Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Rechner gesperrt - "Polizei - Ihr Computer wurde gesperrt"

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 18.09.2012, 17:14   #1
TheMexican
 
Rechner gesperrt - "Polizei - Ihr Computer wurde gesperrt" - Standard

Rechner gesperrt - "Polizei - Ihr Computer wurde gesperrt"



Hallo,
Ich habe mir gestern auf meinem Laptop den Polizei - Trojaner eingefangen, und seither keinen Zugriff darauf wenn ich versuche normal einzusteigen, da der Hinweisbildschirm aufscheint ueber die komplette Sperrung des Computers durch die automatische INformationskontrolle der Polizei.
Im sicheren Modus mit Netzwerktreibern habe ich zuerst "defogger" und dann "OTL" angewendet. Und zuletzt habe ich noch mit Malwarebytes gescannt.

Hier die Logfiles aus dem Quickscan von OTL.

OTL.Txt

Zitat:
OTL logfile created on: 18.09.2012 16:15:37 - Run 1
OTL by OldTimer - Version 3.2.63.0 Folder = C:\Daten\Download
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000C07 | Country: Austria | Language: DEA | Date Format: dd.MM.yyyy

5,80 Gb Total Physical Memory | 4,82 Gb Available Physical Memory | 83,09% Memory free
11,60 Gb Paging File | 10,77 Gb Available in Paging File | 92,84% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 565,43 Gb Total Space | 13,81 Gb Free Space | 2,44% Space Free | Partition Type: NTFS
Drive D: | 30,44 Gb Total Space | 4,47 Gb Free Space | 14,69% Space Free | Partition Type: NTFS
Drive G: | 99,34 Mb Total Space | 88,69 Mb Free Space | 89,29% Space Free | Partition Type: FAT32

Computer Name: OWNER-HP | User Name: owner | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012.09.18 16:15:00 | 000,600,576 | ---- | M] (OldTimer Tools) -- C:\Daten\Download\OTL.exe
PRC - [2010.09.15 21:30:08 | 000,739,664 | ---- | M] (DigitalPersona, Inc.) -- C:\Program Files (x86)\DigitalPersona\Bin\DPAgent.exe


========== Modules (No Company Name) ==========


========== Services (SafeList) ==========

SRV:64bit: - [2012.03.29 15:39:48 | 000,649,344 | ---- | M] (Genie9) [Auto | Stopped] -- C:\Program Files\Genie9\Genie Timeline\GenieTimelineService.exe -- (GenieTimelineService)
SRV:64bit: - [2011.05.13 18:58:10 | 000,030,520 | ---- | M] (Hewlett-Packard Company) [Auto | Stopped] -- C:\Windows\SysNative\hpservice.exe -- (hpsrv)
SRV:64bit: - [2010.09.15 21:30:34 | 000,440,144 | ---- | M] (DigitalPersona, Inc.) [Auto | Running] -- C:\Program Files\DigitalPersona\Bin\DpHostW.exe -- (DpHost)
SRV:64bit: - [2010.09.10 00:26:44 | 000,203,264 | ---- | M] (AMD) [Auto | Stopped] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2010.08.06 04:51:08 | 000,291,896 | ---- | M] (Hewlett-Packard Company) [Auto | Stopped] -- C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe -- (HPClientSvc)
SRV:64bit: - [2010.07.23 04:19:24 | 000,263,168 | ---- | M] (IDT, Inc.) [Auto | Stopped] -- C:\Program Files\IDT\WDM\stacsv64.exe -- (STacSV)
SRV:64bit: - [2010.07.21 23:33:00 | 000,103,992 | ---- | M] (Hewlett-Packard Company) [Auto | Stopped] -- C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe -- (HP Wireless Assistant Service)
SRV:64bit: - [2010.07.20 04:08:30 | 001,429,776 | ---- | M] (Intel(R) Corporation) [Auto | Stopped] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV:64bit: - [2010.07.20 03:48:36 | 000,340,240 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe -- (MyWiFiDHCPDNS)
SRV:64bit: - [2010.07.20 03:46:54 | 000,838,928 | ---- | M] (Intel(R) Corporation) [Auto | Stopped] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV:64bit: - [2010.06.08 01:39:40 | 000,911,872 | ---- | M] (Intel(R) Corporation) [Auto | Stopped] -- C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe -- (WiMAXAppSrv)
SRV:64bit: - [2010.06.08 01:34:20 | 000,408,576 | ---- | M] (Red Bend Ltd.) [Auto | Stopped] -- C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe -- (DMAgent)
SRV:64bit: - [2010.04.14 21:01:15 | 001,052,328 | ---- | M] ( ) [Auto | Stopped] -- C:\Windows\SysNative\lxedcoms.exe -- (lxed_device)
SRV:64bit: - [2010.04.14 21:01:07 | 000,045,736 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysNative\spool\DRIVERS\x64\3\\lxedserv.exe -- (lxedCATSCustConnectService)
SRV:64bit: - [2010.02.23 17:38:54 | 002,192,176 | ---- | M] (Validity Sensors, Inc.) [Auto | Stopped] -- C:\Windows\SysNative\vcsFPService.exe -- (vcsFPService)
SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009.03.04 04:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Stopped] -- C:\Program Files\IDT\WDM\AESTSr64.exe -- (AESTFilters)
SRV:64bit: - [2007.03.16 10:24:18 | 000,566,704 | ---- | M] ( ) [Auto | Stopped] -- C:\Windows\SysNative\lxbccoms.exe -- (lxbc_device)
SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.05.10 20:41:07 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.10 20:41:06 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.01.18 14:38:28 | 000,155,320 | ---- | M] (Avanquest Software) [On_Demand | Stopped] -- C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe -- (Sony PC Companion)
SRV - [2011.12.03 14:48:03 | 000,040,960 | ---- | M] () [Auto | Stopped] -- C:\Users\owner\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe -- (SearchAnonymizer)
SRV - [2011.10.28 09:23:05 | 000,066,872 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2011.07.05 17:02:58 | 000,227,384 | ---- | M] (Hewlett-Packard Company) [Auto | Stopped] -- C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe -- (HPDrvMntSvc.exe)
SRV - [2011.06.14 14:29:22 | 000,026,680 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Auto | Stopped] -- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe -- (HPWMISVC)
SRV - [2011.06.06 13:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.04.15 11:43:20 | 002,280,312 | ---- | M] (TeamViewer GmbH) [Auto | Stopped] -- C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe -- (TeamViewer6)
SRV - [2011.03.15 23:44:30 | 000,428,384 | ---- | M] (Sony Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe -- (PMBDeviceInfoProvider)
SRV - [2010.09.11 11:02:22 | 000,399,344 | ---- | M] (Roxio) [Auto | Stopped] -- C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe -- (RoxioNow Service)
SRV - [2010.06.19 03:59:12 | 000,246,520 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe -- (GameConsoleService)
SRV - [2010.06.02 01:31:28 | 002,804,568 | ---- | M] (Symantec Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe -- (NOBU)
SRV - [2010.05.01 19:21:14 | 002,533,400 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2010.05.01 19:21:14 | 000,325,656 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2010.04.14 21:01:07 | 000,045,736 | ---- | M] () [Auto | Stopped] -- C:\Windows\system32\spool\DRIVERS\x64\3\\lxedserv.exe -- (lxedCATSCustConnectService)
SRV - [2010.04.14 21:00:56 | 000,598,696 | ---- | M] ( ) [Auto | Stopped] -- C:\Windows\SysWOW64\lxedcoms.exe -- (lxed_device)
SRV - [2010.03.18 22:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.03.11 23:06:06 | 000,193,824 | ---- | M] (Protexis Inc.) [Auto | Stopped] -- c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)
SRV - [2010.02.23 17:19:02 | 001,799,472 | ---- | M] (Validity Sensors, Inc.) [Auto | Stopped] -- C:\Windows\SysWOW64\vcsFPService.exe -- (vcsFPService)
SRV - [2009.09.11 15:19:01 | 000,204,800 | ---- | M] ( ) [Auto | Stopped] -- C:\Program Files (x86)\Lexmark\LexPrint\lmablpml.dll -- (LexPrintListener)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008.06.02 15:55:26 | 000,823,296 | ---- | M] (Hauppauge Computer Works) [On_Demand | Stopped] -- C:\Program Files (x86)\WinTV\HCWTVServer.exe -- (HauppaugeTVServer)
SRV - [2008.05.30 11:07:20 | 000,437,248 | ---- | M] (Hauppauge Computer Works) [Auto | Stopped] -- C:\Program Files (x86)\WinTV\EPG Services\System\EPGService.exe -- (EPGService)
SRV - [2007.03.16 10:24:02 | 000,537,520 | ---- | M] ( ) [Auto | Stopped] -- C:\Windows\SysWOW64\lxbccoms.exe -- (lxbc_device)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2012.05.10 20:41:07 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.05.10 20:41:07 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.02.15 11:01:50 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011.12.16 22:47:39 | 000,027,176 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ggsemc.sys -- (ggsemc)
DRV:64bit: - [2011.12.16 22:47:39 | 000,013,352 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ggflt.sys -- (ggflt)
DRV:64bit: - [2011.12.08 06:22:40 | 000,161,280 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sscemdm.sys -- (sscemdm)
DRV:64bit: - [2011.12.08 06:22:40 | 000,127,488 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sscebus.sys -- (sscebus)
DRV:64bit: - [2011.12.08 06:22:40 | 000,018,944 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sscemdfl.sys -- (sscemdfl)
DRV:64bit: - [2011.10.26 21:48:51 | 000,314,016 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\atksgt.sys -- (atksgt)
DRV:64bit: - [2011.10.26 21:48:51 | 000,043,680 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\lirsgt.sys -- (lirsgt)
DRV:64bit: - [2011.10.14 04:37:44 | 000,396,848 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2011.10.11 15:00:01 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011.05.13 18:58:16 | 000,030,008 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\hpdskflt.sys -- (hpdskflt)
DRV:64bit: - [2011.05.13 18:57:58 | 000,043,320 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Accelerometer.sys -- (Accelerometer)
DRV:64bit: - [2011.05.04 08:26:09 | 008,507,392 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETwNs64.sys -- (NETwNs64)
DRV:64bit: - [2011.04.28 08:22:21 | 000,033,344 | ---- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)
DRV:64bit: - [2011.03.30 13:05:55 | 000,035,112 | ---- | M] (TeamViewer GmbH) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\teamviewervpn.sys -- (teamviewervpn)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.20 11:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2010.09.10 00:45:34 | 007,767,552 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2010.09.09 23:52:50 | 000,279,040 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2010.09.04 03:13:32 | 000,031,088 | ---- | M] (CyberLink Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\clwvd.sys -- (clwvd)
DRV:64bit: - [2010.08.16 23:15:56 | 000,039,832 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WDKMD.sys -- (wdkmd)
DRV:64bit: - [2010.07.29 00:10:42 | 010,610,400 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdpmd64.sys -- (intelkmd)
DRV:64bit: - [2010.07.29 00:10:42 | 010,610,400 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2010.07.23 04:19:24 | 000,515,584 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA)
DRV:64bit: - [2010.06.24 19:10:56 | 000,344,680 | ---- | M] (Realtek ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2010.05.17 03:28:38 | 000,175,104 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bpmp.sys -- (bpmp)
DRV:64bit: - [2010.05.17 03:28:30 | 000,081,920 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bpusb.sys -- (bpusb)
DRV:64bit: - [2010.05.17 03:28:28 | 000,071,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bpenum.sys -- (bpenum)
DRV:64bit: - [2010.05.06 15:21:46 | 000,125,456 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2010.05.01 19:21:00 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64)
DRV:64bit: - [2010.04.13 19:44:22 | 000,540,696 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010.01.12 16:31:04 | 000,232,992 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2009.10.27 14:39:44 | 000,151,936 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV:64bit: - [2009.06.10 23:01:11 | 001,485,312 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTDPV6.SYS -- (SrvHsfV92)
DRV:64bit: - [2009.06.10 23:01:11 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTCNXT6.SYS -- (SrvHsfWinac)
DRV:64bit: - [2009.06.10 23:01:11 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTAZL6.SYS -- (SrvHsfHDA)
DRV:64bit: - [2009.06.10 22:35:33 | 000,389,120 | ---- | M] (Marvell) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7)
DRV:64bit: - [2009.06.10 22:35:28 | 005,434,368 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netw5v64.sys -- (netw5v64)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.18 22:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2008.05.07 01:06:00 | 000,014,464 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wdcsam64.sys -- (WDC_SAM)
DRV:64bit: - [2008.04.17 17:59:12 | 000,047,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw95rc.sys -- (hcw95rc)
DRV:64bit: - [2008.04.17 17:58:40 | 000,919,552 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw95bda.sys -- (hcw95bda)
DRV:64bit: - [2007.03.28 03:18:58 | 010,550,272 | ---- | M] (Sonix Co. Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\snpstd3.sys -- (SNPSTD3)
DRV:64bit: - [2006.12.05 20:34:26 | 000,572,416 | ---- | M] (PixArt Imaging Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\PFC027.SYS -- (PAC207)
DRV - [2012.01.19 13:21:46 | 000,015,664 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPNOT/1
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.msn.com/HPNOT/1
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {ec29edf6-ad3c-4e1c-a087-d6cb81400c43}
IE:64bit: - HKLM\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = hxxp://search.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
IE:64bit: - HKLM\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = hxxp://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
IE:64bit: - HKLM\..\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}: "URL" = hxxp://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
IE:64bit: - HKLM\..\SearchScopes\{d944bb61-2e34-4dbf-a683-47e505c587dc}: "URL" = hxxp://rover.ebay.com/rover/1/711-111092-2357-0/4?satitle={searchTerms}&mfe=Notebooks
IE:64bit: - HKLM\..\SearchScopes\{ec29edf6-ad3c-4e1c-a087-d6cb81400c43}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPNOT/1
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.msn.com/HPNOT/1
IE - HKLM\..\SearchScopes,DefaultScope = {ec29edf6-ad3c-4e1c-a087-d6cb81400c43}
IE - HKLM\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = hxxp://search.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
IE - HKLM\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = hxxp://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
IE - HKLM\..\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}: "URL" = hxxp://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
IE - HKLM\..\SearchScopes\{d944bb61-2e34-4dbf-a683-47e505c587dc}: "URL" = hxxp://rover.ebay.com/rover/1/711-111092-2357-0/4?satitle={searchTerms}&mfe=Notebooks
IE - HKLM\..\SearchScopes\{ec29edf6-ad3c-4e1c-a087-d6cb81400c43}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPNOT/1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.msn.com/HPNOT/1
IE - HKCU\..\SearchScopes,DefaultScope = {ec29edf6-ad3c-4e1c-a087-d6cb81400c43}
IE - HKCU\..\SearchScopes\{02E8E085-7405-42C3-B759-F62AD8FA614B}: "URL" = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=13661e15-8fe4-49cc-82e2-14e33e3c9c2e&pid=fotofreeware&mode=bounce&k=0
IE - HKCU\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = hxxp://search.ask.com.anonymize-me.de/?anonymto=687474703A2F2F7365617263682E61736B2E636F6D2F7765623F713D7B7365617263687465726D737D266C3D646973266F3D48504E544446&st={searchTerms}&clid=13661 e15-8fe4-49cc-82e2-14e33e3c9c2e&pid=fotofreeware&k=0
IE - HKCU\..\SearchScopes\{43D80F8B-10A7-4DAB-A6D0-72401BCC82BB}: "URL" = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=13661e15-8fe4-49cc-82e2-14e33e3c9c2e&pid=fotofreeware&mode=bounce&k=0
IE - HKCU\..\SearchScopes\{75B1B06B-3C33-4884-A1C9-FD96EB3FFAA1}: "URL" = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=13661e15-8fe4-49cc-82e2-14e33e3c9c2e&pid=fotofreeware&mode=bounce&k=0
IE - HKCU\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = hxxp://search.yahoo.com.anonymize-me.de/?anonymto=687474703A2F2F7365617263682E7961686F6F2E636F6D2F7365617263683F703D7B7365617263685465726D737D2665693D7B696E707574456E636F64696E677D2666723D63 68722D68702D70736726747970653D48504E544446&st={searchTerms}&clid=13661e15-8fe4-49cc-82e2-14e33e3c9c2e&pid=fotofreeware&k=0
IE - HKCU\..\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}: "URL" = hxxp://en.wikipedia.org.anonymize-me.de/?anonymto=687474703A2F2F656E2E77696B6970656469612E6F72672F77696B692F5370656369616C3A5365617263683F7365617263683D7B7365617263685465726D737D&st={searchT erms}&clid=13661e15-8fe4-49cc-82e2-14e33e3c9c2e&pid=fotofreeware&k=0
IE - HKCU\..\SearchScopes\{d944bb61-2e34-4dbf-a683-47e505c587dc}: "URL" = hxxp://rover.ebay.com.anonymize-me.de/?anonymto=687474703A2F2F726F7665722E656261792E636F6D2F726F7665722F312F3731312D3131313039322D323335372D302F343F73617469746C653D7B7365617263685465726D73 7D266D66653D4E6F7465626F6F6B73&st={searchTerms}&clid=13661e15-8fe4-49cc-82e2-14e33e3c9c2e&pid=fotofreeware&k=0
IE - HKCU\..\SearchScopes\{ec29edf6-ad3c-4e1c-a087-d6cb81400c43}: "URL" = hxxp://www.bing.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E62696E672E636F6D2F7365617263683F713D7B7365617263685465726D737D26666F726D3D48504E5444462670633D48504E544446267372633D49 452D536561726368426F78&st={searchTerms}&clid=13661e15-8fe4-49cc-82e2-14e33e3c9c2e&pid=fotofreeware&k=0
IE - HKCU\..\SearchScopes\{EE3EEBE8-06FC-40B6-AF47-631B75934239}: "URL" = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=13661e15-8fe4-49cc-82e2-14e33e3c9c2e&pid=fotofreeware&mode=bounce&k=0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Search the web"
FF - prefs.js..browser.search.order.1: "Search the web"
FF - prefs.js..browser.search.selectedEngine: "Search the web"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledAddons: {75656794-AB59-4712-BFBC-5D816D56F3BC}:1.1.8
FF - prefs.js..extensions.enabledAddons: 2020Player_IKEA@2020Technologies.com:5.0.7.0
FF - prefs.js..extensions.enabledAddons: welcome@toolmin.com:1.03
FF - prefs.js..extensions.enabledAddons: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.2.145
FF - prefs.js..extensions.enabledAddons: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.7
FF - prefs.js..extensions.enabledAddons: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.9.9
FF - prefs.js..extensions.enabledAddons: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:15.0.2
FF - prefs.js..keyword.URL: "hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q="
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q="

FF - user.js..browser.search.selectedEngine: "Search the web"
FF - user.js..browser.search.order.1: "Search the web"
FF - user.js..browser.search.defaultenginename: "Search the web"
FF - user.js..keyword.URL: "hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q="

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_262.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll (Nexon)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@photoproduct.rocketlife.com/RocketLife App Viewer;version=0.8: File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.2.72: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.2.72: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.2.72: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.2.72: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=15.0.2.72: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@hulu.com/Hulu Desktop: C:\Windows\..\Users\Default\AppData\Local\HuluDesktop\instances\0.9.13.1\npHDPlg.dll ()
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\otis@digitalpersona.com: C:\Program Files (x86)\DigitalPersona\Bin\FirefoxExt\ [2011.02.08 11:14:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011.11.13 20:29:57 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012.04.19 22:03:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.04.19 22:03:03 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.04.19 22:03:18 | 000,000,000 | ---D | M]

[2012.04.29 15:46:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\owner\AppData\Roaming\mozilla\Extensions
[2012.04.29 15:46:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\owner\AppData\Roaming\mozilla\Extensions\songbird@songbirdnest.com
[2012.04.23 01:38:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\owner\AppData\Roaming\mozilla\Firefox\Profiles\iswmnj48.default\extensions
[2011.07.14 07:46:53 | 000,000,000 | ---D | M] (Burn4Free DB Toolbar) -- C:\Users\owner\AppData\Roaming\mozilla\Firefox\Profiles\iswmnj48.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}
[2011.04.29 09:08:25 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\owner\AppData\Roaming\mozilla\Firefox\Profiles\iswmnj48.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.03.31 21:12:40 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\owner\AppData\Roaming\mozilla\Firefox\Profiles\iswmnj48.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011.10.24 00:31:33 | 000,000,000 | ---D | M] (20-20 3D Viewer - IKEA) -- C:\Users\owner\AppData\Roaming\mozilla\Firefox\Profiles\iswmnj48.default\extensions\2020Player_IKEA@2020Technologies.com
[2011.11.13 21:35:16 | 000,000,000 | ---D | M] (toolplugin) -- C:\Users\owner\AppData\Roaming\mozilla\Firefox\Profiles\iswmnj48.default\extensions\welcome@toolmin.com
[2011.07.01 03:33:37 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2011.07.01 03:33:37 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011.11.13 20:29:57 | 000,000,000 | ---D | M] (DivX Plus Web Player HTML5 <video&gt -- C:\PROGRAM FILES (X86)\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\DIVXHTML5
[2012.04.19 22:03:08 | 000,000,000 | ---D | M] (RealPlayer Browser Record Plugin) -- C:\PROGRAMDATA\REAL\REALPLAYER\BROWSERRECORDPLUGIN\FIREFOX\EXT
[2011.09.09 01:07:25 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.07.01 03:33:25 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011.03.22 20:38:12 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2011.12.03 14:48:20 | 000,001,686 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.12.03 14:48:20 | 000,001,937 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011.12.03 14:48:20 | 000,001,273 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011.12.03 14:48:20 | 000,007,053 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.11.13 21:35:16 | 000,000,158 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\Search the web.src
[2011.12.03 14:48:20 | 000,001,280 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.12.03 14:48:20 | 000,001,172 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (no name) - AutorunsDisabled - No CLSID value found.
O2 - BHO: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files (x86)\Lexmark Toolbar\toolband.dll ()
O2 - BHO: (Winamp Toolbar Loader) - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files (x86)\Winamp Toolbar\winamptb.dll (AOL Inc.)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Lexmark ) - {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Program Files\Lexmark Printable Web\bho.dll ()
O2 - BHO: (SMTTB2009 Class) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files (x86)\Burn4Free DB Toolbar\tbcore3.dll ()
O2 - BHO: (no name) - AutorunsDisabled - No CLSID value found.
O3 - HKLM\..\Toolbar: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files (x86)\Lexmark Toolbar\toolband.dll ()
O3 - HKLM\..\Toolbar: (Burn4Free DB Toolbar) - {338B4DFE-2E2C-4338-9E41-E176D497299E} - C:\Program Files (x86)\Burn4Free DB Toolbar\tbcore3.dll ()
O3 - HKLM\..\Toolbar: (toolplugin) - {DFEFCDEE-CF1A-4FC8-89AF-189327213627} - C:\Users\owner\AppData\Roaming\toolplugin\toolbar.dll File not found
O3 - HKLM\..\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files (x86)\Winamp Toolbar\winamptb.dll (AOL Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files (x86)\Lexmark Toolbar\toolband.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Burn4Free DB Toolbar) - {338B4DFE-2E2C-4338-9E41-E176D497299E} - C:\Program Files (x86)\Burn4Free DB Toolbar\tbcore3.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Winamp Toolbar) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Program Files (x86)\Winamp Toolbar\winamptb.dll (AOL Inc.)
O4:64bit: - HKLM..\Run: [Monitor] C:\Windows\PixArt\Pac207\Monitor.exe (PixArt Imaging Incorporation)
O4:64bit: - HKLM..\Run: [Ocs_SM] C:\Users\owner\AppData\Roaming\OCS\SM\SearchAnonymizer.exe (OCS)
O4:64bit: - HKLM..\Run: [snpstd3] C:\Windows\vsnpstd3.exe ()
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [EPGServiceTool] C:\Program Files (x86)\WinTV\EPG Services\System\EPGClient.exe (Hauppauge Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [frbcmqrrznlenro] C:\ProgramData\frbcmqrr.exe ()
O4 - Startup: C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\owner\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktopCleanupWizard = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideClock = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewContextMenu = 0
O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\owner\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8:64bit: - Extra context menu item: Free YouTube to iPhone Converter - C:\Users\owner\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetoiphoneconverter.htm ()
O8:64bit: - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\owner\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8:64bit: - Extra context menu item: Search the Web - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\menuext.html File not found
O8 - Extra context menu item: Free YouTube Download - C:\Users\owner\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to iPhone Converter - C:\Users\owner\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetoiphoneconverter.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\owner\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Search the Web - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\menuext.html File not found
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16:64bit: - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.186.211.21 195.34.133.21
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5C57B477-548C-4F70-8DC6-3433E8761F49}: DhcpNameServer = 212.186.211.21 195.34.133.21
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Program Files (x86)\DigitalPersona\Bin\DPAgent.exe) - C:\Program Files (x86)\DigitalPersona\Bin\DPAgent.exe (DigitalPersona, Inc.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O22:64bit: - SharedTaskScheduler: {1984DD45-52CF-49cd-AB77-18F378FEA264} - FencesShellExt - C:\Program Files\Stardock\Fences Pro\FencesMenu64.dll (Stardock)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{b1d7d22a-54f9-11e0-90d7-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{b1d7d22a-54f9-11e0-90d7-806e6f6e6963}\Shell\AutoRun\command - "" = E:\autorun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012.09.18 01:19:28 | 000,000,000 | ---D | C] -- C:\ProgramData\kufaavjxzwqpuvv
[2012.09.16 00:57:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Farm Frenzy
[2012.09.16 00:55:37 | 000,000,000 | ---D | C] -- C:\Users\owner\AppData\Local\ApplicationHistory
[2012.09.13 21:15:59 | 000,000,000 | ---D | C] -- C:\Users\owner\Documents\Command & Conquer 3 Tiberium Wars
[2012.09.13 20:46:26 | 000,000,000 | ---D | C] -- C:\Users\owner\AppData\Roaming\Command & Conquer 3 Tiberium Wars
[2012.09.12 19:22:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Electronic Arts
[2012.09.12 17:03:16 | 000,000,000 | ---D | C] -- C:\Users\owner\AppData\Local\Microsoft Help
[2012.09.11 20:48:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\IviSDK
[2012.09.11 20:48:05 | 000,000,000 | ---D | C] -- C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Hauppauge WinTV
[2012.09.11 20:47:59 | 000,118,784 | ---- | C] (Hauppauge Computer Works Inc) -- C:\Windows\SysWow64\HCWSched.ocx
[2012.09.11 20:47:59 | 000,069,632 | ---- | C] (Hauppauge Computer Works ) -- C:\Windows\SysWow64\3DES.dll
[2012.09.11 20:47:59 | 000,040,960 | ---- | C] (Hauppauge Computer Works) -- C:\Windows\SysWow64\HcwTvTvOCX.ocx
[2012.09.11 20:47:59 | 000,028,672 | ---- | C] (Hauppauge Computer Works) -- C:\Windows\SysWow64\hcwsched.dll
[2012.09.11 20:47:58 | 000,073,792 | ---- | C] (Hauppauge Computer Works, Inc) -- C:\Windows\SysWow64\CHSUITE.OCX
[2012.09.11 20:47:58 | 000,053,248 | ---- | C] (Hauppauge) -- C:\Windows\SysWow64\MDCustomPanels.ocx
[2012.09.11 20:47:49 | 000,204,800 | ---- | C] (Hauppauge Computer Works) -- C:\Windows\SysWow64\Mdcustoms.ocx
[2012.09.11 20:47:28 | 000,000,000 | ---D | C] -- C:\MyVideos
[2012.09.11 20:47:26 | 000,806,985 | ---- | C] (Hauppauge Computer Works) -- C:\Windows\SysWow64\hcwtvwnd.dll
[2012.09.11 20:47:26 | 000,213,066 | ---- | C] (Hauppauge Computer Works) -- C:\Windows\SysWow64\hcwdvbsubtitles.ax
[2012.09.11 20:47:26 | 000,204,871 | ---- | C] (Hauppauge Computer Works, Inc.) -- C:\Windows\SysWow64\HCWPsiParser.ax
[2012.09.11 20:47:26 | 000,176,197 | ---- | C] (Hauppauge Computer Works Inc.) -- C:\Windows\SysWow64\hcwmux.ax
[2012.09.11 20:47:26 | 000,118,851 | ---- | C] (Hauppauge Computer Works, Inc.) -- C:\Windows\SysWow64\hcwNowNext.ax
[2012.09.11 20:47:26 | 000,094,208 | ---- | C] (Hauppuage Computer Works) -- C:\Windows\SysWow64\hcwsstereo.ax
[2012.09.11 20:47:26 | 000,090,190 | ---- | C] (Hauppauge Computer Works) -- C:\Windows\SysWow64\Bt848WST.DLL
[2012.09.11 20:47:26 | 000,073,728 | ---- | C] (Hauppauge Computer Works, Inc.) -- C:\Windows\SysWow64\hcwSnap.ax
[2012.09.11 20:47:26 | 000,069,632 | ---- | C] (Hauppauge Computer Works, Inc.) -- C:\Windows\SysWow64\hcwPP2PP.ocx
[2012.09.11 20:47:26 | 000,053,248 | ---- | C] (DScaler Project, see hxxp://www.dscaler.org/) -- C:\Windows\SysWow64\HCWdlace.ax
[2012.09.11 20:47:26 | 000,036,921 | ---- | C] (Hauppauge Computer Works) -- C:\Windows\SysWow64\hcwutl32.dll
[2012.09.11 20:47:26 | 000,030,720 | ---- | C] (Hauppauge Computer Works) -- C:\Windows\SysWow64\hcwWinTVCI.dll
[2012.09.11 20:47:25 | 000,081,920 | ---- | C] (Hauppauge Computer Works, Inc.) -- C:\Windows\SysWow64\hcwSplit.ax
[2012.09.11 20:47:25 | 000,081,920 | ---- | C] (Hauppauge Computer Works, Inc.) -- C:\Windows\SysWow64\hcwNull.ax
[2012.09.11 20:47:19 | 000,294,968 | ---- | C] (Hauppauge Computer Works) -- C:\Windows\SysWow64\hcwpnp32.dll
[2012.09.11 20:47:19 | 000,077,824 | ---- | C] (Hauppauge Computer Works) -- C:\Windows\SysWow64\hcwTVDlg.deu
[2012.09.11 20:47:19 | 000,061,440 | ---- | C] (Hauppauge Computer Works) -- C:\Windows\SysWow64\hcwChan.deu
[2012.09.11 20:47:18 | 000,213,050 | ---- | C] (Hauppauge Computer Works) -- C:\Windows\SysWow64\hcwChan.dll
[2012.09.11 20:47:18 | 000,106,559 | ---- | C] (Hauppauge Computer Works) -- C:\Windows\SysWow64\hcwTVDlg.dll
[2012.09.11 20:47:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hauppauge WinTV
[2012.09.11 20:47:11 | 000,393,216 | ---- | C] (Snowbound Software Corporation (www.Snowbnd.com)) -- C:\Windows\SysWow64\hcwsnbd9.dll
[2012.09.11 20:47:11 | 000,073,728 | ---- | C] (Hauppauge Computer Works, Inc.) -- C:\Windows\SysWow64\hcwFRead.ax
[2012.09.11 20:47:11 | 000,065,536 | ---- | C] (Hauppauge Computer Works) -- C:\Windows\SysWow64\hcwDlg.deu
[2012.09.11 20:47:11 | 000,057,344 | ---- | C] (Hauppauge Computer Works, Inc.) -- C:\Windows\SysWow64\hcwFWrit.ax
[2012.09.11 20:47:10 | 000,106,552 | ---- | C] (Hauppauge Computer Works, Inc.) -- C:\Windows\SysWow64\hcwi2c32.dll
[2012.09.11 20:47:10 | 000,065,536 | ---- | C] (Hauppauge Computer Works) -- C:\Windows\SysWow64\hcwDlg.ocx
[2012.09.11 20:47:10 | 000,011,264 | ---- | C] (Hauppauge Computer Works) -- C:\Windows\SysWow64\hcwhook.dll
[2012.09.11 20:47:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WinTV
[2012.09.11 20:44:43 | 000,919,552 | ---- | C] (Hauppauge Computer Works, Inc.) -- C:\Windows\SysNative\drivers\hcw95bda.sys
[2012.09.11 20:44:43 | 000,047,232 | ---- | C] (Hauppauge Computer Works, Inc.) -- C:\Windows\SysNative\hcw95rc.sys
[2012.09.11 20:44:43 | 000,047,232 | ---- | C] (Hauppauge Computer Works, Inc.) -- C:\Windows\SysNative\drivers\hcw95rc.sys
[2012.09.11 19:58:49 | 000,000,000 | ---D | C] -- C:\Users\owner\AppData\Local\Macromedia
[2012.09.10 11:54:13 | 000,000,000 | ---D | C] -- C:\Users\owner\Desktop\New folder
[2012.09.05 21:23:18 | 000,000,000 | ---D | C] -- C:\Users\owner\Desktop\Moni Fotos
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\owner\Desktop\*.tmp files -> C:\Users\owner\Desktop\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012.09.18 16:14:13 | 000,000,000 | ---- | M] () -- C:\Users\owner\defogger_reenable
[2012.09.18 15:58:30 | 000,744,006 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.09.18 15:58:30 | 000,627,742 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.09.18 15:58:30 | 000,111,320 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.09.18 15:53:53 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.09.18 15:53:52 | 377,901,055 | -HS- | M] () -- C:\hiberfil.sys
[2012.09.18 01:19:28 | 000,074,135 | ---- | M] () -- C:\ProgramData\fuzzpmbsfjpgbuj
[2012.09.18 01:17:21 | 000,084,480 | ---- | M] () -- C:\ProgramData\frbcmqrr.exe
[2012.09.18 01:17:21 | 000,084,480 | ---- | M] () -- C:\Users\owner\0.6146328617810239.exe
[2012.09.17 22:53:35 | 000,023,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.09.17 22:53:35 | 000,023,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.09.17 22:17:55 | 000,000,332 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForowner.job
[2012.09.17 20:18:57 | 000,088,363 | ---- | M] () -- C:\Users\owner\Desktop\Moni snapshot.jpg
[2012.09.14 12:40:26 | 000,006,018 | ---- | M] () -- C:\Users\owner\Desktop\elbi_umsaetze_20120914124002.csv
[2012.09.11 20:48:37 | 000,001,084 | ---- | M] () -- C:\Users\owner\Desktop\WinTV Benutzerhandbuch.lnk
[2012.09.11 20:48:33 | 000,000,030 | ---- | M] () -- C:\Windows\SysWow64\UNWISE.INI
[2012.09.11 20:48:14 | 000,006,235 | ---- | M] () -- C:\Windows\HCWPNP.INI
[2012.09.11 20:48:05 | 000,032,295 | ---- | M] () -- C:\Windows\Irremote.ini
[2012.09.11 20:48:05 | 000,001,000 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AutoStart IR.lnk
[2012.09.11 20:47:28 | 000,000,209 | ---- | M] () -- C:\Windows\ODBCINST.INI
[2012.09.11 20:47:28 | 000,000,135 | ---- | M] () -- C:\Windows\ODBC.INI
[2012.09.11 20:47:12 | 000,000,951 | ---- | M] () -- C:\Users\Public\Desktop\WinTV.lnk
[2012.09.11 15:42:12 | 006,502,693 | ---- | M] () -- C:\Users\owner\Desktop\WG111v2_v4.0.0.zip
[2012.09.10 11:08:33 | 000,478,432 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\owner\Desktop\*.tmp files -> C:\Users\owner\Desktop\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012.09.18 16:14:13 | 000,000,000 | ---- | C] () -- C:\Users\owner\defogger_reenable
[2012.09.18 01:19:28 | 000,084,480 | ---- | C] () -- C:\ProgramData\frbcmqrr.exe
[2012.09.18 01:17:23 | 000,074,135 | ---- | C] () -- C:\ProgramData\fuzzpmbsfjpgbuj
[2012.09.18 01:17:21 | 000,084,480 | ---- | C] () -- C:\Users\owner\0.6146328617810239.exe
[2012.09.17 20:18:57 | 000,088,363 | ---- | C] () -- C:\Users\owner\Desktop\Moni snapshot.jpg
[2012.09.14 12:40:04 | 000,006,018 | ---- | C] () -- C:\Users\owner\Desktop\elbi_umsaetze_20120914124002.csv
[2012.09.11 20:48:37 | 000,001,084 | ---- | C] () -- C:\Users\owner\Desktop\WinTV Benutzerhandbuch.lnk
[2012.09.11 20:48:33 | 000,000,030 | ---- | C] () -- C:\Windows\SysWow64\UNWISE.INI
[2012.09.11 20:48:32 | 000,149,504 | ---- | C] () -- C:\Windows\SysWow64\UNWISE.EXE
[2012.09.11 20:48:05 | 000,032,295 | ---- | C] () -- C:\Windows\Irremote.ini
[2012.09.11 20:48:05 | 000,001,000 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AutoStart IR.lnk
[2012.09.11 20:47:58 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\dmcrypto.dll
[2012.09.11 20:47:49 | 000,046,680 | ---- | C] () -- C:\Windows\SysWow64\HCWTVServer.tlb
[2012.09.11 20:47:28 | 000,000,209 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2012.09.11 20:47:28 | 000,000,135 | ---- | C] () -- C:\Windows\ODBC.INI
[2012.09.11 20:47:26 | 000,413,696 | ---- | C] () -- C:\Windows\SysWow64\HCWChMgr.ocx
[2012.09.11 20:47:26 | 000,163,840 | ---- | C] () -- C:\Windows\SysWow64\hcwChDB.dll
[2012.09.11 20:47:26 | 000,023,304 | ---- | C] () -- C:\Windows\SysWow64\HcwChDB.tlb
[2012.09.11 20:47:12 | 000,000,951 | ---- | C] () -- C:\Users\Public\Desktop\WinTV.lnk
[2012.09.11 20:47:11 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\hcwChMgr.deu
[2012.09.11 20:46:37 | 000,006,235 | ---- | C] () -- C:\Windows\HCWPNP.INI
[2012.09.11 15:42:07 | 006,502,693 | ---- | C] () -- C:\Users\owner\Desktop\WG111v2_v4.0.0.zip
[2012.09.04 13:25:50 | 000,000,332 | ---- | C] () -- C:\Windows\tasks\HPCeeScheduleForowner.job
[2012.01.31 02:15:44 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2012.01.31 02:15:42 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2012.01.31 02:15:42 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2012.01.31 02:15:42 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2012.01.31 02:15:42 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2011.12.16 21:55:58 | 000,038,431 | ---- | C] () -- C:\Users\owner\AppData\Roaming\Tabulatorgetrennte Werte (Windows).ADR
[2011.12.16 21:50:50 | 000,038,241 | ---- | C] () -- C:\Users\owner\AppData\Roaming\Microsoft Access 97-2003.ADR
[2011.11.29 19:50:02 | 000,038,421 | ---- | C] () -- C:\Users\owner\AppData\Roaming\Microsoft Excel 97-2003.ADR
[2011.11.24 23:00:10 | 000,344,064 | ---- | C] () -- C:\Windows\SysWow64\lxedcomx.dll
[2011.11.24 23:00:10 | 000,331,776 | ---- | C] () -- C:\Windows\SysWow64\LXEDinst.dll
[2011.11.24 23:00:09 | 000,643,072 | ---- | C] ( ) -- C:\Windows\SysWow64\lxedpmui.dll
[2011.11.24 23:00:09 | 000,364,544 | ---- | C] ( ) -- C:\Windows\SysWow64\lxedinpa.dll
[2011.11.24 23:00:09 | 000,344,064 | ---- | C] ( ) -- C:\Windows\SysWow64\lxediesc.dll
[2011.11.24 23:00:09 | 000,114,688 | ---- | C] () -- C:\Windows\SysWow64\lxedinsr.dll
[2011.11.24 23:00:09 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\lxedjswr.dll
[2011.11.24 23:00:09 | 000,036,864 | ---- | C] () -- C:\Windows\SysWow64\lxedcur.dll
[2011.11.24 23:00:08 | 001,048,576 | ---- | C] ( ) -- C:\Windows\SysWow64\lxedserv.dll
[2011.11.24 23:00:08 | 000,847,872 | ---- | C] ( ) -- C:\Windows\SysWow64\lxedusb1.dll
[2011.11.24 23:00:08 | 000,323,584 | ---- | C] () -- C:\Windows\SysWow64\lxedins.dll
[2011.11.24 23:00:08 | 000,262,144 | ---- | C] () -- C:\Windows\SysWow64\lxedinsb.dll
[2011.11.24 23:00:08 | 000,253,952 | ---- | C] () -- C:\Windows\SysWow64\lxedcu.dll
[2011.11.24 23:00:08 | 000,090,112 | ---- | C] () -- C:\Windows\SysWow64\lxedcub.dll
[2011.11.24 23:00:07 | 000,688,128 | ---- | C] ( ) -- C:\Windows\SysWow64\lxedhbn3.dll
[2011.11.24 23:00:07 | 000,577,536 | ---- | C] ( ) -- C:\Windows\SysWow64\lxedlmpm.dll
[2011.11.24 23:00:07 | 000,324,264 | ---- | C] ( ) -- C:\Windows\SysWow64\lxedih.exe
[2011.11.24 23:00:06 | 000,802,816 | ---- | C] ( ) -- C:\Windows\SysWow64\lxedcomc.dll
[2011.11.24 23:00:06 | 000,598,696 | ---- | C] ( ) -- C:\Windows\SysWow64\lxedcoms.exe
[2011.11.24 23:00:06 | 000,373,416 | ---- | C] ( ) -- C:\Windows\SysWow64\lxedcfg.exe
[2011.11.24 23:00:06 | 000,372,736 | ---- | C] ( ) -- C:\Windows\SysWow64\lxedcomm.dll
[2011.11.24 22:53:21 | 000,024,064 | ---- | C] () -- C:\Windows\SysWow64\LXEDsmr.dll
[2011.11.24 22:53:20 | 000,299,008 | ---- | C] () -- C:\Windows\SysWow64\LXEDsm.dll
[2011.11.21 00:29:01 | 000,029,151 | ---- | C] () -- C:\Users\owner\AppData\Roaming\Kommagetrennte Werte (Windows).ADR
[2011.11.09 00:20:57 | 000,001,854 | ---- | C] () -- C:\Users\owner\AppData\Roaming\GhostObjGAFix.xml
[2011.11.06 20:47:23 | 000,165,376 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2011.10.28 09:23:11 | 000,103,736 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011.10.28 09:23:05 | 000,669,184 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe
[2011.10.28 09:23:05 | 000,066,872 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2011.06.12 20:47:35 | 000,000,212 | ---- | C] () -- C:\Windows\Lexstat.ini
[2011.06.11 21:31:31 | 001,224,704 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbcserv.dll
[2011.06.11 21:31:31 | 000,995,328 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbcusb1.dll
[2011.06.11 21:31:31 | 000,696,320 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbchbn3.dll
[2011.06.11 21:31:31 | 000,684,032 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbccomc.dll
[2011.06.11 21:31:31 | 000,643,072 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbcpmui.dll
[2011.06.11 21:31:31 | 000,585,728 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbclmpm.dll
[2011.06.11 21:31:31 | 000,537,520 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbccoms.exe
[2011.06.11 21:31:31 | 000,421,888 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbccomm.dll
[2011.06.11 21:31:31 | 000,413,696 | ---- | C] () -- C:\Windows\SysWow64\lxbcutil.dll
[2011.06.11 21:31:31 | 000,413,696 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbcinpa.dll
[2011.06.11 21:31:31 | 000,397,312 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbciesc.dll
[2011.06.11 21:31:31 | 000,385,968 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbcih.exe
[2011.06.11 21:31:31 | 000,381,872 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbccfg.exe
[2011.06.11 21:31:31 | 000,274,432 | ---- | C] () -- C:\Windows\SysWow64\LXBCinst.dll
[2011.06.11 21:31:31 | 000,181,168 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbcppls.exe
[2011.06.11 21:31:31 | 000,163,840 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbcprox.dll
[2011.06.11 21:31:31 | 000,094,208 | ---- | C] ( ) -- C:\Windows\SysWow64\lxbcpplc.dll
[2011.05.06 06:58:02 | 000,001,682 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys
[2011.05.04 08:25:33 | 000,749,044 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.04.10 03:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011.02.08 10:49:43 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011.02.08 10:38:33 | 000,002,857 | ---- | C] () -- C:\Windows\SysWow64\atipblup.dat
[2011.02.08 10:37:07 | 000,000,299 | ---- | C] () -- C:\Windows\SysWow64\RStoneLog2.ini
[2011.02.08 10:37:07 | 000,000,240 | ---- | C] () -- C:\Windows\SysWow64\RStoneLog.ini
[2010.10.16 21:42:34 | 000,000,188 | ---- | C] () -- C:\Windows\SysWow64\HPWA.ini
[2010.09.21 20:30:44 | 000,007,736 | ---- | C] () -- C:\Windows\hpDSTRES.DLL

========== ZeroAccess Check ==========

[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

========== LOP Check ==========

[2011.06.20 10:10:10 | 000,000,000 | ---D | M] -- C:\Users\owner\AppData\Roaming\BitTorrent
[2011.04.26 19:10:06 | 000,000,000 | ---D | M] -- C:\Users\owner\AppData\Roaming\Blio
[2011.05.04 22:26:06 | 000,000,000 | ---D | M] -- C:\Users\owner\AppData\Roaming\com.nyt.timesreader.78C54164786ADE80CB31E1C5D95607D0938C987A.1
[2012.09.13 21:15:38 | 000,000,000 | ---D | M] -- C:\Users\owner\AppData\Roaming\Command & Conquer 3 Tiberium Wars
[2011.05.02 11:19:50 | 000,000,000 | ---D | M] -- C:\Users\owner\AppData\Roaming\DAEMON Tools Lite
[2012.04.19 22:01:33 | 000,000,000 | ---D | M] -- C:\Users\owner\AppData\Roaming\Dexpot
[2011.03.23 05:03:48 | 000,000,000 | ---D | M] -- C:\Users\owner\AppData\Roaming\DigitalPersona
[2012.09.18 08:03:31 | 000,000,000 | ---D | M] -- C:\Users\owner\AppData\Roaming\Dropbox
[2011.12.12 20:58:34 | 000,000,000 | ---D | M] -- C:\Users\owner\AppData\Roaming\DVDVideoSoft
[2011.12.12 20:58:23 | 000,000,000 | ---D | M] -- C:\Users\owner\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.04.19 23:09:46 | 000,000,000 | ---D | M] -- C:\Users\owner\AppData\Roaming\Genie9
[2011.09.06 16:53:29 | 000,000,000 | ---D | M] -- C:\Users\owner\AppData\Roaming\IrfanView
[2011.12.03 14:48:03 | 000,000,000 | ---D | M] -- C:\Users\owner\AppData\Roaming\OCS
[2012.04.19 22:01:30 | 000,000,000 | ---D | M] -- C:\Users\owner\AppData\Roaming\OpenCandy
[2011.07.01 03:42:01 | 000,000,000 | ---D | M] -- C:\Users\owner\AppData\Roaming\OpenOffice.org
[2011.12.26 00:39:53 | 000,000,000 | ---D | M] -- C:\Users\owner\AppData\Roaming\Opera
[2012.07.01 12:26:33 | 000,000,000 | ---D | M] -- C:\Users\owner\AppData\Roaming\PhotoScape
[2011.03.23 05:14:07 | 000,000,000 | ---D | M] -- C:\Users\owner\AppData\Roaming\PictureMover
[2012.03.13 00:14:27 | 000,000,000 | ---D | M] -- C:\Users\owner\AppData\Roaming\Samsung
[2011.05.04 22:28:12 | 000,000,000 | ---D | M] -- C:\Users\owner\AppData\Roaming\SoftGrid Client
[2012.04.29 15:46:51 | 000,000,000 | ---D | M] -- C:\Users\owner\AppData\Roaming\Songbird2
[2011.03.23 05:13:07 | 000,000,000 | ---D | M] -- C:\Users\owner\AppData\Roaming\Stardock
[2012.05.03 22:42:43 | 000,000,000 | ---D | M] -- C:\Users\owner\AppData\Roaming\TeamViewer
[2012.03.13 00:47:38 | 000,000,000 | ---D | M] -- C:\Users\owner\AppData\Roaming\Temp
[2011.05.02 10:00:53 | 000,000,000 | ---D | M] -- C:\Users\owner\AppData\Roaming\Thinstall
[2011.11.17 15:27:18 | 000,000,000 | ---D | M] -- C:\Users\owner\AppData\Roaming\toolplugin
[2011.05.04 08:26:23 | 000,000,000 | ---D | M] -- C:\Users\owner\AppData\Roaming\TP
[2012.05.14 22:53:21 | 000,000,000 | ---D | M] -- C:\Users\owner\AppData\Roaming\Ulead Systems
[2011.05.02 10:00:08 | 000,000,000 | ---D | M] -- C:\Users\owner\AppData\Roaming\WildTangent
[2012.04.16 19:56:40 | 000,000,000 | ---D | M] -- C:\Users\owner\AppData\Roaming\Zoner
[2011.06.08 19:26:49 | 000,000,000 | ---D | M] -- C:\Users\owner\AppData\Roaming\ZumoDrive
[2012.06.21 09:05:51 | 000,032,598 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 67 bytes -> C:\Users\owner\Desktop\Key Words - NEW.docx:com.dropbox.attributes

< End of report >

Alt 18.09.2012, 17:15   #2
TheMexican
 
Rechner gesperrt - "Polizei - Ihr Computer wurde gesperrt" - Standard

Rechner gesperrt - "Polizei - Ihr Computer wurde gesperrt"



Hier dann der Rest.


Extras.Txt

OTL EXTRAS Logfile:
Code:
ATTFilter
OTL Extras logfile created on: 18.09.2012 16:15:38 - Run 1
OTL by OldTimer - Version 3.2.63.0     Folder = C:\Daten\Download
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000C07 | Country: Austria | Language: DEA | Date Format: dd.MM.yyyy
 
5,80 Gb Total Physical Memory | 4,82 Gb Available Physical Memory | 83,09% Memory free
11,60 Gb Paging File | 10,77 Gb Available in Paging File | 92,84% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 565,43 Gb Total Space | 13,81 Gb Free Space | 2,44% Space Free | Partition Type: NTFS
Drive D: | 30,44 Gb Total Space | 4,47 Gb Free Space | 14,69% Space Free | Partition Type: NTFS
Drive G: | 99,34 Mb Total Space | 88,69 Mb Free Space | 89,29% Space Free | Partition Type: FAT32
 
Computer Name: OWNER-HP | User Name: owner | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
http [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Browse with &IrfanView] -- "C:\Program Files (x86)\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [Browse with Corel PaintShop Photo Pro X3] -- "c:\Program Files (x86)\Corel\Corel PaintShop Photo Pro\X3\PSPClassic\Corel Paint Shop Pro Photo.exe" "%L" (Corel, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
http [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Browse with &IrfanView] -- "C:\Program Files (x86)\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [Browse with Corel PaintShop Photo Pro X3] -- "c:\Program Files (x86)\Corel\Corel PaintShop Photo Pro\X3\PSPClassic\Corel Paint Shop Pro Photo.exe" "%L" (Corel, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0F383E69-8891-404C-9822-26E909CFE218}" = lport=139 | protocol=6 | dir=in | app=system | 
"{1F4CBAFA-3407-420F-8577-4BD6C4C9C530}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{1F53D216-3E40-4EED-8EE5-087F96892B9A}" = rport=139 | protocol=6 | dir=out | app=system | 
"{355B4C59-9971-4944-ACF1-BE47ECA53CF4}" = lport=137 | protocol=17 | dir=in | app=system | 
"{366B0C0D-D690-42C8-B52F-EF01FBC334F0}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{460D8C6A-2116-469E-985D-4E8A086D81CE}" = rport=445 | protocol=6 | dir=out | app=system | 
"{4A794054-0EB2-4045-A4BE-C60CB7EFD672}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{52BCD5B0-A7E7-4955-9257-26F56DFBC922}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{639A6F9B-746F-413C-9350-06D2E8651816}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\outlook.exe | 
"{6E81DADD-A62F-4CF3-B132-72004331472C}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{71D05844-9074-4628-9458-EEE79D9DB65C}" = rport=138 | protocol=17 | dir=out | app=system | 
"{770D8DC8-B008-4FC2-8F0B-6BF1073A1740}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{82DBB24B-CB19-4B46-8CDA-9860C84AF301}" = rport=137 | protocol=17 | dir=out | app=system | 
"{9203C945-7448-461F-87B0-19F5379FF732}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{95B3D03A-7E06-4571-9735-7221A4D18725}" = lport=445 | protocol=6 | dir=in | app=system | 
"{9FB99193-6300-4A14-ABD8-140AD1691F3E}" = lport=138 | protocol=17 | dir=in | app=system | 
"{ACF25253-A008-4303-BCED-6CE4926C7B4F}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{B150FEC1-908F-43D1-9815-BDE0DF668D4E}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{B572F4FF-ECC5-4E69-833A-142191DBC1B6}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{BC37C4D7-3F00-4B39-A6DB-2FFAB240363E}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{C18C97A6-99D0-4251-8BB1-A35C99553D6B}" = lport=9195 | protocol=17 | dir=in | name=lexprintlistener udp | 
"{C2A1E294-77D3-4B3F-BF27-474720AE40BD}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{CA53F24B-54E9-4E03-993D-BCDC3A3B4F4B}" = lport=9195 | protocol=6 | dir=in | name=lexprintlistener tcp | 
"{DAAE2D91-65D8-4E1E-94C3-DF1EB128D50A}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{E00E5F3A-233B-4B95-B8DC-CA96E7C6C882}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{EB7386EA-795F-43E1-AFE0-F3570649D818}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{EFCCD27D-09BE-4E72-BDBB-FF368E5A43C5}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0545403B-776D-42A0-AB54-496C8F6E1D8E}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version6\teamviewer.exe | 
"{0A19162E-44F9-4EAC-8513-9DD30E19A37E}" = protocol=6 | dir=in | app=c:\program files (x86)\roxio\roxionow player\rnowshell.exe | 
"{0AE383B3-EFEB-407C-8CFB-11BC37B4B624}" = dir=in | app=c:\windows\system32\lxedcoms.exe | 
"{0ECA76F9-5462-4CA1-8C1F-ABC911DDAD75}" = protocol=17 | dir=in | app=c:\program files\intel\wimax\bin\dmagent.exe | 
"{14A6388F-6714-47BA-84F1-2999BD3AAA6A}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\pluginwrapper\opera_plugin_wrapper.exe | 
"{1D1E6438-4F97-4802-B408-6EC2538AFCAA}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{1D62A976-7A2A-40F8-884F-7666F4969C5D}" = dir=in | app=c:\program files (x86)\hewlett-packard\mediasmart\video\hpmediasmartvideo.exe | 
"{1EBA2055-0A91-4A17-809D-3986055FC881}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version6\teamviewer_service.exe | 
"{21985C5B-BDF6-43E9-90E9-2D8A4EC8DDAA}" = protocol=6 | dir=in | app=c:\daten\games\combat arms\nmservice.exe | 
"{24208B2E-F78A-4F47-A6D9-5515664B3C5C}" = protocol=17 | dir=in | app=c:\windows\syswow64\muzapp.exe | 
"{249D2F0D-2EBF-4F05-9B28-48B31DCF0850}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft games\halo 2\halo2.exe | 
"{2931136C-56E6-41EA-989E-9731E914B61D}" = dir=in | app=c:\program files\intel\wifi\bin\pandhcpdns.exe | 
"{29EDA374-3541-4043-8D27-3A19785D7179}" = protocol=17 | dir=in | app=c:\windows\system32\lxbccoms.exe | 
"{2E96BD0B-CA71-4A9E-AD7A-45C2F6793941}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | 
"{316E6922-730E-4B20-BC52-71271A3E62F5}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\hptouchsmartmusic.exe | 
"{40104496-A75C-4A0C-9A85-37FB2F8A0A1E}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{40B662FF-5C03-418A-A9C3-831654C1940D}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\music\hptouchsmartmusic.exe | 
"{4637E14D-CC16-448E-BC56-0CCEC41CF997}" = protocol=6 | dir=in | app=c:\program files\intel\wimax\bin\dmagent.exe | 
"{47FD8704-02BA-4E9E-B387-B62D73642B57}" = protocol=6 | dir=in | app=c:\windows\syswow64\muzapp.exe | 
"{4AC27894-A62E-42E2-99AF-6254636AE8F8}" = protocol=17 | dir=in | app=c:\program files (x86)\abbyy finereader 6.0 sprint\scan\scanman6.exe | 
"{4B516280-8FFF-40D8-A831-70E3C664EF5C}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\pluginwrapper\opera_plugin_wrapper.exe | 
"{4F4B0830-5BD7-4906-8CE4-0865E994BC15}" = dir=in | app=c:\program files (x86)\hewlett-packard\hp clouddrive\zumodrive.exe | 
"{531E4EA2-A739-42F8-8776-83D60AA614FF}" = dir=in | app=c:\program files (x86)\cyberlink\powerdirector\pdr8.exe | 
"{54B2B31D-CCDE-4495-87F2-579CA68B0985}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{577F7A14-DA6C-47DF-A5BB-230E2C2FB2CE}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{5957D75B-99DB-4CDA-A406-258F5DE330ED}" = protocol=17 | dir=in | app=c:\program files (x86)\hewlett-packard\mediasmart\roxionow\rnow.exe | 
"{5B3E845F-DD55-42D0-BE95-EE2D47A70CC5}" = protocol=6 | dir=in | app=c:\program files (x86)\videolan\vlc\vlc.exe | 
"{5C290A88-A159-48CF-B90F-14ADEEFF1EE2}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{5EC3EAA8-19EA-4104-8832-51EF803C75F3}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version6\teamviewer.exe | 
"{65FC67AA-E062-4D10-8F70-E99CB79644C6}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft games\halo 2 dedicated server\h2server.exe | 
"{66E47AA5-FEA7-438F-AF08-C29DA507F77A}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe | 
"{68B93B02-FC19-41A7-97E8-DF9050654F95}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{6AC44D7E-5966-47CB-AD9E-D72FE8B34792}" = protocol=17 | dir=in | app=c:\users\owner\desktop\sweetimsetup.exe | 
"{6DBD09E4-571A-4021-BDEB-31C58C74A5D8}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\hptouchsmartphoto.exe | 
"{6E0F85E1-E81D-41F5-89FE-49D94D313B00}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | 
"{7519C158-E63B-41DB-98AA-828A4AB43F4A}" = protocol=6 | dir=in | app=c:\program files\intel\wimax\bin\appsrv.exe | 
"{77A4EA54-112F-4993-95DB-022C818932AA}" = protocol=17 | dir=in | app=c:\program files (x86)\roxio\roxionow player\rnowshell.exe | 
"{7D1DD3C7-AB62-4EE4-B2F7-EC30337C2B05}" = dir=in | app=c:\windows\system32\lxedcoms.exe | 
"{81684D0F-B4C3-4B2F-8DCA-394EC9488C0F}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{84BF758B-D399-4168-8DFA-73119E653CCD}" = protocol=6 | dir=in | app=c:\program files (x86)\hewlett-packard\mediasmart\roxionow\rnow.exe | 
"{84FFAFC8-382A-4B51-BBC2-230271C375A1}" = protocol=17 | dir=in | app=c:\programdata\nexonus\ngm\ngm.exe | 
"{87E88C6C-2D3D-4482-9CBE-695CE909B472}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe | 
"{89764202-A224-401C-939C-46D27A48806F}" = protocol=6 | dir=in | app=c:\daten\download\facemoods.exe | 
"{8999B4EB-E768-4338-A8C1-FEA1E87B2E0A}" = protocol=6 | dir=in | app=c:\windows\system32\lxbccoms.exe | 
"{8F6A8F2E-7E7C-4E97-9F77-74BAB75B3231}" = protocol=17 | dir=in | app=c:\program files (x86)\videolan\vlc\vlc.exe | 
"{90BBAE1E-4C6F-4BB6-ABD3-9F7754113662}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{9C80D6FE-8CAE-4C49-8E41-9FE2894C04BB}" = dir=in | app=c:\program files (x86)\intel corporation\intel wireless display\widiapp.exe | 
"{9D9A7C81-2D02-4171-B00D-1C1CE14BF581}" = protocol=6 | dir=in | app=c:\users\owner\desktop\sweetimsetup.exe | 
"{9DA79E54-3C02-49B5-9295-96EDF55A8B31}" = protocol=6 | dir=in | app=c:\windows\syswow64\lxbccoms.exe | 
"{A326B43B-2DC9-42F5-9CF1-68437FC77156}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{A3A83196-E276-40C9-8FAA-6C0C9229B5FD}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{A6962398-9482-49B9-A152-147865BC0CE7}" = protocol=17 | dir=in | app=c:\daten\games\combat arms\nmservice.exe | 
"{AE0BA3CB-CD18-4DB1-94EB-B09DA5E89392}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft games\halo 2\halo2.exe | 
"{BCA07997-E1C1-4E22-8ECE-A04B16E00214}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\tsmagent.exe | 
"{C209D6BB-4262-4A42-A045-9485C7B21428}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe | 
"{C236BB2D-CB43-4B33-B685-A0F834118EB6}" = protocol=6 | dir=in | app=c:\users\owner\appdata\roaming\dropbox\bin\dropbox.exe | 
"{C2886F9F-16AB-44F8-9233-ED944B9D63D7}" = protocol=17 | dir=in | app=c:\program files\intel\wimax\bin\appsrv.exe | 
"{C70E1952-585A-4153-ABF6-DDBBA814C5AD}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | 
"{C9131519-9881-4BD5-9220-E02B61B41733}" = protocol=17 | dir=in | app=c:\daten\download\facemoods.exe | 
"{C952B247-855F-4E14-9BA8-C9F8604164E0}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{CC2A98EE-84A5-42F5-9E3B-C23DA2954DE5}" = protocol=17 | dir=in | app=c:\windows\syswow64\lxbccoms.exe | 
"{CE7C9C46-BB83-4F71-A194-74328CC9AA5A}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{CF04EB4A-C298-4143-BEC7-7A8E32E0BC5E}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{CF09BB40-0E8B-44F5-A5DA-971AA87F3D01}" = dir=in | app=c:\program files (x86)\hewlett-packard\mediasmart\photo\hpmediasmartphoto.exe | 
"{D33399BF-B979-4917-B05C-FC037F140B23}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\hpdvdsmart.exe | 
"{D4ED2B35-97FB-46CF-AFF1-E8B96B8FEE3D}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{D63082AC-AC0E-43C3-B649-C3B48FF7C866}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{D66BF11E-BD92-4378-AD3E-E6FCE53F560E}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe | 
"{D74990E2-CE9C-4A16-9465-54916AACE94B}" = protocol=17 | dir=in | app=c:\users\owner\appdata\roaming\dropbox\bin\dropbox.exe | 
"{D8258C88-11AD-4407-A74D-54236AB335C4}" = dir=out | app=c:\program files (x86)\hewlett-packard\hp clouddrive\zumodrive.exe | 
"{D95884E1-CFD4-4F1C-8E19-6B4FEFEBFBB6}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe | 
"{D9DA0F9D-7283-41C8-909E-B08B96DD6CAD}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{D9EA3121-916A-4858-8BE4-0C483170FAE8}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft games\halo 2 dedicated server\h2server.exe | 
"{DD279DA3-C1D2-48E7-8C88-C8B1C3F14E02}" = protocol=6 | dir=in | app=c:\programdata\nexonus\ngm\ngm.exe | 
"{DFEB5E9F-F9EB-42C3-B770-0FC16748DAA5}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\hptouchsmartvideo.exe | 
"{E037E2F9-2B31-4204-AE11-71CFBCC29F3D}" = protocol=6 | dir=in | app=c:\program files (x86)\abbyy finereader 6.0 sprint\scan\scanman6.exe | 
"{E3D277A7-92A6-4FD1-9112-742A926E3D71}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\kernel\clml\clmlsvc.exe | 
"{E4D02E07-C913-4B69-95F1-221673357F8A}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{E9889EBA-8573-48C3-95B1-041EA0D5D19C}" = dir=in | app=c:\windows\system32\lxedcoms.exe | 
"{EC146E28-BCC0-411F-91CF-62A0F3C12D4F}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe | 
"{EE4FB87E-C9AF-488D-ADB5-AE6A7269CDEA}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{EE79E0C2-8F3B-4B76-AE0A-FB23ACF7F5FC}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version6\teamviewer_service.exe | 
"{F18932C4-2F34-4B65-80E1-93A013C222CC}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe | 
"{F3340323-312D-4C3C-9FE4-15A15B106C1D}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"TCP Query User{04992903-24C8-4E2D-8FF0-4DCFDEBD277B}C:\daten\games\dowar2r\dow2.exe" = protocol=6 | dir=in | app=c:\daten\games\dowar2r\dow2.exe | 
"TCP Query User{07922B9A-940A-46B1-8DBF-53D9BDA7C1BC}C:\program files (x86)\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=c:\program files (x86)\videolan\vlc\vlc.exe | 
"TCP Query User{126C48DF-5D6A-42DF-9362-1E297A35CE13}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe | 
"TCP Query User{232A8EBE-E332-44AF-A808-13270FF4A66A}C:\program files (x86)\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files (x86)\winamp\winamp.exe | 
"TCP Query User{23BCF388-3B12-42D2-A888-23775002B963}C:\program files (x86)\valve\hl.exe" = protocol=6 | dir=in | app=c:\program files (x86)\valve\hl.exe | 
"TCP Query User{2F2239A9-6CD0-4ACB-B4B5-73CAC754C581}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe | 
"TCP Query User{455C7FF9-576D-4640-85F0-DF8D3D1AC646}C:\program files (x86)\valve\hl.exe" = protocol=6 | dir=in | app=c:\program files (x86)\valve\hl.exe | 
"TCP Query User{68D95CE4-11D8-4E51-B7A1-ACA207A4778F}C:\program files (x86)\valve\counter-strike source\hl2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\valve\counter-strike source\hl2.exe | 
"TCP Query User{88480834-0E76-40DF-8427-CBA959DD76E9}C:\daten\games\combat arms\engine.exe" = protocol=6 | dir=in | app=c:\daten\games\combat arms\engine.exe | 
"TCP Query User{910EFF8C-F723-4CE3-92DC-3205289F067C}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
"TCP Query User{958EA3B8-2B6D-4DA6-90AA-EFE3558ADBD6}C:\program files (x86)\bittorrent\bittorrent.exe" = protocol=6 | dir=in | app=c:\program files (x86)\bittorrent\bittorrent.exe | 
"TCP Query User{AF3172EA-7D33-404B-A6A0-464728182F69}C:\program files (x86)\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\java.exe | 
"TCP Query User{E9CDA0EB-6087-4A40-8EDE-BFFD63EADA7E}C:\daten\games\halo\halo.exe" = protocol=6 | dir=in | app=c:\daten\games\halo\halo.exe | 
"TCP Query User{EA748ECD-F3B0-4782-A928-4A5EB8E5C41F}C:\program files (x86)\valve\counter-strike source\hl2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\valve\counter-strike source\hl2.exe | 
"TCP Query User{EF8C4897-B483-413A-A8D6-89AE6F081556}C:\users\owner\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\owner\appdata\roaming\dropbox\bin\dropbox.exe | 
"TCP Query User{F2494A7C-71BE-44D8-8907-3B32B9E8F7B8}C:\program files (x86)\hobbyist software\vlc setup helper\mdnsresponder.exe" = protocol=6 | dir=in | app=c:\program files (x86)\hobbyist software\vlc setup helper\mdnsresponder.exe | 
"UDP Query User{030F42B1-D41D-4DDE-9B43-A868CCA78FB0}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe | 
"UDP Query User{14E1C65A-63FF-4AF8-80E2-7B96F795361E}C:\program files (x86)\bittorrent\bittorrent.exe" = protocol=17 | dir=in | app=c:\program files (x86)\bittorrent\bittorrent.exe | 
"UDP Query User{18203923-FC8A-41EA-8C7D-98461E7CF372}C:\program files (x86)\valve\hl.exe" = protocol=17 | dir=in | app=c:\program files (x86)\valve\hl.exe | 
"UDP Query User{35D18F42-9AFA-4E9C-88B3-520B7C1DDA93}C:\program files (x86)\valve\hl.exe" = protocol=17 | dir=in | app=c:\program files (x86)\valve\hl.exe | 
"UDP Query User{6A74AE19-35D2-4718-BD07-9308EA6E1531}C:\daten\games\combat arms\engine.exe" = protocol=17 | dir=in | app=c:\daten\games\combat arms\engine.exe | 
"UDP Query User{6CF57DA5-0A36-47C8-91C0-9196D9628D17}C:\daten\games\dowar2r\dow2.exe" = protocol=17 | dir=in | app=c:\daten\games\dowar2r\dow2.exe | 
"UDP Query User{74860793-17F0-448F-A22B-C72E40E4EB2B}C:\program files (x86)\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\java.exe | 
"UDP Query User{79A60D98-C34A-4542-A4A1-7E9E3DAEC861}C:\program files (x86)\hobbyist software\vlc setup helper\mdnsresponder.exe" = protocol=17 | dir=in | app=c:\program files (x86)\hobbyist software\vlc setup helper\mdnsresponder.exe | 
"UDP Query User{79D6C6D4-2213-4DB6-AE74-4CFBADF30D66}C:\program files (x86)\valve\counter-strike source\hl2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\valve\counter-strike source\hl2.exe | 
"UDP Query User{9994B352-51C5-4585-AA4C-C2EBAB735482}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
"UDP Query User{AA7B617D-35DD-4398-AFAF-B317996A475F}C:\users\owner\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\owner\appdata\roaming\dropbox\bin\dropbox.exe | 
"UDP Query User{B602B2DF-86E7-4A14-9143-302DF3E15F1D}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe | 
"UDP Query User{B8D8186F-D8B8-4E3A-BA62-7523D7D3E29E}C:\program files (x86)\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files (x86)\winamp\winamp.exe | 
"UDP Query User{C5535995-7DC3-4B7F-839D-D46E0EEC7CB1}C:\daten\games\halo\halo.exe" = protocol=17 | dir=in | app=c:\daten\games\halo\halo.exe | 
"UDP Query User{CE0A58F1-A1BF-4D80-9335-3859E1049519}C:\program files (x86)\valve\counter-strike source\hl2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\valve\counter-strike source\hl2.exe | 
"UDP Query User{FF4B1B11-9603-45FC-BFF6-6EA3C8DC51E8}C:\program files (x86)\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=c:\program files (x86)\videolan\vlc\vlc.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{09BDCC02-80F2-4EFB-8F1B-A807D2C38E31}" = HP MediaSmart Movies and TV
"{10CD364B-FFCC-48BE-B469-B9622A033075}" = Fences Pro
"{13DCC2C7-454D-42F0-A892-E0E9A5DE4E67}" = HP Wireless Assistant
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{26A24AE4-039D-4CA4-87B4-2F86416021FF}" = Java(TM) 6 Update 21 (64-bit)
"{2856A1C2-70C5-4EC3-AFF7-E5B51E5530A2}" = HP Client Services
"{426FAE9F-7373-496E-A215-9DB7EF4398CF}" = Validity Sensors DDK
"{4327107B-E95E-415C-9194-458FCED6BF12}" = Intel(R) PROSet/Wireless WiFi Software
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{4F26C164-9373-4974-8F43-E0F2176AF937}" = Intel WiMAX Tutorial
"{5BF97E02-2F6A-412A-BB4D-B6E2DC65FCA7}" = HP SimplePass Identity Protection
"{5EB6F3CB-46F4-451F-A028-7F6D8D35D7D0}" = Windows Live Language Selector
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6548B189-BEA4-4041-80E0-AEB60548E046}" = Intel® PROSet/Wireless WiMAX Software
"{6A76BEAF-6D1F-4273-A79B-DA8410A2E56B}" = Apple Mobile Device Support
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{840A3BAA-4C68-4581-9C7A-6F8D6CF531B9}" = iTunes
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{929685C0-FC01-45E1-8B39-2948E8FF861E}" = Intel(R) Wireless Display
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A04108F4-71E9-FD90-D73D-2058DF6987F4}" = ATI Catalyst Install Manager
"{A1F2C608-32D6-467D-B035-BBEF509042BA}_is1" = Free Opener
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{BE6725F2-6D15-477C-86C6-4522B8569D62}" = HP MediaSmart SmartMenu
"{C84FFB07-C687-45CF-91C8-868DB8D8C8CD}" = HP 3D DriveGuard
"{CC4D56B7-6F18-470B-8734-ABCD75BCF4F1}" = HP Auto
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{F6246243-CF06-4E40-8A37-C3B537695C36}" = Share64
"{FED4086D-51A8-E88C-1CF9-BA21A50470EE}" = ccc-utility64
"Defraggler" = Defraggler
"Lexmark S600 Series" = Lexmark S600 Series
"Lexmark Z500-Z600 Series" = Lexmark Z500-Z600 Series
"Lexmark_iListener" = Lexmark Software Uninstall
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"ProInst" = Intel PROSet Wireless
"Recuva" = Recuva
"SearchAnonymizer" = SearchAnonymizer
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"WinRAR archiver" = WinRAR
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"_{D1AEB5DB-04FA-489D-94EF-8600898B93EE}" = Corel PaintShop Photo Pro X3
"_{F072CA07-A781-45E4-9975-C033A73019CF}" = Corel VideoStudio Pro X3
"{00FB9AA8-5FFF-DDCE-DA2E-530994B59217}" = CCC Help Finnish
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = HP MediaSmart Webcam
"{045C16AD-B2E5-43D0-BB51-2F1987D91038}" = HP Documentation
"{07FA4960-B038-49EB-891B-9F95930AA544}" = HP Customer Experience Enhancements
"{08234a0d-cf39-4dca-99f0-0c5cb496da81}" = Bing Bar
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0CA38F52-F0FA-4B9F-8A36-EC8A9609FBBC}" = Halo 2 for Windows Vista
"{0EDEB615-1A60-425E-8306-0E10519C7B55}" = RoxioNow Player
"{1017A80C-6F09-4548-A84D-EDD6AC9525F0}" = Lexmark Symbolleiste
"{10812DE7-2E57-4740-B226-6B3BE34AF9D7}" = Lexmark Tools for Office
"{120262A6-7A4B-4889-AE85-F5E5688D3683}" = HP MovieStore
"{122ADF8C-DDA1-480C-9936-C88F2825B265}" = Apple Application Support
"{13B792AA-C078-43A4-8A3A-8B12D629940D}" = Counter-Strike 1.6
"{155F4A0E-76ED-45A2-91FB-FF2A2133C31A}" = Risen
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1991D8C3-8354-2228-401C-D3D105CA2AC4}" = CCC Help Chinese Traditional
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1E6E990A-728D-4700-9B0A-2CA541C93A12}" = Catalyst Control Center - Branding
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{2227E1FA-01F5-483C-AB0E-2A308E900B3D}" = InterVideo FilterSDK for Hauppauge
"{254C37AA-6B72-4300-84F6-98A82419187E}" = ActiveCheck component for HP Active Support Library
"{264FE20A-757B-492a-B0C3-4009E2997D8A}" = PictureMover
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 22
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{2D8539EE-3F50-94DB-2605-047B33558C70}" = CCC Help Thai
"{2EA3D6B2-157E-4112-A3AB-BF17E16661C3}" = HP MediaSmart/TouchSmart Netflix
"{2FF2BBBA-341C-4F36-AB55-7398184733CE}" = CCC Help Italian
"{3023EBDA-BF1B-4831-B347-E5018555F26E}" = Movie Theme Pack for HP MediaSmart Video
"{31EEA563-3544-4EA1-8773-BCBF83F9627A}" = HP Software Framework
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{359FCAA7-B544-4147-AE3B-8C8A526E2427}" = Sony Image Data Suite
"{3877C901-7B90-4727-A639-B6ED2DD59D43}" = ESU for Microsoft Windows 7
"{3B834B54-EC4B-48E2-BFC6-03FF5DA06F62}" = Adobe Shockwave Player 11.5
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}" = Norton Online Backup
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}" = Recovery Manager
"{491ADA37-04EE-2ECE-9F86-DDC0106047AC}" = Times Reader
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B930AE3-61C6-4D02-A9D4-84F4ACBCEC25}" = OpenOffice.org 3.3
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{53469506-A37E-4314-A9D9-38724EC23A75}" = HP Setup
"{5410C77F-B22F-61FE-7D93-0BEDBC959FF3}" = PX Profile Update
"{5719D840-C30E-7DD3-C746-00B3A5C9BD6B}" = CCC Help Korean
"{5EDE7E1A-E386-BB8B-CD77-3B5AF9A8D80B}" = CCC Help Greek
"{5F4C776F-8CBD-4C4F-892F-B568ABDD70C8}" = GameSpy Comrade
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = HPAsset component for HP Active Support Library
"{670E7FFC-95FF-C425-BD00-91C120352C4B}" = CCC Help Turkish
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6A05FEDF-662E-46BF-8A25-010E3F1C9C69}" = Windows Live UX Platform Language Pack
"{6A396792-1CA6-E9E5-9844-512238F70C95}" = CCC Help Swedish
"{6D172D0A-B9F1-4046-AFAB-8599288545BF}" = Safari
"{6DAF8CDC-9B04-413B-A0F2-BCC13CF8A5BF}" = HP MediaSmart Photo
"{6DC6392C-4D8C-D21E-A0DD-750BD76627F6}" = CCC Help Chinese Standard
"{705B639E-FAAF-40D7-AD58-C445321C7C3F}" = LightScribe System Software
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{74796D37-75F9-C430-CC1D-FCE8371D5EB3}" = CCC Help English
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}" = Avanquest update
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{7FBDEEDA-ECDB-A348-0FBC-41AD5D852B36}" = Catalyst Control Center Localization All
"{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{872B1C80-38EC-4A31-A25C-980820593900}" = HP Power Manager
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver For Windows 7
"{8AC3E7BB-F819-379B-3F81-255904B67A8A}" = CCC Help Czech
"{8C696008-029B-BBA7-9CD3-45596A069D96}" = CCC Help Polish
"{8D3903E2-4B1B-4A69-B8F6-A3D1BE075BDB}" = Blio
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{9008D736-35CA-40DB-A2BE-5F32D954E5AA}" = HP MovieStore
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0407-1000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91892B48-4503-D842-59A0-842F70503843}" = CCC Help Portuguese
"{91A34181-9FAD-43AB-A35F-E7A8945B7E1C}" = HP MediaSmart Music
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{946B0558-3E7B-D27B-2E95-3A2E99BCB826}" = Catalyst Control Center Graphics Previews Common
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9902DD1A-58CD-EE2D-1401-EF1D07D3D353}" = CCC Help Japanese
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A0BB1E68-1DD0-4acd-AD82-EDA0E49F0615}" = PMB Updater
"{A2D6ECD0-7E52-42B7-9236-DB2951436616}_is1" = Foto-Mosaik-Edda Standard V6.6.11272.1
"{A44E3886-B7E7-ABA4-57C7-B423992CB536}" = Catalyst Control Center InstallProxy
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAD4E5A4-68CD-7957-81EF-8B50DBA5E939}" = CCC Help Danish
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.1) - Deutsch
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{AE8289AB-E18C-36E6-BF9B-99557D9F7517}" = Catalyst Control Center Graphics Previews Vista
"{AE856388-AFAD-4753-81DF-D96B19D0A17C}" = HP Setup Manager
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{B1A4A13D-4665-4ED3-9DFE-F845725FBBD8}" = HP Support Assistant
"{B4F3A360-E1E2-479D-ADE7-9BE3B07F4539}" = NVIDIA PhysX
"{B6A98E5F-D6A7-46FB-9E9D-1F7BF443491C}" = PMB
"{B719C82F-A3AC-ED37-3E2A-947E5A7BA214}" = CCC Help Hungarian
"{BB1C717E-376C-4AA1-8940-81BFC38D9778}" = HP Quick Launch
"{BD1A34C9-4764-4F79-AE1F-112F8C89D3D4}" = Energy Star Digital Logo
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"{C6579A65-9CAE-4B31-8B6B-3306E0630A66}" = Apple Software Update
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C7AAB32A-AA73-ECFD-4F43-F41CFA2CD540}" = ccc-core-static
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}" = PlayReady PC Runtime x86
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CEB37677-3019-4EBE-9BDD-A110A4F70439}" = TurboCAD Designer v9.2
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D12E3E7F-1B13-4933-A915-16C7DD37A095}" = HP MediaSmart Video
"{D1612A3D-0DCC-4055-BB6A-0036F31158A0}" = Setup
"{D1AEB5DB-04FA-489D-94EF-8600898B93EE}" = ICA
"{D1F80EFD-A032-4E8E-A367-70C44AD4DCE0}" = ISCOM
"{D2C5E510-BE6D-42CC-9F61-E4F939078474}" = Lexmark 
"{D3538C4C-8DAF-88CD-55B0-CBF12DECF5A6}" = CCC Help Spanish
"{D36DD326-7280-11D8-97C8-000129760CBE}" = PhotoNow!
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D57588F6-2D35-42B5-5C96-4FC3EB3EF7CE}" = CCC Help Russian
"{D5A3BDAF-542A-43DF-B530-23DD0148ED1B}" = Halo 2 Dedicated Server
"{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}" = Intel(R) Turbo Boost Technology Driver
"{DA4BF4BE-3CDC-43B5-BBDA-DDDA73103111}" = Corel PaintShop Photo Pro X3
"{DBE31207-21B1-5688-450E-9B958643FD2C}" = CCC Help Norwegian
"{DCCAD079-F92C-44DA-B258-624FC6517A5A}" = HP MediaSmart DVD
"{DCD941B6-F2E7-4FAF-B102-F7D4DE5FF99A}" = IPM_PSP_Pro
"{DCF1928A-FC01-48E7-A7E6-4651D42EF6A1}" = PSPPRO_DCRAW
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DDEDAF6C-488E-4CDA-8276-1CCF5F3C5C32}" = Command & Conquer 3
"{DE311B9A-4C1D-C746-264E-DB2A5C6DD2ED}" = CCC Help French
"{DF8B9311-ADE7-4EDE-B121-326CAA3D225D}" = PSPPContent
"{DFC63A26-1EF4-A666-BE94-1DF7351DA7BE}" = CCC Help Dutch
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series
"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{EA2DB6E0-72C5-4ef9-A3A0-E6705F4A6A9E}" = Nexon Game Manager
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{EE74D039-45D7-44E9-BF95-B9CFB015964F_P1Sec}_is1" = ArcaniA - Gothic 4 Patch
"{EE74D039-45D7-44E9-BF95-B9CFB015964F}_is1" = ArcaniA - Gothic 4 Hotfix
"{F069C491-69E6-4D9B-9A0C-B7894A1FA97C}" = Setup
"{F072CA07-A781-45E4-9975-C033A73019CF}" = ICA
"{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}" = Sony PC Companion 2.10.030
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F206FEC3-F5DD-43FD-A8CF-9C46B8A6A92C}" = VSPro
"{F2508213-9989-4E85-A078-72BE483917EF}" = Microsoft Games for Windows - LIVE Redistributable
"{F4E9851F-765E-40B7-9859-237C2724E62C}" = DeviceIO
"{F6A76E9C-C299-4CFA-AD2A-57FE9DD68B70}" = Contents
"{F8423392-2296-4748-9B66-344432459632}" = PureHD
"{F909BD3C-8684-4ACF-B7C3-33F4F9F901B7}" = Share
"{F95C8C1F-25BB-44EC-A7E6-5C17ABC6BC71}" = VIO
"{FB0B6DDD-DF3E-4CD6-927C-724AB854E322}" = VSClassic
"{FB4BB287-37F9-4E27-9C4D-2D3882E08EFF}" = DVD Menu Pack for HP MediaSmart Video
"{FBBCD35F-930F-9B68-7A80-A668A68FE86A}" = CCC Help German
"{FD67D9F3-FED6-4A2E-9D6C-8C8C44DEF8FF}" = IPM_VS_Pro
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FE661711-E392-4B3F-A4A7-02C747C09134}" = ISCOM
"5513-1208-7298-9440" = JDownloader 0.9
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Avira AntiVir Desktop" = Avira Free Antivirus
"BitTorrent" = BitTorrent
"Burn4Free DB Toolbar" = Burn4Free DB Toolbar
"Burn4Free DVD Burning_is1" = Burn4Free DVD Burning 5.6.0.0
"com.nyt.timesreader.78C54164786ADE80CB31E1C5D95607D0938C987A.1" = Times Reader
"CSS FULL DZ [Oct 15 2007]" = CSS FULL DZ [Oct 15 2007] v18.1
"DivX Setup" = DivX-Setup
"DoWar2R_is1" = DoWar2R
"DVD Shrink_is1" = DVD Shrink 3.2
"Elasto Mania" = Elasto Mania
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Fences Pro" = Fences Pro
"Free Studio_is1" = Free Studio version 4.9
"Free Video to iPod Converter_is1" = Free Video to iPod Converter version 4.3.815
"Free YouTube Download_is1" = Free YouTube Download version 3.0.16.923
"Free YouTube to iPhone Converter_is1" = Free YouTube to iPhone Converter version 2.11.14.1206
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.11.923
"Genie Timeline" = Genie Timeline
"Halo 2" = Halo 2 for Windows Vista
"Hamachi" = Hamachi 1.0.3.0
"Hauppauge German Help Files and Resources" = Hauppauge German Help Files and Resources
"Hauppauge WinTV" = Hauppauge WinTV
"Hauppauge WinTV DVB-T EPG Service" = Hauppauge WinTV DVB-T EPG Service
"Hauppauge WinTV Infrared Remote" = Hauppauge WinTV Infrared Remote
"Hauppauge WinTV Scheduler" = Hauppauge WinTV Scheduler
"Hauppauge WinTV TV Services" = Hauppauge WinTV TV Services
"HP DVB-T TV Tuner" = HP DVB-T TV Tuner 8.0.64.43
"HP Photo Creations" = HP Photo Creations
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = HP MediaSmart Webcam
"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite
"InstallShield_{3023EBDA-BF1B-4831-B347-E5018555F26E}" = Movie Theme Pack for HP MediaSmart Video
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"InstallShield_{6DAF8CDC-9B04-413B-A0F2-BCC13CF8A5BF}" = HP MediaSmart Photo
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"InstallShield_{91A34181-9FAD-43AB-A35F-E7A8945B7E1C}" = HP MediaSmart Music
"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"InstallShield_{D12E3E7F-1B13-4933-A915-16C7DD37A095}" = HP MediaSmart Video
"InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}" = PhotoNow!
"InstallShield_{D5A3BDAF-542A-43DF-B530-23DD0148ED1B}" = Halo 2 Dedicated Server
"InstallShield_{DCCAD079-F92C-44DA-B258-624FC6517A5A}" = HP MediaSmart DVD
"InstallShield_{FB4BB287-37F9-4E27-9C4D-2D3882E08EFF}" = DVD Menu Pack for HP MediaSmart Video
"IrfanView" = IrfanView (remove only)
"KLiteCodecPack_is1" = K-Lite Codec Pack 7.0.0 (Standard)
"Mixxx (1.10.0)" = Mixxx 1.10.0
"Mozilla Firefox 6.0.2 (x86 de)" = Mozilla Firefox 6.0.2 (x86 de)
"My HP Game Console" = HP Game Console
"Opera 12.02.1578" = Opera 12.02
"Personal Backup 5_is1" = Personal Backup 5.3
"PhotoScape" = PhotoScape
"PunkBusterSvc" = PunkBuster Services
"RealPlayer 15.0" = RealPlayer
"Recover Data for FAT & NTFS_is1" = Recover Data for FAT & NTFS
"Revo Uninstaller" = Revo Uninstaller 1.93
"SoftwareUpdUtility" = Download Updater (AOL LLC)
"Songbird-release-2199" = Songbird 1.10.2 (Build 2199)
"TeamViewer 6" = TeamViewer 6
"toolplugin" = toolplugin
"Uninstall_is1" = Uninstall 1.0.0.1
"Veetle TV" = Veetle TV 0.9.18
"VLC media player" = VLC media player 1.1.11
"VLC Setup Helper_is1" = VLC Setup Helper 4.05
"waterMark V2" = waterMark V2
"WildTangent hp Master Uninstall" = HP Games
"Winamp" = Winamp
"Winamp Toolbar" = Winamp Toolbar
"Windows Media Encoder 9" = Windows Media Encoder 9 Series
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR Archivierer
"WT087328" = Blackhawk Striker 2
"WT087330" = Bounce Symphony
"WT087335" = Build-a-lot 2
"WT087343" = Dora's World Adventure
"WT087360" = Escape Rosecliff Island
"WT087361" = FATE
"WT087362" = Final Drive Nitro
"WT087372" = Heroes of Hellas 2 - Olympia
"WT087379" = Jewel Quest Solitaire 2
"WT087394" = Penguins!
"WT087395" = Poker Superstars III
"WT087396" = Polar Bowler
"WT087397" = Polar Golfer
"WT087414" = Virtual Families
"WT087415" = Wheel of Fortune 2
"WT087428" = Bejeweled 2 Deluxe
"WT087453" = Chuzzle Deluxe
"WT087501" = Plants vs. Zombies
"WT087533" = Zuma Deluxe
"WT087536" = Diner Dash 2 Restaurant Rescue
"WT089299" = Mystery P.I. - The London Caper
"WT089307" = Virtual Villagers 4 - The Tree of Life
"WT089308" = Blasterball 3
"WT089328" = Farm Frenzy
"WT089359" = Cake Mania
"WT089362" = Agatha Christie - Peril at End House
"ZonerPhotoStudio14_EN_is1" = Zoner Photo Studio 14 FREE
"ZumoDrive" = HP CloudDrive
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Airfield Mayhem" = Airfield Mayhem
"Character Map 1.7" = Character Map 1.7
"Dexpot" = Dexpot
"Dropbox" = Dropbox
"HuluDesktop" = Hulu Desktop
"TankWar" = TankWar
"Torus" = Torus
"Winamp Detect" = Winamp Detector Plug-in
"World+Clock" = World+Clock
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 12.07.2012 13:18:18 | Computer Name = owner-HP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 795917
 
Error - 12.07.2012 13:18:18 | Computer Name = owner-HP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 795917
 
Error - 12.07.2012 13:29:29 | Computer Name = owner-HP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 12.07.2012 13:29:29 | Computer Name = owner-HP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 579170
 
Error - 12.07.2012 13:29:29 | Computer Name = owner-HP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 579170
 
Error - 12.07.2012 14:19:27 | Computer Name = owner-HP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 12.07.2012 14:19:27 | Computer Name = owner-HP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 45443
 
Error - 12.07.2012 14:19:27 | Computer Name = owner-HP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 45443
 
Error - 13.07.2012 08:55:16 | Computer Name = owner-HP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 13.07.2012 08:55:16 | Computer Name = owner-HP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 912403
 
Error - 13.07.2012 08:55:16 | Computer Name = owner-HP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 912403
 
[ Hewlett-Packard Events ]
Error - 07.09.2011 09:21:26 | Computer Name = owner-HP | Source = Hewlett-Packard | ID = 0
Description = AAProcessExited() C:\ProgramData\Hewlett-Packard\HP Support Framework\Telemetry\091107032123.xml
 File not created by asset agent
 
Error - 13.09.2011 15:29:49 | Computer Name = owner-HP | Source = Hewlett-Packard | ID = 0
Description = AAProcessExited() C:\ProgramData\Hewlett-Packard\HP Support Framework\Telemetry\091113092945.xml
 File not created by asset agent
 
Error - 06.10.2011 07:16:31 | Computer Name = owner-HP | Source = Hewlett-Packard | ID = 0
Description = AAProcessExited() C:\ProgramData\Hewlett-Packard\HP Support Framework\Telemetry\101106011607.xml
 File not created by asset agent
 
Error - 08.11.2011 18:20:48 | Computer Name = owner-HP | Source = Hewlett-Packard | ID = 0
Description = AAProcessExited() C:\ProgramData\Hewlett-Packard\HP Support Framework\Telemetry\111108112043.xml
 File not created by asset agent
 
Error - 13.12.2011 19:37:51 | Computer Name = owner-HP | Source = Hewlett-Packard | ID = 0
Description = AAProcessExited() C:\ProgramData\Hewlett-Packard\HP Support Framework\Telemetry\121114123746.xml
 File not created by asset agent
 
Error - 03.01.2012 18:22:44 | Computer Name = owner-HP | Source = Hewlett-Packard | ID = 0
Description = AAProcessExited() C:\ProgramData\Hewlett-Packard\HP Support Framework\Telemetry\011203112238.xml
 File not created by asset agent
 
Error - 03.01.2012 18:22:46 | Computer Name = owner-HP | Source = Hewlett-Packard | ID = 0
Description = AAProcessExited() C:\ProgramData\Hewlett-Packard\HP Support Framework\Telemetry\011203112244.xml
 File not created by asset agent
 
Error - 12.02.2012 19:22:36 | Computer Name = owner-HP | Source = Hewlett-Packard | ID = 0
Description = AAProcessExited() C:\ProgramData\Hewlett-Packard\HP Support Framework\Telemetry\021213122226.xml
 File not created by asset agent
 
Error - 22.02.2012 08:51:14 | Computer Name = owner-HP | Source = Hewlett-Packard | ID = 0
Description = AAProcessExited() C:\ProgramData\Hewlett-Packard\HP Support Framework\Telemetry\021222015110.xml
 File not created by asset agent
 
Error - 22.05.2012 15:08:01 | Computer Name = owner-HP | Source = Hewlett-Packard | ID = 0
Description = AAProcessExited() C:\ProgramData\Hewlett-Packard\HP Support Framework\Telemetry\051222090758.xml
 File not created by asset agent
 
[ HP Wireless Assistant Events ]
Error - 22.03.2011 23:14:01 | Computer Name = owner-HP | Source = HP WA Service | ID = 0
Description = System.Runtime.InteropServices.COMException The RPC server is unavailable.
 (Exception from HRESULT: 0x800706BA)    at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32
 errorCode, IntPtr errorInfo)     at System.Management.ManagementScope.InitializeGuts(Object
 o)     at System.Management.ManagementScope.Initialize()     at System.Management.ManagementObject.Initialize(Boolean
 getObject)     at System.Management.ManagementBaseObject.get_Properties()     at System.Management.ManagementBaseObject.GetPropertyValue(String
 propertyName)     at HPPA_Service.CurrentConfiguration.<ReloadRadioList>b__c()
 
Error - 22.03.2011 23:14:06 | Computer Name = owner-HP | Source = HP WA Service | ID = 0
Description = System.Runtime.InteropServices.COMException The RPC server is unavailable.
 (Exception from HRESULT: 0x800706BA)    at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32
 errorCode, IntPtr errorInfo)     at System.Management.ManagementScope.InitializeGuts(Object
 o)     at System.Management.ManagementScope.Initialize()     at System.Management.ManagementObject.Initialize(Boolean
 getObject)     at System.Management.ManagementBaseObject.get_Properties()     at System.Management.ManagementBaseObject.GetPropertyValue(String
 propertyName)     at HPPA_Service.CurrentConfiguration.<ReloadRadioList>b__c()
 
Error - 22.03.2011 23:15:12 | Computer Name = owner-HP | Source = HP WA Service | ID = 0
Description = System.Runtime.InteropServices.COMException The RPC server is unavailable.
 (Exception from HRESULT: 0x800706BA)    at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32
 errorCode, IntPtr errorInfo)     at System.Management.ManagementScope.InitializeGuts(Object
 o)     at System.Management.ManagementScope.Initialize()     at System.Management.ManagementObject.Initialize(Boolean
 getObject)     at System.Management.ManagementBaseObject.get_Properties()     at System.Management.ManagementBaseObject.GetPropertyValue(String
 propertyName)     at HPPA_Service.CurrentConfiguration.<ReloadRadioList>b__c()
 
Error - 22.03.2011 23:15:17 | Computer Name = owner-HP | Source = HP WA Service | ID = 0
Description = System.Runtime.InteropServices.COMException The RPC server is unavailable.
 (Exception from HRESULT: 0x800706BA)    at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32
 errorCode, IntPtr errorInfo)     at System.Management.ManagementScope.InitializeGuts(Object
 o)     at System.Management.ManagementScope.Initialize()     at System.Management.ManagementObject.Initialize(Boolean
 getObject)     at System.Management.ManagementBaseObject.get_Properties()     at System.Management.ManagementBaseObject.GetPropertyValue(String
 propertyName)     at HPPA_Service.CurrentConfiguration.<ReloadRadioList>b__c()
 
Error - 22.03.2011 23:16:22 | Computer Name = owner-HP | Source = HP WA Service | ID = 0
Description = System.Runtime.InteropServices.COMException The RPC server is unavailable.
 (Exception from HRESULT: 0x800706BA)    at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32
 errorCode, IntPtr errorInfo)     at System.Management.ManagementScope.InitializeGuts(Object
 o)     at System.Management.ManagementScope.Initialize()     at System.Management.ManagementObject.Initialize(Boolean
 getObject)     at System.Management.ManagementBaseObject.get_Properties()     at System.Management.ManagementBaseObject.GetPropertyValue(String
 propertyName)     at HPPA_Service.CurrentConfiguration.<ReloadRadioList>b__c()
 
Error - 22.03.2011 23:16:28 | Computer Name = owner-HP | Source = HP WA Service | ID = 0
Description = System.Runtime.InteropServices.COMException The RPC server is unavailable.
 (Exception from HRESULT: 0x800706BA)    at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32
 errorCode, IntPtr errorInfo)     at System.Management.ManagementScope.InitializeGuts(Object
 o)     at System.Management.ManagementScope.Initialize()     at System.Management.ManagementObject.Initialize(Boolean
 getObject)     at System.Management.ManagementBaseObject.get_Properties()     at System.Management.ManagementBaseObject.GetPropertyValue(String
 propertyName)     at HPPA_Service.CurrentConfiguration.<ReloadRadioList>b__c()
 
Error - 22.03.2011 23:17:33 | Computer Name = owner-HP | Source = HP WA Service | ID = 0
Description = System.Runtime.InteropServices.COMException The RPC server is unavailable.
 (Exception from HRESULT: 0x800706BA)    at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32
 errorCode, IntPtr errorInfo)     at System.Management.ManagementScope.InitializeGuts(Object
 o)     at System.Management.ManagementScope.Initialize()     at System.Management.ManagementObject.Initialize(Boolean
 getObject)     at System.Management.ManagementBaseObject.get_Properties()     at System.Management.ManagementBaseObject.GetPropertyValue(String
 propertyName)     at HPPA_Service.CurrentConfiguration.<ReloadRadioList>b__c()
 
Error - 21.06.2011 15:11:29 | Computer Name = owner-HP | Source = HP WA Service | ID = 0
Description = System.Exception GetDeviceInfo() failed : 597    at HP_Common.CaslWrapper.GetDeviceInfo(List`1&
 radioList)     at HPPA_Service.CurrentConfiguration.ReloadRadioList()
 
Error - 04.07.2011 03:10:46 | Computer Name = owner-HP | Source = HP WA Service | ID = 0
Description = System.Exception GetDeviceInfo() failed : 597    at HP_Common.CaslWrapper.GetDeviceInfo(List`1&
 radioList)     at HPPA_Service.CurrentConfiguration.ReloadRadioList()
 
Error - 12.03.2012 13:48:01 | Computer Name = owner-HP | Source = HP WA Service | ID = 0
Description = System.Management.ManagementException Unexpected error     at System.Management.ManagementException.ThrowWithExtendedInfo(ManagementStatus
 errorCode)     at System.Management.ManagementObjectCollection.ManagementObjectEnumerator.MoveNext()

   at HPPA_Service.CurrentConfiguration.FindDevice(String hostPath, String portName)

   at HPPA_Service.CurrentConfiguration.<ApplyFriendlyNames>b__23(RadioHardware 
radio)     at System.Linq.Enumerable.WhereSelectListIterator`2.MoveNext()     at System.Linq.Enumerable.WhereSelectEnumerableIterator`2.MoveNext()

   at HPPA_Service.CurrentConfiguration.ApplyFriendlyNames()     at HPPA_Service.CurrentConfiguration.ReloadRadioList()
 
[ OSession Events ]
Error - 27.07.2011 21:05:22 | Computer Name = owner-HP | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2405
 seconds with 1980 seconds of active time.  This session ended with a crash.
 
Error - 07.05.2012 14:49:59 | Computer Name = owner-HP | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 1103
 seconds with 360 seconds of active time.  This session ended with a crash.
 
Error - 14.05.2012 07:39:25 | Computer Name = owner-HP | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 1407
 seconds with 480 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 18.09.2012 10:19:41 | Computer Name = owner-HP | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
 to start because of the following error:   %%1068
 
Error - 18.09.2012 10:20:23 | Computer Name = owner-HP | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
 to start because of the following error:   %%1068
 
Error - 18.09.2012 10:20:23 | Computer Name = owner-HP | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
 to start because of the following error:   %%1068
 
Error - 18.09.2012 10:20:23 | Computer Name = owner-HP | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
 to start because of the following error:   %%1068
 
Error - 18.09.2012 10:21:47 | Computer Name = owner-HP | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
 to start because of the following error:   %%1068
 
Error - 18.09.2012 10:21:47 | Computer Name = owner-HP | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
 to start because of the following error:   %%1068
 
Error - 18.09.2012 10:21:47 | Computer Name = owner-HP | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
 to start because of the following error:   %%1068
 
Error - 18.09.2012 10:22:23 | Computer Name = owner-HP | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
 to start because of the following error:   %%1068
 
Error - 18.09.2012 10:22:23 | Computer Name = owner-HP | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
 to start because of the following error:   %%1068
 
Error - 18.09.2012 10:22:23 | Computer Name = owner-HP | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
 to start because of the following error:   %%1068
 
 
< End of report >
         
--- --- ---




Zu guter Letzt noch der Log vom Malwarebytes Scan Durchlauf.

Zitat:
Malwarebytes Anti-Malware (Test) 1.65.0.1400
Malwarebytes : Free Anti-Malware download

Datenbank Version: v2012.09.18.06

Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 8.0.7601.17514
owner :: OWNER-HP [Administrator]

Schutz: Deaktiviert

18.09.2012 18:05:48
mbam-log-2012-09-18 (18-09-21).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 223933
Laufzeit: 2 Minute(n), 59 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowSearch (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Keine Aktion durchgeführt.

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Users\owner\0.6146328617810239.exe (Exploit.Drop.UR.2) -> Keine Aktion durchgeführt.

(Ende)

Vielen Dank schon mal im Vorraus fuer jede Hilfe

lg Dan

Update: Das Problem mit dem gesperrten Rechner waere eigentlich geloest. Ich habe herausgefunden, dass ich mit dem HP Rescue Assistent mein System zureucksetzten kann auf vor 4 Tagen. Das habe ich gemacht und der Virus scheint weg zu sein.

Die Frage ist nur. Da der Rescue Assistent nur das C: Drive zuruecksetzt habe ich die Angst das vll woanders auch noch Rueckstaende des Trojaners sein koennten.
Kann das sein?

Vielen Dank fuer den Rat:-)
lg Dan
__________________


Alt 05.12.2012, 18:10   #3
t'john
/// Helfer-Team
 
Rechner gesperrt - "Polizei - Ihr Computer wurde gesperrt" - Standard

Rechner gesperrt - "Polizei - Ihr Computer wurde gesperrt"





Dein Thema ist leider untergegangen, bitte in Zukunft nicht selbst antworten.

Benoetigst du noch Hilfe?
__________________
__________________

Alt 06.12.2012, 00:31   #4
TheMexican
 
Rechner gesperrt - "Polizei - Ihr Computer wurde gesperrt" - Standard

Rechner gesperrt - "Polizei - Ihr Computer wurde gesperrt"



Vielen Dank:-) aber es hat sich erledigt, da ich meinen rechner mit der Systemwiederherstellung zu einem vorherigen zeitpunkt wieder sauber gekriegt hab!

Bis zum naechsten mal:-)
lg Dan

Alt 06.12.2012, 16:32   #5
t'john
/// Helfer-Team
 
Rechner gesperrt - "Polizei - Ihr Computer wurde gesperrt" - Standard

Rechner gesperrt - "Polizei - Ihr Computer wurde gesperrt"



Java aktualisieren

Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
  • Downloade dir bitte die neueste Java-Version von hier
  • Speichere die jxpiinstall.exe
  • Schließe alle laufenden Programme. Speziell deinen Browser.
  • Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 9 ) herunter laden.
  • Wenn die Installation beendet wurde
    Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
  • Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.
Nach dem Neustart
  • Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
  • Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
  • Klicke auf Dateien löschen....
  • Gehe sicher das überall ein Hacken gesetzt ist und klicke OK.
  • Klicke erneut OK.


Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html

Danach poste (kopieren und einfuegen) mir, was du hier angezeigt bekommst: PluginCheck



Java deaktivieren

Aufgrund derezeitigen Sicherheitsluecke:

http://www.trojaner-board.de/122961-...ktivieren.html

Danach poste mir (kopieren und einfuegen), was du hier angezeigt bekommst: PluginCheck

__________________
Mfg, t'john
Das TB unterstützen

Alt 12.02.2013, 07:13   #6
t'john
/// Helfer-Team
 
Rechner gesperrt - "Polizei - Ihr Computer wurde gesperrt" - Standard

Rechner gesperrt - "Polizei - Ihr Computer wurde gesperrt"



Fehlende Rückmeldung

Gibt es Probleme beim Abarbeiten obiger Anleitung?

Um Kapazitäten für andere Hilfesuchende freizumachen, lösche ich dieses Thema aus meinen Benachrichtigungen.

Solltest Du weitermachen wollen, schreibe mir eine PN oder eröffne ein neues Thema.
http://www.trojaner-board.de/69886-a...-beachten.html


Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner sauber ist.
__________________
--> Rechner gesperrt - "Polizei - Ihr Computer wurde gesperrt"

Antwort

Themen zu Rechner gesperrt - "Polizei - Ihr Computer wurde gesperrt"
adobe, antivir, avira, bho, bonjour, computer, converter, defender, desktop, excel, explorer, firefox, gesperrt, home, igdpmd64.sys, launch, monitor, monitor.exe, mp3, netzwerk, object, realtek, registry, search the web, services.exe, software, symantec, trojaner, windows



Ähnliche Themen: Rechner gesperrt - "Polizei - Ihr Computer wurde gesperrt"


  1. Computer wurde gesperrt - "Polizei" Trojaner/Virus
    Plagegeister aller Art und deren Bekämpfung - 09.05.2013 (15)
  2. Polizei (Österreich) Control Department "Ihr Computer ist gesperrt"
    Plagegeister aller Art und deren Bekämpfung - 26.03.2013 (12)
  3. Polizei Control Department gegen Cyberkriminalität "Ihr Computer ist gesperrt"
    Plagegeister aller Art und deren Bekämpfung - 31.01.2013 (15)
  4. Polizei Control Department gegen Cyberkriminalität "Ihr Computer ist gesperrt"
    Plagegeister aller Art und deren Bekämpfung - 31.01.2013 (7)
  5. Computer gesperrt "POLIZEI Cybercrime Investigation Department" , Ukash / Schweizerische Eidgenossenschaft
    Log-Analyse und Auswertung - 16.12.2012 (14)
  6. Bundestrojaner Variante: "Ihr Computer wurde gesperrt"; " Ihr Computer wurde durch das Speichern der autom. Informationskontrolle gesperrt"
    Log-Analyse und Auswertung - 25.11.2012 (10)
  7. Computer von "Cyber-Polizei Schweiz" gesperrt
    Log-Analyse und Auswertung - 11.11.2012 (26)
  8. Computer von "POLIZEI Cybercrime Investigation Department" gesperrt
    Log-Analyse und Auswertung - 05.11.2012 (9)
  9. Computer von "info@online-cyber-polizei" gesperrt
    Plagegeister aller Art und deren Bekämpfung - 26.09.2012 (2)
  10. "Ihr Computer wurde durch das System der automatischen Informationskontrolle gesperrt"
    Log-Analyse und Auswertung - 19.09.2012 (1)
  11. Computer von "info@online-cyber-polizei" gesperrt
    Plagegeister aller Art und deren Bekämpfung - 28.08.2012 (15)
  12. "Der Computer ist für die Verletzung der Gesetze der Bundesrepublik Deutschland wurde gesperrt."
    Plagegeister aller Art und deren Bekämpfung - 22.08.2012 (2)
  13. Windows 7 64 Bit "GVU"" Ihr Computer wurde gesperrt."
    Log-Analyse und Auswertung - 30.07.2012 (27)
  14. Windows Sicherheitszenter-Fenster "Achtung! Ihr Computer wurde gesperrt!"
    Log-Analyse und Auswertung - 15.02.2012 (7)
  15. Meldung "Security Center !Achtung! Ihr Computer wurde gesperrt"
    Log-Analyse und Auswertung - 06.02.2012 (3)
  16. windows security center " Achtung! Ihr Computer wurde gesperrt! " Nr. 2
    Alles rund um Windows - 31.01.2012 (1)
  17. windows security center " Achtung! Ihr Computer wurde gesperrt! "
    Alles rund um Windows - 31.01.2012 (1)

Zum Thema Rechner gesperrt - "Polizei - Ihr Computer wurde gesperrt" - Hallo, Ich habe mir gestern auf meinem Laptop den Polizei - Trojaner eingefangen, und seither keinen Zugriff darauf wenn ich versuche normal einzusteigen, da der Hinweisbildschirm aufscheint ueber die komplette - Rechner gesperrt - "Polizei - Ihr Computer wurde gesperrt"...
Archiv
Du betrachtest: Rechner gesperrt - "Polizei - Ihr Computer wurde gesperrt" auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.