USB Virus (auf Vista Parallels): Verknüfungen statt normale Ordner

crunschi · 16.09.2012, 15:33

Hey zusammen! Ich bin ein totaler Neuling hier. Also bitte Anfängerfehler verzeihen, wenn ich welche mache

Also, wie ich gesehen habe bin ich nicht der erste mit diesem Trojaner. Die Besonderheit ist bei mir nur, dass ich mein Windows nur über Parallels auf einem Mac OS X 10.6.8 laufen habe. In Parallels verhält sich der Virus genauso wie bei allen anderen beschrieben. In OS X werden sowohl Verknüpfungen als auch die echten Ordner angezeigt...
Ich glaube/hoffe, dass also nur die Windows Partition vom Virus betroffen ist, habe aber keine Ahnung, wie man das nachprüfen kann

Definitiv ist aber meine externe Festplatte vom Virus befallen. Und zwar komplett. D.h. die NTFS- und die Mac OS Extended (Journaled)-Partitition.
Bei beiden sollte er am besten relativ flott wieder runter, weil die meine Sicherungsfestplatte ist...

Wäre echt suuuper, wenn mir einer von euch als Experte helfen kann, den Virus zu besiegen!!
Folgende logs habe ich schon erstellt:

Malwarebytes Anti-Malware (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.03.05

Windows Vista Service Pack 2 x86 PrlSF
Internet Explorer 9.0.8112.16421
Francesco :: FRANCESCOS-PC [Administrator]

Schutz: Aktiviert

08.09.2012 11:15:18
mbam-log-2012-09-08 (16-04-56).txt

Art des Suchlaufs: Vollständiger Suchlauf (A:\|C:\|D:\|E:\|F:\|H:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 559375
Laufzeit: 3 Stunde(n), 9 Minute(n), 43 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 1
HKCU\Software\Schmidt-Pro (Trojan.Agent) -> Keine Aktion durchgeführt.

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|jiiad (Heuristics.Shuriken) -> Daten: C:\Users\Francesco\jiiad.exe /W -> Keine Aktion durchgeführt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Users\Francesco\jiiad.exe (Heuristics.Shuriken) -> Keine Aktion durchgeführt.

(Ende)

.............

ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internet# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=8b0a4a3a920e764494807350087e87bd
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-09-13 12:55:51
# local_time=2012-09-13 02:55:51 (+0100, Mitteleurop‰ische Sommerzeit )
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1792 16777215 100 0 65839079 65839079 0 0
# compatibility_mode=5892 16776573 100 100 25942 185011393 0 0
# compatibility_mode=8192 67108863 100 0 30291 30291 0 0
# compatibility_mode=9217 16777214 25 15 136009144 136017896 0 0
# scanned=556402
# found=4
# cleaned=0
# scan_time=19211
C:\Users\Francesco\xeixue.exe Win32/AutoRun.AFI worm (unable to clean) 00000000000000000000000000000000 I
G:\xeixue.exe Win32/AutoRun.AFI worm (unable to clean) 00000000000000000000000000000000 I
G:\xeixuex.exe Win32/AutoRun.AFI worm (unable to clean) 00000000000000000000000000000000 I
${Memory} Win32/AutoRun.AFI worm 00000000000000000000000000000000 I
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=8b0a4a3a920e764494807350087e87bd
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-09-13 10:22:01
# local_time=2012-09-13 12:22:01 (+0100, Mitteleurop‰ische Sommerzeit )
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1792 16777215 100 0 65874762 65874762 0 0
# compatibility_mode=5892 16776573 100 100 61625 185047076 0 0
# compatibility_mode=8192 67108863 100 0 65974 65974 0 0
# compatibility_mode=9217 16777214 25 15 136044827 136053579 0 0
# scanned=593884
# found=3
# cleaned=0
# scan_time=17498
G:\autorun.inf Win32/AutoRun.VB.ADE worm (unable to clean) 00000000000000000000000000000000 I
G:\xeixue.exe Win32/AutoRun.AFI worm (unable to clean) 00000000000000000000000000000000 I
G:\xeixuex.exe Win32/AutoRun.AFI worm (unable to clean) 00000000000000000000000000000000 I

Was soll ich als nächstes machen?
Vielen vielen Dank schonmal!!!

cosinus · 17.09.2012, 13:33

Code:

ATTFilter

Datenbank Version: v2012.07.03.05

Ein Scan mit so alten Signaturen ist fast wirkungslos und damit sinnfrei.
Bitte den Vollscan mit aktuellen Signaturen wiederholen

crunschi · 20.09.2012, 17:06

ok, danke für den Hinweis! Hab nochmal einen durchgeführt, aber komischerweise hat er diesmal garnichts mehr gefunden (s.u.).

Beim Öffnen von Malwarebytes kam eine Fehlermeldung, die ich angehängt habe... das hat nichts gutes zu bedeuten oder?

seit neuestem kommt bei mir auf der google-startseite auch ein kleines werbefenster mit werbevideos...kann das mit dem trojaner zusammenhängen?

Malwarebytes Anti-Malware (Test) 1.65.0.1400
www.malwarebytes.org

Datenbank Version: v2012.09.07.13

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Francesco :: FRANCESCOS-PC [Administrator]

Schutz: Aktiviert

19.09.2012 15:27:16
mbam-log-2012-09-19 (15-27-16).txt

Art des Suchlaufs: Vollständiger Suchlauf (A:\|C:\|D:\|E:\|F:\|G:\|H:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 599702
Laufzeit: 4 Stunde(n), 20 Minute(n), 39 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Was soll ich als nächstes tun?
Danke!!

cosinus · 20.09.2012, 20:23

adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Falls der adwCleaner schon mal in der runtergeladen wurde, bitte die alte adwcleaner.exe löschen und neu runterladen!!

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Suche.
Nach Ende des Suchlaufs öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[Rx].txt. (x=fortlaufende Nummer)

crunschi · 21.09.2012, 02:17

# AdwCleaner v2.002 - Datei am 09/21/2012 um 02:56:00 erstellt
# Aktualisiert am 16/09/2012 von Xplode
# Betriebssystem : Windows Vista (TM) Ultimate Service Pack 2 (32 bits)
# Benutzer : Francesco - FRANCESCOS-PC
# Bootmodus : Normal
# Ausgeführt unter : \\psf\Home\Desktop\adwcleaner.exe
# Option [Suche]

**** [Dienste] ****

***** [Dateien / Ordner] *****

***** [Registrierungsdatenbank] *****

Schlüssel Gefunden : HKCU\Software\Softonic

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v3.6.10 (de)

Profilname : default
Datei : C:\Users\Francesco\AppData\Roaming\Mozilla\Firefox\Profiles\soeukzx3.default\prefs.js

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [934 octets] - [21/09/2012 02:54:33]
AdwCleaner[R2].txt - [864 octets] - [21/09/2012 02:56:00]

########## EOF - C:\AdwCleaner[R2].txt - [923 octets] ##########

...habe dann auf "Löschen" geklickt, weil das Programm mir das vorgeschlagen hat. Ich hoffe, dass war kein Fehler?

cosinus · 21.09.2012, 14:58

adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen

Schließe alle offenen Programme und Browser.
Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Löschen.
Bestätige jeweils mit Ok.
Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[Sx].txt. (x=fortlaufende Nummer)

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

ATTFilter

 hier steht das Log

crunschi · 22.09.2012, 06:16

Code:

ATTFilter

 # AdwCleaner v2.002 - Datei am 09/21/2012 um 02:57:42 erstellt
# Aktualisiert am 16/09/2012 von Xplode
# Betriebssystem : Windows Vista (TM) Ultimate Service Pack 2 (32 bits)
# Benutzer : Francesco - FRANCESCOS-PC
# Bootmodus : Normal
# Ausgef¸hrt unter : \\psf\Home\Desktop\adwcleaner.exe
# Option [Lˆschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****


***** [Registrierungsdatenbank] *****

Schl¸ssel Gelˆscht : HKCU\Software\Softonic

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

Wiederhergestellt : [HKCU\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

-\\ Mozilla Firefox v3.6.10 (de)

Profilname : default 
Datei : C:\Users\Francesco\AppData\Roaming\Mozilla\Firefox\Profiles\soeukzx3.default\prefs.js

C:\Users\Francesco\AppData\Roaming\Mozilla\Firefox\Profiles\soeukzx3.default\user.js ... Gelˆscht !

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [934 octets] - [21/09/2012 02:54:33]
AdwCleaner[R2].txt - [991 octets] - [21/09/2012 02:56:00]
AdwCleaner[S1].txt - [1471 octets] - [21/09/2012 02:57:42]

########## EOF - C:\AdwCleaner[S1].txt - [1531 octets] ##########

das Problem ist, dass die Werbung auf dem Firefox von Mac auftaucht... Ich denke, das Programm hat das, weil für Windows, nicht geprüft...?

cosinus · 22.09.2012, 17:06

Hätte da mal zwei Fragen bevor es weiter geht (wir sind noch nicht fertig!)

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

crunschi · 23.09.2012, 15:33

Kann beides mit Ja beantworten. Fragt sich nur, ob das jetzt gut ist

wie gehts weiter?

cosinus · 23.09.2012, 18:25

Wieso beides mit ja, vermisst du denn was im Startmenü, ist da alles weg?

crunschi · 24.09.2012, 12:23

oh sorry, hatte die Frage ungenau gelesen:
1) jap, hatte da bisher noch keine Probleme
2) ich vermisse nichts im Startmenü, aber es gibt dort einige leere Ordner von Programmen, die ich schon lange deinstalliert habe. Aber diese Ordner sind zusätzlich zu den normalen und ich bin mir ehrlich gesagt nicht sicher, ob die nicht schon vor dem Trojaner da waren...benutze das Startmenü nur ganz selten...

cosinus · 24.09.2012, 18:43

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

ATTFilter

 hier steht das Log

CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die Textbox von OTL - wenn OTL auf deutsch ist wird sie mit beschriftet

Code:

ATTFilter

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf .
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

crunschi · 26.09.2012, 07:39

OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 26.09.2012 07:03:54 - Run 1
OTL by OldTimer - Version 3.2.68.0     Folder = \\psf\Home\Desktop
Windows Vista Ultimate Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1022,84 Mb Total Physical Memory | 450,25 Mb Available Physical Memory | 44,02% Memory free
2,26 Gb Paging File | 1,51 Gb Available in Paging File | 66,87% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 69,77 Gb Total Space | 8,10 Gb Free Space | 11,61% Space Free | Partition Type: NTFS
Drive D: | 15,47 Gb Total Space | 11,25 Gb Free Space | 72,71% Space Free | Partition Type: NTFS
 
Computer Name: FRANCESCOS-PC | User Name: Francesco | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.09.25 04:28:33 | 000,602,112 | ---- | M] (OldTimer Tools) -- \\psf\Home\Desktop\OTL.exe
PRC - [2012.09.07 17:04:46 | 000,676,936 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.09.07 17:04:46 | 000,399,432 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2012.09.07 17:04:44 | 000,766,536 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2011.09.14 02:04:22 | 000,028,488 | ---- | M] (Parallels Holdings, Ltd. and its affiliates.) -- C:\Program Files\Parallels\Parallels Tools\Services\coherence.exe
PRC - [2011.09.14 02:03:32 | 000,131,912 | ---- | M] (Parallels Holdings, Ltd. and its affiliates.) -- C:\Program Files\Parallels\Parallels Tools\SIA\SharedIntApp.exe
PRC - [2011.09.14 02:03:24 | 000,186,696 | ---- | M] (Parallels Holdings, Ltd. and its affiliates.) -- C:\Program Files\Parallels\Parallels Tools\Services\prl_tools_service.exe
PRC - [2011.09.14 02:03:22 | 000,203,592 | ---- | M] (Parallels Holdings, Ltd. and its affiliates.) -- C:\Program Files\Parallels\Parallels Tools\Services\prl_tools.exe
PRC - [2011.09.14 02:02:58 | 000,201,544 | ---- | M] (Parallels Holdings, Ltd. and its affiliates.) -- C:\Program Files\Parallels\Parallels Tools\prl_cc.exe
PRC - [2011.03.31 17:08:14 | 000,080,896 | ---- | M] () -- C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe
PRC - [2010.12.21 02:07:48 | 000,227,712 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.01.19 09:38:38 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe
PRC - [2007.09.20 16:05:06 | 000,589,824 | ---- | M] ( ) -- C:\Windows\System32\lxdocoms.exe
PRC - [2007.09.06 16:38:58 | 000,450,560 | ---- | M] () -- C:\Program Files\Lexmark 9500 Series\lxdomon.exe
PRC - [2007.08.10 02:11:54 | 000,020,480 | ---- | M] () -- C:\Program Files\Lexmark 9500 Series\lxdoamon.exe
PRC - [2007.07.17 08:26:04 | 000,094,208 | ---- | M] (Lexmark International, Inc.) -- C:\Windows\System32\spool\drivers\w32x86\3\lxdoserv.exe
PRC - [2007.06.27 11:15:34 | 000,752,136 | ---- | M] (Dritek System Inc.) -- C:\Program Files\Launch Manager\LManager.exe
PRC - [2007.04.11 10:30:34 | 000,030,800 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
PRC - [2007.04.11 10:30:06 | 000,026,704 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe
PRC - [2007.01.26 15:24:42 | 000,050,688 | ---- | M] () -- C:\Acer\ALaunch\ALaunchSvc.exe
PRC - [2006.11.02 11:45:59 | 000,215,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\WindowsMobile\wmdSync.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.06.15 13:22:14 | 012,433,920 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\f2691cfa7671cdc58179e56ba9227591\System.Windows.Forms.ni.dll
MOD - [2012.06.15 13:22:04 | 001,592,320 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\18f9789aa214c657113e676b3a9015aa\System.Drawing.ni.dll
MOD - [2012.05.11 18:56:22 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bd76aaaa03ddc15d1840207b5a480644\System.Configuration.ni.dll
MOD - [2012.05.11 18:54:32 | 005,450,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d2630342a066a7cb9056d9eb6157687a\System.Xml.ni.dll
MOD - [2012.05.11 18:48:23 | 007,953,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\28d633338fc8d29f8af31935ef7d001b\System.ni.dll
MOD - [2012.05.11 18:47:16 | 011,492,352 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\af9c9e9d7e0523cd444f8b551baa9cbf\mscorlib.ni.dll
MOD - [2011.09.14 02:04:04 | 000,322,376 | ---- | M] () -- C:\Program Files\Parallels\Parallels Tools\Plugins\SharedGuestApps.dll
MOD - [2011.09.14 02:04:00 | 000,184,136 | ---- | M] () -- C:\Program Files\Parallels\Parallels Tools\Plugins\DragAndDrop.dll
MOD - [2011.09.14 02:03:58 | 000,160,072 | ---- | M] () -- C:\Program Files\Parallels\Parallels Tools\Plugins\DesktopUtilities.dll
MOD - [2011.09.14 02:03:56 | 000,128,840 | ---- | M] () -- C:\Program Files\Parallels\Parallels Tools\Plugins\CopyPasteTool.dll
MOD - [2011.09.14 02:03:54 | 000,120,136 | ---- | M] () -- C:\Program Files\Parallels\Parallels Tools\Plugins\CEPTool.dll
MOD - [2009.03.30 06:42:11 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2007.10.08 04:59:26 | 000,036,864 | ---- | M] () -- C:\Program Files\Lexmark 9500 Series\app4r.monitor.core.dll
MOD - [2007.10.08 04:59:26 | 000,028,672 | ---- | M] () -- C:\Program Files\Lexmark 9500 Series\app4r.monitor.common.dll
MOD - [2007.10.08 04:58:34 | 000,057,344 | ---- | M] () -- C:\Program Files\Lexmark 9500 Series\app4r.devmons.mcmdevmon.dll
MOD - [2007.09.20 18:34:58 | 000,129,024 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll
MOD - [2007.09.06 16:38:58 | 000,450,560 | ---- | M] () -- C:\Program Files\Lexmark 9500 Series\lxdomon.exe
MOD - [2007.09.06 16:38:30 | 000,278,528 | ---- | M] () -- C:\Program Files\Lexmark 9500 Series\lxdoscw.dll
MOD - [2007.08.10 02:12:14 | 000,011,776 | ---- | M] () -- C:\Program Files\Lexmark 9500 Series\app4r.devmons.mcmdevmon.autoplayutil.dll
MOD - [2007.08.10 02:11:54 | 000,020,480 | ---- | M] () -- C:\Program Files\Lexmark 9500 Series\lxdoamon.exe
MOD - [2007.05.03 11:39:32 | 000,589,824 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\lxdodatr.dll
MOD - [2007.04.11 10:30:34 | 000,030,800 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
MOD - [2007.04.11 10:30:06 | 000,026,704 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe
MOD - [2007.03.26 03:39:36 | 000,073,728 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\lxdocats.dll
MOD - [2003.06.07 07:30:08 | 000,057,344 | ---- | M] () -- C:\Program Files\Launch Manager\PowerUtl.dll
 
 
========== Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - File not found [Auto | Stopped] -- C:\Acer\Mobility Center\MobilityService.exe -- (MobilityService)
SRV - File not found [Auto | Stopped] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - File not found [Auto | Stopped] -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe -- (AntiVirService)
SRV - File not found [Auto | Stopped] -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe -- (AntiVirScheduler)
SRV - [2012.09.07 17:04:46 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.09.07 17:04:46 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2011.09.14 02:04:22 | 000,028,488 | ---- | M] (Parallels Holdings, Ltd. and its affiliates.) [Auto | Running] -- C:\Program Files\Parallels\Parallels Tools\Services\coherence.exe -- (Parallels Coherence Service)
SRV - [2011.09.14 02:03:24 | 000,186,696 | ---- | M] (Parallels Holdings, Ltd. and its affiliates.) [Auto | Running] -- C:\Program Files\Parallels\Parallels Tools\Services\prl_tools_service.exe -- (Parallels Tools Service)
SRV - [2011.03.31 17:08:14 | 000,080,896 | ---- | M] () [Auto | Running] -- C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe -- (PassThru Service)
SRV - [2009.08.07 12:44:18 | 000,045,816 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper)
SRV - [2008.03.03 14:05:02 | 000,079,400 | ---- | M] (Check Point Software Technologies LTD) [Auto | Stopped] -- C:\Windows\System32\ZoneLabs\vsmon.exe -- (vsmon)
SRV - [2008.01.19 09:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008.01.19 09:36:49 | 000,365,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2008.01.19 09:36:15 | 000,167,936 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
SRV - [2007.09.20 16:05:06 | 000,589,824 | ---- | M] ( ) [Auto | Running] -- C:\Windows\System32\lxdocoms.exe -- (lxdo_device)
SRV - [2007.07.17 08:26:04 | 000,094,208 | ---- | M] () [Auto | Running] -- C:\Windows\System32\spool\DRIVERS\W32X86\3\\lxdoserv.exe -- (lxdoCATSCustConnectService)
SRV - [2007.02.13 06:26:50 | 000,053,248 | ---- | M] (Acer Inc.) [Disabled | Stopped] -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe -- (eRecoveryService)
SRV - [2007.01.26 15:24:42 | 000,050,688 | ---- | M] () [Auto | Running] -- C:\Acer\ALaunch\ALaunchSvc.exe -- (ALaunchService)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\SynasUSB.sys -- (SynasUSB)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | Disabled | Stopped] -- system32\drivers\RTKVHDA.sys -- (IntcAzAudAddService)
DRV - File not found [Kernel | System | Stopped] -- C:\Program Files\Launch Manager\DPortIO.sys -- (DritekPortIO)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\DKbFltr.sys -- (DKbFltr)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
DRV - File not found [Kernel | System | Stopped] -- system32\DRIVERS\avipbb.sys -- (avipbb)
DRV - File not found [File_System | On_Demand | Stopped] -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys -- (avgntflt)
DRV - File not found [Kernel | System | Stopped] -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys -- (avgio)
DRV - [2012.09.07 17:04:46 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011.12.04 18:52:25 | 000,239,168 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV - [2011.10.22 16:09:10 | 000,023,880 | ---- | M] (Parallels Holdings, Ltd. and its affiliates.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\prl_pv32.sys -- (prl_pv32)
DRV - [2011.09.14 02:04:30 | 000,148,808 | ---- | M] (Parallels Holdings, Ltd. and its affiliates.) [File_System | System | Running] -- C:\Windows\System32\drivers\prl_fs.sys -- (prl_fs)
DRV - [2011.09.14 02:03:20 | 000,015,816 | ---- | M] (Parallels Holdings, Ltd. and its affiliates.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\prl_time.sys -- (prl_time)
DRV - [2011.09.14 02:03:18 | 000,029,640 | ---- | M] (Parallels Holdings, Ltd. and its affiliates.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\prl_strg.sys -- (prl_strg)
DRV - [2011.09.14 02:03:18 | 000,024,008 | ---- | M] (Parallels Holdings, Ltd. and its affiliates.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\prl_tg.sys -- (prl_tg)
DRV - [2011.09.14 02:03:16 | 000,045,896 | ---- | M] (Parallels Holdings, Ltd. and its affiliates.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\prl_sound.sys -- (prl_sound)
DRV - [2011.09.14 02:03:08 | 000,016,200 | ---- | M] (Parallels Holdings, Ltd. and its affiliates.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\prl_mouf.sys -- (prl_mouf)
DRV - [2011.09.14 02:03:06 | 000,015,176 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\prl_memdev.sys -- (prl_memdev)
DRV - [2011.09.14 02:03:04 | 000,117,064 | ---- | M] (Parallels Holdings, Ltd. and its affiliates.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\prl_kmdd.sys -- (prl_dd)
DRV - [2011.09.14 02:02:58 | 000,038,600 | ---- | M] (Parallels Holdings, Ltd. and its affiliates.) [Kernel | System | Running] -- C:\Windows\System32\drivers\prl_boot.sys -- (prl_boot)
DRV - [2010.09.20 00:01:59 | 000,114,048 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\snapman.sys -- (snapman)
DRV - [2010.06.23 11:23:44 | 000,023,040 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\htcnprot.sys -- (htcnprot)
DRV - [2009.10.19 05:26:06 | 000,474,880 | ---- | M] (AVerMedia TECHNOLOGIES, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AVerAF35.sys -- (AVerAF35)
DRV - [2009.06.10 01:49:32 | 000,024,576 | ---- | M] (HTC, Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ANDROIDUSB.sys -- (HTCAND32)
DRV - [2008.04.17 20:42:16 | 000,026,112 | ---- | M] (NCH Swift Sound) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nchssvad.sys -- (NCHSSVAD)
DRV - [2008.04.14 17:05:41 | 000,021,248 | ---- | M] (AVIRA GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2008.03.26 15:56:00 | 000,024,832 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbmodem.sys -- (USBModem)
DRV - [2008.03.26 15:55:00 | 000,019,840 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbdiag.sys -- (UsbDiag)
DRV - [2008.03.26 15:55:00 | 000,012,800 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbbus.sys -- (usbbus)
DRV - [2008.03.03 14:06:04 | 000,279,440 | ---- | M] (Check Point Software Technologies LTD) [Kernel | System | Running] -- C:\Windows\System32\drivers\vsdatant.sys -- (Vsdatant)
DRV - [2008.01.19 07:53:28 | 000,050,048 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mstape.sys -- (MSTAPE)
DRV - [2008.01.19 07:53:26 | 000,014,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\avcstrm.sys -- (AVCSTRM)
DRV - [2007.06.06 10:07:00 | 007,120,768 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2007.05.30 09:40:42 | 000,735,232 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2007.05.17 03:05:10 | 000,012,032 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2007.05.17 03:04:08 | 001,059,112 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
DRV - [2007.05.17 02:46:50 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2007.05.16 14:47:44 | 000,032,256 | ---- | M] (ENE TECHNOLOGY INC.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\enecir.sys -- (enecir)
DRV - [2007.04.24 17:52:10 | 000,016,688 | ---- | M] (IBM) [Kernel | System | Running] -- C:\Windows\System32\drivers\LUMDriver.sys -- (LUMDriver)
DRV - [2007.03.21 23:02:04 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2007.02.24 15:42:22 | 000,039,936 | ---- | M] (REDC) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2007.01.23 17:40:20 | 000,042,496 | ---- | M] (REDC) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2006.12.07 18:12:02 | 000,076,584 | ---- | M] () [Kernel | Disabled | Stopped] -- C:\Acer\Empowering Technology\eRecovery\int15.sys -- (int15)
DRV - [2002.07.17 16:20:32 | 000,084,832 | ---- | M] (Adaptec) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ASPI32.SYS -- (ASPI)
DRV - [2002.05.08 14:01:06 | 000,100,182 | ---- | M] (Roland Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdwm1021.sys -- (RDID1021)
DRV - [2001.08.24 23:14:40 | 000,044,612 | ---- | M] (Sony Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sonympeg.sys -- (SonyMPEG)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
 
IE - HKU\S-1-5-21-1743292834-4225409643-1500153955-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
IE - HKU\S-1-5-21-1743292834-4225409643-1500153955-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\S-1-5-21-1743292834-4225409643-1500153955-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://global.acer.com [binary data]
IE - HKU\S-1-5-21-1743292834-4225409643-1500153955-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/
IE - HKU\S-1-5-21-1743292834-4225409643-1500153955-1002\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-1743292834-4225409643-1500153955-1002\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKU\S-1-5-21-1743292834-4225409643-1500153955-1002\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKU\S-1-5-21-1743292834-4225409643-1500153955-1002\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.de/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7SUNA_de
IE - HKU\S-1-5-21-1743292834-4225409643-1500153955-1002\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1743292834-4225409643-1500153955-1002\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1
FF - prefs.js..extensions.enabledItems: 6
FF - prefs.js..extensions.enabledItems: 2
FF - prefs.js..extensions.enabledItems: 41
FF - prefs.js..extensions.enabledItems: csfire@cs.kuleuven.be:1.0.5
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0:  File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.10.07 17:52:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.05.20 12:50:11 | 000,000,000 | ---D | M]
 
[2008.09.17 22:06:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Francesco\AppData\Roaming\mozilla\Extensions
[2012.07.18 22:59:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Francesco\AppData\Roaming\mozilla\Firefox\Profiles\soeukzx3.default\extensions
[2010.06.18 20:50:53 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Francesco\AppData\Roaming\mozilla\Firefox\Profiles\soeukzx3.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009.08.26 17:41:47 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus(R))) -- C:\Users\Francesco\AppData\Roaming\mozilla\Firefox\Profiles\soeukzx3.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2012.05.07 23:29:28 | 000,000,000 | ---D | M] (Diigo Toolbar) -- C:\Users\Francesco\AppData\Roaming\mozilla\Firefox\Profiles\soeukzx3.default\extensions\{fc2b8f80-d9a5-4f51-8076-7c7ce3c67ee3}
[2012.05.07 23:29:34 | 000,000,000 | ---D | M] (CsFire) -- C:\Users\Francesco\AppData\Roaming\mozilla\Firefox\Profiles\soeukzx3.default\extensions\csfire@cs.kuleuven.be
[2010.03.12 17:55:02 | 000,002,477 | ---- | M] () -- C:\Users\Francesco\AppData\Roaming\mozilla\firefox\profiles\soeukzx3.default\searchplugins\diigo--google.xml
[2009.03.16 17:43:25 | 000,005,424 | ---- | M] () -- C:\Users\Francesco\AppData\Roaming\mozilla\firefox\profiles\soeukzx3.default\searchplugins\rhymegen.xml
[2011.06.10 15:00:38 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010.06.02 23:44:59 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.10.07 17:56:03 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2011.01.02 12:26:56 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011.03.27 18:28:21 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011.06.10 15:00:38 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
[2011.05.04 04:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010.09.14 23:32:39 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.09.14 23:32:39 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2010.09.14 23:32:39 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.09.14 23:32:39 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.09.14 23:32:39 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2011.01.02 12:12:06 | 000,000,779 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: ::1             localhost
O1 - Hosts: 0.0.0.0         .psf
O1 - Hosts: 0.0.0.0         psf
O2 - BHO: (no name) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - No CLSID value found.
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O3 - HKU\S-1-5-21-1743292834-4225409643-1500153955-1002\..\Toolbar\ShellBrowser: (no name) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - No CLSID value found.
O3 - HKU\S-1-5-21-1743292834-4225409643-1500153955-1002\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [LManager] C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [lxdoamon] C:\Program Files\Lexmark 9500 Series\lxdoamon.exe ()
O4 - HKLM..\Run: [lxdomon.exe] C:\Program Files\Lexmark 9500 Series\lxdomon.exe ()
O4 - HKLM..\Run: [NeroFilterCheck] C:\Windows\System32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [Parallels Shared Internet Applications] C:\Program Files\Parallels\Parallels Tools\SIA\SharedIntApp.exe (Parallels Holdings, Ltd. and its affiliates.)
O4 - HKLM..\Run: [Parallels Tools Center] C:\Program Files\Parallels\Parallels Tools\prl_cc.exe (Parallels Holdings, Ltd. and its affiliates.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Windows Mobile-based device management] C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [WrtMon.exe] C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe ()
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-1743292834-4225409643-1500153955-1002..\Run: [vupur] C:\Users\Francesco\vupur.exe /w File not found
O4 - Startup: C:\Users\Francesco\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk = C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System:  = 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSimpleNetIDList = 1
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSimpleNetIDList = 1
O7 - HKU\S-1-5-21-1743292834-4225409643-1500153955-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0
O8 - Extra context menu item: An OneNote s&enden - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKLM\..Trusted Domains: .psf ([]* in Local intranet)
O15 - HKLM\..Trusted Domains: psf ([]* in Local intranet)
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} https://oas.support.microsoft.com/ActiveX/MSDcode.cab (Microsoft Data Collection Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 180.168.255.18 116.228.111.118
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9FF7C41C-6405-4A23-A055-6294675E070E}: DhcpNameServer = 180.168.255.18 116.228.111.118
O20 - AppInit_DLLs: (eNetHook.dll) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O22 - SharedTaskScheduler: {E31004D1-A431-41B8-826F-E902F9D95C81} - Windows DreamScene - C:\Windows\System32\DreamScene.dll (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Francesco\AppData\Roaming\Microsoft\Windows DreamScene\DreamScene.jpg
O24 - Desktop BackupWallPaper: C:\Users\Francesco\AppData\Roaming\Microsoft\Windows DreamScene\DreamScene.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{0eb8df0e-1cbd-11e1-910c-001c42a6e7ef}\Shell - "" = AutoRun
O33 - MountPoints2\{0eb8df0e-1cbd-11e1-910c-001c42a6e7ef}\Shell\AutoRun\command - "" = H:\INTEL\startspk.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^phase6_17_erinnerung.lnk - C:\Program Files\phase6\phase6_17\WinStart\WinStart.exe - (phase6)
MsConfig - StartUpFolder: C:^Users^Francesco^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Acer Empowering Technology.lnk -  - File not found
MsConfig - StartUpReg: Acer Tour Reminder - hkey= - key= -  File not found
MsConfig - StartUpReg: Acrobat Assistant 8.0 - hkey= - key= -  File not found
MsConfig - StartUpReg: Adobe_ID0EYTHM - hkey= - key= -  File not found
MsConfig - StartUpReg: eAudio - hkey= - key= -  File not found
MsConfig - StartUpReg: PlayMovie - hkey= - key= -  File not found
MsConfig - StartUpReg: QuickTime Task - hkey= - key= -  File not found
MsConfig - StartUpReg: Skype - hkey= - key= - C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)
MsConfig - StartUpReg: swg - hkey= - key= -  File not found
MsConfig - StartUpReg: WarReg_PopUp - hkey= - key= - C:\Acer\WR_PopUp\WarReg_PopUp.exe (Acer Inc.)
MsConfig - State: "startup" - 2
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfPf - Driver
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353)
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {166B1BCA-3F9C-11CF-8075-444553540000} - Macromedia Shockwave Director 8.5
ActiveX: {1897C549-AE52-4571-8996-44854F5612B2} - Microsoft .NET Framework 1.1 Security Update (KB2656370)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Macromedia Shockwave Director 8.5
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {57CC6CD9-90FC-5A40-C7B5-3E4C9440A2AB} - 
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7070D8E0-650A-46b3-B03C-9497582E6A74} - %SystemRoot%\system32\soundschemes.exe /AddRegistration
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {AAE2A559-2180-1D71-1261-EC120317E912} - Microsoft Windows Media Player 11.0
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: midi1 - C:\Windows\System32\rddv1021.dll (Roland Corporation)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\Windows\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.iv50 - C:\Windows\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.XVID - C:\Windows\System32\xvidvfw.dll ()
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.09.25 04:28:21 | 000,602,112 | ---- | C] (OldTimer Tools) -- \\psf\Home\Desktop\OTL.exe
[2012.09.17 16:11:51 | 000,000,000 | ---D | C] -- \\psf\Home\Documents\MBA Shanghai
[2012.09.12 13:10:47 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012.09.08 10:59:51 | 000,000,000 | ---D | C] -- C:\Users\Francesco\AppData\Roaming\Malwarebytes
[2012.09.08 10:59:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.09.08 10:59:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.09.08 10:59:29 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.09.08 10:59:28 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.09.06 17:08:51 | 000,000,000 | ---D | C] -- C:\Leo_Movies
[2 \\psf\Home\Documents\*.tmp files -> \\psf\Home\Documents\*.tmp -> ]
[14 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[14 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.09.26 07:01:19 | 000,024,580 | -H-- | M] () -- \\psf\Home\Desktop\.DS_Store
[2012.09.26 06:57:10 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.09.26 04:55:35 | 000,005,936 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.09.26 04:55:35 | 000,005,936 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.09.25 15:59:27 | 000,046,922 | ---- | M] () -- \\psf\Home\Desktop\Bildschirmfoto 2012-09-25 um 15.59.19.png
[2012.09.25 15:57:08 | 000,024,580 | -H-- | M] () -- \\psf\Home\Documents\.DS_Store
[2012.09.25 09:56:06 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.09.25 04:28:33 | 000,602,112 | ---- | M] (OldTimer Tools) -- \\psf\Home\Desktop\OTL.exe
[2012.09.24 11:05:36 | 000,001,111 | ---- | M] () -- C:\Users\Francesco\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
[2012.09.24 05:18:15 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.09.24 05:02:12 | 000,223,395 | ---- | M] () -- \\psf\Home\Desktop\Bildschirmfoto 2012-09-24 um 05.02.07.png
[2012.09.24 03:27:26 | 000,120,832 | ---- | M] () -- C:\Users\Francesco\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.09.23 17:17:46 | 012,311,423 | ---- | M] () -- \\psf\Home\Documents\Niko Geburtstagsvideo.m4v
[2012.09.23 15:58:38 | 000,086,232 | ---- | M] () -- \\psf\Home\Desktop\clip0010.avi
[2012.09.22 10:27:57 | 000,058,880 | ---- | M] () -- \\psf\Home\Documents\Visitenkarten China Englisch.pub
[2012.09.22 07:23:09 | 000,295,406 | ---- | M] () -- \\psf\Home\Desktop\Bildschirmfoto 2012-09-22 um 07.23.06.png
[2012.09.21 10:04:38 | 000,484,189 | ---- | M] () -- \\psf\Home\Desktop\Bildschirmfoto 2012-09-21 um 10.04.34.png
[2012.09.21 02:53:17 | 000,512,737 | ---- | M] () -- \\psf\Home\Desktop\adwcleaner.exe
[2012.09.20 08:59:01 | 000,019,834 | ---- | M] () -- \\psf\Home\Desktop\Bildschirmfoto 2012-09-20 um 08.58.57.png
[2012.09.13 03:07:54 | 000,000,127 | ---- | M] () -- C:\Windows\System32\MRT.INI
[2012.09.12 18:33:35 | 000,642,258 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.09.12 18:33:35 | 000,607,228 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.09.12 18:33:35 | 000,131,678 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.09.12 18:33:35 | 000,108,604 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.09.08 10:59:33 | 000,000,872 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.09.07 17:04:46 | 000,022,856 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.09.07 09:57:01 | 163,789,432 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2 \\psf\Home\Documents\*.tmp files -> \\psf\Home\Documents\*.tmp -> ]
[14 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[14 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.09.25 15:59:27 | 000,046,922 | ---- | C] () -- \\psf\Home\Desktop\Bildschirmfoto 2012-09-25 um 15.59.19.png
[2012.09.24 05:02:12 | 000,223,395 | ---- | C] () -- \\psf\Home\Desktop\Bildschirmfoto 2012-09-24 um 05.02.07.png
[2012.09.23 17:17:45 | 012,311,423 | ---- | C] () -- \\psf\Home\Documents\Niko Geburtstagsvideo.m4v
[2012.09.23 15:58:09 | 000,086,232 | ---- | C] () -- \\psf\Home\Desktop\clip0010.avi
[2012.09.22 10:27:58 | 000,058,880 | ---- | C] () -- \\psf\Home\Documents\Visitenkarten China Englisch.pub
[2012.09.22 07:23:09 | 000,295,406 | ---- | C] () -- \\psf\Home\Desktop\Bildschirmfoto 2012-09-22 um 07.23.06.png
[2012.09.21 10:04:37 | 000,484,189 | ---- | C] () -- \\psf\Home\Desktop\Bildschirmfoto 2012-09-21 um 10.04.34.png
[2012.09.21 02:53:08 | 000,512,737 | ---- | C] () -- \\psf\Home\Desktop\adwcleaner.exe
[2012.09.20 08:59:00 | 000,019,834 | ---- | C] () -- \\psf\Home\Desktop\Bildschirmfoto 2012-09-20 um 08.58.57.png
[2012.09.13 03:07:54 | 000,000,127 | ---- | C] () -- C:\Windows\System32\MRT.INI
[2012.09.08 10:59:33 | 000,000,872 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.09.07 09:57:01 | 163,789,432 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2012.06.29 13:03:18 | 000,001,514 | ---- | C] () -- C:\Users\Francesco\gsview32.ini
[2011.10.23 14:04:34 | 000,015,176 | ---- | C] () -- C:\Windows\System32\drivers\prl_memdev.sys
[2010.10.25 11:22:41 | 000,000,600 | ---- | C] () -- C:\Users\Francesco\AppData\Roaming\winscp.rnd
[2009.10.09 15:22:27 | 000,005,225 | ---- | C] () -- C:\ProgramData\lxdo
[2009.09.19 16:16:46 | 000,038,451 | ---- | C] () -- C:\Users\Francesco\AppData\Roaming\Kommagetrennte Werte (Windows).ADR
[2009.09.19 16:15:09 | 000,038,457 | ---- | C] () -- C:\Users\Francesco\AppData\Roaming\Tabulatorgetrennte Werte (Windows).ADR
[2009.01.30 18:49:58 | 000,000,616 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2009.01.06 17:32:32 | 000,038,431 | ---- | C] () -- C:\Users\Francesco\AppData\Roaming\Kommagetrennte Werte (DOS).ADR
[2008.11.28 21:42:41 | 000,001,793 | ---- | C] () -- C:\Users\Francesco\AppData\Roaming\SAS7_000.DAT
[2008.04.28 21:17:42 | 000,028,915 | ---- | C] () -- C:\Users\Francesco\AppData\Roaming\UserTile.png
[2008.04.13 13:36:22 | 000,000,032 | ---- | C] () -- C:\ProgramData\ezsid.dat
[2008.04.12 10:18:28 | 000,001,489 | ---- | C] () -- C:\Users\Francesco\AppData\Local\SearchResults.wpl
[2008.03.15 20:07:07 | 000,000,125 | -HS- | C] () -- C:\ProgramData\.zreglib
[2008.03.09 15:11:20 | 000,001,024 | ---- | C] () -- C:\Users\Francesco\.rnd
[2008.02.29 18:00:17 | 000,000,552 | ---- | C] () -- C:\Users\Francesco\AppData\Local\d3d8caps.dat
[2008.02.08 00:18:11 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html
[2008.01.21 23:18:23 | 000,120,832 | ---- | C] () -- C:\Users\Francesco\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.01.21 15:00:11 | 000,001,356 | ---- | C] () -- C:\Users\Francesco\AppData\Local\d3d9caps.dat
[2007.12.25 01:47:04 | 000,000,097 | ---- | C] () -- C:\Users\Francesco\AppData\Local\fusioncache.dat
[2007.12.24 21:22:29 | 000,094,485 | ---- | C] () -- C:\Users\Francesco\AppData\Roaming\nvModes.001
[2007.12.24 21:14:12 | 000,094,485 | ---- | C] () -- C:\Users\Francesco\AppData\Roaming\nvModes.dat
[2007.11.16 20:14:11 | 000,000,000 | ---- | C] () -- C:\Users\Francesco\AppData\Roaming\wklnhst.dat
 
========== ZeroAccess Check ==========
 
[2006.11.02 14:53:06 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 19:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 08:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 08:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2009.08.22 20:12:33 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\9500 Series
[2009.06.02 23:09:39 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Ableton
[2009.08.30 17:59:26 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Audacity
[2008.09.26 08:21:19 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Blender Foundation
[2008.09.09 09:26:02 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\CopyTransControlCenter
[2011.12.04 19:00:18 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\DAEMON Tools Lite
[2011.12.04 18:45:05 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\DAEMON Tools Pro
[2011.12.04 21:54:42 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\DassaultSystemes
[2012.03.28 13:36:10 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\elsterformular
[2009.05.08 22:55:32 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\gtk-2.0
[2008.01.01 19:34:54 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\ICQ
[2009.08.25 16:52:20 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Lexmark Productivity Studio
[2009.09.20 17:42:03 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\LG Electronics
[2009.10.03 18:50:32 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\MAGIX
[2008.02.29 21:39:08 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Miranda
[2008.07.02 22:22:26 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\NCH Swift Sound
[2010.09.22 20:47:44 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\NewSoft
[2008.11.28 21:10:45 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Nuance
[2010.09.22 07:50:47 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Parallels
[2008.04.28 21:17:42 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\PeerNetworking
[2008.10.31 14:00:15 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\S.V. Softwares
[2009.04.18 22:50:48 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Steinberg
[2010.01.17 16:57:42 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Teleca
[2007.12.25 00:54:07 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Template
[2011.02.05 11:18:39 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Transcend
[2009.04.18 22:09:48 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\TuneUp Software
[2009.07.25 15:58:54 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Ulead Systems
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2009.08.22 20:12:33 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\9500 Series
[2009.06.02 23:09:39 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Ableton
[2011.12.26 16:44:03 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Adobe
[2008.01.03 23:29:08 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\AdobeUM
[2009.10.03 11:02:30 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Apple Computer
[2009.08.30 17:59:26 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Audacity
[2008.09.26 08:21:19 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Blender Foundation
[2008.09.09 09:26:02 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\CopyTransControlCenter
[2007.12.25 20:28:01 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\CyberLink
[2011.12.04 19:00:18 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\DAEMON Tools Lite
[2011.12.04 18:45:05 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\DAEMON Tools Pro
[2011.12.04 21:54:42 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\DassaultSystemes
[2009.09.20 22:05:09 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\DivX
[2009.09.10 10:04:23 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\dvdcss
[2012.03.28 13:36:10 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\elsterformular
[2008.03.15 14:33:49 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Google
[2009.05.08 22:55:32 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\gtk-2.0
[2008.01.01 19:34:54 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\ICQ
[2007.12.25 18:39:13 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Identities
[2008.04.17 16:50:30 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\InstallShield
[2009.08.25 16:52:20 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Lexmark Productivity Studio
[2009.09.20 17:42:03 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\LG Electronics
[2007.12.25 00:54:07 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Macromedia
[2009.10.03 18:50:32 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\MAGIX
[2012.09.08 10:59:51 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Malwarebytes
[2006.11.02 14:35:50 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Media Center Programs
[2012.07.11 13:10:08 | 000,000,000 | --SD | M] -- C:\Users\Francesco\AppData\Roaming\Microsoft
[2008.02.29 21:39:08 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Miranda
[2008.09.17 22:06:55 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Mozilla
[2008.07.02 22:22:26 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\NCH Swift Sound
[2008.03.09 15:12:07 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Nero
[2010.09.22 20:47:44 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\NewSoft
[2008.11.28 21:10:45 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Nuance
[2010.09.22 07:50:47 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Parallels
[2008.04.28 21:17:42 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\PeerNetworking
[2008.07.06 19:39:31 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Real
[2008.10.31 14:00:15 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\S.V. Softwares
[2008.06.18 19:01:03 | 000,000,000 | RH-D | M] -- C:\Users\Francesco\AppData\Roaming\SecuROM
[2010.11.01 15:49:39 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Skype
[2010.06.02 19:01:50 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\skypePM
[2009.08.26 15:06:01 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Sony Ericsson
[2009.04.18 22:50:48 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Steinberg
[2010.01.17 16:57:42 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Teleca
[2007.12.25 00:54:07 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Template
[2011.02.05 11:18:39 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Transcend
[2009.04.18 22:09:48 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\TuneUp Software
[2009.08.15 17:19:18 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\U3
[2009.07.25 15:58:54 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Ulead Systems
[2010.11.03 17:34:43 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\vlc
[2008.08.08 18:44:41 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\WinRAR
[2008.09.20 08:38:55 | 000,000,000 | ---D | M] -- C:\Users\Francesco\AppData\Roaming\Yahoo!
 
< %APPDATA%\*.exe /s >
[2012.04.02 15:42:12 | 006,232,600 | ---- | M] (Landesfinanzdirektion Thueringen) -- C:\Users\Francesco\AppData\Roaming\elsterformular\pluginmanager\tmp\install_eur11.exe
[2011.12.26 16:43:53 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\Francesco\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2010.06.01 11:37:39 | 000,010,134 | R--- | M] () -- C:\Users\Francesco\AppData\Roaming\Microsoft\Installer\{CE7FC1FF-8528-47F6-A67C-7017C14DBF3D}\ARPPRODUCTICON.exe
[2009.08.07 12:44:18 | 000,019,792 | ---- | M] (NOS Microsystems Ltd.) -- C:\Users\Francesco\AppData\Roaming\Mozilla\Firefox\Profiles\soeukzx3.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg.exe
[2009.08.07 12:44:18 | 000,022,848 | ---- | M] (NOS Microsystems Ltd.) -- C:\Users\Francesco\AppData\Roaming\Mozilla\Firefox\Profiles\soeukzx3.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg_bootstrap.exe
[2012.06.04 18:57:34 | 000,161,280 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Adobe Reader (Mac).exe
[2010.09.22 07:59:57 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Adressbuch (Mac).exe
[2010.09.22 08:09:06 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\AirPort-Dienstprogramm (Mac).exe
[2010.09.22 08:09:08 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\AppleScript-Editor (Mac).exe
[2012.01.04 16:00:14 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Assistent zur WLAN-Einrichtung (Mac).exe
[2010.09.22 08:09:09 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Audio-MIDI-Setup (Mac).exe
[2010.09.22 08:00:36 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Automator (Mac).exe
[2011.01.27 12:27:36 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Canon IJ-Bildschirmhandbuch (Mac).exe
[2011.01.27 12:27:45 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\CD-LabelPrint (Mac).exe
[2010.09.22 08:00:52 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Chess (Mac).exe
[2010.09.22 08:09:10 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\ColorSync-Dienstprogramm (Mac).exe
[2010.09.22 08:01:24 | 000,152,432 | ---- | M] () -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Dashboard (Mac).exe
[2012.01.04 16:00:13 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Deinstaller (Mac).exe
[2010.09.22 08:09:18 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\DigitalColor-Farbmesser (Mac).exe
[2010.09.22 10:43:57 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\DiskImageMounter (Mac).exe
[2011.04.16 11:20:16 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\DivX Community (Mac).exe
[2011.04.12 22:29:53 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\DivX Converter (Mac).exe
[2011.04.12 22:32:08 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\DivX Player (Mac).exe
[2012.04.23 20:36:46 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\DivX Plus Player (Mac).exe
[2011.04.16 11:20:18 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\DivX Products (Mac).exe
[2011.04.16 11:20:18 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\DivX Support (Mac).exe
[2012.01.04 16:00:09 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Druckereinstellungen (Mac).exe
[2010.09.22 08:08:28 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\DVD-Player (Mac).exe
[2012.04.22 13:00:38 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Evernote (Mac).exe
[2010.09.22 08:09:20 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Exposé (Mac).exe
[2010.09.22 08:09:19 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Festplatten-Dienstprogramm (Mac).exe
[2010.09.22 08:08:30 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Firefox (Mac).exe
[2010.09.22 08:08:34 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Front Row (Mac).exe
[2010.09.22 08:08:35 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\GarageBand (Mac).exe
[2011.06.09 18:12:40 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Gimp (Mac).exe
[2010.09.22 08:09:21 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Grapher (Mac).exe
[2010.09.22 08:08:37 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\iCal (Mac).exe
[2010.09.22 08:08:38 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\iChat (Mac).exe
[2011.08.10 17:26:49 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\iDVD (Mac).exe
[2010.09.22 08:08:43 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\iMovie (Mac).exe
[2010.09.22 08:08:44 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\iPhoto (Mac).exe
[2010.09.22 08:08:45 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\iSync (Mac).exe
[2010.09.22 08:08:46 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\iTunes (Mac).exe
[2010.09.22 08:08:47 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\iWeb (Mac).exe
[2012.08.17 15:14:12 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Kindle (Mac).exe
[2010.09.22 08:08:26 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Lexikon (Mac).exe
[2010.09.22 08:08:53 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Lexmark 9500 Series Center (Mac).exe
[2010.09.22 08:08:53 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Live (Mac).exe
[2010.09.22 08:08:54 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Mail (Mac).exe
[2010.12.01 18:08:24 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\MATLAB_R2010aSV (Mac).exe
[2011.03.09 16:11:30 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\MediaCentral (Mac).exe
[2010.09.22 10:56:27 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Microsoft PowerPoint (Mac).exe
[2010.09.22 10:56:27 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Microsoft Word (Mac).exe
[2011.01.27 12:27:44 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\MP Navigator EX 4.0 (Mac).exe
[2010.10.24 21:11:02 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\NetBeans 6.9.1 (Mac).exe
[2010.09.22 08:09:14 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Netzwerkdienstprogramm (Mac).exe
[2012.01.04 16:00:08 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Netzwerkkartenleser (Mac).exe
[2010.09.22 08:08:59 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Notizzettel (Mac).exe
[2010.12.14 20:19:07 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\OpenOffice.org (Mac).exe
[2010.09.22 08:08:57 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\QuickTime Player (Mac).exe
[2010.09.22 08:09:14 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\RAID-Dienstprogramm (Mac).exe
[2011.05.16 17:39:24 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Rhinoceros (Mac).exe
[2010.09.22 08:08:57 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Safari (Mac).exe
[2012.01.04 16:00:12 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Scan Center (Mac).exe
[2010.09.22 08:09:22 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Schlüsselbundverwaltung (Mac).exe
[2010.09.22 08:08:32 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Schriftsammlung (Mac).exe
[2010.09.22 08:08:59 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\SimplyRAR (Mac).exe
[2010.11.02 23:30:52 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Skype (Mac).exe
[2012.08.12 12:48:20 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Skype_old (Mac).exe
[2010.09.22 08:09:15 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Spaces (Mac).exe
[2010.09.22 08:09:15 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\System-Profiler (Mac).exe
[2010.09.22 08:09:00 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Systemeinstellungen (Mac).exe
[2010.09.22 08:09:01 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\TextEdit (Mac).exe
[2011.03.09 16:11:30 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\The Tube (Mac).exe
[2010.09.22 08:09:04 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Time Machine (Mac).exe
[2011.04.16 11:20:21 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Uninstall DivX for Mac (Mac).exe
[2010.10.08 09:22:23 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\VLC (Mac).exe
[2010.09.22 08:08:56 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Vorschau (Mac).exe
[2012.02.16 11:27:07 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\Wolfram CDF Player (Mac).exe
[2010.09.22 08:09:16 | 000,228,864 | ---- | M] (Parallels Software International, Inc.) -- C:\Users\Francesco\AppData\Roaming\Parallels\Shared Applications\X11 (Mac).exe
[2007.10.23 09:27:20 | 000,110,592 | ---- | M] () -- C:\Users\Francesco\AppData\Roaming\U3\temp\cleanup.exe
[2008.05.02 10:41:48 | 003,493,888 | -H-- | M] (SanDisk Corporation) -- C:\Users\Francesco\AppData\Roaming\U3\temp\Launchpad Removal.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.19 09:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.19 09:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2008.02.13 19:35:10 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2008.02.13 19:35:10 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2008.02.13 19:35:09 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2008.01.19 09:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.19 09:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.19 09:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.19 09:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.19 09:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: NVSTOR32.SYS  >
[2007.05.17 03:04:26 | 000,108,328 | ---- | M] (NVIDIA Corporation) MD5=4A820160BC3C85297BF33CEF08A905C2 -- C:\Acer\Empowering Technology\eRecovery\Autorun\SW1\Chipset\IDE\WinVista\sata_ide\nvstor32.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.19 09:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2007.12.25 02:06:48 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=63B4F59D7C89B1BF5277F1FFEFD491CD -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll
[2007.12.25 02:06:48 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=9D9F061EDA75425FC67F0365E3467C86 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll
[2008.01.19 09:36:46 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
[2006.11.02 11:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll
[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2012.09.07 17:04:42 | 000,218,696 | ---- | M] () MD5=4E0D8C9F83B7FD82393F7D8CCC27E7AE -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2008.01.19 09:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys
[2008.01.19 07:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.19 07:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2008.03.03 14:06:04 | 000,279,440 | ---- | M] (Check Point Software Technologies LTD) Unable to obtain MD5 -- C:\Windows\system32\drivers\vsdatant.sys
 
< %systemroot%\System32\config\*.sav >
[2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006.11.02 12:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]
 
<           >
[2006.11.02 15:00:25 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT
[2006.11.02 15:00:25 | 000,032,588 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2008.04.08 22:04:56 | 000,000,426 | -H-- | C] () -- C:\Windows\Tasks\User_Feed_Synchronization-{F8265E79-4C94-4D98-8622-CE060FAA9C18}.job
[2010.06.01 11:46:17 | 000,001,094 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
[2010.06.01 11:46:19 | 000,001,098 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:B623B5B8
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:B203B914
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:A95A95AC
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:8CE646EE
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:798A3728
@Alternate Data Stream - 111 bytes -> C:\ProgramData\TEMP:7B212553
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:30A9E86A
@Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:F35A93AD

< End of report >

--- --- ---

crunschi · 26.09.2012, 07:40

und dieser log ist auch noch entstanden:
OTL EXTRAS Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 26.09.2012 07:03:54 - Run 1
OTL by OldTimer - Version 3.2.68.0     Folder = \\psf\Home\Desktop
Windows Vista Ultimate Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1022,84 Mb Total Physical Memory | 450,25 Mb Available Physical Memory | 44,02% Memory free
2,26 Gb Paging File | 1,51 Gb Available in Paging File | 66,87% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 69,77 Gb Total Space | 8,10 Gb Free Space | 11,61% Space Free | Partition Type: NTFS
Drive D: | 15,47 Gb Total Space | 11,25 Gb Free Space | 72,71% Space Free | Partition Type: NTFS
 
Computer Name: FRANCESCOS-PC | User Name: Francesco | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-1743292834-4225409643-1500153955-1002\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{12A4881C-0457-46CC-9FA8-88ED49A16C47}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{263E81A1-C32E-454B-8F74-AEF3712FE336}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{29692651-B82E-40A5-8ACC-557F740982F7}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{2A3D8B2D-4EF5-4BEC-9CF3-6FFE2BC0A1C3}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{60ACCA44-CC2C-4727-A33B-AFD8D5A4D1F7}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{6843FCAA-2976-4A9E-821A-CA32BA63BE0F}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{70F99AE8-5442-487C-9A7A-48DB56349FC8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{7A20EBEF-9793-4CE6-A4CC-1089AAD7B6B4}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{84EF9B18-69B0-4B8D-A955-894ED66487E2}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{8810070D-8538-47F1-BDE3-BDF66D5F3116}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{89ADCCFD-7388-4039-9CF7-6ABBFAFCB415}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{980AB920-CE51-4B6E-B157-E8133F4F227A}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{A2D2C65C-9AD3-4322-9499-E29EBD4ED0E0}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{A8C900C5-612F-418A-AE6A-2F7196CDACD0}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{B8900BFF-A2DF-4D18-82DE-3A7CF07C66F3}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{CD060FAC-EBAF-4044-97B1-F422E88C62BD}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{D2BCE533-D554-49B8-BDE1-07D5899DC7B8}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{E9B1D216-3E90-4B59-9440-86BD4499A14E}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{FD8F4FCA-F94B-4402-8752-5D7797C38206}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0A6BE6A3-ADFB-4980-8C82-659C31C9FB7D}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{0AD1AD00-5AB1-4071-8A9B-1940B6122497}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{0BB1E9CA-DEFD-4059-9811-5530A203D22A}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{0F2675EE-E12B-4DFF-98AD-921E0E467712}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdopswx.exe | 
"{0F6919CD-AF3E-4D38-8366-63506F2A2F10}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdotime.exe | 
"{13A261F3-7051-4FBC-85AD-A43E989AD40C}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{17B7095B-64E8-45BA-A4DC-D9D055319B13}" = protocol=17 | dir=in | app=c:\program files\lexmark 9500 series\lxdomon.exe | 
"{1895F96F-E9F6-4977-BAE3-9FF5A10F4FB8}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe | 
"{1B2DCA0B-EE00-4720-BD40-1DAB86AF8C7D}" = protocol=17 | dir=in | app=c:\program files\lexmark 9500 series\wireless\lxdowpss.exe | 
"{22B5D3A9-B42D-41F3-A31A-1C21F1505F38}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdopswx.exe | 
"{23E291F5-2239-45D1-9E3D-40F9E23D31CF}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{2794586E-B781-4AC8-A18F-BDF0AD5BE976}" = protocol=17 | dir=in | app=c:\program files\lexmark 9500 series\lxdofax.exe | 
"{2A559485-5593-43B1-940C-26BCBA60187F}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
"{2C3C8183-BE7D-419E-8242-DC0D25DAC466}" = protocol=6 | dir=in | app=c:\program files\lexmark 9500 series\wireless\lxdowpss.exe | 
"{2E59826B-5EB4-47E8-961C-93DD09A15CFA}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe | 
"{3C8E83A3-832A-49DF-8EF8-961E190579C9}" = protocol=17 | dir=in | app=c:\program files\parallels\parallels transporter agent\parallelstransporteragent.exe | 
"{3DCBDF6C-F108-4A16-A53E-3E436951FB53}" = protocol=6 | dir=in | app=c:\windows\system32\lxdocoms.exe | 
"{3EED477B-D46E-4484-8F70-0D167B364F84}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{405E33B1-D269-47A2-B5DD-C28DD6EBD08B}" = protocol=6 | dir=in | app=c:\program files\parallels\parallels transporter agent\parallelstransporteragent.exe | 
"{4CA9F22F-5F2A-40A3-9952-58B759022FA8}" = protocol=17 | dir=in | app=c:\program files\parallels\parallels transporter agent\parallelstransporteragent.exe | 
"{4E32350C-30A4-40C1-ACFA-0DC196F609EA}" = protocol=6 | dir=in | app=c:\program files\parallels\parallels transporter agent\parallelstransporteragent.exe | 
"{4E9BE38A-EE66-453B-BF22-607AA99E94EE}" = protocol=17 | dir=in | app=c:\program files\lexmark 9500 series\lxdoamon.exe | 
"{50D8DCAC-C998-451A-A397-5DDD6CB5BAE0}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
"{54153CC9-67DF-43F4-B8FC-B6263AC0A616}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{54513617-8DC4-48D5-AD3F-889D652580EB}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe | 
"{59B66BF8-8F27-4AF3-9007-407149DC5F05}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{5A1E3C84-8D44-4B59-A22A-BCE9C3B10209}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{5DFEFC07-ED86-4D97-B856-95ED27A24DBB}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{76558601-0969-40E9-B32C-5848FD42A24D}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{80A3F266-F711-48AC-8786-4E5118E38680}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdojswx.exe | 
"{81178336-F694-404C-BC0B-FE0FB8E1FAE5}" = protocol=17 | dir=in | app=c:\windows\system32\lxdocfg.exe | 
"{815C4576-8F61-4195-9DF7-EC9A3BACC2CD}" = protocol=6 | dir=in | app=c:\windows\system32\lxdocfg.exe | 
"{912A1574-1467-4EAD-961C-44B606CCA63F}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{91E38753-FA0B-4AD4-B692-362DEB1EECDA}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdowbgw.exe | 
"{A129F1E0-73CF-4949-8AE5-08F9BB433E19}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{ABDF0568-4356-4045-BAB5-5BC85CB2BE81}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{AEA9E6C7-C26B-49A8-B833-6C46B587B3DD}" = protocol=6 | dir=in | app=c:\program files\lexmark 9500 series\lxdoamon.exe | 
"{B93C2667-2C14-406B-BD3B-62C0C3BCBBBB}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe | 
"{BE8C4A3C-854C-4F4D-9FCD-1A33A4D3D881}" = protocol=6 | dir=in | app=c:\program files\lexmark 9500 series\lxdomon.exe | 
"{C8479C6A-2EDE-4785-9ECD-3B27F1913D25}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdowbgw.exe | 
"{C9B31CD8-12AA-4B90-AF63-9137D92F9AE7}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdojswx.exe | 
"{CA792BEA-376F-4704-8C1C-59BAF2CF6633}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{D79A67C7-8DCF-46F5-A677-BF7DD1EDB986}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdotime.exe | 
"{DD0F0BD8-5431-4113-A342-A8DF1D0C7345}" = protocol=6 | dir=out | app=system | 
"{E03FD88A-3E59-471B-8940-F2595CEE1F7F}" = protocol=17 | dir=in | app=c:\program files\abbyy finereader 6.0 sprint\scan\scanman6.exe | 
"{E6B2333E-8847-4C0E-8690-9CEE53E3F084}" = protocol=6 | dir=in | app=c:\program files\abbyy finereader 6.0 sprint\scan\scanman6.exe | 
"{EDD0527E-4414-4812-B7FE-60CB20C6E693}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{F681F830-538E-4B7A-BBAD-5BA267993D84}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{F737E58B-EC94-4B7B-8A23-F3228895FDC8}" = protocol=6 | dir=in | app=c:\program files\lexmark 9500 series\frun.exe | 
"{F78783E8-EF48-4C46-A154-A96C9F0F642C}" = protocol=17 | dir=in | app=c:\program files\lexmark 9500 series\frun.exe | 
"{FC45FB3A-B35E-4F94-A892-BBCED9175038}" = protocol=6 | dir=in | app=c:\program files\lexmark 9500 series\lxdofax.exe | 
"{FEFEAD2C-4BF6-4D37-8C32-C922080BAA44}" = protocol=17 | dir=in | app=c:\windows\system32\lxdocoms.exe | 
"TCP Query User{02B4F54F-56CC-468B-86B5-FBC7026735B9}C:\program files\intuwave\shared\mrouterruntime\mrouterruntime.exe" = protocol=6 | dir=in | app=c:\program files\intuwave\shared\mrouterruntime\mrouterruntime.exe | 
"TCP Query User{1163660A-78E7-406C-BFA2-E3D79775FEDB}C:\windows\system32\spool\drivers\w32x86\3\lxdopswx.exe" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdopswx.exe | 
"TCP Query User{29F8CBD3-BCAB-4AF8-A7FC-5A2BB784AC58}C:\program files\dassault systemes\b19\intel_a\code\bin\cnext.exe" = protocol=6 | dir=in | app=c:\program files\dassault systemes\b19\intel_a\code\bin\cnext.exe | 
"TCP Query User{2E2E39AB-7664-4877-8C43-C468164CD767}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe | 
"TCP Query User{3453074D-6288-40CC-A0E6-918FF93F99D7}C:\program files\miranda im\miranda32.exe" = protocol=6 | dir=in | app=c:\program files\miranda im\miranda32.exe | 
"TCP Query User{54776137-C9D4-420F-83AC-003ED7EC60D0}D:\vsk5\vsk5.exe" = protocol=6 | dir=in | app=d:\vsk5\vsk5.exe | 
"TCP Query User{64B5ED3F-FBEE-482E-8213-32BD413CCF16}C:\program files\lexmark 9500 series\frun.exe" = protocol=6 | dir=in | app=c:\program files\lexmark 9500 series\frun.exe | 
"TCP Query User{74187A19-E769-433D-8E22-3C00B2149113}C:\program files\miranda fusion 1.4.2+\miranda32.exe" = protocol=6 | dir=in | app=c:\program files\miranda fusion 1.4.2+\miranda32.exe | 
"TCP Query User{843DB101-D9DA-4188-AC96-59DA29F871E7}D:\vsk5 bei data\vsk5.exe" = protocol=6 | dir=in | app=d:\vsk5 bei data\vsk5.exe | 
"TCP Query User{95819E68-AD66-4851-A7E5-7B73552B7A6D}C:\program files\miranda fusion 1.4.2+\miranda32.exe" = protocol=6 | dir=in | app=c:\program files\miranda fusion 1.4.2+\miranda32.exe | 
"TCP Query User{971474CB-5405-4F1B-AA67-0BDDE819A4BF}C:\program files\lexmark 9500 series\lxdomon.exe" = protocol=6 | dir=in | app=c:\program files\lexmark 9500 series\lxdomon.exe | 
"TCP Query User{B2A7CF31-35B8-49BF-B4BA-9AE023FDFD4F}C:\program files\dassault systemes\b19\intel_a\code\bin\orbixd.exe" = protocol=6 | dir=in | app=c:\program files\dassault systemes\b19\intel_a\code\bin\orbixd.exe | 
"TCP Query User{C712E982-33AC-490A-8694-6DD694903A8E}C:\ruby_on_rails\bin\ruby.exe" = protocol=6 | dir=in | app=c:\ruby_on_rails\bin\ruby.exe | 
"TCP Query User{C9A69CEC-DB72-4B58-B85D-AF242CA87AF6}C:\program files\sony ericsson\mobile4\sync manager\dxp syncml.exe" = protocol=6 | dir=in | app=c:\program files\sony ericsson\mobile4\sync manager\dxp syncml.exe | 
"TCP Query User{E3D1B2D4-AC3A-48D6-B5BA-45EDA5AC6616}C:\users\francesco\appdata\local\temp\rar$ex00.568\miranda32.exe" = protocol=6 | dir=in | app=c:\users\francesco\appdata\local\temp\rar$ex00.568\miranda32.exe | 
"TCP Query User{FEB0A668-E68E-4C06-80FE-60ADDAC7FCAF}C:\program files\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe | 
"UDP Query User{00F951C0-CF7A-4795-B504-67B510CED32D}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe | 
"UDP Query User{093334AE-6DB1-4E69-983B-ADBAE9450D54}D:\vsk5\vsk5.exe" = protocol=17 | dir=in | app=d:\vsk5\vsk5.exe | 
"UDP Query User{292E75DB-1CC9-49D0-A3B2-DE33A372630E}C:\program files\lexmark 9500 series\frun.exe" = protocol=17 | dir=in | app=c:\program files\lexmark 9500 series\frun.exe | 
"UDP Query User{41C95001-C05A-4746-874F-BAEC1552544F}C:\program files\miranda im\miranda32.exe" = protocol=17 | dir=in | app=c:\program files\miranda im\miranda32.exe | 
"UDP Query User{640CCE79-6EB2-4A26-9711-5396F8B14043}C:\program files\miranda fusion 1.4.2+\miranda32.exe" = protocol=17 | dir=in | app=c:\program files\miranda fusion 1.4.2+\miranda32.exe | 
"UDP Query User{8643E1A7-71AC-4CD5-AB9B-841E98DEAD2E}C:\program files\dassault systemes\b19\intel_a\code\bin\cnext.exe" = protocol=17 | dir=in | app=c:\program files\dassault systemes\b19\intel_a\code\bin\cnext.exe | 
"UDP Query User{8A7F3D81-C6D3-4C94-82A9-D48A3739A883}C:\users\francesco\appdata\local\temp\rar$ex00.568\miranda32.exe" = protocol=17 | dir=in | app=c:\users\francesco\appdata\local\temp\rar$ex00.568\miranda32.exe | 
"UDP Query User{98308BCA-C33C-4ABE-9D8D-D7180D32D921}C:\program files\sony ericsson\mobile4\sync manager\dxp syncml.exe" = protocol=17 | dir=in | app=c:\program files\sony ericsson\mobile4\sync manager\dxp syncml.exe | 
"UDP Query User{9DCB448C-B6CC-4646-AD3E-EE2DFA7E669B}C:\program files\miranda fusion 1.4.2+\miranda32.exe" = protocol=17 | dir=in | app=c:\program files\miranda fusion 1.4.2+\miranda32.exe | 
"UDP Query User{B287E0B9-DD0C-423A-9263-064C1738335F}C:\program files\dassault systemes\b19\intel_a\code\bin\orbixd.exe" = protocol=17 | dir=in | app=c:\program files\dassault systemes\b19\intel_a\code\bin\orbixd.exe | 
"UDP Query User{B3518041-2B13-4AD9-90AB-8E0784F9F03C}C:\program files\lexmark 9500 series\lxdomon.exe" = protocol=17 | dir=in | app=c:\program files\lexmark 9500 series\lxdomon.exe | 
"UDP Query User{C933728E-2927-48E1-A8CC-0014261D4AA0}D:\vsk5 bei data\vsk5.exe" = protocol=17 | dir=in | app=d:\vsk5 bei data\vsk5.exe | 
"UDP Query User{DD146821-527F-48C0-84FC-F3E628C1CB4E}C:\program files\intuwave\shared\mrouterruntime\mrouterruntime.exe" = protocol=17 | dir=in | app=c:\program files\intuwave\shared\mrouterruntime\mrouterruntime.exe | 
"UDP Query User{E3D4C9F9-596A-456A-A332-710D0595A8BF}C:\program files\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe | 
"UDP Query User{F7C54C82-3082-465A-A690-612BECEDEEF5}C:\ruby_on_rails\bin\ruby.exe" = protocol=17 | dir=in | app=c:\ruby_on_rails\bin\ruby.exe | 
"UDP Query User{F86E18EB-2782-4D07-B6EC-78BAF863AFC8}C:\windows\system32\spool\drivers\w32x86\3\lxdopswx.exe" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdopswx.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{00428418-D4AE-4A2B-B866-825F0BF7EC67}" = LG PC Suite II
"{01501EBA-EC35-4F9F-8889-3BE346E5DA13}" = MSXML4 Parser
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID-Anmelde-Assistent
"{0CB9668D-F979-4F31-B8B8-67FE90F929F8}" = Bonjour
"{14DCD95A-EBA3-4BF0-B7EF-533852E99BE6}" = LG PC Suite II
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{248057F8-58C8-4E44-9182-9AF85DF787FC}" = Adobe Setup
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 26
"{310DFC2C-C918-4384-BFFF-245A8971D099}" = Parallels Tools
"{31A559C1-9E4D-423B-9DD3-34A6C5398752}" = HTC BMP USB Driver
"{362A43F1-D2C1-4C89-98B7-B9BD894D160D}" = Parallels runtime modules
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D9892BB-A751-4E48-ADC8-E4289956CE1D}" = QuickTime
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A5A427F-BA39-4BF0-9A47-9999FBE60C9F}" = Visual C++ Runtime for Dragon NaturallySpeaking
"{4D180A2C-9364-4384-8889-9DD425EC1497}" = PHP 5.3.3
"{501451DE-5808-4599-B544-8BD0915B6B24}_is1" = FreeRIP v3.081
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{59F6A514-9813-47A3-948C-8A155460CC2A}" = RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01
"{5BDD15BE-EFF5-436E-B0C1-1E63665854B9}" = BMWi-Softwarepaket 9.3
"{5C474A83-A45F-470C-9AC8-2BD1C251BF9A}" = Skype™ 4.2
"{64C1FA9A-FA94-4B6E-B3E4-8573738E4AD1}" = Adobe Setup
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF}" = Adobe Color Common Settings
"{6D6664A9-3342-4948-9B7E-034EFE366F0F}" = HTC Driver Installer
"{6DE6837F-F3A3-40FF-9F5C-A0B95948E32D}" = Dassault Systemes Software Prerequisites x86
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77D2A9D3-5800-43E3-B274-87841BC87DB2}" = Adobe ExtendScript Toolkit 2
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11170417}" = Luxor 2
"{85991ED2-010C-4930-96FA-52F43C2CE98A}" = Apple Mobile Device Support
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8815F011-43AF-4F50-BBD8-D78ED3D6F5B9}" = PRODUCT_NAME
"{8AE03988-8C8C-40EE-BDC7-76781BEF1B1D}" = Adobe Setup
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ULTIMATER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ULTIMATER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ULTIMATER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ULTIMATER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ULTIMATER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ULTIMATER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_PRJPRO_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}_ULTIMATER_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}_WebDesigner_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PRJPRO_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}_ULTIMATER_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}_WebDesigner_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PRJPRO_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}_ULTIMATER_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}_WebDesigner_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_PRJPRO_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}_ULTIMATER_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}_WebDesigner_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-003B-0000-0000-0000000FF1CE}" = Microsoft Office Project Professional 2007
"{90120000-003B-0000-0000-0000000FF1CE}_PRJPRO_{8446EB22-A746-46DC-B1BD-E0DFA1F3CDDA}" = Microsoft Office Project 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ULTIMATER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_PRJPRO_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}_ULTIMATER_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}_WebDesigner_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ULTIMATER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00B4-0407-0000-0000000FF1CE}" = Microsoft Office Project MUI (German) 2007
"{90120000-00B4-0407-0000-0000000FF1CE}_PRJPRO_{C8D442F2-CF33-486E-8079-A704A2E80A39}" = Microsoft Office Project 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ULTIMATER_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.ONENOTER_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.ONENOTER_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.ONENOTER_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.ONENOTER_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.ONENOTER_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.ONENOTER_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.ONENOTER_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-002E-0000-0000-0000000FF1CE}" = Microsoft Office Ultimate 2007
"{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{91140000-00A1-0000-0000-0000000FF1CE}" = Microsoft Office OneNote 2010
"{91140000-00A1-0000-0000-0000000FF1CE}_Office14.ONENOTER_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-A70000000000}" = Adobe Reader 7.0
"{AF145F8997B44EE9B106D018EF1DB58B}" = DivX Converter Mobile
"{AFF7E080-1974-45BF-9310-10DE1A1F5ED0}" = Adobe AIR
"{B2D328BE-45AD-4D92-96F9-2151490A203E}" = Apple Application Support
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B79920F8-AB6E-45B2-B257-900BBA969FF7}" = Presto! Forms 3.60.10
"{BD8A0C60-1AEB-11D6-B8E1-00025521AE60}" = VBA (3821b)
"{C3ABE126-2BB2-4246-BFE1-6797679B3579}" = LG USB Modem driver
"{C8BB4912-12D9-42AE-B571-E580D8CD1B5B}" = TuneUp Utilities 2007
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe  1.4.142.1
"{CE7FC1FF-8528-47F6-A67C-7017C14DBF3D}" = Control Media
"{D642E38E-0D24-486C-9A2D-E316DD696F4B}" = Microsoft XML Parser
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{E901C3E0-E37C-4645-9906-718C3A5FE59F}" = SnapAPI
"{EFFE151C-F863-4B1E-9E22-3C1369B4C690}" = phase6_17
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F7B0939E-58DF-11DF-B3A6-005056806466}" = Google Earth
"{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1" = StreamTransport version: 1.0.2.1975
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe_3e054d2218e7aa282c2369d939e58ff" = Adobe ExtendScript Toolkit 2
"Adobe_6c8e2cb4fd241c55406016127a6ab2e" = Adobe Color Common Settings
"Adobe_c5cbed37a01f242ac41d8f4528b7a0d" = Adobe Creative Suite 3 Design Standard hinzufügen oder entfernen
"AntiVir PersonalEdition Classic" = Avira AntiVir Personal - Free Antivirus
"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.7 (Unicode)
"Blender" = Blender (remove only)
"Bridge Construction Set Demo_is1" = Bridge Construction Set Demo 1.36
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFAOR2C06_118" = HDAUDIO Soft Data Fax Modem with SmartCP
"DAEMON Tools Lite" = DAEMON Tools Lite
"Dassault Systemes B19_0" = Dassault Systemes Software B19
"Derive 6" = Derive 6
"ee4p_is1" = Efficient Elements for presentations 1.2.0.89
"ElsterFormular 13.1.1.8531p" = ElsterFormular
"ESET Online Scanner" = ESET Online Scanner v3
"FormatFactory" = FormatFactory 2.00
"Free DVD Ripper 2.25_is1" = Free DVD Ripper Version 2.25
"Free YouTube to Mp3 Converter_is1" = Free YouTube to Mp3 Converter version 3.1
"FreeWAVToMP3Converter" = Free WAV To MP3 Converter 1.0
"GridVista" = Acer GridVista
"GSview 5.0" = GSview 5.0
"HTScript" = HTScript
"HyperCam 2" = HyperCam 2
"jZip" = jZip
"Lexmark 9500 Series" = Lexmark 9500 Series
"LHTTSGED" = L&H TTS3000 Deutsch
"Live 7.0.16" = Live 7.0.16
"LManager" = Launch Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.0.1400
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Miranda IM" = Miranda IM 0.7.8
"Mozilla Firefox (3.6.10)" = Mozilla Firefox (3.6.10)
"Muon Tau / mDrive" = 
"NeroMultiInstaller!UninstallKey" = Nero Suite
"NVIDIA Drivers" = NVIDIA Drivers
"Office14.ONENOTER" = Microsoft OneNote 2010
"PRJPRO" = Microsoft Office Project Professional 2007
"Shockwave" = Shockwave
"StoppUhr" = StoppUhr
"ULTIMATER" = Microsoft Office Ultimate 2007
"UltSounds" = Windows-Soundschemas
"Virtual DJ - Atomix Productions" = Virtual DJ - Atomix Productions
"VLC media player" = VLC media player 0.9.8a
"WAV to MP3" = WAV to MP3
"WinRAR archiver" = WinRAR
"winscp3_is1" = WinSCP 4.2.9
"XMoto" = X-Moto
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-1743292834-4225409643-1500153955-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"QUICKMEDIACONVERTER" = Converter
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 23.09.2012 08:40:22 | Computer Name = Francescos-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 82968
 
Error - 23.09.2012 09:57:37 | Computer Name = Francescos-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung wmpnetwk.exe, Version 11.0.6001.7000, Zeitstempel
 0x47919370, fehlerhaftes Modul Indiv01.key, Version 11.0.6000.7000, Zeitstempel
 0x474f7f87, Ausnahmecode 0xc0000005, Fehleroffset 0x000adacc,  Prozess-ID 0xdc0, 
Anwendungsstartzeit 01cd99935b65c190.
 
Error - 23.09.2012 09:58:25 | Computer Name = Francescos-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung wmpnetwk.exe, Version 11.0.6001.7000, Zeitstempel
 0x47919370, fehlerhaftes Modul Indiv01.key, Version 11.0.6000.7000, Zeitstempel
 0x474f7f87, Ausnahmecode 0xc0000005, Fehleroffset 0x000b0778,  Prozess-ID 0x510, 
Anwendungsstartzeit 01cd99937dbd250d.
 
Error - 23.09.2012 09:59:48 | Computer Name = Francescos-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung wmpnetwk.exe, Version 11.0.6001.7000, Zeitstempel
 0x47919370, fehlerhaftes Modul Indiv01.key, Version 11.0.6000.7000, Zeitstempel
 0x474f7f87, Ausnahmecode 0xc0000005, Fehleroffset 0x000ac993,  Prozess-ID 0xf50, 
Anwendungsstartzeit 01cd9993add4e898.
 
Error - 23.09.2012 10:01:06 | Computer Name = Francescos-PC | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 23.09.2012 23:20:51 | Computer Name = Francescos-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung wmpnetwk.exe, Version 11.0.6001.7000, Zeitstempel
 0x47919370, fehlerhaftes Modul Indiv01.key, Version 11.0.6000.7000, Zeitstempel
 0x474f7f87, Ausnahmecode 0xc0000005, Fehleroffset 0x000ab0db,  Prozess-ID 0x410, 
Anwendungsstartzeit 01cd9a0393b59906.
 
Error - 23.09.2012 23:21:29 | Computer Name = Francescos-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung wmpnetwk.exe, Version 11.0.6001.7000, Zeitstempel
 0x47919370, fehlerhaftes Modul Indiv01.key, Version 11.0.6000.7000, Zeitstempel
 0x474f7f87, Ausnahmecode 0xc0000005, Fehleroffset 0x000ab88a,  Prozess-ID 0xd8c, 
Anwendungsstartzeit 01cd9a03af8b50b8.
 
Error - 23.09.2012 23:22:02 | Computer Name = Francescos-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung wmpnetwk.exe, Version 11.0.6001.7000, Zeitstempel
 0x47919370, fehlerhaftes Modul Indiv01.key, Version 11.0.6000.7000, Zeitstempel
 0x474f7f87, Ausnahmecode 0xc0000005, Fehleroffset 0x000b0925,  Prozess-ID 0x4f4, 
Anwendungsstartzeit 01cd9a03c3cbb84e.
 
Error - 24.09.2012 07:44:49 | Computer Name = Francescos-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung moviemk.exe, Version 6.0.6002.18273, Zeitstempel
 0x4c1a4a61, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000,
 Ausnahmecode 0xc0000005, Fehleroffset 0x057bb5ed,  Prozess-ID 0x434, Anwendungsstartzeit
 01cd9a49f3c34244.
 
Error - 25.09.2012 03:56:30 | Computer Name = Francescos-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung WINWORD.EXE, Version 12.0.6661.5000, Zeitstempel
 0x4f7cd9da, fehlerhaftes Modul wwlib.dll, Version 12.0.6661.5000, Zeitstempel 0x4f7cdad7,
 Ausnahmecode 0xc0000005, Fehleroffset 0x00be8501,  Prozess-ID 0x734, Anwendungsstartzeit
 01cd9accf246c9c6.
 
[ Media Center Events ]
Error - 17.08.2008 15:34:41 | Computer Name = Francescos-PC | Source = MCUpdate | ID = 0
Description = Es konnte nicht auf den MCUpdate-Mutex gewartet werden. Ausnahme: 
'Der Wartezustand wurde aufgrund eines abgebrochenen Mutex beendet.'.
 
[ OSession Events ]
Error - 22.10.2008 11:28:46 | Computer Name = Francescos-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
 12.0.6316.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 326
 seconds with 120 seconds of active time.  This session ended with a crash.
 
Error - 18.02.2009 12:27:48 | Computer Name = Francescos-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6331.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 339
 seconds with 240 seconds of active time.  This session ended with a crash.
 
Error - 03.03.2009 02:50:45 | Computer Name = Francescos-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6331.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 1018
 seconds with 240 seconds of active time.  This session ended with a crash.
 
Error - 08.07.2009 14:40:51 | Computer Name = Francescos-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 188864
 seconds with 480 seconds of active time.  This session ended with a crash.
 
Error - 21.10.2009 03:28:04 | Computer Name = Francescos-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
 12.0.6504.5001, Microsoft Office Version: 12.0.6425.1000. This session lasted 0
 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error - 12.02.2010 15:59:53 | Computer Name = Francescos-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 13, Application Name: Microsoft Office OneNote, Application Version:
 12.0.6415.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 12
 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error - 12.08.2010 16:05:40 | Computer Name = Francescos-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 20, Application Name: Microsoft Expression Web, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.6425.1000. This session lasted 3706
 seconds with 2760 seconds of active time.  This session ended with a crash.
 
Error - 08.03.2011 06:39:47 | Computer Name = Francescos-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 40
 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error - 20.01.2012 11:32:05 | Computer Name = Francescos-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 13387
 seconds with 300 seconds of active time.  This session ended with a crash.
 
Error - 21.04.2012 18:31:30 | Computer Name = Francescos-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6612.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 206881
 seconds with 5280 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 23.09.2012 23:19:39 | Computer Name = Francescos-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 23.09.2012 23:19:39 | Computer Name = Francescos-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 23.09.2012 23:19:39 | Computer Name = Francescos-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 23.09.2012 23:19:39 | Computer Name = Francescos-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 23.09.2012 23:19:39 | Computer Name = Francescos-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 23.09.2012 23:19:39 | Computer Name = Francescos-PC | Source = Service Control Manager | ID = 7026
Description = 
 
Error - 23.09.2012 23:19:39 | Computer Name = Francescos-PC | Source = Service Control Manager | ID = 7023
Description = 
 
Error - 23.09.2012 23:20:58 | Computer Name = Francescos-PC | Source = Service Control Manager | ID = 7031
Description = 
 
Error - 23.09.2012 23:21:32 | Computer Name = Francescos-PC | Source = Service Control Manager | ID = 7031
Description = 
 
Error - 23.09.2012 23:22:06 | Computer Name = Francescos-PC | Source = Service Control Manager | ID = 7034
Description = 
 
 
< End of report >

--- --- ---

[/code]

cosinus · 26.09.2012, 15:24

Code:

ATTFilter

Windows Vista Ultimate Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 180.168.255.18 116.228.111.118
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9FF7C41C-6405-4A23-A055-6294675E070E}: DhcpNameServer = 180.168.255.18 116.228.111.118

Sieht mir stark nach einem gewerblichen PC aus! Ist das so oder irre ich mich? Bitte erlären warum Vista Ultimate und DHCP-Nameserver aus China?!

Firmenrechner werden hier eigentlich nicht bereinigt

Siehe => http://www.trojaner-board.de/108422-...-anfragen.html

Zitat:

3. Grundsätzlich bereinigen wir keine gewerblich genutzten Rechner. Dafür ist die IT Abteilung eurer Firma zuständig.

Bei Kleinunternehmen, welche keinen IT Support haben, machen wir da eine Ausnahme und helfen gerne ( kleine Spende hilft auch uns ).
Voraussetzung: Ihr teilt uns dies in eurer ersten Antwort mit.
Bedenkt jedoch, dass Logfiles viele heikle Informationen enthalten können ( Kundendaten, Bankdaten, etc ) sowie das Malware die Möglichkeit besitzt, diese auszuspähen und zu missbrauchen. Hier legen wir euch ein Formatieren und Neuaufsetzen nahe.

17.09.2012, 13:33	#2
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	USB Virus (auf Vista Parallels): Verknüfungen statt normale Ordner Code: ATTFilter Datenbank Version: v2012.07.03.05 Ein Scan mit so alten Signaturen ist fast wirkungslos und damit sinnfrei. Bitte den Vollscan mit aktuellen Signaturen wiederholen __________________ __________________

22.09.2012, 17:06	#8
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	USB Virus (auf Vista Parallels): Verknüfungen statt normale Ordner Hätte da mal zwei Fragen bevor es weiter geht (wir sind noch nicht fertig!) 1.) Geht der normale Modus von Windows (wieder) uneingeschränkt? 2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden? __________________ Logfiles bitte immer in CODE-Tags posten

23.09.2012, 18:25	#10
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	USB Virus (auf Vista Parallels): Verknüfungen statt normale Ordner Wieso beides mit ja, vermisst du denn was im Startmenü, ist da alles weg? __________________ Logfiles bitte immer in CODE-Tags posten

USB Virus (auf Vista Parallels): Verknüfungen statt normale Ordner

Log-Analyse und Auswertung: USB Virus (auf Vista Parallels): Verknüfungen statt normale Ordner