare.Tool.CK) -> Erfolgreich gelöscht und in Quarantäne gestellt.
         
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 06.08.2012, 11:47   #11
artist91
 
GVU 2.07 trojaner - Standard

GVU 2.07 trojaner



das hier heißt ??

Alt 06.08.2012, 14:31   #12
t'john
/// Helfer-Team
 
GVU 2.07 trojaner - Standard

GVU 2.07 trojaner



Dass du Deinen Rechner Neuaufsetzen solltest.
__________________
Mfg, t'john
Das TB unterstützen

Antwort

Themen zu GVU 2.07 trojaner
autostart, cdrom, desktop, dllcache, einstellungen, explorer, firefox, forum, frage, google, internet, internet explorer, java, log, microsoft, mozilla, nodrivetypeautorun, programme, services, setup, software, system, system32, trojaner, windows



Zum Thema GVU 2.07 trojaner - Ich habe alles soweit wie hier im forum versucht durchzuarbeiten. Nun eine Frage von mir ist das jetzt so in Ordnung : Zitat: All processes killed ========== OTL ========== Service - GVU 2.07 trojaner...
Archiv
Du betrachtest: GVU 2.07 trojaner auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.