Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Polizeivirus Österreich, 20.08.12

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 20.08.2012, 19:40   #1
Toni_jun
 
Polizeivirus Österreich, 20.08.12 - Icon26

Polizeivirus Österreich, 20.08.12



Hallo,

mein Notebook wurde nun leider auch von dem bekannten "Polizei Virus" befallen !
Wie in der Anleitung geschildert, habe ich im abgesicherten Modus einen OTL-Scan gemacht um Ihnen hier die zwei Logfiles im Anhang hochladen zu können.

Bitte um Hilfe vielen Dank

Hier die OTL und EXTRA direkt als Code:OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 20.08.2012 20:06:59 - Run 1
OTL by OldTimer - Version 3.2.58.1     Folder = C:\Users\****\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
 
7,94 Gb Total Physical Memory | 7,17 Gb Available Physical Memory | 90,33% Memory free
15,87 Gb Paging File | 15,14 Gb Available in Paging File | 95,37% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 441,99 Gb Total Space | 357,87 Gb Free Space | 80,97% Space Free | Partition Type: NTFS
Drive E: | 18,48 Gb Total Space | 2,81 Gb Free Space | 15,22% Space Free | Partition Type: NTFS
Drive F: | 4,98 Gb Total Space | 2,10 Gb Free Space | 42,21% Space Free | Partition Type: FAT32
 
Computer Name: TONI-HP | User Name: Toni | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Toni\Desktop\OTL.exe (OldTimer Tools)
 
 
========== Modules (No Company Name) ==========
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (STacSV) -- C:\Program Files\IDT\WDM\STacSV64.exe (IDT, Inc.)
SRV:64bit: - (AESTFilters) -- C:\Program Files\IDT\WDM\AESTSr64.exe (Andrea Electronics Corporation)
SRV:64bit: - (hpsrv) -- C:\Windows\SysNative\hpservice.exe (Hewlett-Packard Company)
SRV:64bit: - (McAfee Endpoint Encryption Agent) -- C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe ()
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (DpHost) -- C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe (DigitalPersona, Inc.)
SRV:64bit: - (vcsFPService) -- C:\Windows\SysNative\vcsFPService.exe (Validity Sensors, Inc.)
SRV:64bit: - (HP Power Assistant Service) -- C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe (Hewlett-Packard Company)
SRV:64bit: - (HPDayStarterService) -- c:\Program Files\Hewlett-Packard\HP DayStarter\32-bit\HPDayStarterService.exe (Hewlett-Packard Company)
SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (ServiceLayer) -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (TeamViewer7) -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (hpHotkeyMonitor) -- C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe (Hewlett-Packard Company)
SRV - (HPDrvMntSvc.exe) -- C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe (Hewlett-Packard Company)
SRV - (Sony PC Companion) -- C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe (Avanquest Software)
SRV - (HP Support Assistant Service) -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe (Hewlett-Packard Company)
SRV - (FLCDLOCK) -- c:\Windows\SysWOW64\flcdlock.exe (Hewlett-Packard Company)
SRV - (vcsFPService) -- C:\Windows\SysWOW64\vcsFPService.exe (Validity Sensors, Inc.)
SRV - (pdfcDispatcher) -- C:\Program Files (x86)\PDF Complete\pdfsvc.exe (PDF Complete Inc)
SRV - (hpCMSrv) -- C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe (Hewlett-Packard Development Company L.P.)
SRV - (PdiService) -- C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe (Portrait Displays, Inc.)
SRV - (XobniService) -- C:\Program Files (x86)\Xobni\XobniService.exe (Xobni Corporation)
SRV - (HPFSService) -- C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe (Hewlett-Packard)
SRV - (IAStorDataMgrSvc) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (Atheros Bt&Wlan Coex Agent) -- C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe (Atheros)
SRV - (AtherosSvc) -- C:\Program Files (x86)\Bluetooth Suite\AdminService.exe (Atheros Commnucations)
SRV - (jhi_service) -- C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe (Intel Corporation)
SRV - (uArcCapture) -- C:\Windows\SysWOW64\ArcVCapRender\uArcCapture.exe (ArcSoft, Inc.)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (ACDaemon) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (ggsemc) -- C:\Windows\SysNative\drivers\ggsemc.sys (Sony Ericsson Mobile Communications)
DRV:64bit: - (ggflt) -- C:\Windows\SysNative\drivers\ggflt.sys (Sony Ericsson Mobile Communications)
DRV:64bit: - (STHDA) -- C:\Windows\SysNative\drivers\stwrt64.sys (IDT, Inc.)
DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (pccsmcfd) -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys (Nokia)
DRV:64bit: - (Fs_Rec) -- C:\windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (Accelerometer) -- C:\Windows\SysNative\drivers\Accelerometer.sys (Hewlett-Packard Company)
DRV:64bit: - (hpdskflt) -- C:\Windows\SysNative\drivers\hpdskflt.sys (Hewlett-Packard Company)
DRV:64bit: - (MfeEpeOpal) -- C:\windows\SysNative\drivers\MfeEpeOpal.sys (McAfee, Inc.)
DRV:64bit: - (MfeEpePc) -- C:\windows\SysNative\drivers\MfeEpePc.sys (McAfee, Inc.)
DRV:64bit: - (nmwcd) -- C:\Windows\SysNative\drivers\ccdcmbx64.sys (Nokia)
DRV:64bit: - (UsbserFilt) -- C:\Windows\SysNative\drivers\usbser_lowerfltjx64.sys (Nokia)
DRV:64bit: - (upperdev) -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys (Nokia)
DRV:64bit: - (nmwcdc) -- C:\Windows\SysNative\drivers\ccdcmbox64.sys (Nokia)
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (intelkmd) -- C:\Windows\SysNative\drivers\igdpmd64.sys (Intel Corporation)
DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (DAMDrv) -- C:\Windows\SysNative\drivers\DAMDrv64.sys (Hewlett-Packard Company)
DRV:64bit: - (JMCR) -- C:\Windows\SysNative\drivers\jmcr.sys (JMicron Technology Corporation)
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (BtFilter) -- C:\Windows\SysNative\drivers\btfilter.sys (Atheros)
DRV:64bit: - (BTATH_HCRP) -- C:\Windows\SysNative\drivers\btath_hcrp.sys (Atheros)
DRV:64bit: - (BTATH_RCP) -- C:\Windows\SysNative\drivers\btath_rcp.sys (Atheros)
DRV:64bit: - (BTATH_LWFLT) -- C:\Windows\SysNative\drivers\btath_lwflt.sys (Atheros)
DRV:64bit: - (AthBTPort) -- C:\Windows\SysNative\drivers\btath_flt.sys (Atheros)
DRV:64bit: - (BTATH_A2DP) -- C:\Windows\SysNative\drivers\btath_a2dp.sys (Atheros)
DRV:64bit: - (BTATH_BUS) -- C:\Windows\SysNative\drivers\btath_bus.sys (Atheros)
DRV:64bit: - (SNP2UVC) -- C:\Windows\SysNative\drivers\snp2uvc.sys ()
DRV:64bit: - (nusb3xhc) -- C:\Windows\SysNative\drivers\nusb3xhc.sys (Renesas Electronics Corporation)
DRV:64bit: - (nusb3hub) -- C:\Windows\SysNative\drivers\nusb3hub.sys (Renesas Electronics Corporation)
DRV:64bit: - (HpqKbFiltr) -- C:\Windows\SysNative\drivers\HpqKbFiltr.sys (Hewlett-Packard Company)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (dmvsc) -- C:\Windows\SysNative\drivers\dmvsc.sys (Microsoft Corporation)
DRV:64bit: - (usbser) -- C:\Windows\SysNative\drivers\usbser.sys (Microsoft Corporation)
DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (ARCVCAM) -- C:\Windows\SysNative\drivers\ArcSoftVCapture.sys (ArcSoft, Inc.)
DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (vpcvmm) -- C:\Windows\SysNative\drivers\vpcvmm.sys (Microsoft Corporation)
DRV:64bit: - (vpcnfltr) -- C:\Windows\SysNative\drivers\vpcnfltr.sys (Microsoft Corporation)
DRV:64bit: - (vpcusb) -- C:\Windows\SysNative\drivers\vpcusb.sys (Microsoft Corporation)
DRV:64bit: - (vpcbus) -- C:\Windows\SysNative\drivers\vpchbus.sys (Microsoft Corporation)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (usb_rndisx) -- C:\Windows\SysNative\drivers\usb8023x.sys (Microsoft Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM/4
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPCOM/4
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {ec29edf6-ad3c-4e1c-a087-d6cb81400c43}
IE:64bit: - HKLM\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CMNTDF
IE:64bit: - HKLM\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CMNTDF
IE:64bit: - HKLM\..\SearchScopes\{ec29edf6-ad3c-4e1c-a087-d6cb81400c43}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM/4
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPCOM/4
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4
IE - HKLM\..\SearchScopes,DefaultScope = {ec29edf6-ad3c-4e1c-a087-d6cb81400c43}
IE - HKLM\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CMNTDF
IE - HKLM\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CMNTDF
IE - HKLM\..\SearchScopes\{ec29edf6-ad3c-4e1c-a087-d6cb81400c43}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-2962388088-3790687715-1872597749-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM/4
IE - HKU\S-1-5-21-2962388088-3790687715-1872597749-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.tt.com/
IE - HKU\S-1-5-21-2962388088-3790687715-1872597749-1001\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-2962388088-3790687715-1872597749-1001\..\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}: "URL" = hxxp://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4
IE - HKU\S-1-5-21-2962388088-3790687715-1872597749-1001\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=112843&tt=060612_6_&babsrc=SP_ss&mntrId=a20a507b0000000000009cb70d7e8eaa
IE - HKU\S-1-5-21-2962388088-3790687715-1872597749-1001\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CMNTDF
IE - HKU\S-1-5-21-2962388088-3790687715-1872597749-1001\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CMNTDF
IE - HKU\S-1-5-21-2962388088-3790687715-1872597749-1001\..\SearchScopes\{ec29edf6-ad3c-4e1c-a087-d6cb81400c43}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox
IE - HKU\S-1-5-21-2962388088-3790687715-1872597749-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2962388088-3790687715-1872597749-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
========== FireFox ==========
 
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.4.1: C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.4.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nokia.com/EnablerPlugin: C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\otis@digitalpersona.com: C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt\ [2012.05.10 21:34:08 | 000,000,000 | ---D | M]
 
[2012.07.29 15:47:58 | 000,002,048 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrch.xml
 
O1 HOSTS File: ([2012.08.17 15:23:02 | 000,000,848 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 192.168.1.1    akusrv01
O2 - BHO: (Browser Companion Helper) - {00cbb66b-1d3b-46d3-9577-323a336acb50} - C:\Program Files (x86)\BrowserCompanion\jsloader.dll ( )
O2 - BHO: (File Sanitizer for HP ProtectTools) - {3134413B-49B4-425C-98A5-893C1F195601} - C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\IEBHO.dll (Hewlett-Packard)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (VideoFileDownload) - {82EA3E77-7BD2-4744-A8F2-670770767EC5} - C:\Program Files (x86)\OApps\bho_project.dll File not found
O2 - BHO: (CIESpeechBHO Class) - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
O2 - BHO: (Browser Companion Helper Verifier) - {963B125B-8B21-49A2-A3A8-E37092276531} - C:\Program Files (x86)\BrowserCompanion\updatebhoWin32.dll ( )
O2 - BHO: (DealPly) - {A6174F27-1FFF-E1D6-A93F-BA48AD5DD448} - C:\Program Files (x86)\DealPly\DealPlyIE.dll (DealPly Technologies Ltd)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (SweetPacks Browser Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKU\S-1-5-21-2962388088-3790687715-1872597749-1001\..\Toolbar\WebBrowser: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O4:64bit: - HKLM..\Run: [AthBtTray] C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe (Atheros Commnucations)
O4:64bit: - HKLM..\Run: [AtherosBtStack] C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe (Atheros Communications)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [HPPowerAssistant] C:\Program Files\Hewlett-Packard\HP Power Assistant\DelayedAppStarter.exe (Hewlett-Packard Company, L.P.)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [MfeEpePcMonitor] C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcMonitor.exe ()
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe (IDT, Inc.)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Browser companion helper] C:\Program Files (x86)\BrowserCompanion\BCHelper.exe (Blabbers Communications LTD)
O4 - HKLM..\Run: [DTRun] c:\Program Files (x86)\ArcSoft\TotalMedia Suite\TotalMedia Theatre 3\uDTRun.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [File Sanitizer] C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\coreshredder.exe (Hewlett-Packard)
O4 - HKLM..\Run: [HPConnectionManager] C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe (Hewlett-Packard Development Company L.P.)
O4 - HKLM..\Run: [HPQuickWebProxy] c:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [NUSB3MON] c:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
O4 - HKLM..\Run: [PDF Complete] C:\Program Files (x86)\PDF Complete\pdfsty.exe (PDF Complete Inc)
O4 - HKLM..\Run: [QLBController] C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SweetIM] C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-2962388088-3790687715-1872597749-1001..\Run: []  File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9:64bit: - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
O9 - Extra Button: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 195.34.133.21 212.186.211.21
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3EF88343-C192-4F7A-A69E-6D59DB567EF3}: DhcpNameServer = 195.34.133.21 212.186.211.21
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6C7932B6-1908-4224-8CC1-B53493D5303E}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D210C341-3EA8-4E5E-890A-5B4C839C2DC6}: DhcpNameServer = 192.168.42.129
O18:64bit: - Protocol\Handler\base64 - No CLSID value found
O18:64bit: - Protocol\Handler\chrome - No CLSID value found
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\prox - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\base64 {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Program Files (x86)\BrowserCompanion\tdataprotocol.dll (Blabbers Communications Ltd)
O18 - Protocol\Handler\chrome {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Program Files (x86)\BrowserCompanion\tdataprotocol.dll (Blabbers Communications Ltd)
O18 - Protocol\Handler\prox {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Program Files (x86)\BrowserCompanion\tdataprotocol.dll (Blabbers Communications Ltd)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\windows\SysNative\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\DeviceNP: DllName - (DeviceNP.dll) - C:\windows\SysWow64\DeviceNP.dll (Hewlett-Packard Company)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.20 19:59:38 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Toni\Desktop\OTL.exe
[2012.08.20 19:39:54 | 000,000,000 | ---D | C] -- C:\Users\Toni\AppData\Local\ElevatedDiagnostics
[2012.08.16 06:26:09 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\mshtmled.dll
[2012.08.16 06:26:09 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\mshtmled.dll
[2012.08.16 06:26:08 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\url.dll
[2012.08.16 06:26:08 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\url.dll
[2012.08.16 06:26:08 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\ieui.dll
[2012.08.16 06:26:07 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\jscript9.dll
[2012.08.16 06:26:07 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\inetcpl.cpl
[2012.08.16 06:26:07 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\inetcpl.cpl
[2012.08.16 06:26:07 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\ieui.dll
[2012.08.16 06:26:07 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\ieUnatt.exe
[2012.08.16 06:26:07 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\ieUnatt.exe
[2012.08.16 06:26:06 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\jscript.dll
[2012.08.16 06:26:06 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\jscript.dll
[2012.08.15 06:23:49 | 000,503,808 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\srcore.dll
[2012.08.15 06:23:48 | 000,751,104 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\win32spl.dll
[2012.08.15 06:23:48 | 000,492,032 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\win32spl.dll
[2012.08.15 06:23:48 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\netapi32.dll
[2012.08.15 06:23:48 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\windows\splwow64.exe
[2012.08.15 06:23:48 | 000,059,392 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\browcli.dll
[2012.08.15 06:23:48 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\browcli.dll
[2012.08.15 06:23:47 | 000,956,928 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\localspl.dll
[2012.08.11 06:24:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2012.08.10 15:43:55 | 000,000,000 | ---D | C] -- C:\Users\Toni\Documents\Vuze Downloads
[2012.08.09 18:29:50 | 000,000,000 | ---D | C] -- C:\Users\Toni\AppData\Roaming\Skype
[2012.08.09 18:29:46 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype
[2012.08.09 18:29:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2012.08.09 18:29:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2012.08.05 10:10:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Azureus
[2012.08.05 10:06:15 | 000,000,000 | ---D | C] -- C:\Users\Toni\AppData\Roaming\Azureus
[2012.08.05 10:06:04 | 000,000,000 | ---D | C] -- C:\Users\Toni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Azureus
[2012.08.05 10:06:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Azureus
[2012.08.05 10:06:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Azureus
[2012.08.05 09:55:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\BitTorrent
[2012.08.05 09:54:53 | 000,000,000 | ---D | C] -- C:\Users\Toni\AppData\Roaming\BitTorrent
[2012.08.03 16:05:04 | 000,000,000 | ---D | C] -- C:\Users\Toni\AppData\Local\Sony
[2012.08.03 15:46:50 | 000,027,760 | ---- | C] (Sony Ericsson Mobile Communications) -- C:\windows\SysNative\drivers\ggsemc.sys
[2012.08.03 15:46:50 | 000,014,448 | ---- | C] (Sony Ericsson Mobile Communications) -- C:\windows\SysNative\drivers\ggflt.sys
[2012.08.03 15:45:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Sony Ericsson
[2012.08.03 15:45:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sony Ericsson
[2012.08.03 14:14:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
[2012.08.03 14:14:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Sony
[2012.08.03 14:14:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sony
[2012.07.29 17:58:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip
[2012.07.29 17:57:57 | 000,000,000 | ---D | C] -- C:\Program Files\WinZip
[2012.07.29 15:47:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2012.07.29 15:47:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\JDownloader
[2012.07.29 15:43:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DealPly
[2012.07.29 15:43:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DealPly
[2012.07.29 15:42:50 | 000,000,000 | ---D | C] -- C:\ProgramData\SweetIM
[2012.07.29 15:42:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SweetIM
[2012.07.29 12:46:41 | 000,000,000 | ---D | C] -- C:\Users\Toni\AppData\Local\Unity
[2012.07.29 12:46:25 | 000,000,000 | ---D | C] -- C:\Users\Toni\AppData\Local\Apps
[2012.07.29 12:46:24 | 000,000,000 | ---D | C] -- C:\Users\Toni\AppData\Local\Deployment
[2012.07.29 10:12:12 | 000,000,000 | ---D | C] -- C:\windows\SysNative\appmgmt
[2012.07.29 09:38:13 | 000,000,000 | ---D | C] -- C:\Users\Toni\Documents\BattleForge
[2012.07.29 09:37:43 | 004,379,984 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\D3DX9_40.dll
[2012.07.29 09:37:43 | 002,036,576 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\D3DCompiler_40.dll
[2012.07.29 09:37:43 | 000,514,384 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\XAudio2_3.dll
[2012.07.29 09:37:43 | 000,452,440 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\d3dx10_40.dll
[2012.07.29 09:37:43 | 000,235,856 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\xactengine3_3.dll
[2012.07.29 09:37:43 | 000,070,992 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\XAPOFX1_2.dll
[2012.07.29 09:37:43 | 000,023,376 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\X3DAudio1_5.dll
[2012.07.29 09:37:42 | 001,491,992 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\D3DCompiler_38.dll
[2012.07.29 09:37:42 | 000,507,400 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\XAudio2_1.dll
[2012.07.29 09:37:42 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\d3dx10_38.dll
[2012.07.29 09:37:42 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\xactengine3_1.dll
[2012.07.29 09:37:42 | 000,065,032 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\XAPOFX1_0.dll
[2012.07.29 09:37:42 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\X3DAudio1_4.dll
[2012.07.25 08:19:51 | 000,000,000 | ---D | C] -- C:\windows\Minidump
 
========== Files - Modified Within 30 Days ==========
 
[2012.08.20 19:59:38 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Toni\Desktop\OTL.exe
[2012.08.20 19:58:12 | 4226,138,111 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.20 19:58:12 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2012.08.20 19:56:49 | 004,503,728 | ---- | M] () -- C:\ProgramData\ism_0_llatsni.pad
[2012.08.20 19:56:43 | 000,000,035 | ---- | M] () -- C:\Users\Public\Documents\AtherosServiceConfig.ini
[2012.08.20 18:42:58 | 001,645,398 | ---- | M] () -- C:\windows\SysWow64\PerfStringBackup.INI
[2012.08.20 18:42:58 | 000,702,312 | ---- | M] () -- C:\windows\SysNative\perfh007.dat
[2012.08.20 18:42:58 | 000,655,648 | ---- | M] () -- C:\windows\SysNative\perfh009.dat
[2012.08.20 18:42:58 | 000,149,836 | ---- | M] () -- C:\windows\SysNative\perfc007.dat
[2012.08.20 18:42:58 | 000,122,520 | ---- | M] () -- C:\windows\SysNative\perfc009.dat
[2012.08.20 18:34:19 | 000,001,893 | ---- | M] () -- C:\Users\Toni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.08.20 06:25:26 | 000,031,536 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.20 06:25:26 | 000,031,536 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.19 20:13:00 | 000,000,884 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job
[2012.08.17 15:25:23 | 000,000,574 | ---- | M] () -- C:\Users\Toni\Desktop\daten (akusrv01) (Z) - Verknüpfung.lnk
[2012.08.17 15:15:44 | 000,000,556 | ---- | M] () -- C:\Users\Toni\Desktop\Akutherm - VPN.lnk
[2012.08.17 06:17:39 | 000,000,328 | ---- | M] () -- C:\windows\tasks\HPCeeScheduleForToni.job
[2012.08.16 18:13:21 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\windows\SysWow64\FlashPlayerApp.exe
[2012.08.16 18:13:21 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\windows\SysWow64\FlashPlayerCPLApp.cpl
[2012.08.16 18:07:25 | 000,415,384 | ---- | M] () -- C:\windows\SysNative\FNTCACHE.DAT
[2012.08.11 06:24:26 | 000,002,030 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2012.08.10 18:15:15 | 000,000,340 | ---- | M] () -- C:\windows\tasks\HPCeeScheduleForTONI-HP$.job
[2012.08.09 18:36:12 | 000,002,535 | ---- | M] () -- C:\Users\Toni\Desktop\Skype.lnk
[2012.08.05 10:10:41 | 000,000,973 | ---- | M] () -- C:\Users\Toni\Desktop\Azureus.lnk
[2012.08.05 09:55:47 | 000,000,927 | ---- | M] () -- C:\Users\Public\Desktop\BitTorrent.lnk
[2012.08.03 16:32:03 | 000,000,000 | -H-- | M] () -- C:\windows\SysNative\drivers\Msft_Kernel_WinUSB_01009.Wdf
[2012.08.03 15:50:53 | 000,000,000 | -H-- | M] () -- C:\windows\SysNative\drivers\Msft_Kernel_ggsemc_01009.Wdf
[2012.08.03 15:50:53 | 000,000,000 | -H-- | M] () -- C:\windows\SysNative\drivers\Msft_Kernel_ggflt_01009.Wdf
[2012.08.03 15:46:50 | 000,027,760 | ---- | M] (Sony Ericsson Mobile Communications) -- C:\windows\SysNative\drivers\ggsemc.sys
[2012.08.03 15:46:50 | 000,014,448 | ---- | M] (Sony Ericsson Mobile Communications) -- C:\windows\SysNative\drivers\ggflt.sys
[2012.08.03 14:54:09 | 001,612,484 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI
[2012.08.03 14:14:03 | 000,002,086 | R--- | M] () -- C:\Users\Toni\Desktop\Sony PC Companion 2.1.lnk
[2012.07.31 21:24:56 | 596,333,319 | ---- | M] () -- C:\windows\MEMORY.DMP
[2012.07.29 17:58:07 | 000,002,189 | ---- | M] () -- C:\Users\Public\Desktop\WinZip.lnk
[2012.07.29 15:56:21 | 000,001,220 | ---- | M] () -- C:\prefs.js
 
========== Files Created - No Company Name ==========
 
[2012.08.20 18:34:19 | 004,503,728 | ---- | C] () -- C:\ProgramData\ism_0_llatsni.pad
[2012.08.20 18:34:19 | 000,001,893 | ---- | C] () -- C:\Users\Toni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.08.17 15:25:23 | 000,000,574 | ---- | C] () -- C:\Users\Toni\Desktop\daten (akusrv01) (Z) - Verknüpfung.lnk
[2012.08.17 15:15:44 | 000,000,556 | ---- | C] () -- C:\Users\Toni\Desktop\Akutherm - VPN.lnk
[2012.08.09 18:36:12 | 000,002,535 | ---- | C] () -- C:\Users\Toni\Desktop\Skype.lnk
[2012.08.05 10:10:41 | 000,000,973 | ---- | C] () -- C:\Users\Toni\Desktop\Azureus.lnk
[2012.08.05 09:55:47 | 000,000,927 | ---- | C] () -- C:\Users\Public\Desktop\BitTorrent.lnk
[2012.08.03 16:32:03 | 000,000,000 | -H-- | C] () -- C:\windows\SysNative\drivers\Msft_Kernel_WinUSB_01009.Wdf
[2012.08.03 15:50:53 | 000,000,000 | -H-- | C] () -- C:\windows\SysNative\drivers\Msft_Kernel_ggsemc_01009.Wdf
[2012.08.03 15:50:53 | 000,000,000 | -H-- | C] () -- C:\windows\SysNative\drivers\Msft_Kernel_ggflt_01009.Wdf
[2012.08.03 14:14:03 | 000,002,086 | R--- | C] () -- C:\Users\Toni\Desktop\Sony PC Companion 2.1.lnk
[2012.07.29 17:58:07 | 000,002,189 | ---- | C] () -- C:\Users\Public\Desktop\WinZip.lnk
[2012.07.29 15:47:58 | 000,001,220 | ---- | C] () -- C:\prefs.js
[2012.07.25 08:19:47 | 596,333,319 | ---- | C] () -- C:\windows\MEMORY.DMP
[2012.07.09 18:12:44 | 000,038,446 | ---- | C] () -- C:\Users\Toni\AppData\Roaming\Microsoft Excel 97-2003.ADR
[2012.05.10 19:30:57 | 000,007,605 | ---- | C] () -- C:\Users\Toni\AppData\Local\Resmon.ResmonCfg
[2012.03.04 16:42:27 | 000,003,120 | ---- | C] () -- C:\windows\SysWow64\drivers\wdcfhbd.sys
[2012.03.04 16:26:44 | 000,000,000 | ---- | C] () -- C:\windows\ativpsrm.bin
[2012.03.04 16:24:15 | 000,003,917 | ---- | C] () -- C:\windows\SysWow64\atipblup.dat
[2012.03.04 16:22:56 | 000,025,984 | ---- | C] () -- C:\windows\snuvcdsm.exe
[2012.03.04 16:22:56 | 000,015,497 | ---- | C] () -- C:\windows\snp2uvc.ini
[2012.03.04 05:18:55 | 000,963,116 | ---- | C] () -- C:\windows\SysWow64\igkrng600.bin
[2012.03.04 05:18:53 | 000,216,000 | ---- | C] () -- C:\windows\SysWow64\igfcg600m.bin
[2012.03.04 05:18:52 | 000,145,804 | ---- | C] () -- C:\windows\SysWow64\igcompkrng600.bin
[2012.03.04 05:18:52 | 000,056,832 | ---- | C] () -- C:\windows\SysWow64\igdde32.dll
[2012.03.04 05:18:51 | 013,903,872 | ---- | C] () -- C:\windows\SysWow64\ig4icd32.dll
[2012.03.04 05:18:50 | 000,204,952 | ---- | C] () -- C:\windows\SysWow64\ativvsvl.dat
[2012.03.04 05:18:50 | 000,157,144 | ---- | C] () -- C:\windows\SysWow64\ativvsva.dat
[2012.03.04 05:18:50 | 000,003,917 | ---- | C] () -- C:\windows\SysWow64\atipblag.dat
[2011.12.26 07:43:47 | 000,003,120 | ---- | C] () -- C:\windows\SysWow64\drivers\wdcgfgj.sys
[2011.12.26 07:13:14 | 000,003,120 | ---- | C] () -- C:\windows\SysWow64\drivers\wdcgfhh.sys
[2011.12.26 06:42:16 | 001,645,398 | ---- | C] () -- C:\windows\SysWow64\PerfStringBackup.INI
[2011.10.14 01:53:18 | 000,056,832 | ---- | C] () -- C:\windows\SysWow64\OpenVideo.dll
[2011.10.14 01:53:02 | 000,056,832 | ---- | C] () -- C:\windows\SysWow64\OVDecoder.dll
[2011.09.05 09:57:34 | 000,366,136 | ---- | C] () -- C:\windows\SysWow64\flcdlmsg.dll
[2011.08.30 10:08:54 | 000,000,256 | ---- | C] () -- C:\windows\SysWow64\HPUsageTrackingSDK.exe.hpsign
[2011.08.30 10:08:52 | 000,000,256 | ---- | C] () -- C:\windows\SysWow64\CogHPUsageTrackingReport.dll.hpsign
[2011.08.30 10:08:48 | 000,021,840 | ---- | C] () -- C:\windows\SysWow64\CogHPUsageTrackingReport.dll
[2011.08.24 15:30:30 | 000,000,256 | R--- | C] () -- C:\windows\SysWow64\DPLic.dll.hpsign
[2011.08.24 14:55:46 | 000,000,256 | R--- | C] () -- C:\windows\SysWow64\DPPassFilter.dll.hpsign
[2011.08.24 14:55:46 | 000,000,256 | R--- | C] () -- C:\windows\SysWow64\DPCrProv.dll.hpsign
[2011.08.24 14:55:30 | 000,000,256 | R--- | C] () -- C:\windows\SysWow64\DPFPApiUI.dll.hpsign
[2011.08.24 14:53:44 | 000,000,256 | R--- | C] () -- C:\windows\SysWow64\DPSCEL.dll.hpsign
[2011.08.24 14:53:44 | 000,000,256 | R--- | C] () -- C:\windows\SysWow64\DPFPApi.dll.hpsign
[2011.08.24 14:53:42 | 000,000,256 | R--- | C] () -- C:\windows\SysWow64\DPClback.dll.hpsign
[2011.08.23 10:10:44 | 000,000,256 | ---- | C] () -- C:\windows\SysWow64\vcsAPIShared.dll.hpsign
[2011.05.30 21:58:34 | 000,185,168 | ---- | C] () -- C:\windows\SysWow64\PassThroughOTP.dll
[2011.05.30 21:58:34 | 000,000,256 | ---- | C] () -- C:\windows\SysWow64\PassThroughOTP.dll.hpsign
[2011.02.26 00:32:12 | 000,012,144 | ---- | C] () -- C:\windows\HPun2430Version.dll
[2011.02.21 09:37:16 | 000,038,224 | ---- | C] () -- C:\windows\SysWow64\CoHpCasl.exe
[2011.01.10 20:03:08 | 086,271,980 | ---- | C] () -- C:\windows\SysWow64\BioTrustFace.dat
 
========== LOP Check ==========
 
[2012.08.11 15:39:23 | 000,000,000 | ---D | M] -- C:\Users\Toni\AppData\Roaming\Azureus
[2012.06.25 18:53:52 | 000,000,000 | ---D | M] -- C:\Users\Toni\AppData\Roaming\Babylon
[2012.08.06 06:15:12 | 000,000,000 | ---D | M] -- C:\Users\Toni\AppData\Roaming\BitTorrent
[2012.05.09 16:36:02 | 000,000,000 | ---D | M] -- C:\Users\Toni\AppData\Roaming\DigitalPersona
[2012.05.11 15:42:22 | 000,000,000 | ---D | M] -- C:\Users\Toni\AppData\Roaming\IDT
[2012.08.03 18:38:35 | 000,000,000 | ---D | M] -- C:\Users\Toni\AppData\Roaming\MyPhoneExplorer
[2012.07.20 19:19:28 | 000,000,000 | ---D | M] -- C:\Users\Toni\AppData\Roaming\Nokia
[2012.07.20 19:19:28 | 000,000,000 | ---D | M] -- C:\Users\Toni\AppData\Roaming\Nokia Suite
[2012.07.20 19:17:43 | 000,000,000 | ---D | M] -- C:\Users\Toni\AppData\Roaming\PC Suite
[2012.05.09 17:50:26 | 000,000,000 | ---D | M] -- C:\Users\Toni\AppData\Roaming\Synaptics
[2012.06.20 10:10:32 | 000,000,000 | ---D | M] -- C:\Users\Toni\AppData\Roaming\TeamViewer
[2012.05.09 19:28:39 | 000,000,000 | ---D | M] -- C:\Users\Toni\AppData\Roaming\TS3Client
[2012.07.29 15:52:55 | 000,000,000 | ---D | M] -- C:\Users\Toni\AppData\Roaming\uTorrent
[2012.06.25 16:23:33 | 000,000,000 | ---D | M] -- C:\Users\Toni\AppData\Roaming\WildTangent
[2012.06.22 18:36:01 | 000,032,552 | ---- | M] () -- C:\windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:1DA424AA

< End of report >
         
--- --- ---
OTL Logfile:
Code:
ATTFilter
OTL Extras logfile created on: 20.08.2012 20:06:59 - Run 1
OTL by OldTimer - Version 3.2.58.1     Folder = C:\Users\****\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
 
7,94 Gb Total Physical Memory | 7,17 Gb Available Physical Memory | 90,33% Memory free
15,87 Gb Paging File | 15,14 Gb Available in Paging File | 95,37% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 441,99 Gb Total Space | 357,87 Gb Free Space | 80,97% Space Free | Partition Type: NTFS
Drive E: | 18,48 Gb Total Space | 2,81 Gb Free Space | 15,22% Space Free | Partition Type: NTFS
Drive F: | 4,98 Gb Total Space | 2,10 Gb Free Space | 42,21% Space Free | Partition Type: FAT32
 
Computer Name: TONI-HP | User Name: Toni | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\windows\SysWow64\control.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04B37F07-8A71-48CA-9053-31306A47C4AD}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{0B9A7BD4-AAC0-4059-93D7-C61831E4E5A1}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{11B4316A-B05A-45C0-875B-47BF9429A845}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{2BB5078D-3D4B-4BE4-B5FF-0E033DE6ABE7}" = rport=137 | protocol=17 | dir=out | app=system | 
"{30153384-9686-46B8-A535-A0F17D1E1CCB}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{3DA9678B-BB01-4F16-BD87-108473F56828}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{3E17698E-8455-40EF-B95F-1A21B3620F0F}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{4DC8B254-F76D-445D-961B-31137A3505DB}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{4E06EA37-F620-477B-A456-5AA5E7144DE2}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{4E11E360-8977-4BCC-86B7-9A5790AF4A1F}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{535CAD50-9B2D-4F7F-8952-AAF55B695EE7}" = lport=139 | protocol=6 | dir=in | app=system | 
"{57E3E6AA-6076-48AA-9D1A-AE1DFB73D5A2}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{5A035719-D447-42D8-8591-E4296CB71592}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{5AE1886E-C7C0-48BA-A2DD-65C6E4B705BB}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{6FA13AD0-9D5A-46FD-9188-773DECD85273}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{724AD820-B6D1-4A3E-AFB4-D95B0A4A3F8B}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{7E5F151F-6AF5-4496-ADAD-91208336294F}" = rport=139 | protocol=6 | dir=out | app=system | 
"{7E6550BA-69DF-4BAD-A0E6-6E490DEEC8B9}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{839796F5-B778-4EE0-8B46-3A50D71B13B8}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{8D5C0D74-D7CB-4CCD-8C05-2F375F8F7862}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\outlook.exe | 
"{8F0C0C95-7A94-462F-9123-048574E1A416}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{8FEDD50F-7127-48EE-9A8C-69635CA5A128}" = rport=138 | protocol=17 | dir=out | app=system | 
"{94D3EEEF-5460-4556-BA34-053413D1C0CB}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{961DFA64-DDDB-4D28-829A-93D4A60CCC7D}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{BB8AD607-09E0-43E3-BC63-04F4BBE22E1A}" = lport=445 | protocol=6 | dir=in | app=system | 
"{BD80F91C-B0AE-4B29-A2D7-3145BA30D5A5}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{BF0739E2-51C9-444E-8574-0510D6CA404C}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{C0230CEB-03F8-405B-8870-9A809156129B}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{C2E2C80C-4199-4EA1-9B36-063163F58E92}" = lport=138 | protocol=17 | dir=in | app=system | 
"{D4C78047-72E3-4858-BF09-86A17FEA72BD}" = lport=137 | protocol=17 | dir=in | app=system | 
"{D62D35C0-9017-4DAF-83AA-454A8C73B3D2}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{D6846B69-6799-4BC8-B8F9-94EE6DBFA99D}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{DAF2EF70-C5F8-477F-A8AA-EC6A3F7B912A}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{FFF56934-DB16-41CD-B811-03428A23BEB3}" = rport=445 | protocol=6 | dir=out | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{004A0127-0210-433E-8C36-383761F95BA7}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe | 
"{1ABB7081-2B62-4390-A50E-9582617F6517}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer.exe | 
"{1CC5B18B-F78F-40D2-A903-B0E2586CACEB}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{1F76E37B-5075-4298-A247-891F1DAADF3B}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe | 
"{38E43FB1-4C32-4428-95A3-FDDA16C03284}" = protocol=6 | dir=in | app=c:\program files (x86)\bittorrent\bittorrent.exe | 
"{39F5C547-8E4F-429C-B076-3C7178F0E9D0}" = protocol=6 | dir=in | app=c:\program files (x86)\sony ericsson\update engine\sony ericsson update engine.exe | 
"{410B9EB0-D9D2-40D7-B72D-807013CBA201}" = dir=in | app=c:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe | 
"{49FC6F0A-265A-4523-86F4-2C4F6D007A78}" = protocol=6 | dir=out | app=system | 
"{503181DD-BAA9-4B79-A94B-418967860838}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{56969F96-5993-4388-8C6A-E7E9B66FFA7B}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{5CBF33FF-4651-427B-AE47-C29B2BE0A4A5}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | 
"{63B4EFFA-629B-484C-BD72-C01D6EFE3B7A}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{6657C688-8160-4891-A08C-ADB6B859C0AF}" = protocol=17 | dir=in | app=c:\program files (x86)\sony ericsson\update engine\sony ericsson update engine.exe | 
"{6F455CE0-3AD0-4AEF-A6F1-9F1A8BF3A8C5}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{72E49CEC-B2F0-4FD3-B088-CB34F011F0E3}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{734D2286-DE13-43A3-AB79-9C9ABE335983}" = protocol=17 | dir=in | app=c:\program files (x86)\sweetim\communicator\sweetpacksupdatemanager.exe | 
"{7C6B4DC2-290C-46A9-B11C-81FA9C7EE8B3}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe | 
"{7DC39F76-EC38-4EA2-93D2-655EBE73EAD6}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{81B9F632-7120-4D44-A410-63E4BE006B03}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer_service.exe | 
"{81D75593-389D-45D3-9599-D239BBFCB1BB}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{844498D6-5834-4176-AD3A-8D82F0BB3B6E}" = dir=in | app=c:\program files (x86)\nokia\nokia suite\nokiasuite.exe | 
"{86ED972C-6B24-4C78-BB70-325BF36F15C8}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer_service.exe | 
"{8738DD2F-4CF2-48B9-9A6F-D25A185A3562}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe | 
"{89E8F723-434E-4291-AD79-558456992793}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{91320BF6-667A-4CE6-A311-E48F23A75F5C}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{96B4F826-C416-4E39-8F5B-3B16F14D2144}" = protocol=6 | dir=in | app=c:\windows\syswow64\msiexec.exe | 
"{97DAA24F-579A-4A05-B8D9-338CBCD4A068}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{99C4E439-436D-46A1-BC44-6112650463D0}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{9BA68FAF-DDAF-427C-816F-9E569D30BF99}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer.exe | 
"{9FA7B587-B0B7-4A43-8A33-320A43BFC5A0}" = protocol=6 | dir=in | app=c:\program files (x86)\sweetim\communicator\sweetpacksupdatemanager.exe | 
"{A9293E13-98EF-4653-ADD4-78BC02225944}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{AB9CAC27-B59E-4AD4-9C24-A9A273E16426}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{B009657E-98FF-4238-A3B2-6536AD63D797}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{B7A78C2C-2140-4F44-A1C8-6EE917A0BDA7}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{C1C7D4B0-CECA-4A42-94F1-47AD72C9586A}" = protocol=17 | dir=in | app=c:\program files (x86)\bittorrent\bittorrent.exe | 
"{C5320F65-9DB0-48F9-80D2-432E4A2FF407}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{C5F5569B-F74D-4E81-BD54-638F86E709E0}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe | 
"{CCB3A4D2-72A3-4FFA-A35F-B54A8AD76DCA}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{D0704491-1674-4A21-A515-B311711622C9}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{D4850A8C-8322-4AEF-B85C-9B453D5E64D5}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{DA3A4A12-1CD2-4236-A77E-363E4C177E31}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{DA6F6590-DD84-4675-9AF8-2114943566D6}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{DC4031ED-F2AC-4DF4-B07C-FEBCE8F9D853}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | 
"{F108330D-67A6-406F-8C89-655915748BB6}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{F98E93F7-A0E8-4CC2-AD30-D7735A197218}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{FD3376DE-356E-48A1-9278-8EC31B23FBE8}" = protocol=17 | dir=in | app=c:\windows\syswow64\msiexec.exe | 
"TCP Query User{22642B68-1530-4447-B078-C39D7ADFECDB}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe | 
"TCP Query User{5C2C0FB4-93DE-4B4C-9B40-AADAE879F9DD}C:\program files (x86)\torrentsearch\easydownload.exe" = protocol=6 | dir=in | app=c:\program files (x86)\torrentsearch\easydownload.exe | 
"TCP Query User{AEDBB7A7-26D1-4523-8452-313113730D67}C:\program files (x86)\emule\emule.exe" = protocol=6 | dir=in | app=c:\program files (x86)\emule\emule.exe | 
"TCP Query User{BD6B3C01-4CED-4273-97A0-AF0B967EBFD5}C:\program files (x86)\azureus\azureus.exe" = protocol=6 | dir=in | app=c:\program files (x86)\azureus\azureus.exe | 
"TCP Query User{C6175DBD-32D0-477D-BDA9-BDBD3BE9A836}C:\program files (x86)\myphoneexplorer\myphoneexplorer.exe" = protocol=6 | dir=in | app=c:\program files (x86)\myphoneexplorer\myphoneexplorer.exe | 
"UDP Query User{29FB44A1-69CE-4C36-9E85-A508C9DAAE58}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe | 
"UDP Query User{3B4CB163-718F-4D44-AA7F-F96119DE10CD}C:\program files (x86)\emule\emule.exe" = protocol=17 | dir=in | app=c:\program files (x86)\emule\emule.exe | 
"UDP Query User{890C1B9C-7E83-4844-A79D-5B4E46AC21C4}C:\program files (x86)\torrentsearch\easydownload.exe" = protocol=17 | dir=in | app=c:\program files (x86)\torrentsearch\easydownload.exe | 
"UDP Query User{D8AA6D90-E598-4F1C-B993-ABB61B5308F1}C:\program files (x86)\azureus\azureus.exe" = protocol=17 | dir=in | app=c:\program files (x86)\azureus\azureus.exe | 
"UDP Query User{E008771F-EAC2-4C3A-9426-0B495AE404D2}C:\program files (x86)\myphoneexplorer\myphoneexplorer.exe" = protocol=17 | dir=in | app=c:\program files (x86)\myphoneexplorer\myphoneexplorer.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{03520551-508E-EDCA-4A14-90C706A54A41}" = AMD Catalyst Install Manager
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{230D1595-57DA-4933-8C4E-375797EBB7E1}" = Bluetooth Win7 Suite (64)
"{2C233758-BD55-8F3F-4BBE-0A11B833CB96}" = ccc-utility64
"{2DA0E83F-81B5-4C3F-8F36-8AD30CFF67B4}" = HP ProtectTools Security Manager
"{3D2D0DB9-5199-4A77-B6D3-646693FAE63C}" = AMD Media Foundation Decoders
"{483D5A49-A26B-4CB8-AA2D-0D1811322061}" = HP DayStarter
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{4D668D4F-FAA2-4726-834C-31F4614F312E}" = MSVC80_x64_v2
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{55B52830-024A-443E-AF61-61E1E71AFA1B}" = Device Access Manager for HP ProtectTools
"{5EB6F3CB-46F4-451F-A028-7F6D8D35D7D0}" = Windows Live Language Selector
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{65C1BEAD-B50B-498C-BB6B-CDE4F30584B1}" = HP 3D DriveGuard
"{680EDA59-9266-44B4-949E-0C24F65DFF82}" = Microsoft_VC100_CRT_SP1_x64
"{6A76BEAF-6D1F-4273-A79B-DA8410A2E56B}" = Apple Mobile Device Support
"{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{840A3BAA-4C68-4581-9C7A-6F8D6CF531B9}" = iTunes
"{8A0041CD-277C-4C1F-BFE4-7AC508B20B4C}" = Drive Encryption For HP ProtectTools
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{AB071C8B-873C-459F-ACA9-9EBE03C3E89B}" = MSVC90_x64
"{ACA53F68-B003-4D0E-9C3D-0C4EE09D08A8}" = Privacy Manager for HP ProtectTools
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{BFA2D2A7-4FAC-4862-B7A3-960B329C2177}" = Validity Fingerprint Sensor Driver
"{CC4D56B7-6F18-470B-8734-ABCD75BCF4F1}" = HP Auto
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240D3}" = WinZip 16.5
"{D3A775F2-2674-4452-8D80-1FC1446052EE}" = Face Recognition for HP ProtectTools
"{D9355D03-2C06-401B-8A16-F6500379AE21}" = HP Power Assistant
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"FCEC33AD40CEA5E0FC4CEE6E42041A0DA189652D" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"HPProtectTools" = HP ProtectTools Security Manager
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"SynTPDeinstKey" = Synaptics Pointing Device Driver
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{03046EBB-CB7C-4B98-BEFB-690EB955DA22}" = HP Setup
"{07FA4960-B038-49EB-891B-9F95930AA544}" = HP Customer Experience Enhancements
"{08D02198-001C-FB17-9280-756444349E29}" = CCC Help Portuguese
"{09F56A49-A7B1-4AAB-95B9-D13094254AD1}" = Windows Live UX Platform Language Pack
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0BE5C4DB-8EA2-483D-BD71-D7EB09040CDE}" = Windows Live UX Platform Language Pack
"{0DEA342C-15CB-4F52-97B6-06A9C4B9C06F}" = SDK
"{110A6D3A-A966-992B-173F-6D4A6A93A7F3}" = CCC Help Chinese Traditional
"{1111706F-666A-4037-7777-210328764D10}" = JavaFX 2.1.0
"{11C9A461-DD9D-4C71-85A4-6DCE7F99CC44}" = HP Wallpaper
"{122ADF8C-DDA1-480C-9936-C88F2825B265}" = Apple Application Support
"{190A7D93-3823-439C-91B9-ADCE3EC2A6A2}" = ArcSoft Webcam Sharing Manager
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{19D899D7-CF47-8DEC-4976-F8CB8DAD6C61}" = CCC Help Norwegian
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{2396EE07-88BE-67F0-229D-E46088C86AC1}" = Catalyst Control Center Graphics Previews Common
"{26604C7E-A313-4D12-867F-7C6E7820BE4C}" = JMicron Flash Media Controller Driver
"{26A24AE4-039D-4CA4-87B4-2F83217004FF}" = Java(TM) 7 Update 4
"{2A07C35B-8384-4DA4-9A95-442B6C89A073}" = Windows Live Essentials
"{2C43790E-8470-1027-82D3-DF319F3C410F}" = Intel(R) Identity Protection Technology 1.0.71.0
"{3327995E-0937-0BB1-F258-711F165E096F}" = CCC Help Japanese
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34319F1F-7CF2-4CC9-B357-1AE7D2FF3AC5}" = Windows Live
"{344A1AA2-AC8E-4741-BDB0-65B68FDA883C}" = HP SoftPaq Download Manager
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = HP Webcam Driver
"{3A53DC94-79F4-2141-772A-569A7FCD38A9}" = Catalyst Control Center
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{3F437675-F102-4866-BDE1-FFFC7B45EC0B}" = HP QuickWeb
"{4114A073-7385-4742-8A5E-A5788FAC838F}" = ArcSoft TotalMedia
"{488F0347-C4A7-4374-91A7-30818BEDA710}" = Galerie de photos Windows Live
"{48B40F85-4F69-456F-82EB-E3DCCA15E9F0}" = CCC Help Finnish
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{501B8F04-368E-A540-2E46-19A44FDF7109}" = Catalyst Control Center Profiles Mobile
"{51C7AD07-C3F6-4635-8E8A-231306D810FE}" = Cisco LEAP Module
"{531000B3-DBEE-4115-BBF3-DA48B67C053F}" = HP Software Setup
"{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"{5DF24781-FA89-2E36-3FDE-D3974BCB5675}" = CCC Help Danish
"{610C146B-F818-BD30-C0F1-7D6E46EEC025}" = CCC Help Spanish
"{6357258D-2BF9-49E7-A9EF-0C609D52C46D}" = HP ESU for Microsoft Windows 7
"{638FCD4E-0EA4-4EC2-6C06-FC1A06BAB336}" = CCC Help Korean
"{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}" = Cisco EAP-FAST Module
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{670B9685-76B4-0E94-99F8-92FCBFAF3547}" = CCC Help English
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{692C218E-34B2-1D36-670D-9AB3A8D107BC}" = CCC Help Chinese Standard
"{6A05FEDF-662E-46BF-8A25-010E3F1C9C69}" = Windows Live UX Platform Language Pack
"{6A822F2F-8C69-4095-8B18-32326C49B0ED}" = CCC Help Swedish
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6D6ADF03-B257-4EA5-BBC1-1D145AF8D514}" = File Sanitizer For HP ProtectTools
"{6DEC8BD5-7574-47FA-B080-492BBBE2FEA3}" = Windows Live Movie Maker
"{6F340107-F9AA-47C6-B54C-C3A19F11553F}" = Hewlett-Packard ACLM.NET v1.1.2.0
"{6F44AF95-3CDE-4513-AD3F-6D45F17BF324}" = HP Support Assistant
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{73FC3510-6421-40F7-9503-EDAE4D0CF70D}" = Windows Live Photo Common
"{7683B745-6060-41FD-AA75-0BBB383FEAD4}" = SweetIM for Messenger 3.7
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{774C0434-9948-4DEE-A14E-69CDD316E36C}" = Internet Explorer Toolbar 4.6 by SweetPacks
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7964AE02-9127-42C0-A917-2CE4CD4EFE3B}" = Nokia Suite
"{7A6B4340-7090-418F-8976-EE9650B35550}" = HP Connection Manager
"{7C62B5F1-938A-50F9-78AF-4143E9604507}" = CCC Help Czech
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DC069E7-893C-41E1-9442-DE89FEC33371}" = Xobni Core
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISER_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISER_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISER_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISER_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISER_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0407-1000-0000000FF1CE}_ENTERPRISER_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISER_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{91120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{96F82870-A977-2AE6-BAF0-04B143412099}" = CCC Help Hungarian
"{99BBECCE-5865-B26C-912A-0B339081F799}" = Catalyst Control Center InstallProxy
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BD262D0-B788-4546-A0A5-F4F56EC3834B}" = Windows Live Photo Common
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9E48FF52-082C-4CC2-BB67-6E10D09C0431}" = Windows Live UX Platform Language Pack
"{A57025CC-5F2E-4D01-B387-06DB10500D43}" = Nokia Connectivity Cable Driver
"{A60B3BF0-954B-42AF-B8D8-2C1D34B613AA}" = Windows Live Photo Gallery
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{ADC70B7A-530B-46E3-8384-48D22681A41E}" = Theft Recovery for HP ProtectTools
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{AF6EB833-D48A-49AC-9394-4C57489FDFF2}" = HP Software Framework
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1525FFC-6691-BCC7-CBFF-CDCF47BC606C}" = CCC Help Greek
"{B2506DF2-78E6-8C09-A40D-EA92DB0FA5F0}" = CCC Help Russian
"{B6B16F49-0533-8772-7C20-09C241847185}" = CCC Help Turkish
"{B78F6C6D-3EFB-B64D-FE49-C6318FDD116E}" = CCC Help German
"{B975C052-531D-97C0-AB47-EB6BA7620887}" = Catalyst Control Center Localization All
"{BD1A34C9-4764-4F79-AE1F-112F8C89D3D4}" = Energy Star Digital Logo
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C33240AB-1F4B-4DE2-B1C7-54E0A182BB5D}" = Catalyst Control Center - Branding
"{C3A32068-8AB1-4327-BB16-BED9C6219DC7}" = Atheros Driver Installation Program
"{C6A49140-A2D9-4CA4-BB92-2E1C8CBB6E16}" = HP Documentation
"{C7DF9961-9EB4-B130-D201-BE71591673F9}" = CCC Help French
"{C893D8C0-1BA0-4517-B11C-E89B65E72F70}" = Windows Live Photo Common
"{C97CC14E-4789-4FC5-BC75-79191F7CE009}" = HP Hotkey Support
"{CB7224D9-6DCA-43F1-8F83-6B1E39A00F92}" = Windows Live Movie Maker
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D2131BFA-A0D6-4FDE-8614-75B07A9B15EE}" = Windows Live UX Platform Language Pack
"{D2A2E5CD-801A-4B8D-8119-F79449A09B67}" = HP System Default Settings
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DA5B2BDC-F654-4A88-A669-4D34BC7846A1}" = PC Connectivity Solution
"{DB94388C-62E9-570D-2BD6-90864F7E1282}" = PX Profile Update
"{DEF91E0F-D266-453D-B6F2-1BA002B40CB6}" = Windows Live Essentials
"{DF2035BE-5820-4965-BD97-7FAF8D4A7879}" = Microsoft_VC90_CRT_x86
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E328DF8F-CD40-DE5A-E9D0-4367EBA5BD25}" = CCC Help Thai
"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio
"{E3B64CC5-C011-40C0-92BC-7316CD5E5688}" = Microsoft_VC100_CRT_SP1_x86
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E7EA2C61-4E65-AD62-B151-D517F37AFB80}" = CCC Help Polish
"{EAD66E57-B386-DB10-29F9-A5A75BC60952}" = CCC Help Dutch
"{ED16B700-D91F-44B0-867C-7EB5253CA38D}" = Raccolta foto di Windows Live
"{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}" = Cisco PEAP Module
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}" = Sony PC Companion 2.10.079
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F761359C-9CED-45AE-9A51-9D6605CD55C4}" = Evernote v. 4.2.2
"{F7E7F0CB-AA41-4D5A-B6F2-8E6738EB063F}" = Realtek Ethernet Controller All-In-One Windows Driver
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FD53BD91-BAA5-2F85-315D-CD3816A280A6}" = CCC Help Italian
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FF3DFA01-1E98-46B4-A065-DA8AD47C9598}" = Windows Live Movie Maker
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"ArcSoft TotalMedia" = ArcSoft TotalMedia
"Avira AntiVir Desktop" = Avira Free Antivirus
"Azureus" = Azureus
"BitTorrent" = BitTorrent
"BrowserCompanion" = BrowserCompanion
"DealPly" = DealPly
"ENTERPRISER" = Microsoft Office Enterprise 2007
"InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"InstallShield_{ADC70B7A-530B-46E3-8384-48D22681A41E}" = Theft Recovery for HP ProtectTools
"MPE" = MyPhoneExplorer
"Nokia Suite" = Nokia Suite
"PDF Complete" = PDF Complete Special Edition
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"TeamViewer 7" = TeamViewer 7
"Update Engine" = Sony Ericsson Update Engine
"vfd-ob" = VideoFileDownload
"VIP Access SDK" = VIP Access SDK x64(1.0.0.50) 
"win2day Poker " = win2day Poker
"WinLiveSuite" = Windows Live Essentials
"XobniMain" = Xobni
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 03.08.2012 07:06:25 | Computer Name = Toni-HP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 12254425
 
Error - 03.08.2012 07:34:44 | Computer Name = Toni-HP | Source = WinMgmt | ID = 10
Description = 
 
Error - 03.08.2012 08:51:26 | Computer Name = Toni-HP | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 9.0.8112.16447 kann nicht mehr unter
 Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf 
in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem
 zu suchen.    Prozess-ID: 19d4    Startzeit: 01cd71769ef661e6    Endzeit: 1    Anwendungspfad: 
C:\Program Files (x86)\Internet Explorer\iexplore.exe    Berichts-ID:   
 
Error - 03.08.2012 09:31:53 | Computer Name = Toni-HP | Source = Bonjour Service | ID = 100
Description = ERROR: mDNSPlatformReadTCP - recv: 10053 
 
Error - 03.08.2012 09:31:53 | Computer Name = Toni-HP | Source = Bonjour Service | ID = 100
Description = 472: ERROR: read_msg errno 0 (Der Vorgang wurde erfolgreich beendet.)
 
Error - 03.08.2012 09:32:08 | Computer Name = Toni-HP | Source = WinMgmt | ID = 10
Description = 
 
Error - 03.08.2012 09:41:50 | Computer Name = Toni-HP | Source = WinMgmt | ID = 10
Description = 
 
Error - 03.08.2012 11:52:39 | Computer Name = Toni-HP | Source = WinMgmt | ID = 10
Description = 
 
Error - 05.08.2012 00:25:30 | Computer Name = Toni-HP | Source = WinMgmt | ID = 10
Description = 
 
Error - 05.08.2012 13:46:20 | Computer Name = Toni-HP | Source = Avira Antivirus | ID = 4118
Description = AUSNAHMEFEHLER beim Aufruf der Funktion AVEPROC_TestFile() für die
 Datei  C:\Users\Toni\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\CXKTF6FG\267785_2231861002819_7352197_s[1].jpg.

 [ACCESS_VIOLATION Exception!! EIP = 0x1e36d12]   Bitte Avira informieren und die 
obige Datei übersenden!
 
[ Hewlett-Packard Events ]
Error - 10.05.2012 15:47:23 | Computer Name = Toni-HP | Source = HPSF.exe | ID = 2000
Description = HP Error ID: -2147467261   bei HP.SupportAssistant.Common.CustomerExperience.HPSASession.AddNavigationProperties()
Message:
 Der Objektverweis wurde nicht auf eine Objektinstanz festgelegt.  StackTrace:   bei
 HP.SupportAssistant.Common.CustomerExperience.HPSASession.AddNavigationProperties()
Source:
 HP.SupportAssistant.Common    Name: HPSF.exe  Version: 06.00.01.01  Path: C:\Program Files
 (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe  Format: de-DE  RAM: 8126  Ram Utilization:
   TargetSite: HP.SupportFramework.HPSFReporting._Property[] AddNavigationProperties()

 
Error - 10.05.2012 15:51:29 | Computer Name = Toni-HP | Source = HPSF.exe | ID = 4000
Description = 
 
Error - 11.05.2012 00:08:54 | Computer Name = Toni-HP | Source = HPSF.exe | ID = 4000
Description = 
 
Error - 11.05.2012 00:09:14 | Computer Name = Toni-HP | Source = HPSF.exe | ID = 4000
Description = 
 
Error - 11.05.2012 00:17:47 | Computer Name = Toni-HP | Source = HPSF.exe | ID = 4000
Description = HP Error ID: -2147467261HPSF.exe   bei HP.SupportFramework.Communicator.MessengerComm.MessengerPublisher.closeConnection()

   bei HP.SupportAssistant.UI.MessengerCommunication.initializeCommunication()    
 bei HP.SupportAssistant.UI.MessengerCommunication.sendTimerUpdate()  Message: Der
 Objektverweis wurde nicht auf eine Objektinstanz festgelegt.  StackTrace:   bei HP.SupportFramework.Communicator.MessengerComm.MessengerPublisher.closeConnection()

   bei HP.SupportAssistant.UI.MessengerCommunication.initializeCommunication()    
 bei HP.SupportAssistant.UI.MessengerCommunication.sendTimerUpdate()  Source: HP.SupportFramework.Communicator

Name:
 HPSF.exe  Version: 06.00.01.01  Path: C:\Program Files (x86)\Hewlett-Packard\HP Support
 Framework\HPSF.exe  Format: de-DE  RAM: 8126  Ram Utilization: 30  TargetSite: Void closeConnection()

 
Error - 11.05.2012 00:23:47 | Computer Name = Toni-HP | Source = HPSF.exe | ID = 4000
Description = HP Error ID: -2147467261HPSF.exe   bei HP.SupportFramework.Communicator.MessengerComm.MessengerPublisher.closeConnection()

   bei HP.SupportAssistant.UI.MessengerCommunication.initializeCommunication()    
 bei HP.SupportAssistant.UI.MessengerCommunication.sendTimerUpdate()  Message: Der
 Objektverweis wurde nicht auf eine Objektinstanz festgelegt.  StackTrace:   bei HP.SupportFramework.Communicator.MessengerComm.MessengerPublisher.closeConnection()

   bei HP.SupportAssistant.UI.MessengerCommunication.initializeCommunication()    
 bei HP.SupportAssistant.UI.MessengerCommunication.sendTimerUpdate()  Source: HP.SupportFramework.Communicator

Name:
 HPSF.exe  Version: 06.00.01.01  Path: C:\Program Files (x86)\Hewlett-Packard\HP Support
 Framework\HPSF.exe  Format: de-DE  RAM: 8126  Ram Utilization: 30  TargetSite: Void closeConnection()

 
[ HP Connection Manager Events ]
Error - 15.08.2012 01:51:44 | Computer Name = Toni-HP | Source = hpCMSrv | ID = 5
Description = 2012/08/15 07:51:44.210|000013F4|Error      |CWLAN::SignalStrengthChanged|Fire_SignalStrengthChanged
 failed [hr:0x800706BA]
 
Error - 16.08.2012 00:54:29 | Computer Name = Toni-HP | Source = hpCMSrv | ID = 5
Description = 2012/08/16 06:54:29.162|00001290|Error      |CWLAN::SignalStrengthChanged|Fire_SignalStrengthChanged
 failed [hr:0x800706BA]
 
Error - 16.08.2012 00:54:52 | Computer Name = Toni-HP | Source = hpCMSrv | ID = 5
Description = 2012/08/16 06:54:52.265|00001290|Error      |CWLAN::SignalStrengthChanged|Fire_SignalStrengthChanged
 failed [hr:0x800706BA]
 
Error - 17.08.2012 00:53:32 | Computer Name = Toni-HP | Source = hpCMSrv | ID = 5
Description = 2012/08/17 06:53:32.218|000013D4|Error      |CWLAN::SignalStrengthChanged|Fire_SignalStrengthChanged
 failed [hr:0x800706BA]
 
Error - 17.08.2012 09:04:21 | Computer Name = Toni-HP | Source = hpMobile | ID = 5
Description = 2012.08.17 15:04:21.204|00001154|Error      |[HP.Mobile]Wlan::UpdateProperties{void()}|Die
 Daten sind unzulässig. (Ausnahme von HRESULT: 0x8007000D)
 
Error - 18.08.2012 07:40:46 | Computer Name = Toni-HP | Source = hpCMSrv | ID = 5
Description = 2012/08/18 13:40:46.373|000016BC|Error      |CWLAN::SignalStrengthChanged|Fire_SignalStrengthChanged
 failed [hr:0x800706BA]
 
Error - 18.08.2012 07:40:50 | Computer Name = Toni-HP | Source = hpCMSrv | ID = 5
Description = 2012/08/18 13:40:50.554|000016BC|Error      |CWLAN::SignalStrengthChanged|Fire_SignalStrengthChanged
 failed [hr:0x800706BA]
 
Error - 19.08.2012 03:22:57 | Computer Name = Toni-HP | Source = hpCMSrv | ID = 5
Description = 2012/08/19 09:22:57.254|0000117C|Error      |CWLAN::SignalStrengthChanged|Fire_SignalStrengthChanged
 failed [hr:0x800706BA]
 
Error - 19.08.2012 03:23:01 | Computer Name = Toni-HP | Source = hpCMSrv | ID = 5
Description = 2012/08/19 09:23:01.104|0000117C|Error      |CWLAN::SignalStrengthChanged|Fire_SignalStrengthChanged
 failed [hr:0x800706BA]
 
Error - 19.08.2012 14:27:08 | Computer Name = Toni-HP | Source = hpCMSrv | ID = 5
Description = 2012/08/19 20:27:08.399|00000D80|Error      |CWLAN::SignalStrengthChanged|Fire_SignalStrengthChanged
 failed [hr:0x800706BA]
 
[ HP Power Assistant Events ]
Error - 03.08.2012 03:03:02 | Computer Name = Toni-HP | Source = HP PA Application | ID = 1020
Description = An error occured in HP Power Assistant application, module [HPPA_Main].
Please
 restart HP Power Assistant application. Additional details may be available in the
 Details section.    DETAILS   Power Control Settings: registry Threshold contains an 
invalid value: 0
 
Error - 03.08.2012 07:36:40 | Computer Name = Toni-HP | Source = HP PA Application | ID = 1020
Description = An error occured in HP Power Assistant application, module [HPPA_Main].
Please
 restart HP Power Assistant application. Additional details may be available in the
 Details section.    DETAILS   Power Control Settings: registry Threshold contains an 
invalid value: 0
 
Error - 03.08.2012 09:34:08 | Computer Name = Toni-HP | Source = HP PA Application | ID = 1020
Description = An error occured in HP Power Assistant application, module [HPPA_Main].
Please
 restart HP Power Assistant application. Additional details may be available in the
 Details section.    DETAILS   Power Control Settings: registry Threshold contains an 
invalid value: 0
 
Error - 03.08.2012 09:43:56 | Computer Name = Toni-HP | Source = HP PA Application | ID = 1020
Description = An error occured in HP Power Assistant application, module [HPPA_Main].
Please
 restart HP Power Assistant application. Additional details may be available in the
 Details section.    DETAILS   Power Control Settings: registry Threshold contains an 
invalid value: 0
 
Error - 03.08.2012 11:54:46 | Computer Name = Toni-HP | Source = HP PA Application | ID = 1020
Description = An error occured in HP Power Assistant application, module [HPPA_Main].
Please
 restart HP Power Assistant application. Additional details may be available in the
 Details section.    DETAILS   Power Control Settings: registry Threshold contains an 
invalid value: 0
 
Error - 05.08.2012 00:27:24 | Computer Name = Toni-HP | Source = HP PA Application | ID = 1020
Description = An error occured in HP Power Assistant application, module [HPPA_Main].
Please
 restart HP Power Assistant application. Additional details may be available in the
 Details section.    DETAILS   Power Control Settings: registry Threshold contains an 
invalid value: 0
 
Error - 06.08.2012 14:08:01 | Computer Name = Toni-HP | Source = HP PA Application | ID = 1020
Description = An error occured in HP Power Assistant application, module [HPPA_Main].
Please
 restart HP Power Assistant application. Additional details may be available in the
 Details section.    DETAILS   Power Control Settings: registry Threshold contains an 
invalid value: 0
 
Error - 07.08.2012 00:19:40 | Computer Name = Toni-HP | Source = HP PA Application | ID = 1020
Description = An error occured in HP Power Assistant application, module [HPPA_Main].
Please
 restart HP Power Assistant application. Additional details may be available in the
 Details section.    DETAILS   Power Control Settings: registry Threshold contains an 
invalid value: 0
 
Error - 07.08.2012 11:54:16 | Computer Name = Toni-HP | Source = HP PA Application | ID = 1020
Description = An error occured in HP Power Assistant application, module [HPPA_Main].
Please
 restart HP Power Assistant application. Additional details may be available in the
 Details section.    DETAILS   Power Control Settings: registry Threshold contains an 
invalid value: 0
 
Error - 08.08.2012 11:27:13 | Computer Name = Toni-HP | Source = HP PA Application | ID = 1020
Description = An error occured in HP Power Assistant application, module [HPPA_Main].
Please
 restart HP Power Assistant application. Additional details may be available in the
 Details section.    DETAILS   Power Control Settings: registry Threshold contains an 
invalid value: 0
 
[ HP Software Framework Events ]
Error - 14.06.2012 03:46:44 | Computer Name = Toni-HP | Source = Casl | ID = 5
Description = 2012.06.14 09:46:44.249|00000454|Error      |[CaslWmi]A::A{bool(object,object)}|Error
 invoking subscriber delegate. Exception: No handler registered for event, Wireless.GlobalChanged
 
Error - 14.06.2012 03:46:44 | Computer Name = Toni-HP | Source = Casl | ID = 5
Description = 2012.06.14 09:46:44.374|000016D8|Error      |[CaslWmi]A::A{bool(object,object)}|Error
 invoking subscriber delegate. Exception: No handler registered for event, Wireless.GlobalChanged.2.0
 
Error - 14.06.2012 03:47:49 | Computer Name = Toni-HP | Source = Casl | ID = 5
Description = 2012.06.14 09:47:49.388|00001A08|Error      |[CaslWmi]A::A{bool(object,object)}|Error
 invoking subscriber delegate. Exception: No handler registered for event, Wireless.GlobalChanged
 
Error - 14.06.2012 03:47:49 | Computer Name = Toni-HP | Source = Casl | ID = 5
Description = 2012.06.14 09:47:49.458|000016D8|Error      |[CaslWmi]A::A{bool(object,object)}|Error
 invoking subscriber delegate. Exception: No handler registered for event, Wireless.GlobalChanged.2.0
 
Error - 14.06.2012 03:47:49 | Computer Name = Toni-HP | Source = Casl | ID = 5
Description = 2012.06.14 09:47:49.538|00001A08|Error      |[CaslWmi]A::A{bool(object,object)}|Error
 invoking subscriber delegate. Exception: No handler registered for event, Wireless.GlobalChanged
 
Error - 14.06.2012 03:47:49 | Computer Name = Toni-HP | Source = Casl | ID = 5
Description = 2012.06.14 09:47:49.598|00001474|Error      |[CaslWmi]A::A{bool(object,object)}|Error
 invoking subscriber delegate. Exception: No handler registered for event, Wireless.GlobalChanged.2.0
 
Error - 14.06.2012 03:55:41 | Computer Name = Toni-HP | Source = CaslWmi | ID = 5
Description = 2012.06.14 09:55:41.523|0000155C|Error      |[CaslWmi]CommandFolio::A{hpCasl.enReturnCode(int&)}|Error
 0xe_BIOS_INVALID_COMMAND_TYPE from BIOS WMI call Read/2Eh while getting Folio state
 
Error - 09.07.2012 12:23:45 | Computer Name = Toni-HP | Source = CaslSmBios | ID = 5
Description = 2012.07.09 18:23:45.151|00000FC8|Error      |[CaslWmi]CommandPanelBrightness::GetCurrentPanelBrightnessFromOS{hpCasl.enReturnCode(CaslWmi.enPanelBrightnessDataType,ushort&)}|Exception
 occurred in querying WMI for WmiMonitorBrightness: 'Nicht unterstützt '
 
Error - 09.07.2012 12:23:56 | Computer Name = Toni-HP | Source = CaslSmBios | ID = 5
Description = 2012.07.09 18:23:56.788|0000171C|Error      |[CaslWmi]CommandPanelBrightness::GetCurrentPanelBrightnessFromOS{hpCasl.enReturnCode(CaslWmi.enPanelBrightnessDataType,ushort&)}|Exception
 occurred in querying WMI for WmiMonitorBrightness: 'Nicht unterstützt '
 
Error - 09.07.2012 12:24:09 | Computer Name = Toni-HP | Source = CaslSmBios | ID = 5
Description = 2012.07.09 18:24:09.881|00000C0C|Error      |[CaslWmi]CommandPanelBrightness::GetCurrentPanelBrightnessFromOS{hpCasl.enReturnCode(CaslWmi.enPanelBrightnessDataType,ushort&)}|Exception
 occurred in querying WMI for WmiMonitorBrightness: 'Nicht unterstützt '
 
[ System Events ]
Error - 03.08.2012 09:29:08 | Computer Name = Toni-HP | Source = DCOM | ID = 10010
Description = 
 
Error - 03.08.2012 09:38:45 | Computer Name = Toni-HP | Source = DCOM | ID = 10010
Description = 
 
Error - 03.08.2012 10:57:12 | Computer Name = Toni-HP | Source = DCOM | ID = 10010
Description = 
 
Error - 03.08.2012 11:52:53 | Computer Name = Toni-HP | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
 XobniService erreicht.
 
Error - 03.08.2012 11:52:53 | Computer Name = Toni-HP | Source = Service Control Manager | ID = 7000
Description = Der Dienst "XobniService" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%1053
 
Error - 04.08.2012 00:44:39 | Computer Name = Toni-HP | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
 von Dienst Schedule erreicht.
 
Error - 04.08.2012 11:06:52 | Computer Name = Toni-HP | Source = DCOM | ID = 10010
Description = 
 
Error - 06.08.2012 00:48:35 | Computer Name = Toni-HP | Source = DCOM | ID = 10010
Description = 
 
Error - 06.08.2012 14:27:22 | Computer Name = Toni-HP | Source = DCOM | ID = 10010
Description = 
 
Error - 07.08.2012 00:49:21 | Computer Name = Toni-HP | Source = DCOM | ID = 10010
Description = 
 
 
< End of report >
         
--- --- ---

Alt 20.08.2012, 21:01   #2
t'john
/// Helfer-Team
 
Polizeivirus Österreich, 20.08.12 - Standard

Polizeivirus Österreich, 20.08.12





Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

  • Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
  • Starte die OTL.exe.
    Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
  • Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:


Code:
ATTFilter
:OTL
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} 
IE:64bit: - HKLM\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = http://eu.ask.com/web?q={searchterms}&l=dis&o=CMNTDF 
IE:64bit: - HKLM\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = http://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CMNTDF 
IE:64bit: - HKLM\..\SearchScopes\{ec29edf6-ad3c-4e1c-a087-d6cb81400c43}: "URL" = http://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4 
IE - HKLM\..\SearchScopes,DefaultScope = {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} 
IE - HKLM\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = http://eu.ask.com/web?q={searchterms}&l=dis&o=CMNTDF 
IE - HKLM\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = http://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CMNTDF 
IE - HKLM\..\SearchScopes\{ec29edf6-ad3c-4e1c-a087-d6cb81400c43}: "URL" = http://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\S-1-5-21-2962388088-3790687715-1872597749-1001\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} 
IE - HKU\S-1-5-21-2962388088-3790687715-1872597749-1001\..\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}: "URL" = http://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4 
IE - HKU\S-1-5-21-2962388088-3790687715-1872597749-1001\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}&affID=112843&tt=060612_6_&babsrc=SP_ss&mntrId=a20a507b0000000000009cb70d7e8eaa 
IE - HKU\S-1-5-21-2962388088-3790687715-1872597749-1001\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = http://eu.ask.com/web?q={searchterms}&l=dis&o=CMNTDF 
IE - HKU\S-1-5-21-2962388088-3790687715-1872597749-1001\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = http://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CMNTDF 
IE - HKU\S-1-5-21-2962388088-3790687715-1872597749-1001\..\SearchScopes\{ec29edf6-ad3c-4e1c-a087-d6cb81400c43}: "URL" = http://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox 
IE - HKU\S-1-5-21-2962388088-3790687715-1872597749-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\S-1-5-21-2962388088-3790687715-1872597749-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local 
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found 
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found 
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found 
O2 - BHO: (Browser Companion Helper) - {00cbb66b-1d3b-46d3-9577-323a336acb50} - C:\Program Files (x86)\BrowserCompanion\jsloader.dll ( ) 
O2 - BHO: (VideoFileDownload) - {82EA3E77-7BD2-4744-A8F2-670770767EC5} - C:\Program Files (x86)\OApps\bho_project.dll File not found 
O2 - BHO: (Browser Companion Helper Verifier) - {963B125B-8B21-49A2-A3A8-E37092276531} - C:\Program Files (x86)\BrowserCompanion\updatebhoWin32.dll ( ) 
O2 - BHO: (SweetPacks Browser Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) 
O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) 
O3 - HKU\S-1-5-21-2962388088-3790687715-1872597749-1001\..\Toolbar\WebBrowser: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) 
O4:64bit: - HKLM..\Run: [MfeEpePcMonitor] C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcMonitor.exe () 
O4 - HKLM..\Run: [] File not found 
O4 - HKU\S-1-5-21-2962388088-3790687715-1872597749-1001..\Run: [] File not found 
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found 
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 
O9:64bit: - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - Reg Error: Value error. File not found 
O18 - Protocol\Handler\base64 {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Program Files (x86)\BrowserCompanion\tdataprotocol.dll (Blabbers Communications Ltd) 
O18 - Protocol\Handler\chrome {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Program Files (x86)\BrowserCompanion\tdataprotocol.dll (Blabbers Communications Ltd) 
O18 - Protocol\Handler\prox {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Program Files (x86)\BrowserCompanion\tdataprotocol.dll (Blabbers Communications Ltd) 
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 
O32 - HKLM CDRom: AutoRun - 1 
[2012.07.29 15:43:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DealPly 
[2012.07.29 15:42:50 | 000,000,000 | ---D | C] -- C:\ProgramData\SweetIM 
[2012.08.20 19:56:49 | 004,503,728 | ---- | M] () -- C:\ProgramData\ism_0_llatsni.pad 
[2012.08.20 18:42:58 | 001,645,398 | ---- | M] () -- C:\windows\SysWow64\PerfStringBackup.INI 
[2012.08.20 18:34:19 | 000,001,893 | ---- | M] () -- C:\Users\Toni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk 
[2012.08.17 15:25:23 | 000,000,574 | ---- | M] () -- C:\Users\Toni\Desktop\daten (akusrv01) (Z) - Verknüpfung.lnk 
 
@Alternate Data Stream - 123 bytes -> C:\ProgramData\Temp:1DA424AA 
[2012.07.29 15:47:58 | 000,001,220 | ---- | C] () -- C:\prefs.js 

[2012.06.25 18:53:52 | 000,000,000 | ---D | M] -- C:\Users\Toni\AppData\Roaming\Babylon 
:Files

ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
         
  • Schließe alle Programme.
  • Klicke auf den Fix Button.
  • Wenn OTL einen Neustart verlangt, bitte zulassen.
  • Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
    Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!
__________________

__________________

Alt 21.08.2012, 05:37   #3
Toni_jun
 
Polizeivirus Österreich, 20.08.12 - Standard

Polizeivirus Österreich, 20.08.12



Guten morgen,
vielen vielen Dank hat super geklappt.
DANKE
__________________

Alt 21.08.2012, 15:57   #4
t'john
/// Helfer-Team
 
Polizeivirus Österreich, 20.08.12 - Standard

Polizeivirus Österreich, 20.08.12



Wo ist das FIx Log?

Wir sind noch nicht fertig!
__________________
Mfg, t'john
Das TB unterstützen

Alt 05.10.2012, 02:33   #5
t'john
/// Helfer-Team
 
Polizeivirus Österreich, 20.08.12 - Standard

Polizeivirus Österreich, 20.08.12



Fehlende Rückmeldung

Gibt es Probleme beim Abarbeiten obiger Anleitung?

Um Kapazitäten für andere Hilfesuchende freizumachen, lösche ich dieses Thema aus meinen Benachrichtigungen.

Solltest Du weitermachen wollen, schreibe mir eine PN oder eröffne ein neues Thema.
http://www.trojaner-board.de/69886-a...-beachten.html


Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner sauber ist.

__________________
Mfg, t'john
Das TB unterstützen

Antwort

Themen zu Polizeivirus Österreich, 20.08.12
autorun, avira, bho, bonjour, browser, dealply, error, excel, failed, firefox, flash player, helper, iexplore.exe, igdpmd64.sys, install.exe, installation, msiexec.exe, object, office 2007, programm, realtek, registry, rundll, security, software, svchost.exe, sweetim, sweetpacks, teamspeak, usb 3.0, virus, windows



Ähnliche Themen: Polizeivirus Österreich, 20.08.12


  1. Polizeivirus Österreich
    Plagegeister aller Art und deren Bekämpfung - 10.06.2013 (13)
  2. Polizeivirus Österreich
    Plagegeister aller Art und deren Bekämpfung - 04.04.2013 (17)
  3. Polizeivirus Österreich
    Alles rund um Windows - 30.03.2013 (1)
  4. Polizeivirus Österreich
    Log-Analyse und Auswertung - 07.02.2013 (9)
  5. Polizeivirus Österreich
    Plagegeister aller Art und deren Bekämpfung - 13.12.2012 (3)
  6. polizeivirus! österreich
    Plagegeister aller Art und deren Bekämpfung - 07.11.2012 (10)
  7. Polizeivirus (Österreich)
    Plagegeister aller Art und deren Bekämpfung - 27.10.2012 (2)
  8. Polizeivirus Österreich
    Plagegeister aller Art und deren Bekämpfung - 22.09.2012 (23)
  9. Polizeivirus Österreich
    Plagegeister aller Art und deren Bekämpfung - 14.09.2012 (11)
  10. Polizeivirus österreich
    Plagegeister aller Art und deren Bekämpfung - 09.09.2012 (2)
  11. Polizeivirus Österreich
    Plagegeister aller Art und deren Bekämpfung - 06.09.2012 (4)
  12. Polizeivirus Österreich...
    Plagegeister aller Art und deren Bekämpfung - 06.09.2012 (14)
  13. Polizeivirus Österreich
    Log-Analyse und Auswertung - 02.09.2012 (13)
  14. Polizeivirus Österreich, 20.08.12
    Plagegeister aller Art und deren Bekämpfung - 21.08.2012 (2)
  15. Polizeivirus Österreich
    Plagegeister aller Art und deren Bekämpfung - 19.08.2012 (12)
  16. Polizeivirus Österreich vom 2.8.12
    Log-Analyse und Auswertung - 16.08.2012 (49)
  17. Polizeivirus Österreich
    Plagegeister aller Art und deren Bekämpfung - 13.08.2012 (13)

Zum Thema Polizeivirus Österreich, 20.08.12 - Hallo, mein Notebook wurde nun leider auch von dem bekannten "Polizei Virus" befallen ! Wie in der Anleitung geschildert, habe ich im abgesicherten Modus einen OTL-Scan gemacht um Ihnen hier - Polizeivirus Österreich, 20.08.12...
Archiv
Du betrachtest: Polizeivirus Österreich, 20.08.12 auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.