Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk)

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 10.10.2012, 16:23   #1
meric
 
Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk) - Ausrufezeichen

Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk)



Hallo zusammen,

ich bräuchte dringend Hilfe bzgl. der im Titel genannten Hosts.

Ich habe heute eine E-Mail von Twitter erhalten, dass mein Account wohl kompromittiert und deshalb vorsorglich das Passwort geändert wurde.
Und tatsächlich hat jemand in meinem Namen Links zu chinesischen Malware-Seiten gepostet (Hab den Eintrag leider nicht notiert, bevor ich ihn gelöscht habe).

Gestern ist mir allerdings schon aufgefallen, dass meine Internetverbindung sporadisch langsam ist und habe deshalb mal nach auffälligen Verbindungen geschaut.
Dabei sind mir die o.g. Hosts aufgefallen, zu denen mein Computer (svchost.exe (NetworkService)) ab und zu Daten mit ziemlich genau 50000 Byte/s sendet.

Daraufhin habe ich einen kompletten Virusscan mit Avast durchgeführt, der aber nichts gefunden hat. Ebenso habe ich Hijackthis, OTL, OSAM, Mbam und aswMBR ausgeführt. Keines der Programme hat irgendetwas entdeckt.

Trotzdem sendet mein Computer immer noch Daten an diese Hosts (mehr an den *.your-server.de-Host).

Ich habe jetzt beide Einträge in der hosts-Datei blockiert. Allerdings weiß ich nun immer noch nicht, was genau die Ursache dafür ist

Vielleicht habt jemand von euch eine Ahnung?

Alt 10.10.2012, 16:26   #2
kira
/// Helfer-Team
 
Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk) - Standard

Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk)



Hallo und Herzlich Willkommen!

Bevor wir unsere Zusammenarbeit beginnen, [Bitte Vollständig lesen]:
Zitat:
  • "Fernbehandlungen/Fernhilfe" und die damit verbundenen Haftungsrisken:
    - da die Fehlerprüfung und Handlung werden über große Entfernungen durchgeführt, besteht keine Haftung unsererseits für die daraus entstehenden Folgen.
    - also, jede Haftung für die daraus entstandene Schäden wird ausgeschlossen, ANWEISUNGEN UND DEREN BEFOLGUNG, ERFOLGT AUF DEINE EIGENE VERANTWORTUNG!
  • Charakteristische Merkmale/Profilinformationen:
    - aus der verwendeten Loglisten oder Logdateien - wie z.B. deinen Realnamen, Seriennummer in Programm etc)- kannst Du durch [X] oder Sternchen (*) ersetzen
  • Die Systemprüfung und Bereinigung:
    - kann einige Zeit in Anspruch nehmen (je nach Art der Infektion), kann aber sogar so stark kompromittiert sein, so dass eine wirkungsvolle technische Säuberung ist nicht mehr möglich bzw Du es neu installieren musst
  • Ich empfehle Dir die Anweisungen erst einmal komplett durchzulesen, bevor du es anwendest, weil wenn du etwas falsch machst, kann es wirklich gefährlich werden. Wenn du meinen Anweisungen Schritt für Schritt folgst, kann eigentlich nichts schief gehen.
  • Innerhalb der Betreuungszeit:
    - ohne Abspräche bitte nicht auf eigene Faust handeln!- bei Problemen nachfragen.
  • Die Reihenfolge:
    - genau so wie beschrieben bitte einhalten, nicht selbst die Reihenfolge wählen!
  • GECRACKTE SOFTWARE werden hier nicht geduldet!!!!
  • Ansonsten unsere Forumsregeln:
    - Bitte erst lesen, dann posten!-> Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten?
  • Alle Logfile mit einem vBCode Tag eingefügen, das bietet hier eine gute Übersicht, erleichtert mir die Arbeit! Falls das Logfile zu groß, teile es in mehrere Teile auf.

Sobald Du diesen Einführungstext gelesen hast, kannst Du beginnen
Hilfeleistung - geplante Vorgehensweise:
  • Problemsuche
  • Problembeseitigung/Systembereinigung
  • Verwendete Programme deinstallieren/entfernen
  • Thema abschließen: Tipps zur Computersicherheit

Für Vista und Win7:
Wichtig: Alle Befehle bitte als Administrator ausführen! rechte Maustaste auf die Eingabeaufforderung und "als Administrator ausführen" auswählen
Auf der angewählten Anwendung einen Rechtsklick (rechte Maustaste) und "Als Administrator ausführen" wählen!

1.
Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Mache Häckchen bei LOP- und Purity-Prüfung
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt - OTL.txt und Extras.txt
  • Poste die Logfiles in Code-Tags hier in den Thread.

2.
Um festzustellen, ob veraltete oder schädliche Software unter Programme installiert sind, ich würde gerne noch all deine installierten Programme sehen:
  • Download den CCleaner herunter
  • Software-Lizenzvereinbarung lesen, falls irgendeine Toolbar angeboten wird, bitte abwählen!-> starten -> Falls nötig, auf "Deutsch" einstellen.
  • starten-> klick auf `Extras` (um auf deinem System installierte Software zu anzeigen)-> dann auf `Als Textdatei speichern...`
  • ein Textdatei wird automatisch erstellt, poste auch dieses Logfile (also die Liste alle installierten Programme...eine Textdatei)

3.
Lade dir von hier -> HijackThis herunter
Keine offenen Fenster, solang bis HijackThis läuft!!-> HijackThis starten-> "Do a system scan and save a logfile" klicken (kurz warten) -> das erhaltene Logfile "markieren" -> "kopieren"-> hier in deinem Thread (rechte Maustaste) "einfügen"
► Vista und Win7 - Rechtsklick auf HijackThis-> "Als administrator ausführen" wählen...

Zitat:
Damit dein Thread übersichtlicher und schön lesbar bleibt, am besten nutze den Code-Tags für deinen Post:
→ vor dein Log schreibst Du (also am Anfang des Logfiles):[code]
hier kommt dein Logfile rein - z.B OTL-Logfile o. sonstiges
→ dahinter - also am Ende der Logdatei: [/code]
gruß
kira
__________________

__________________

Alt 10.10.2012, 16:49   #3
meric
 
Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk) - Standard

Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk)



Edit:
Mir ist gerade bei einem Blick in die Windows-Ereignisanzeige aufgefallen, dass ich seit dem 09.10. Fehlermeldungen von den Diensten Remotedesktop-Dienst, NLA (Network Location Awareness), Arbeitsstationsdienst, DNS-Client und Kryptografiedienste im Protokoll habe. Diese Fehlermeldungen kamen ziemlich genau zu dem Zeitpunkt, an denen ich die Netzwerkverbindung getrennt habe.
Kann es vielleicht sein, dass jemand eine Remoteverbindung zu meinem Rechner aufbaut?

----------------

Okay, ich hoffe, ich habe alles richtig gemacht:

OTL-Logfile:
Code:
ATTFilter
OTL logfile created on: 10.10.2012 16:53:44 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\meric\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 1,85 Gb Available Physical Memory | 46,27% Memory free
6,00 Gb Paging File | 3,77 Gb Available in Paging File | 62,91% Paging File free
Paging file location(s): d:\pagefile.sys 2048 2048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 40,43 Gb Total Space | 0,63 Gb Free Space | 1,55% Space Free | Partition Type: NTFS
Drive D: | 425,33 Gb Total Space | 30,41 Gb Free Space | 7,15% Space Free | Partition Type: NTFS
Drive E: | 149,04 Gb Total Space | 4,55 Gb Free Space | 3,05% Space Free | Partition Type: NTFS
Drive F: | 3,85 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: CHOSENONE | User Name: meric | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\meric\Desktop\OTL.exe (OldTimer Tools)
PRC - D:\Programme\Opera\opera.exe (Opera Software)
PRC - D:\Programme\avast Antivirus\AvastUI.exe (AVAST Software)
PRC - D:\Programme\avast Antivirus\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - D:\Programme\Microsoft Office\Office12\OUTLOOK.EXE (Microsoft Corporation)
PRC - D:\Programme\DynDNS Updater\DynUpSvc.exe (Dyn, Inc.)
PRC - D:\Programme\DynDNS Updater\DynTray.exe (Dyn, Inc.)
PRC - D:\Programme\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG)
PRC - C:\Windows\SysWOW64\CTxfispi.exe (Creative Technology Ltd)
PRC - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
PRC - C:\Program Files (x86)\Common Files\Realtime Soft\RTSHookInterop\x32\RTSHookInterop.exe (Realtime Soft Ltd)
PRC - C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe (Creative Technology Ltd.)
 
 
========== Modules (No Company Name) ==========
 
MOD - D:\Programme\Opera\gstreamer\plugins\gstoggdec.dll ()
MOD - D:\Programme\Opera\gstreamer\plugins\gstwebmdec.dll ()
MOD - D:\Programme\Opera\gstreamer\plugins\gstffmpegcolorspace.dll ()
MOD - D:\Programme\Opera\gstreamer\plugins\gstwavparse.dll ()
MOD - D:\Programme\Opera\gstreamer\plugins\gstdirectsound.dll ()
MOD - D:\Programme\Opera\gstreamer\plugins\gstdecodebin2.dll ()
MOD - D:\Programme\Opera\gstreamer\plugins\gstautodetect.dll ()
MOD - D:\Programme\Opera\gstreamer\plugins\gstwaveform.dll ()
MOD - D:\Programme\Opera\gstreamer\plugins\gsttypefindfunctions.dll ()
MOD - D:\Programme\Opera\gstreamer\gstreamer.dll ()
MOD - D:\Programme\Opera\gstreamer\plugins\gstcoreplugins.dll ()
MOD - D:\Programme\Opera\gstreamer\plugins\gstaudioresample.dll ()
MOD - D:\Programme\Opera\gstreamer\plugins\gstaudioconvert.dll ()
MOD - D:\Programme\avast Antivirus\aswOtl.dll ()
MOD - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL ()
MOD - D:\Programme\Microsoft Office\Office12\ADDINS\UmOutlookAddin.dll ()
MOD - C:\Windows\SysWOW64\APOMngr.DLL ()
MOD - D:\Programme\Samsung\Samsung PC Studio 7\PCSCM_Samsung.dll ()
MOD - D:\Programme\Microsoft Office\Office12\ADDINS\ColleagueImport.dll ()
MOD - C:\Windows\SysWOW64\CmdRtr.DLL ()
MOD - D:\Programme\Samsung\Samsung PC Studio 7\PhoneBrowser.dll ()
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (Hamachi2Svc) -- D:\Programme\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
SRV - (avast! Antivirus) -- D:\Programme\avast Antivirus\AvastSvc.exe (AVAST Software)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (HiPatchService) -- D:\Spiele\Hi-Rez Studios\HiPatchService.exe (Hi-Rez Studios)
SRV - (SkypeUpdate) -- D:\Programme\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (npggsvc) -- C:\Windows\SysWOW64\GameMon.des (INCA Internet Co., Ltd.)
SRV - (wampmysqld) -- c:\wamp\bin\mysql\mysql5.5.20\bin\mysqld.exe ()
SRV - (Giraffic) -- C:\Program Files (x86)\Giraffic\Veoh_GirafficWatchdog.exe (Giraffic)
SRV - (Dyn Updater) -- D:\Programme\DynDNS Updater\DynUpSvc.exe (Dyn, Inc.)
SRV - (Creative Audio Engine Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs)
SRV - (Creative ALchemy AL6 Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe (Creative Labs)
SRV - (LBTServ) -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (wampapache) -- c:\wamp\bin\apache\Apache2.2.21\bin\httpd.exe (Apache Software Foundation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (CTAudSvcService) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (ServiceLayer) -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (dg_ssudbus) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (ssudmdm) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (aswSnx) -- C:\Windows\SysNative\drivers\aswSnx.sys (AVAST Software)
DRV:64bit: - (aswSP) -- C:\Windows\SysNative\drivers\aswSP.sys (AVAST Software)
DRV:64bit: - (aswTdi) -- C:\Windows\SysNative\drivers\aswTdi.sys (AVAST Software)
DRV:64bit: - (aswMonFlt) -- C:\Windows\SysNative\drivers\aswMonFlt.sys (AVAST Software)
DRV:64bit: - (aswRdr) -- C:\Windows\SysNative\drivers\aswRdr2.sys (AVAST Software)
DRV:64bit: - (aswFsBlk) -- C:\Windows\SysNative\drivers\aswFsBlk.sys (AVAST Software)
DRV:64bit: - (EuMusDesignVirtualAudioCableWdm) -- C:\Windows\SysNative\drivers\vrtaucbl.sys (Eugene V. Muzychenko)
DRV:64bit: - (aswKbd) -- C:\Windows\SysNative\drivers\aswKbd.sys (AVAST Software)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (usbfilter) -- C:\Windows\SysNative\drivers\usbfilter.sys (Advanced Micro Devices)
DRV:64bit: - (amd_xata) -- C:\Windows\SysNative\drivers\amd_xata.sys (Advanced Micro Devices)
DRV:64bit: - (amd_sata) -- C:\Windows\SysNative\drivers\amd_sata.sys (Advanced Micro Devices)
DRV:64bit: - (LMouFilt) -- C:\Windows\SysNative\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV:64bit: - (LHidFilt) -- C:\Windows\SysNative\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV:64bit: - (taphss) -- C:\Windows\SysNative\drivers\taphss.sys (AnchorFree Inc)
DRV:64bit: - (ssadmdm) -- C:\Windows\SysNative\drivers\ssadmdm.sys (MCCI Corporation)
DRV:64bit: - (ssadbus) -- C:\Windows\SysNative\drivers\ssadbus.sys (MCCI Corporation)
DRV:64bit: - (ssadmdfl) -- C:\Windows\SysNative\drivers\ssadmdfl.sys (MCCI Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (LGBusEnum) -- C:\Windows\SysNative\drivers\LGBusEnum.sys (Logitech Inc.)
DRV:64bit: - (LGVirHid) -- C:\Windows\SysNative\drivers\LGVirHid.sys (Logitech Inc.)
DRV:64bit: - (VClone) -- C:\Windows\SysNative\drivers\VClone.sys (Elaborate Bytes AG)
DRV:64bit: - (sscemdm) -- C:\Windows\SysNative\drivers\sscemdm.sys (MCCI Corporation)
DRV:64bit: - (ssceserd) -- C:\Windows\SysNative\drivers\ssceserd.sys (MCCI Corporation)
DRV:64bit: - (sscebus) -- C:\Windows\SysNative\drivers\sscebus.sys (MCCI Corporation)
DRV:64bit: - (androidusb) -- C:\Windows\SysNative\drivers\ssadadb.sys (Google Inc)
DRV:64bit: - (sscemdfl) -- C:\Windows\SysNative\drivers\sscemdfl.sys (MCCI Corporation)
DRV:64bit: - (ElbyCDIO) -- C:\Windows\SysNative\drivers\ElbyCDIO.sys (Elaborate Bytes AG)
DRV:64bit: - (vpcvmm) -- C:\Windows\SysNative\drivers\vpcvmm.sys (Microsoft Corporation)
DRV:64bit: - (vpcbus) -- C:\Windows\SysNative\drivers\vpchbus.sys (Microsoft Corporation)
DRV:64bit: - (vpcusb) -- C:\Windows\SysNative\drivers\vpcusb.sys (Microsoft Corporation)
DRV:64bit: - (vpcuxd) -- C:\Windows\SysNative\drivers\vpcuxd.sys (Microsoft Corporation)
DRV:64bit: - (vpcnfltr) -- C:\Windows\SysNative\drivers\vpcnfltr.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (ha20x22k) -- C:\Windows\SysNative\drivers\ha20x22k.sys (Creative Technology Ltd)
DRV:64bit: - (ha20x2k) -- C:\Windows\SysNative\drivers\ha20x2k.sys (Creative Technology Ltd)
DRV:64bit: - (emupia) -- C:\Windows\SysNative\drivers\emupia2k.sys (Creative Technology Ltd)
DRV:64bit: - (ctsfm2k) -- C:\Windows\SysNative\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV:64bit: - (ctprxy2k) -- C:\Windows\SysNative\drivers\ctprxy2k.sys (Creative Technology Ltd)
DRV:64bit: - (ossrv) -- C:\Windows\SysNative\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV:64bit: - (ctaud2k) -- C:\Windows\SysNative\drivers\ctaud2k.sys (Creative Technology Ltd)
DRV:64bit: - (ctac32k) -- C:\Windows\SysNative\drivers\ctac32k.sys (Creative Technology Ltd)
DRV:64bit: - (CTEXFIFX.SYS) -- C:\Windows\SysNative\drivers\CTEXFIFX.sys (Creative Technology Ltd.)
DRV:64bit: - (CTEXFIFX) -- C:\Windows\SysNative\drivers\CTEXFIFX.sys (Creative Technology Ltd.)
DRV:64bit: - (CTHWIUT.SYS) -- C:\Windows\SysNative\drivers\CTHWIUT.sys (Creative Technology Ltd.)
DRV:64bit: - (CTHWIUT) -- C:\Windows\SysNative\drivers\CTHWIUT.sys (Creative Technology Ltd.)
DRV:64bit: - (CT20XUT.SYS) -- C:\Windows\SysNative\drivers\CT20XUT.sys (Creative Technology Ltd.)
DRV:64bit: - (CT20XUT) -- C:\Windows\SysNative\drivers\CT20XUT.sys (Creative Technology Ltd.)
DRV:64bit: - (AtiPcie) -- C:\Windows\SysNative\drivers\AtiPcie64.sys (Advanced Micro Devices Inc.)
DRV:64bit: - (Revoflt) -- C:\Windows\SysNative\drivers\revoflt.sys (VS Revo Group)
DRV:64bit: - (lowcdc) -- C:\Windows\SysNative\drivers\lowcdc.sys (hxxp://www.recursion.jp/avrcdc/)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (StillCam) -- C:\Windows\SysNative\drivers\serscan.sys (Microsoft Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (grmnusb) -- C:\Windows\SysNative\drivers\grmnusb.sys (GARMIN Corp.)
DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek Corporation                                            )
DRV:64bit: - (VCSVADHWSer) -- C:\Windows\SysNative\drivers\vcsvad.sys (Avnex)
DRV:64bit: - (pccsmcfd) -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys (Nokia)
DRV:64bit: - (nmwcdsax64) -- C:\Windows\SysNative\drivers\nmwcdsax64.sys (Nokia)
DRV:64bit: - (nmwcdsacjx64) -- C:\Windows\SysNative\drivers\nmwcdsacjx64.sys (Nokia)
DRV:64bit: - (nmwcdsacx64) -- C:\Windows\SysNative\drivers\nmwcdsacx64.sys (Nokia)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (UltraMonUtility) -- C:\Program Files (x86)\Common Files\Realtime Soft\UltraMonMirrorDrv\x64\UltraMonUtility.sys (Realtime Soft Ltd)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 51 07 D0 4F 35 A4 CD 01  [binary data]
IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\..\SearchScopes\{3D336522-0C99-4412-B500-3472495092DA}: "URL" = hxxp://www.google.de/search?q={searchTerms}
IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "chrome://speeddial/content/speeddial.xul"
FF - prefs.js..extensions.enabledAddons: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E}:3.0.1
FF - prefs.js..extensions.enabledAddons: {8b86149f-01fb-4842-9dd8-4d7eb02fd055}:0.22.1
FF - prefs.js..extensions.enabledAddons: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.10
FF - prefs.js..extensions.enabledAddons: {dc572301-7619-498c-a57d-39143191b318}:0.4.0.3
FF - prefs.js..extensions.enabledAddons: ich@maltegoetz.de:1.4.3
FF - prefs.js..extensions.enabledAddons: yetanothersmoothscrolling@kataho:3.0.24
FF - prefs.js..extensions.enabledAddons: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:1.3
FF - prefs.js..extensions.enabledAddons: {64161300-e22b-11db-8314-0800200c9a66}:0.9.6.10
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_287.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1165635.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.0: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=0.80.0: C:\Program Files (x86)\Battlelog Web Plugins\0.80.0\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@garmin.com/GpsControl: C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: D:\Programme\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: D:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\meric\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\meric\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\meric\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011.08.05 04:20:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: D:\Programme\avast Antivirus\WebRep\FF [2012.09.07 06:02:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Components: D:\Programme\Mozilla Firefox 4\components [2012.09.07 19:37:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Plugins: D:\Programme\Mozilla Firefox 4\plugins [2012.09.07 19:37:15 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: D:\Programme\Mozilla Firefox 4\components [2012.09.07 19:37:21 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: D:\Programme\Mozilla Firefox 4\plugins [2012.09.07 19:37:15 | 000,000,000 | ---D | M]
 
[2011.02.19 06:14:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\Extensions
[2012.10.10 14:30:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions
[2011.08.26 14:05:17 | 000,000,000 | ---D | M] (Garmin Communicator) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2011.06.29 22:54:50 | 000,000,000 | ---D | M] (All-in-One Gestures) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\{8b86149f-01fb-4842-9dd8-4d7eb02fd055}
[2012.09.16 02:47:33 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012.10.02 23:00:12 | 000,000,000 | ---D | M] (FoxyProxy Standard) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\foxyproxy-basic@eric.h.jung
[2012.09.15 12:21:45 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\ich@maltegoetz.de
[2012.02.23 17:04:32 | 000,164,722 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\compatibility@addons.mozilla.org.xpi
[2012.10.10 04:24:53 | 001,626,141 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\firebug@software.joehewitt.com.xpi
[2012.09.15 12:21:45 | 000,066,522 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\yetanothersmoothscrolling@kataho.xpi
[2012.10.10 14:30:49 | 000,281,285 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{64161300-e22b-11db-8314-0800200c9a66}.xpi
[2012.10.10 04:24:51 | 000,529,404 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2012.09.05 13:40:27 | 001,268,546 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}.xpi
[2012.07.25 05:41:33 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2011.11.05 14:28:38 | 000,434,392 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi
[2012.07.21 13:05:28 | 000,702,524 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi
[2012.09.13 01:44:36 | 000,698,867 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi
[2012.10.03 12:46:51 | 000,257,937 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: chrome://speeddial/content/speeddial.xul
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\meric\AppData\Local\Google\Chrome\Application\17.0.963.78\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.240.7 (Enabled) = D:\Programme\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U24 (Enabled) = D:\Programme\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = D:\Programme\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\np-mswmp.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\meric\AppData\Local\Google\Chrome\Application\17.0.963.78\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\meric\AppData\Local\Google\Chrome\Application\17.0.963.78\pdf.dll
CHR - plugin: Google Talk Plugin (Enabled) = C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: Garmin Communicator Plug-In (Enabled) = C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
CHR - plugin: Windows Activation Technologies (Enabled) = C:\Windows\system32\Wat\npWatWeb.dll
CHR - plugin: Picasa (Enabled) = D:\Programme\Google\Picasa3\npPicasa3.dll
CHR - plugin: iTunes Application Detector (Enabled) = D:\Programme\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: TooManyTabs f\u00FCr Chrome = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\amigcgbheognjmfkaieeeadojiibgbdp\1.9.1_0\
CHR - Extension: TooManyTabs f\u00FCr Chrome = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\amigcgbheognjmfkaieeeadojiibgbdp\1.9.2_0\
CHR - Extension: Turn Off the Lights = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfbmjmiodbnnpllbbbfblcplfjjepjdn\2.0.0.81_0\
CHR - Extension: GCVote = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\boingbkmoapffongfpcancmephhnmehp\2.4.5_0\
CHR - Extension: GCVote = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\boingbkmoapffongfpcancmephhnmehp\2.4.5_0\~
CHR - Extension: SmoothScroll = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\cccpiddacjljmfbbgeimpelpndgpoknn\1.0.6_0\
CHR - Extension: Adblock Plus f\u00FCr Google Chrome\u2122 (Beta) = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.1.3_0\
CHR - Extension: Session Buddy = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\edacconmaakjimmfgnblocblbcdcpbko\2.1.2_0\
CHR - Extension: Direkt Werbung auf YouTube = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\epbmnbdplhcomkedpjfceakddnbgfjmf\1.199_0\
CHR - Extension: Direkt Werbung auf YouTube = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\epbmnbdplhcomkedpjfceakddnbgfjmf\1.52_0\
CHR - Extension: AdBlock = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.33_0\
CHR - Extension: avast! WebRep = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\
CHR - Extension: Speed Dial 2 = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpfpebmajhhopeonhlcgidhclcccjcik\1.6.0.8_0\
CHR - Extension: Smooth Gestures = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfkgmnnajiljnolcgolmmgnecgldgeld\0.15.4.13_0\
CHR - Extension: GC little helper = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\nagohipignfajbmgdcedbnmafoebnnjg\1.0_0\
CHR - Extension: New Tabs Always Last = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\nldmhfnlbkkdhboedalogjpeedjbmjgi\0.1_0\
CHR - Extension: Mehr Leistung und Videoformate f\u00FCr dein HTML5 \u003Cvideo\u003E = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.126_0\
 
O1 HOSTS File: ([2012.10.10 15:46:01 | 000,002,688 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 clients.your-server.de
O1 - Hosts: 127.0.0.1 your-server.de
O1 - Hosts: 127.0.0.1 rackcentre.redstation.net.uk
O1 - Hosts: 127.0.0.1 redstation.net.uk
O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - D:\Programme\avast Antivirus\aswWebRepIE64.dll (AVAST Software)
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\avast Antivirus\aswWebRepIE.dll (AVAST Software)
O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - D:\Programme\avast Antivirus\aswWebRepIE64.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\avast Antivirus\aswWebRepIE.dll (AVAST Software)
O4:64bit: - HKLM..\Run: [EvtMgr6] D:\Programme\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [Launch LCore] C:\Program Files\Logitech Gaming Software\LCore.exe (Logitech Inc.)
O4 - HKLM..\Run: [avast] D:\Programme\avast Antivirus\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] D:\Programme\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [Module Loader] C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [VirtualCloneDrive] D:\Programme\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG)
O4 - HKU\.DEFAULT..\Run: [Samsung.PCSync] D:\Programme\Samsung\Samsung PC Studio 7\PcSync2.exe (Time Information Services Ltd.)
O4 - HKU\S-1-5-18..\Run: [Samsung.PCSync] D:\Programme\Samsung\Samsung PC Studio 7\PcSync2.exe (Time Information Services Ltd.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] D:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\meric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\launch.jnlp ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1
O8:64bit: - Extra context menu item: add to &BOM - D:\\PROGRA~1\\BIET-O~1\\\\AddToBOM.hta ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: add to &BOM - D:\\PROGRA~1\\BIET-O~1\\\\AddToBOM.hta ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKU\.DEFAULT\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: sony.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: sony.com ([]* in Trusted sites)
O15 - HKU\S-1-5-19\..Trusted Domains: clonewarsadventures.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: freerealms.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: soe.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: sony.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: clonewarsadventures.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: freerealms.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: soe.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: sony.com ([]* in )
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15114/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7261E20A-4D13-42CD-AACA-ADDBC90946B2}: NameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\gopher - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\AutorunsDisabled: DllName - (Reg Error: Value error.) - Reg Error: Value error. File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{374c1187-4813-11e1-9fcd-00241ddbd724}\Shell - "" = AutoRun
O33 - MountPoints2\{374c1187-4813-11e1-9fcd-00241ddbd724}\Shell\AutoRun\command - "" = H:\iStudio.exe
O33 - MountPoints2\{f79fdbda-579f-11e0-857b-a96a988e982a}\Shell - "" = AutoRun
O33 - MountPoints2\{f79fdbda-579f-11e0-857b-a96a988e982a}\Shell\AutoRun\command - "" = G:\start.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.10.10 16:53:00 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\meric\Desktop\OTL.exe
[2012.10.10 16:33:54 | 000,000,000 | ---D | C] -- C:\Users\meric\Desktop\OSAM
[2012.10.10 16:13:14 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Users\meric\Desktop\aswMBR.exe
[2012.10.10 16:01:56 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Roaming\Malwarebytes
[2012.10.10 16:01:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.10.10 16:01:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.10.10 16:01:41 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.10.10 15:20:59 | 000,000,000 | ---D | C] -- C:\Users\meric\Desktop\backups
[2012.10.10 15:01:33 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\meric\Desktop\HijackThis.exe
[2012.10.10 14:46:18 | 000,424,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll
[2012.10.10 14:46:17 | 001,162,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll
[2012.10.10 14:46:17 | 000,338,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\conhost.exe
[2012.10.10 14:46:17 | 000,215,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll
[2012.10.10 14:46:14 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll
[2012.10.10 14:46:13 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe
[2012.10.10 14:46:13 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll
[2012.10.10 14:46:13 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll
[2012.10.10 14:46:12 | 000,362,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll
[2012.10.10 14:46:12 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll
[2012.10.10 14:46:12 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe
[2012.10.10 14:46:12 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll
[2012.10.10 14:46:12 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2012.10.10 14:46:12 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2012.10.10 14:46:12 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012.10.10 14:46:11 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2012.10.10 14:46:10 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2012.10.10 14:46:09 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2012.10.10 14:46:09 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2012.10.10 14:46:08 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2012.10.10 14:46:08 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2012.10.10 14:46:07 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2012.10.10 14:46:07 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2012.10.10 14:46:07 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2012.10.10 14:46:07 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2012.10.10 14:46:07 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2012.10.10 14:46:07 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2012.10.10 14:46:06 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2012.10.10 14:46:06 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2012.10.10 14:46:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2012.10.10 14:46:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2012.10.10 14:46:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2012.10.10 14:46:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2012.10.10 14:46:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2012.10.10 14:46:05 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe
[2012.10.10 14:45:24 | 001,464,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll
[2012.10.10 14:45:23 | 000,140,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll
[2012.10.10 14:45:01 | 000,220,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll
[2012.10.10 14:44:21 | 005,559,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2012.10.10 14:44:20 | 003,914,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2012.10.10 14:44:19 | 003,968,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2012.10.07 04:57:11 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Local\SCE
[2012.10.07 04:57:11 | 000,000,000 | ---D | C] -- C:\Crash
[2012.10.05 17:44:27 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Logishrd
[2012.10.03 16:44:17 | 000,000,000 | ---D | C] -- C:\ProgramData\MAGIX
[2012.10.03 16:44:16 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Local\Xara
[2012.10.03 16:44:16 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Roaming\MAGIX
[2012.10.03 16:43:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Xara
[2012.10.03 16:43:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xara
[2012.09.29 15:31:59 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Local\Solid State Networks
[2012.09.29 15:31:52 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Meteor Entertainment
[2012.09.27 00:02:30 | 000,000,000 | ---D | C] -- C:\Windows\rescache
[2012.09.26 11:14:27 | 000,245,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\OxpsConverter.exe
[2012.09.22 11:51:09 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012.09.22 11:51:09 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012.09.22 11:51:08 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012.09.22 11:51:08 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012.09.22 11:51:08 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2012.09.22 11:51:08 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2012.09.22 11:51:07 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2012.09.22 11:51:07 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012.09.22 11:51:07 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012.09.22 11:51:07 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012.09.22 11:51:06 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2012.09.22 11:51:06 | 000,729,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2012.09.22 11:51:04 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2012.09.22 11:51:04 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012.09.22 11:51:04 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2012.09.19 10:02:08 | 000,102,368 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudbus.sys
[2012.09.19 10:02:06 | 000,203,104 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudmdm.sys
[2012.09.15 03:50:21 | 000,000,000 | --SD | C] -- C:\Users\meric\Documents\Eigene Datenquellen
[2012.09.12 12:44:00 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\RNDISMP.sys
[2012.09.12 12:43:59 | 000,574,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10level9.dll
[2012.09.12 12:43:58 | 000,376,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\netio.sys
[2012.09.12 12:43:58 | 000,288,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\FWPKCLNT.SYS
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.10.10 16:53:01 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\meric\Desktop\OTL.exe
[2012.10.10 16:13:21 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Users\meric\Desktop\aswMBR.exe
[2012.10.10 16:12:58 | 000,007,624 | ---- | M] () -- C:\Users\meric\AppData\Local\Resmon.ResmonCfg
[2012.10.10 16:06:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.10.10 16:02:47 | 000,646,577 | ---- | M] () -- C:\Users\meric\Desktop\svchost.exe_redstation.net.uk.png
[2012.10.10 15:03:31 | 000,013,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.10.10 15:03:31 | 000,013,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.10.10 15:01:34 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\meric\Desktop\HijackThis.exe
[2012.10.10 14:56:58 | 000,000,306 | ---- | M] () -- C:\Windows\tasks\GlaryInitialize.job
[2012.10.10 14:55:12 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.10.10 14:55:00 | 3220,037,632 | -HS- | M] () -- C:\hiberfil.sys
[2012.10.10 14:54:26 | 000,062,308 | ---- | M] () -- C:\Windows\SysNative\BMXStateBkp-{00000002-00000000-00000000-00001102-0000000B-00411102}.rfx
[2012.10.10 14:54:26 | 000,062,308 | ---- | M] () -- C:\Windows\SysNative\BMXState-{00000002-00000000-00000000-00001102-0000000B-00411102}.rfx
[2012.10.10 14:54:26 | 000,000,820 | ---- | M] () -- C:\Windows\SysNative\DVCState-{00000002-00000000-00000000-00001102-0000000B-00411102}.rfx
[2012.10.10 03:29:07 | 000,281,120 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2012.10.10 03:29:07 | 000,281,120 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012.10.10 01:34:04 | 000,281,120 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0
[2012.10.09 18:10:11 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
[2012.10.09 17:14:28 | 000,696,760 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012.10.09 17:14:28 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012.10.08 09:04:12 | 000,053,095 | ---- | M] () -- C:\Users\meric\Desktop\Hochschulsport - Anmeldebestätigung.pdf
[2012.10.07 04:56:54 | 000,000,707 | ---- | M] () -- C:\Users\meric\Desktop\PlanetSide 2 Beta.lnk
[2012.10.05 17:45:08 | 000,018,960 | ---- | M] (Logitech, Inc.) -- C:\Windows\SysNative\drivers\LNonPnP.sys
[2012.10.05 14:01:11 | 004,977,352 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.10.03 17:07:09 | 000,010,387 | ---- | M] () -- C:\Users\meric\Desktop\sdfsdf.png
[2012.10.01 23:26:20 | 001,517,344 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.10.01 23:26:20 | 000,653,918 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.10.01 23:26:20 | 000,614,770 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.10.01 23:26:20 | 000,129,718 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.10.01 23:26:20 | 000,106,012 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.10.01 21:13:21 | 001,594,114 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.10.01 21:13:08 | 000,265,598 | ---- | M] () -- C:\Users\meric\Desktop\dotnetfx_cleanup_tool.zip
[2012.09.26 18:33:12 | 000,617,992 | ---- | M] () -- C:\Users\meric\Desktop\parken.jpg
[2012.09.25 16:47:17 | 000,000,248 | ---- | M] () -- C:\Users\meric\Desktop\dbscheme.ase
[2012.09.24 23:15:52 | 000,176,169 | ---- | M] () -- C:\Users\meric\Desktop\gangnamstyle.mp3
[2012.09.19 10:02:08 | 000,102,368 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudbus.sys
[2012.09.19 10:02:06 | 000,203,104 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudmdm.sys
[2012.09.10 17:47:29 | 000,000,852 | ---- | M] () -- C:\Users\meric\Desktop\DayZ Commander.lnk
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.10.10 16:02:46 | 000,646,577 | ---- | C] () -- C:\Users\meric\Desktop\svchost.exe_redstation.net.uk.png
[2012.10.08 09:04:11 | 000,053,095 | ---- | C] () -- C:\Users\meric\Desktop\Hochschulsport - Anmeldebestätigung.pdf
[2012.10.07 04:56:54 | 000,000,707 | ---- | C] () -- C:\Users\meric\Desktop\PlanetSide 2 Beta.lnk
[2012.10.07 04:56:54 | 000,000,707 | ---- | C] () -- C:\Users\meric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PlanetSide 2 Beta.lnk
[2012.10.03 17:05:26 | 000,010,387 | ---- | C] () -- C:\Users\meric\Desktop\sdfsdf.png
[2012.10.01 21:13:24 | 000,265,598 | ---- | C] () -- C:\Users\meric\Desktop\dotnetfx_cleanup_tool.zip
[2012.09.29 16:22:19 | 001,594,114 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.09.26 18:33:09 | 000,617,992 | ---- | C] () -- C:\Users\meric\Desktop\parken.jpg
[2012.09.25 16:47:16 | 000,000,248 | ---- | C] () -- C:\Users\meric\Desktop\dbscheme.ase
[2012.09.24 23:15:51 | 000,176,169 | ---- | C] () -- C:\Users\meric\Desktop\gangnamstyle.mp3
[2012.05.29 19:59:33 | 000,003,193 | ---- | C] () -- C:\Users\meric\.TransferManager.db
[2012.05.14 04:45:43 | 000,000,703 | ---- | C] () -- C:\Windows\NewsRover.INI
[2012.03.26 01:16:02 | 000,645,632 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2012.03.26 01:16:02 | 000,240,640 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2012.03.03 16:30:28 | 000,577,536 | ---- | C] () -- C:\Windows\SysWow64\ChilkatCsv.dll
[2012.02.29 18:14:42 | 000,000,060 | ---- | C] () -- C:\Windows\picture2avi.ini
[2011.10.15 15:41:55 | 000,002,560 | ---- | C] () -- C:\Windows\SysWow64\CTXFIGER.DLL
[2011.10.15 14:24:42 | 000,164,864 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2011.10.15 14:24:42 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2011.09.28 18:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011.09.22 12:29:58 | 000,321,856 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2011.09.19 09:07:46 | 000,015,360 | ---- | C] () -- C:\Windows\SysWow64\bdmjpeg.dll
[2011.09.19 09:07:32 | 000,058,368 | ---- | C] () -- C:\Windows\SysWow64\bdmpegv.dll
[2011.09.16 11:54:48 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2011.09.16 11:54:44 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2011.09.16 11:54:44 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2011.09.16 11:54:44 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2011.09.16 11:54:44 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2011.09.14 11:36:30 | 000,000,184 | ---- | C] () -- C:\Users\meric\AppData\Roaming\3a99ed39.dat
[2011.05.12 01:10:29 | 000,000,600 | ---- | C] () -- C:\Users\meric\AppData\Roaming\winscp.rnd
[2011.04.22 01:53:09 | 000,010,240 | ---- | C] () -- C:\Users\meric\qlgt.db
[2011.04.17 18:34:36 | 000,000,132 | ---- | C] () -- C:\Users\meric\AppData\Roaming\Adobe GIF Format CS5 Prefs
[2011.04.16 16:16:51 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll
[2011.04.03 20:23:51 | 000,015,873 | ---- | C] () -- C:\Windows\SysWow64\Inetde.dll
[2011.03.10 22:53:14 | 000,000,600 | ---- | C] () -- C:\Users\meric\AppData\Local\PUTTY.RND
[2011.03.05 00:41:26 | 000,007,624 | ---- | C] () -- C:\Users\meric\AppData\Local\Resmon.ResmonCfg
[2011.02.25 07:51:49 | 000,000,132 | ---- | C] () -- C:\Users\meric\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2011.02.19 19:30:01 | 000,281,120 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011.02.19 19:30:00 | 000,837,192 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe
[2011.02.19 19:30:00 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 05:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2011.11.22 23:53:29 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft
[2011.11.22 23:47:21 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft - 1.0 aktuell
[2011.03.04 13:23:26 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft - john smith texture pack v7
[2011.03.04 13:22:58 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft - misa's texture pack
[2012.09.24 23:28:07 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Audacity
[2011.05.04 21:05:29 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Avnex
[2012.04.28 05:12:56 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\BANDISOFT
[2011.10.20 05:29:38 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Beat Hazard
[2011.04.13 03:07:11 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Bridge!
[2011.03.02 21:12:17 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Canon
[2011.04.15 21:18:40 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2011.02.19 18:04:10 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\DAEMON Tools Lite
[2012.03.03 21:42:36 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\EurekaLog
[2012.06.27 14:44:30 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\FileZilla
[2011.08.21 15:46:14 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\flightgear.org
[2011.02.26 21:08:06 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GARMIN
[2012.03.03 16:51:09 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GeoSetter
[2011.02.21 19:32:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GetRight
[2011.08.15 02:12:07 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GlarySoft
[2012.05.17 19:30:34 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GrabIt
[2012.07.17 17:53:03 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\gslist
[2011.12.27 20:46:27 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Highresolution Enterprises
[2012.05.29 13:49:48 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\ijjigame
[2011.02.23 18:24:43 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\ImgBurn
[2011.04.14 01:02:14 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\JAM Software
[2011.09.22 13:04:12 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\JOSM
[2011.02.19 05:17:20 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Leadertech
[2012.07.13 21:51:22 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\LolClient
[2012.06.04 00:45:51 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\LolClient2
[2012.10.03 16:44:17 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\MAGIX
[2011.04.15 02:06:11 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\mirkes.de
[2011.02.20 07:14:12 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Mp3tag
[2011.03.12 16:55:07 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\net.tw.Boks.7C34F9BA9FAD6689FAABBE85F1F5B46BA5A32DE5.1
[2011.02.20 02:07:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Notepad++
[2011.06.05 16:36:43 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\OpenOffice.org
[2011.02.26 20:56:52 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Opera
[2011.04.15 20:58:26 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\PACE Anti-Piracy
[2011.03.18 19:27:45 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\PC Suite
[2011.02.24 18:28:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\POV-Ray
[2011.11.20 03:52:57 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\pymclevel
[2011.10.20 21:30:41 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Samsung
[2012.07.17 03:41:36 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\six-updater
[2012.07.17 02:38:53 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\six-zsync
[2012.07.16 00:15:08 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\SplitMediaLabs
[2012.06.02 14:43:42 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Spotify
[2011.02.23 16:52:00 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2011.08.21 15:45:04 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Subversion
[2011.08.03 23:55:14 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\System
[2012.06.03 21:03:45 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\TeamViewer
[2012.07.10 13:32:48 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Temp
[2012.05.17 19:14:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Thunderbird
[2011.08.11 02:27:43 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Tropico 4 Demo
[2012.06.29 19:17:56 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\ts3overlay
[2011.10.07 23:33:58 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Unity
[2011.08.15 02:26:04 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\uTorrent
[2012.04.30 15:42:37 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Wireshark
[2011.10.19 18:15:14 | 000,000,000 | -HSD | M] -- C:\Users\meric\AppData\Roaming\wyUpdate AU
[2012.01.19 23:25:41 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\XMedia Recode
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 1225 bytes -> C:\Users\meric\AppData\Local\1vCCkxoreGSr:LmKM0wxK1yKopb7y44SV8UUG
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:5F64C164
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:9D1B94FD

< End of report >
         
Installierte Software:
Code:
ATTFilter
7-Zip 9.20 (x64 edition)	Igor Pavlov	15.09.2011	4,53MB	9.20.00.0
ABC Amber Nokia Converter		23.05.2012		
Adobe AIR	Adobe Systems Incorporated	02.12.2011		3.1.0.4880
Adobe Community Help	Adobe Systems Incorporated	22.02.2011		3.0.0.400
Adobe Creative Suite 5 Master Collection	Adobe Systems Incorporated	22.02.2011	8,46GB	5.0
Adobe Flash Media Live Encoder 3.2	Adobe Systems Incorporated	16.08.2011	14,0MB	3.2.0
Adobe Flash Player 11 ActiveX	Adobe Systems Incorporated	09.10.2012	6,00MB	11.4.402.287
Adobe Flash Player 11 Plugin	Adobe Systems Incorporated	09.10.2012	6,00MB	11.4.402.287
Adobe Media Player	Adobe Systems Incorporated	22.02.2011		1.8
Adobe Reader X (10.1.4) - Deutsch	Adobe Systems Incorporated	24.08.2012	169MB	10.1.4
Adobe Shockwave Player 11.6	Adobe Systems, Inc.	27.07.2012		11.6.5.635
AMD Catalyst Install Manager	Advanced Micro Devices, Inc.	03.03.2012	26,2MB	3.0.859.0
Apple Application Support	Apple Inc.	08.08.2011	60,1MB	2.0.1
Apple Mobile Device Support	Apple Inc.	20.02.2011	22,3MB	3.3.1.3
Apple Software Update	Apple Inc.	08.08.2011	2,38MB	2.1.3.127
ArmA 2 Uninstall		16.07.2012		
ARMA 2: Operation Arrowhead	Bohemia Interactive	16.07.2012		
Audacity 2.0	Audacity Team	09.08.2012	42,8MB	
Audiosurf	All of Nothing	21.10.2011	204MB	33
AutoHotkey 1.0.48.05	Chris Mallett	15.04.2011		1.0.48.05
avast! Free Antivirus	AVAST Software	07.09.2012		7.0.1466.0
bada SDK 2.0.5	Samsung Electronics Co., Ltd.	09.06.2012		2.0.5
Bandicam	Bandisoft.com	28.04.2012		
Bandisoft MPEG-1 Decoder		28.04.2012		
Battlelog Web Plugins	EA Digital Illusions CE AB	29.09.2011		0.80.0
BattlEye for OA Uninstall		21.07.2012		
Biet-O-Matic v2.14.8	BOM Development Team	03.04.2011		Biet-O-Matic v2.14.8
Boks	UNKNOWN	12.03.2011		0.5.8
Canon IJ Network Scan Utility		23.02.2011		
Canon IJ Network Tool		23.02.2011		
Canon MP Navigator EX 2.0		23.02.2011		
Canon MP620 series MP Drivers		23.02.2011		
CCleaner	Piriform	24.09.2012		3.23
Creative Audio-Systemsteuerung	Creative Technology Limited	15.10.2011		3.00
Creative Software AutoUpdate	Creative Technology Limited	15.10.2011		1.40
Creative Sound Blaster Properties x64 Edition	Creative Technology Limited	15.10.2011		1.02
DayZ Commander	Dotjosh Open Source	17.07.2012	2,86MB	1.09.39
Deus Ex - Human Revolution version 1.0	Square Enix	31.08.2011		1.0
DivX-Setup	DivX, LLC	05.08.2011		2.6.0.34
Driver Sweeper Version 3.2.0	Phyxion.net	15.10.2011	13,0MB	3.2.0
DTS Connect Pack	Creative Technology Limited	15.10.2011		1.00
Dyn Updater	Dyn, Inc.	18.11.2011		4.1.10
EOSInfo	astrojargon.net	22.05.2011	1,66MB	0.2.0
ESN Sonar	ESN Social Software AB	29.09.2011		0.70.0
FastStone Image Viewer 4.3	FastStone Soft	23.02.2011		4.3
FileZilla Client 3.4.0		07.10.2012		3.4.0
Fraps (remove only)		16.03.2011		
FWTools 2.4.7		22.04.2011		
Garmin Communicator Plugin	Garmin Ltd or its subsidiaries	24.03.2011	11,6MB	2.9.3
Garmin MapSource	Garmin Ltd or its subsidiaries	23.02.2011	59,4MB	6.16.3
Garmin USB Drivers	Garmin Ltd or its subsidiaries	25.10.2011	121KB	2.3.0.0
GeoSetter 3.4.16	Friedemann Schmidt	18.12.2011	28,1MB	
Glary Utilities 2.38.0.1288	Glarysoft Ltd	22.10.2011	22,1MB	2.38.0.1288
Google Chrome	Google Inc.	15.06.2011		17.0.963.78
Google Earth	Google	17.11.2011	92,7MB	6.1.0.5001
Google Talk Plugin	Google	17.01.2012	18,9MB	2.6.1.5251
GPS-Track-Analyse.NET 6.0		15.07.2011	6,72MB	
GrabIt 1.7.2 Beta 6 (build 1008)	Ilan Shemes	12.05.2012	7,38MB	
GSAK 8.1.0.10 (Final)	CWE computer services	03.03.2012	42,1MB	
Hawken	Meteor Entertainment	07.10.2012	1,34GB	
Hi-Rez Studios Authenticate and Update Service	Hi-Rez Studios	15.07.2012		3.0.0.0
ImageShack Uploader 2.2.0	ImageShack Corp.	28.06.2011	26,3MB	2.2.0
ImgBurn	LIGHTNING UK!	24.08.2012		2.5.7.0
Internet-TV für Windows Media Center	Microsoft Corporation	14.03.2011	13,6MB	4.2.2.0
iTunes	Apple Inc.	20.02.2011	145MB	10.1.2.17
iTunes Library Updater	N/A	21.02.2011	1,86MB	1.2.2
Java(TM) 6 Update 31	Oracle	20.02.2012	97,2MB	6.0.310
Java(TM) 6 Update 31 (64-bit)	Oracle	20.02.2012	91,8MB	6.0.310
JDownloader	AppWork UG (haftungsbeschränkt)	24.02.2011		
JOSM 4399	The OpenStreetMap developer community, hxxp://www.openstreetmap.org/	22.09.2011		4399
Kies Air Discovery Service	Samsung	07.10.2012		
LAME v3.98.3 for Audacity		24.10.2011	1,16MB	
League of Legends	Riot Games	03.06.2012		1.3
LightScribe Applications	LightScribe	24.02.2012	12,6MB	1.18.15.1
LightScribe System Software	LightScribe	24.02.2012	26,3MB	1.18.24.1
LightScribe Template Designs - Music Pack 1	LightScribe	24.02.2012	3,12MB	1.15.0.0
LightScribe Template Labeler	LightScribe	24.02.2012	22,6MB	1.18.24.1
Logitech Gaming Software 8.20	Logitech Inc.	04.01.2012	76,6MB	8.20.74
Logitech MouseWare 9.79.1		19.02.2011		
Logitech SetPoint 6.32	Logitech	05.10.2012	39,0MB	6.32.20
LogMeIn Hamachi	LogMeIn, Inc.	30.08.2012		2.1.0.215
Malwarebytes Anti-Malware Version 1.65.0.1400	Malwarebytes Corporation	10.10.2012	19,3MB	1.65.0.1400
Mass Effect 2	Electronic Arts, Inc.	04.03.2012		1.02
Microsoft .NET Framework 4 Client Profile	Microsoft Corporation	01.10.2012	38,8MB	4.0.30319
Microsoft .NET Framework 4 Client Profile DEU Language Pack	Microsoft Corporation	20.10.2011	2,93MB	4.0.30320
Microsoft .NET Framework 4 Extended DEU Language Pack	Microsoft Corporation	29.09.2012	10,6MB	4.0.30319
Microsoft Games for Windows - LIVE Redistributable	Microsoft Corporation	14.03.2012	31,3MB	3.5.92.0
Microsoft Games for Windows Marketplace	Microsoft Corporation	06.05.2011	6,03MB	3.5.50.0
Microsoft Office Enterprise 2007	Microsoft Corporation	22.01.2012		12.0.6612.1000
Microsoft Office File Validation Add-In	Microsoft Corporation	15.09.2011	7,95MB	14.0.5130.5003
Microsoft Office Live Add-in 1.5	Microsoft Corporation	18.04.2012	508KB	2.0.4024.1
Microsoft Silverlight	Microsoft Corporation	11.05.2012	100MB	5.1.10411.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053	Microsoft Corporation	24.01.2012	250KB	8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable	Microsoft Corporation	15.06.2011	300KB	8.0.61001
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570	Microsoft Corporation	13.04.2011	790KB	9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570	Microsoft Corporation	13.04.2011	598KB	9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17	Microsoft Corporation	19.02.2011	252KB	9.0.30729
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148	Microsoft Corporation	19.02.2011	788KB	9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161	Microsoft Corporation	15.06.2011	788KB	9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729	Microsoft Corporation	07.10.2011	222KB	9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17	Microsoft Corporation	19.02.2011	240KB	9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148	Microsoft Corporation	19.02.2011	596KB	9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161	Microsoft Corporation	15.06.2011	600KB	9.0.30729.6161
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219	Microsoft Corporation	30.09.2012	13,8MB	10.0.40219
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219	Microsoft Corporation	20.08.2011	15,0MB	10.0.40219
Microsoft XNA Framework Redistributable 4.0	Microsoft Corporation	13.07.2011	9,17MB	4.0.20823.0
Miranda IM 0.10.4	Miranda IM Project	02.10.2012		0.10.4
mIRC	mIRC Co. Ltd.	02.07.2012		7.25
Mozilla Firefox 15.0.1 (x86 de)	Mozilla	07.10.2012	41,7MB	15.0.1
Mozilla Firefox 6.0 (x86 de)	Mozilla	14.08.2011	34,5MB	6.0
Mp3tag v2.48	Florian Heidenreich	20.02.2011		v2.48
MSXML 4.0 SP2 (KB954430)	Microsoft Corporation	14.07.2011	1,27MB	4.20.9870.0
MSXML 4.0 SP2 (KB973688)	Microsoft Corporation	14.07.2011	1,33MB	4.20.9876.0
MSXML 4.0 SP2 Parser and SDK	Microsoft Corporation	18.03.2011	1,22MB	4.20.9818.0
MSXML 4.0 SP3 Parser	Microsoft Corporation	03.10.2012	1,47MB	4.30.2100.0
MSXML 4.0 SP3 Parser (KB2721691)	Microsoft Corporation	04.10.2012	1,53MB	4.30.2114.0
NAVIGON Fresh 3.4.1	NAVIGON	25.05.2012		3.4.1
Notepad++		20.02.2011		5.8.7
NVIDIA Grafiktreiber 301.42	NVIDIA Corporation	02.06.2012		301.42
NVIDIA PhysX-Systemsoftware 9.12.0213	NVIDIA Corporation	02.06.2012		9.12.0213
OpenAL		15.10.2011		
OpenOffice.org 3.3	OpenOffice.org	05.06.2011	414MB	3.3.9567
Opera 12.02	Opera Software ASA	28.09.2012		12.02.1578
Pando Media Booster	Pando Networks Inc.	03.06.2012	5,46MB	2.6.0.7
PC Connectivity Solution	Nokia	18.08.2011	17,5MB	8.47.7.0
PDFCreator	Frank Heindörfer, Philip Chinery	26.08.2011		1.2.2
Picasa 3	Google, Inc.	04.08.2011		3.8
PlanetSide 2 Beta	Sony Online Entertainment	07.10.2012		
POV-Ray for Windows v3.62	Persistence of Vision Raytracer Pty. Ltd.	24.02.2011	19,7MB	3.62
PunkBuster Services	Even Balance, Inc.	29.09.2011		0.991
QLandkarte GT (remove only)		07.10.2012		
QuickTime	Apple Inc.	08.08.2011	73,0MB	7.70.80.34
RAD Video Tools		22.11.2011		
Revo Uninstaller Pro 2.5.7	VS Revo Group, Ltd.	01.03.2012	54,2MB	2.5.7
SABnzbd 0.7.3	The SABnzbd Team	08.09.2012	28,9MB	0.7.3
Samsung Kies	Samsung Electronics Co., Ltd.	20.10.2011	193MB	2.0.3.11082_152
Samsung PC Studio 7	Samsung	22.05.2012		7.2.20.9
SAMSUNG USB Driver for Mobile Phones	SAMSUNG Electronics Co., Ltd.	27.09.2012	42,9MB	1.5.9.0
SamsungConnectivityCableDriver	Samsung	22.05.2012	741KB	6.83.6.2.1
Sibelius Scorch (all browsers)	Sibelius Software	26.02.2011	41,3MB	5.2.1
Sibelius Scorch (Firefox, Opera, Netscape only)	Sibelius Software	26.02.2011	21,1MB	6.2.0
Six Updater	Six Projects	25.07.2012	38,7MB	2.09.7016
Skype™ 5.10	Skype Technologies S.A.	27.07.2012	19,4MB	5.10.116
Sound Blaster X-Fi		15.10.2011		1.0
Spoiler Sync	aRRKS	07.06.2011	3,99MB	
Spotify	Spotify AB	15.05.2012		0.8.3.222.g317ab79d
Stegano.Net	Svenomenal.Net	07.10.2012		2.1.1.9
stolencamerafinder	mattburns	07.10.2012		
TeamSpeak 3 Client	TeamSpeak Systems GmbH	07.10.2012		3.0.8.1
Topaz Adjust 4	Topaz Labs	03.02.2012		4.1.0
Topaz Adjust 4 (64-bit)	Topaz Labs	03.02.2012		4.1.0
Topaz Adjust 4 (64-bit)		19.02.2011		
Topaz Clean 3	Topaz Labs	03.02.2012		3.0.2
Topaz Clean 3 (64-bit)	Topaz Labs	03.02.2012		3.0.2
Topaz Clean 3 (64-bit)		19.02.2011		
Topaz DeJpeg 4	Topaz Labs	03.02.2012		4.0.2
Topaz DeJpeg 4 (64-bit)	Topaz Labs	03.02.2012		4.0.2
Topaz DeJpeg 4 (64-bit)		19.02.2011		
Topaz DeNoise 5	Topaz Labs	03.02.2012		5.0.1
Topaz DeNoise 5 (64-bit)		19.02.2011		
Topaz DeNoise 5 (64-bit)	Topaz Labs	03.02.2012		5.0.1
Topaz Detail 2	Topaz Labs	03.02.2012		2.0.5
Topaz Detail 2 (64-bit)	Topaz Labs	03.02.2012		2.0.5
Topaz Detail 2 (64-bit)		19.02.2011		
Topaz Fusion Express 2	Topaz Labs	03.02.2012		2.0.2
Topaz Fusion Express 2 (64-bit)	Topaz Labs	03.02.2012		2.0.2
Topaz Fusion Express 2 (64-bit)		19.02.2011		
Topaz InFocus	Topaz Labs	03.02.2012		1.0.0
Topaz InFocus (64-bit)	Topaz Labs	03.02.2012		1.0.0
Topaz InFocus (64-bit)		19.02.2011		
Topaz Lens Effects	Topaz Labs	03.02.2012		1.0.0
Topaz Lens Effects (64-bit)	Topaz Labs	03.02.2012		1.0.0
Topaz Lens Effects (64-bit)		19.02.2011		
Topaz ReMask 3	Topaz Labs	03.02.2012		3.1.0
Topaz ReMask 3 (64-bit)	Topaz Labs	03.02.2012		3.1.0
Topaz ReMask 3 (64-bit)		19.02.2011		
Topaz Simplify 3	Topaz Labs	03.02.2012		3.0.2
Topaz Simplify 3 (64-bit)	Topaz Labs	03.02.2012		3.0.2
Topaz Simplify 3 (64-bit)		19.02.2011		
Total Commander (Remove or Repair)	Ghisler Software GmbH	12.03.2012		7.57a
Tribes Ascend	Hi-Rez Studios	15.07.2012		1.0.1016.7
TweetDeck	Twitter, Inc.	14.02.2012	29,9MB	1.0.0
Ubisoft Game Launcher	UBISOFT	21.08.2011		1.0.0.0
UltraMon	Realtime Soft Ltd	28.01.2012	6,18MB	3.1.0
Unity Web Player	Unity Technologies ApS	07.10.2012	12,0MB	
Veoh Giraffic Video Accelerator	Giraffic	25.03.2012		0.86.192.230
Veoh Web Player	Veoh Networks, Inc.	25.03.2012		1.1.2.0000
Virtual Audio Cable 4.10		26.07.2012		
VirtualCloneDrive	Elaborate Bytes	27.03.2011		
VirtualDJ Home FREE	Atomix Productions	29.02.2012	48,3MB	7.0.5
VLC media player 2.0.0	VideoLAN	19.02.2012		2.0.0
WampServer 2.2	Hervé Leclerc (HeL)	15.03.2012	225MB	
Winamp	Nullsoft, Inc	12.03.2012		5.623 
Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (06/03/2009 2.3.0.0)	Garmin	25.10.2011		06/03/2009 2.3.0.0
Windows Live ID Sign-in Assistant	Microsoft Corporation	14.04.2011	10,0MB	6.500.3165.0
Windows Media Center Add-in for Silverlight	Microsoft Corporation	14.03.2011	245KB	4.7.3.0
Windows Media Player Firefox Plugin	Microsoft Corp	12.04.2011	296KB	1.0.0.8
Windows XP Mode	Microsoft Corporation	26.04.2012	1,13GB	1.3.7600.16422
Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)	Nokia	18.08.2011		08/22/2008 7.0.0.0
WinRAR		22.02.2011		
WinSCP 4.3.7	Martin Prikryl	19.02.2012	8,76MB	4.3.7
WinUAE 2.3.3	Arabuusimiehet	19.01.2012		2.3.3
Wireshark 1.6.7 (64-bit)	The Wireshark developer community, hxxp://www.wireshark.org	30.04.2012	80,9MB	1.6.7
XAMPP 1.7.4		14.03.2011		
Xara 3D Maker 7	Xara Group Ltd	03.10.2012		7.0.0.415
XMedia Recode 3.0.7.0	Sebastian Dörfler	19.01.2012		3.0.7.0
xp-AntiSpy 3.97-11	Christian Taubenheim	01.03.2011		
XSplit	SplitMediaLabs	16.07.2012	47,8MB	1.0.1206.0203
Xvid Video Codec	Xvid Team	26.03.2012		1.3.2
         
Hijackthis-Logfile:
Code:
ATTFilter
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:45:19, on 10.10.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16450)
Boot mode: Normal

Running processes:
D:\Programme\DynDNS Updater\DynTray.exe
D:\Programme\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe
D:\Programme\avast Antivirus\AvastUI.exe
D:\Programme\LogMeIn Hamachi\hamachi-2-ui.exe
C:\Windows\SysWOW64\CTXFISPI.EXE
D:\Programme\Opera\opera.exe
C:\Program Files (x86)\Common Files\Realtime Soft\RTSHookInterop\x32\RTSHookInterop.exe
C:\Windows\SysWOW64\NOTEPAD.EXE
D:\Programme\Notepad++\notepad++.exe
C:\Users\meric\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Increase performance and video formats for your HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\avast Antivirus\aswWebRepIE.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\avast Antivirus\aswWebRepIE.dll
O4 - HKLM\..\Run: [VirtualCloneDrive] "D:\Programme\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [Module Loader] C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe -StartUpRun
O4 - HKLM\..\Run: [avast] "D:\Programme\avast Antivirus\avastUI.exe" /nogui
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "D:\Programme\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
O4 - HKUS\S-1-5-18\..\Run: [Samsung.PCSync] "D:\Programme\Samsung\Samsung PC Studio 7\PcSync2.exe" /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Samsung.PCSync] "D:\Programme\Samsung\Samsung PC Studio 7\PcSync2.exe" /NoDialog (User 'Default user')
O4 - Startup: launch.jnlp
O4 - Global Startup: Dyn Updater Tray Icon.lnk = D:\Programme\DynDNS Updater\DynTray.exe
O4 - Global Startup: UltraMon.lnk = ?
O8 - Extra context menu item: add to &BOM - D:\\PROGRA~1\\BIET-O~1\\\\AddToBOM.hta
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://D:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} (Creative Software AutoUpdate Support Package 2) - hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15114/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7261E20A-4D13-42CD-AACA-ADDBC90946B2}: NameServer = 192.168.2.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{7261E20A-4D13-42CD-AACA-ADDBC90946B2}: NameServer = 192.168.2.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{7261E20A-4D13-42CD-AACA-ADDBC90946B2}: NameServer = 192.168.2.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: avast! Antivirus - AVAST Software - D:\Programme\avast Antivirus\AvastSvc.exe
O23 - Service: Creative ALchemy AL6 Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
O23 - Service: Dyn Updater - Dyn, Inc. - D:\Programme\DynDNS Updater\DynUpSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: LogMeIn Hamachi Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - D:\Programme\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: Hi-Rez Studios Authenticate and Update Service (HiPatchService) - Hi-Rez Studios - D:\Spiele\Hi-Rez Studios\HiPatchService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.21\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.5.20\bin\mysqld.exe
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 9394 bytes
         
So ganz ahnungslos bin ich ja selber nicht. Deswegen hab ich mir die Logfiles alle schon einmal selber angeschaut. Etwas verdächtiges aufgefallen ist mir aber leider nicht
__________________

Geändert von meric (10.10.2012 um 17:04 Uhr)

Alt 11.10.2012, 07:24   #4
kira
/// Helfer-Team
 
Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk) - Standard

Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk)



Systemreinigung und Prüfung:

► Wenn Du nun alle Schritte erledigt hast, melde dich mit die gewünschten Ergebnisse zurück!
Nur bei Probleme inzwischen melden!

1.
Deinstalliere - nicht empfohlen:
Zitat:
Veoh Web Player <- Softwareart: Adware
finanziert sich über eine Adware-Komponente
Hinweis: Um den "Veoh Web Player" vollständig nutzen zu können, müssen Sie sich nach der Installation beim Hersteller mit einer E-Mail-Adresse registrieren. Während der Installation sollten Sie die angebotene Software abklicken, diese hat nichts mit dem eigentlichen Programm zu tun. Zudem empfehlen wir Ihnen, die ungefragt mitgelieferte Veoh-Toolbar gleich nach der Installation wieder aus dem System zu löschen.

2.
Hast du es denn in der Hosts selbst eingetragen bzw absichtlich zugefügt? Wenn ja, warum?
Code:
ATTFilter
O1 - Hosts: 127.0.0.1 clients.your-server.de
O1 - Hosts: 127.0.0.1 your-server.de
O1 - Hosts: 127.0.0.1 rackcentre.redstation.net.uk
O1 - Hosts: 127.0.0.1 redstation.net.uk
         
3.
Zitat:
Achtung wichtig!:
Falls Du selber im Logfile Änderungen vorgenommen hast, musst Du durch die Originalbezeichnung ersetzen und so in Script einfügen! sonst funktioniert nicht!
(Benutzerordner, dein Name oder sonstige Änderungen durch X, Stern oder andere Namen ersetzt)
Fixen mit OTL
  • Starte die OTL.exe.
  • Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
  • Kopiere folgendes Skript also - nach dem "Code", alles was in der Codebox steht - (also beginnend mit :OTL und am Ende [emptytemp]), alles was in der Codebox steht (ohne "code"!) :
Code:
ATTFilter
:OTL
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\..\SearchScopes\{3D336522-0C99-4412-B500-3472495092DA}: "URL" = http://www.google.de/search?q={searchTerms}
IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\meric\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\meric\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{374c1187-4813-11e1-9fcd-00241ddbd724}\Shell - "" = AutoRun
O33 - MountPoints2\{374c1187-4813-11e1-9fcd-00241ddbd724}\Shell\AutoRun\command - "" = H:\iStudio.exe
O33 - MountPoints2\{f79fdbda-579f-11e0-857b-a96a988e982a}\Shell - "" = AutoRun
O33 - MountPoints2\{f79fdbda-579f-11e0-857b-a96a988e982a}\Shell\AutoRun\command - "" = G:\start.exe
@Alternate Data Stream - 1225 bytes -> C:\Users\meric\AppData\Local\1vCCkxoreGSr:LmKM0wxK1yKopb7y44SV8UUG
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:5F64C164
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:9D1B94FD

:Files
C:\Users\meric\AppData\Roaming\uTorrent
C:\Users\meric\AppData\Roaming\DAEMON Tools Lite
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
         
  • und füge es hier ein:
  • Schließe alle Programme.
  • Klicke auf den Fix Button.
  • Klick auf .
  • OTL verlangt einen Neustart. Bitte zulassen.
  • Nach dem Neustart findest Du ein Textdokument.
    Kopiere den Inhalt hier in Deinen Thread.

4.
Hast Du zur Zone Vertrauenswürdige Sites absichtlich hinzugefügt? einer Reihe der von dir besuchten Websites vollständig vertrauen?:
Zitat:
O15 - HKU\.DEFAULT\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: sony.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: sony.com ([]* in Trusted sites)
O15 - HKU\S-1-5-19\..Trusted Domains: clonewarsadventures.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: freerealms.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: soe.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: sony.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: clonewarsadventures.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: freerealms.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: soe.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: sony.com ([]* in )
wenn nicht: -> Sicherheitszonen: Hinzufügen oder Entfernen von Websites.

5.
Deine Javaversion ist nicht aktuell!
Da aufgrund alter Sicherheitslücken ist Java sehr anfällig, deinstalliere zunächst alle vorhandenen Java-Versionen:
→ Systemsteuerung → Software → deinstallieren...
→ Rechner neu aufstarten
→ Downloade nun die Offline-Version von Java "Empfohlen Version Java(TM) 7 Update 7 - von Oracle herunter
Achte darauf, eventuell angebotene Toolbars abwählen (den Haken bei der Toolbar entfernen)!
Tipp: -> Java-Updates konfigurieren

6.
Aktualisieren:
Code:
ATTFilter
OpenOffice.org
         
7.
Tipps - Der Internet Explorer von Microsoft gehört zur Grundausstattung unter Windows, somit wie alle andere installierte Software muss gepflegt werden! Auch bei Nicht-Verwendung!:
-> Tipps zu Internet Explorer
-> Standard Suchmaschine des Explorers ändern
-> Ändern oder Auswählen eines Suchanbieters in Internet Explorer 7/8
-> Wie kann ich den Cache im Internet Explorer leeren?

8.
Alle Programme/Fenster schliessen
reinige dein System mit CCleaner:
  • "CCleaner"→ "Analysieren"→ Klick auf den Button "Start CCleaner"
  • "Registry""Fehler suchen"→ "Fehler beheben"→ "Alle beheben"
  • Starte dein System neu auf

9.
Vorbereitung
  • Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an.
  • Bitte während der Online-Scans deaktivieren:
    Anti-Virus-Programm und Firewall.
  • Internet Explorer starten => im Menü unter Extras => Internetoption => Datenschutz => den Haken bei "Popupblocker einschalten" entfernen und
  • unter dem Reiter "Sicherheit" => die Sicherheitsstufe ggfs. auf "Mittelhoch" herabsetzen.
    Nicht vergessen, sie hinterher wieder einzuschalten bzw. die Internetoptionen wie zuvor einzustellen..
  • Während der Online-Scans auf andere Online-Aktivitäten verzichten.
  • Du musst das Herunterladen und Installieren von ActiveX-Steuerelementen (Controls) zulassen.


  • .

Den PC NUR online scannen und NICHT ein zweites Antivirenprogramm installieren!!!
  • Eset Online Scanner (NOD32)
    • Unterstützte Betriebssysteme: Microsoft Windows 7 - Vista - XP - 2000 - NT.
    • Anmerkung für Vista und Windows 7-User: Bitte den Browser unbedingt als Administrator starten.
    • Dein Anti-Virus-Programm während des Scans deaktivieren.
    • Button "ESET Online Scanner" drücken.
    • IE-User müssen das Installieren eines ActiveX Elements erlauben.
    • Einen Haken bei "YES, I accept the Terms of Use." machen und auf den Button "Start" drücken.
    • Einen Haken bei "Remove found threads" und "Scan archives" machen.
    • Start drücken.
    • Signaturen werden heruntergeladen.
    • Der Scan beginnt automatisch.
    • Wenn fertig, das Protokoll speichern und mir posten.
      -> List of found threats
      -> Export to text file
      -> Back
      -> Delete quarantäne files
    • Finish drücken.
    • Browser schließen.
    • Deinstallation nachdem das Protokoll mir gepostet hast: Systemsteuerung => Software => Eset Online Scanner V3 entfernen.
    • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

10.
erneut einen Scan mit OTL:
  • Doppelklick auf die OTL.exe
  • Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
  • Oben findest Du ein Kästchen mit Ausgabe.
    Wähle bitte Standard-Ausgabe
  • Unter Extra-Registrierung wähle bitte Benutze SafeList.
  • Mache Häckchen bei LOP- und Purity-Prüfung.
  • Klicke nun auf Scan links oben.
  • Wenn der Scan beendet wurde werden zwei Logfiles erstellt.
    Du findest die Logfiles auf Deinem Desktop => OTL.txt und Extras.txt
  • Poste die Logfiles in Code-Tags hier in den Thread.

► berichte erneut über den Zustand des Computers. Ob noch Probleme auftreten, wenn ja, welche?
__________________

Warnung!:
Vorsicht beim Rechnungen per Email mit ZIP-Datei als Anhang! Kann mit einen Verschlüsselungs-Trojaner infiziert sein!
Anhang nicht öffnen, in unserem Forum erst nachfragen!

Sichere regelmäßig deine Daten, auf CD/DVD, USB-Sticks oder externe Festplatten, am besten 2x an verschiedenen Orten!
Bitte diese Warnung weitergeben, wo Du nur kannst!

Alt 12.10.2012, 00:45   #5
meric
 
Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk) - Standard

Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk)



1.
Hab den "Veoh Web Player" deinstalliert. Weiß selber nicht mehr so genau, warum der überhaupt drauf war.

2.
Die Hosts hatte ich eingetrage, in der Hoffnung, dass mein Computer keine Verbindung mehr zu diesen herstellen kann. Hat aber nicht funktioniert. Hab die Einträge wieder entfernt.

Allerdings haben die wohl über die Remotedesktopverbindung zugegriffen. Seit dem ich die deaktiviert hab, hatte ich keine Verbindung mehr von und zu diesen Hosts.

3.
Hab OTL mit diesen Befehlen ausgeführt. Hier die Logdatei:
Code:
ATTFilter
OTL logfile created on: 11.10.2012 17:01:58 - Run 3
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\meric\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 1,64 Gb Available Physical Memory | 40,95% Memory free
6,00 Gb Paging File | 3,86 Gb Available in Paging File | 64,33% Paging File free
Paging file location(s): d:\pagefile.sys 2048 2048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 40,43 Gb Total Space | 2,29 Gb Free Space | 5,66% Space Free | Partition Type: NTFS
Drive D: | 425,33 Gb Total Space | 30,44 Gb Free Space | 7,16% Space Free | Partition Type: NTFS
Drive E: | 149,04 Gb Total Space | 4,55 Gb Free Space | 3,05% Space Free | Partition Type: NTFS
Drive F: | 3,85 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: CHOSENONE | User Name: meric | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.10.10 16:53:01 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\meric\Desktop\OTL.exe
PRC - [2012.10.09 16:06:31 | 000,692,152 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_4_402_287_ActiveX.exe
PRC - [2012.08.29 12:03:38 | 001,996,200 | ---- | M] (LogMeIn Inc.) -- D:\Programme\LogMeIn Hamachi\hamachi-2-ui.exe
PRC - [2012.08.21 11:12:26 | 004,282,728 | ---- | M] (AVAST Software) -- D:\Programme\avast Antivirus\AvastUI.exe
PRC - [2012.08.21 11:12:25 | 000,044,808 | ---- | M] (AVAST Software) -- D:\Programme\avast Antivirus\AvastSvc.exe
PRC - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.05.29 17:09:57 | 000,076,888 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2011.11.15 19:20:26 | 000,095,608 | ---- | M] (Dyn, Inc.) -- D:\Programme\DynDNS Updater\DynUpSvc.exe
PRC - [2011.11.15 19:20:26 | 000,078,192 | ---- | M] (Dyn, Inc.) -- D:\Programme\DynDNS Updater\DynTray.exe
PRC - [2011.03.07 15:33:08 | 000,089,456 | ---- | M] (Elaborate Bytes AG) -- D:\Programme\VirtualCloneDrive\VCDDaemon.exe
PRC - [2010.07.07 21:27:16 | 001,268,224 | ---- | M] (Creative Technology Ltd) -- C:\Windows\SysWOW64\CTxfispi.exe
PRC - [2010.02.12 10:23:12 | 000,286,720 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
PRC - [2009.12.21 09:00:50 | 000,081,920 | ---- | M] (Realtime Soft Ltd) -- C:\Program Files (x86)\Common Files\Realtime Soft\RTSHookInterop\x32\RTSHookInterop.exe
PRC - [2007.07.18 09:19:02 | 000,057,344 | ---- | M] (Creative Technology Ltd.) -- C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2009.06.29 10:54:08 | 000,164,864 | ---- | M] () -- C:\Windows\SysWOW64\APOMngr.DLL
MOD - [2009.02.06 18:52:24 | 000,073,728 | ---- | M] () -- C:\Windows\SysWOW64\CmdRtr.DLL
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2012.10.09 17:14:30 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.09.15 02:02:29 | 000,529,744 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.08.29 12:03:36 | 002,369,960 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- D:\Programme\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2012.08.21 11:12:25 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Running] -- D:\Programme\avast Antivirus\AvastSvc.exe -- (avast! Antivirus)
SRV - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.07.12 15:16:56 | 000,008,704 | ---- | M] (Hi-Rez Studios) [On_Demand | Stopped] -- D:\Spiele\Hi-Rez Studios\HiPatchService.exe -- (HiPatchService)
SRV - [2012.06.07 19:12:14 | 000,160,944 | R--- | M] (Skype Technologies) [Disabled | Stopped] -- D:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.05.29 17:09:57 | 000,076,888 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2012.03.06 17:19:00 | 003,953,632 | ---- | M] (INCA Internet Co., Ltd.) [Disabled | Stopped] -- C:\Windows\SysWOW64\GameMon.des -- (npggsvc)
SRV - [2012.01.25 10:56:30 | 009,690,112 | ---- | M] () [On_Demand | Stopped] -- c:\wamp\bin\mysql\mysql5.5.20\bin\mysqld.exe -- (wampmysqld)
SRV - [2011.11.15 19:20:26 | 000,095,608 | ---- | M] (Dyn, Inc.) [Auto | Running] -- D:\Programme\DynDNS Updater\DynUpSvc.exe -- (Dyn Updater)
SRV - [2011.10.15 16:04:37 | 000,079,360 | ---- | M] (Creative Labs) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service)
SRV - [2011.10.15 15:40:18 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe -- (Creative ALchemy AL6 Licensing Service)
SRV - [2011.09.27 21:04:08 | 000,359,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2011.09.26 11:06:54 | 000,021,504 | ---- | M] (Apache Software Foundation) [On_Demand | Stopped] -- c:\wamp\bin\apache\Apache2.2.21\bin\httpd.exe -- (wampapache)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.19 14:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2010.02.12 10:23:12 | 000,286,720 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService)
SRV - [2009.08.18 12:48:02 | 002,291,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008.11.11 09:38:06 | 000,620,544 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.09.19 10:02:08 | 000,102,368 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudbus.sys -- (dg_ssudbus)
DRV:64bit: - [2012.09.19 10:02:06 | 000,203,104 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudmdm.sys -- (ssudmdm)
DRV:64bit: - [2012.08.21 11:13:13 | 000,969,200 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx)
DRV:64bit: - [2012.08.21 11:13:13 | 000,359,464 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswSP.sys -- (aswSP)
DRV:64bit: - [2012.08.21 11:13:13 | 000,059,728 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswTdi.sys -- (aswTdi)
DRV:64bit: - [2012.08.21 11:13:12 | 000,071,600 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV:64bit: - [2012.08.21 11:13:12 | 000,054,072 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr)
DRV:64bit: - [2012.08.21 11:13:11 | 000,025,232 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV:64bit: - [2012.07.26 21:32:08 | 000,066,728 | ---- | M] (Eugene V. Muzychenko) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vrtaucbl.sys -- (EuMusDesignVirtualAudioCableWdm)
DRV:64bit: - [2012.03.07 01:02:45 | 000,028,504 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswKbd.sys -- (aswKbd)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.11.16 15:35:58 | 000,054,400 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbfilter.sys -- (usbfilter)
DRV:64bit: - [2011.10.29 03:41:28 | 000,042,624 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amd_xata.sys -- (amd_xata)
DRV:64bit: - [2011.10.29 03:41:26 | 000,080,512 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amd_sata.sys -- (amd_sata)
DRV:64bit: - [2011.09.02 08:30:36 | 000,060,696 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt)
DRV:64bit: - [2011.09.02 08:30:24 | 000,066,840 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)
DRV:64bit: - [2011.07.26 19:49:12 | 000,037,888 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\taphss.sys -- (taphss)
DRV:64bit: - [2011.06.02 07:47:22 | 000,177,640 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadmdm.sys -- (ssadmdm)
DRV:64bit: - [2011.06.02 07:47:22 | 000,157,672 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadbus.sys -- (ssadbus)
DRV:64bit: - [2011.06.02 07:47:22 | 000,016,872 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadmdfl.sys -- (ssadmdfl)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.02.19 05:18:18 | 000,022,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGBusEnum.sys -- (LGBusEnum)
DRV:64bit: - [2011.02.19 05:18:18 | 000,016,008 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGVirHid.sys -- (LGVirHid)
DRV:64bit: - [2011.01.15 18:21:04 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone)
DRV:64bit: - [2010.12.21 07:55:02 | 000,161,280 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sscemdm.sys -- (sscemdm)
DRV:64bit: - [2010.12.21 07:55:02 | 000,129,024 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssceserd.sys -- (ssceserd)
DRV:64bit: - [2010.12.21 07:55:02 | 000,127,488 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sscebus.sys -- (sscebus)
DRV:64bit: - [2010.12.21 07:55:02 | 000,036,328 | ---- | M] (Google Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadadb.sys -- (androidusb)
DRV:64bit: - [2010.12.21 07:55:02 | 000,018,944 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sscemdfl.sys -- (sscemdfl)
DRV:64bit: - [2010.12.17 00:58:14 | 000,040,816 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO)
DRV:64bit: - [2010.11.20 15:34:04 | 000,360,832 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vpcvmm.sys -- (vpcvmm)
DRV:64bit: - [2010.11.20 15:34:04 | 000,194,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vpchbus.sys -- (vpcbus)
DRV:64bit: - [2010.11.20 13:35:34 | 000,095,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vpcusb.sys -- (vpcusb)
DRV:64bit: - [2010.11.20 13:35:26 | 000,016,384 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vpcuxd.sys -- (vpcuxd)
DRV:64bit: - [2010.11.20 13:35:22 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vpcnfltr.sys -- (vpcnfltr)
DRV:64bit: - [2010.11.20 06:33:36 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 04:07:06 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.07.12 20:36:10 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2010.07.07 23:21:18 | 001,612,888 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ha20x22k.sys -- (ha20x22k)
DRV:64bit: - [2010.07.07 23:21:06 | 001,567,832 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ha20x2k.sys -- (ha20x2k)
DRV:64bit: - [2010.07.07 23:20:56 | 000,118,360 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\emupia2k.sys -- (emupia)
DRV:64bit: - [2010.07.07 23:20:48 | 000,213,080 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctsfm2k.sys -- (ctsfm2k)
DRV:64bit: - [2010.07.07 23:20:40 | 000,015,960 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctprxy2k.sys -- (ctprxy2k)
DRV:64bit: - [2010.07.07 23:16:32 | 000,179,288 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctoss2k.sys -- (ossrv)
DRV:64bit: - [2010.07.07 23:16:24 | 000,697,816 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctaud2k.sys -- (ctaud2k)
DRV:64bit: - [2010.07.07 23:16:14 | 000,580,696 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ctac32k.sys -- (ctac32k)
DRV:64bit: - [2010.07.07 23:16:06 | 001,445,976 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CTEXFIFX.sys -- (CTEXFIFX.SYS)
DRV:64bit: - [2010.07.07 23:16:06 | 001,445,976 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTEXFIFX.sys -- (CTEXFIFX)
DRV:64bit: - [2010.07.07 23:15:56 | 000,095,320 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CTHWIUT.sys -- (CTHWIUT.SYS)
DRV:64bit: - [2010.07.07 23:15:56 | 000,095,320 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTHWIUT.sys -- (CTHWIUT)
DRV:64bit: - [2010.07.07 23:15:50 | 000,230,488 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CT20XUT.sys -- (CT20XUT.SYS)
DRV:64bit: - [2010.07.07 23:15:50 | 000,230,488 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CT20XUT.sys -- (CT20XUT)
DRV:64bit: - [2010.06.17 11:15:36 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie64.sys -- (AtiPcie)
DRV:64bit: - [2009.12.30 11:21:26 | 000,031,800 | ---- | M] (VS Revo Group) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\revoflt.sys -- (Revoflt)
DRV:64bit: - [2009.08.24 11:36:00 | 000,010,752 | ---- | M] (hxxp://www.recursion.jp/avrcdc/) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lowcdc.sys -- (lowcdc)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.18 14:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009.05.08 17:08:00 | 000,020,520 | ---- | M] (GARMIN Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\grmnusb.sys -- (grmnusb)
DRV:64bit: - [2009.03.18 17:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)
DRV:64bit: - [2009.03.02 00:05:32 | 000,187,392 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2008.12.26 12:56:04 | 000,021,504 | ---- | M] (Avnex) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vcsvad.sys -- (VCSVADHWSer)
DRV:64bit: - [2008.08.28 11:44:42 | 000,025,600 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys -- (pccsmcfd)
DRV:64bit: - [2007.05.02 16:34:30 | 000,171,008 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nmwcdsax64.sys -- (nmwcdsax64)
DRV:64bit: - [2007.05.02 16:33:38 | 000,017,408 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nmwcdsacjx64.sys -- (nmwcdsacjx64)
DRV:64bit: - [2007.05.02 16:33:36 | 000,012,288 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nmwcdsacx64.sys -- (nmwcdsacx64)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2008.11.14 03:11:42 | 000,020,512 | ---- | M] (Realtime Soft Ltd) [Kernel | Auto | Running] -- C:\Program Files (x86)\Common Files\Realtime Soft\UltraMonMirrorDrv\x64\UltraMonUtility.sys -- (UltraMonUtility)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 51 07 D0 4F 35 A4 CD 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "chrome://speeddial/content/speeddial.xul"
FF - prefs.js..extensions.enabledAddons: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E}:3.0.1
FF - prefs.js..extensions.enabledAddons: {8b86149f-01fb-4842-9dd8-4d7eb02fd055}:0.22.1
FF - prefs.js..extensions.enabledAddons: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.10
FF - prefs.js..extensions.enabledAddons: {dc572301-7619-498c-a57d-39143191b318}:0.4.0.3
FF - prefs.js..extensions.enabledAddons: ich@maltegoetz.de:1.4.3
FF - prefs.js..extensions.enabledAddons: yetanothersmoothscrolling@kataho:3.0.24
FF - prefs.js..extensions.enabledAddons: {64161300-e22b-11db-8314-0800200c9a66}:0.9.6.10
FF - prefs.js..extensions.enabledAddons: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:1.4
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_287.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1165635.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.0: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=0.80.0: C:\Program Files (x86)\Battlelog Web Plugins\0.80.0\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@garmin.com/GpsControl: C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: D:\Programme\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: D:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\meric\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011.08.05 04:20:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: D:\Programme\avast Antivirus\WebRep\FF [2012.09.07 06:02:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Components: D:\Programme\Mozilla Firefox 4\components [2012.09.07 19:37:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Plugins: D:\Programme\Mozilla Firefox 4\plugins [2012.10.11 10:04:29 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: D:\Programme\Mozilla Firefox 4\components [2012.09.07 19:37:21 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: D:\Programme\Mozilla Firefox 4\plugins [2012.10.11 10:04:29 | 000,000,000 | ---D | M]
 
[2011.02.19 06:14:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\Extensions
[2012.10.11 08:59:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions
[2011.08.26 14:05:17 | 000,000,000 | ---D | M] (Garmin Communicator) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2011.06.29 22:54:50 | 000,000,000 | ---D | M] (All-in-One Gestures) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\{8b86149f-01fb-4842-9dd8-4d7eb02fd055}
[2012.09.16 02:47:33 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012.10.02 23:00:12 | 000,000,000 | ---D | M] (FoxyProxy Standard) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\foxyproxy-basic@eric.h.jung
[2012.09.15 12:21:45 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\ich@maltegoetz.de
[2012.02.23 17:04:32 | 000,164,722 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\compatibility@addons.mozilla.org.xpi
[2012.10.10 04:24:53 | 001,626,141 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\firebug@software.joehewitt.com.xpi
[2012.09.15 12:21:45 | 000,066,522 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\yetanothersmoothscrolling@kataho.xpi
[2012.10.10 14:30:49 | 000,281,285 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{64161300-e22b-11db-8314-0800200c9a66}.xpi
[2012.10.10 04:24:51 | 000,529,404 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2012.09.05 13:40:27 | 001,268,546 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}.xpi
[2012.07.25 05:41:33 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2011.11.05 14:28:38 | 000,434,392 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi
[2012.07.21 13:05:28 | 000,702,524 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi
[2012.09.13 01:44:36 | 000,698,867 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi
[2012.10.11 08:59:30 | 000,252,340 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: chrome://speeddial/content/speeddial.xul
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\meric\AppData\Local\Google\Chrome\Application\17.0.963.78\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.240.7 (Enabled) = D:\Programme\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U24 (Enabled) = D:\Programme\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = D:\Programme\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\np-mswmp.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\meric\AppData\Local\Google\Chrome\Application\17.0.963.78\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\meric\AppData\Local\Google\Chrome\Application\17.0.963.78\pdf.dll
CHR - plugin: Google Talk Plugin (Enabled) = C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: Garmin Communicator Plug-In (Enabled) = C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
CHR - plugin: Windows Activation Technologies (Enabled) = C:\Windows\system32\Wat\npWatWeb.dll
CHR - plugin: Picasa (Enabled) = D:\Programme\Google\Picasa3\npPicasa3.dll
CHR - plugin: iTunes Application Detector (Enabled) = D:\Programme\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: TooManyTabs f\u00FCr Chrome = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\amigcgbheognjmfkaieeeadojiibgbdp\1.9.1_0\
CHR - Extension: TooManyTabs f\u00FCr Chrome = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\amigcgbheognjmfkaieeeadojiibgbdp\1.9.2_0\
CHR - Extension: Turn Off the Lights = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfbmjmiodbnnpllbbbfblcplfjjepjdn\2.0.0.81_0\
CHR - Extension: GCVote = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\boingbkmoapffongfpcancmephhnmehp\2.4.5_0\
CHR - Extension: GCVote = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\boingbkmoapffongfpcancmephhnmehp\2.4.5_0\~
CHR - Extension: SmoothScroll = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\cccpiddacjljmfbbgeimpelpndgpoknn\1.0.6_0\
CHR - Extension: Adblock Plus f\u00FCr Google Chrome\u2122 (Beta) = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.1.3_0\
CHR - Extension: Session Buddy = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\edacconmaakjimmfgnblocblbcdcpbko\2.1.2_0\
CHR - Extension: Direkt Werbung auf YouTube = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\epbmnbdplhcomkedpjfceakddnbgfjmf\1.199_0\
CHR - Extension: Direkt Werbung auf YouTube = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\epbmnbdplhcomkedpjfceakddnbgfjmf\1.52_0\
CHR - Extension: AdBlock = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.33_0\
CHR - Extension: avast! WebRep = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\
CHR - Extension: Speed Dial 2 = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpfpebmajhhopeonhlcgidhclcccjcik\1.6.0.8_0\
CHR - Extension: Smooth Gestures = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfkgmnnajiljnolcgolmmgnecgldgeld\0.15.4.13_0\
CHR - Extension: GC little helper = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\nagohipignfajbmgdcedbnmafoebnnjg\1.0_0\
CHR - Extension: New Tabs Always Last = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\nldmhfnlbkkdhboedalogjpeedjbmjgi\0.1_0\
CHR - Extension: Mehr Leistung und Videoformate f\u00FCr dein HTML5 \u003Cvideo\u003E = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.126_0\
 
O1 HOSTS File: ([2012.10.11 09:57:32 | 000,000,771 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - D:\Programme\avast Antivirus\aswWebRepIE64.dll (AVAST Software)
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\avast Antivirus\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - D:\Programme\avast Antivirus\aswWebRepIE64.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\avast Antivirus\aswWebRepIE.dll (AVAST Software)
O4:64bit: - HKLM..\Run: [EvtMgr6] D:\Programme\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [Launch LCore] C:\Program Files\Logitech Gaming Software\LCore.exe (Logitech Inc.)
O4 - HKLM..\Run: [avast] D:\Programme\avast Antivirus\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] D:\Programme\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [Module Loader] C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [VirtualCloneDrive] D:\Programme\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG)
O4 - Startup: C:\Users\meric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\launch.jnlp ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1
O8:64bit: - Extra context menu item: add to &BOM - D:\\PROGRA~1\\BIET-O~1\\\\AddToBOM.hta ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: add to &BOM - D:\\PROGRA~1\\BIET-O~1\\\\AddToBOM.hta ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15114/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7261E20A-4D13-42CD-AACA-ADDBC90946B2}: NameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\gopher - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\AutorunsDisabled: DllName - (Reg Error: Value error.) - Reg Error: Value error. File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.10.11 10:35:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.10.11 10:09:10 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.4.1
[2012.10.11 10:05:34 | 001,034,216 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\npDeployJava1.dll
[2012.10.11 10:05:34 | 000,289,768 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\javaws.exe
[2012.10.11 10:05:29 | 000,189,416 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\javaw.exe
[2012.10.11 10:05:29 | 000,188,904 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\java.exe
[2012.10.11 10:05:29 | 000,108,008 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\WindowsAccessBridge-64.dll
[2012.10.11 10:05:17 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2012.10.11 10:04:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2012.10.11 10:04:29 | 000,821,736 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\npDeployJava1.dll
[2012.10.11 10:04:29 | 000,246,760 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2012.10.11 10:04:21 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2012.10.11 10:04:21 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2012.10.11 10:04:21 | 000,095,208 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2012.10.11 10:04:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2012.10.11 09:26:20 | 000,000,000 | ---D | C] -- C:\_OTL
[2012.10.10 17:38:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012.10.10 17:38:39 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012.10.10 17:38:22 | 003,941,312 | ---- | C] (Piriform Ltd) -- C:\Users\meric\Desktop\ccsetup323.exe
[2012.10.10 16:53:00 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\meric\Desktop\OTL.exe
[2012.10.10 16:33:54 | 000,000,000 | ---D | C] -- C:\Users\meric\Desktop\OSAM
[2012.10.10 16:13:14 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Users\meric\Desktop\aswMBR.exe
[2012.10.10 16:01:56 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Roaming\Malwarebytes
[2012.10.10 16:01:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.10.10 16:01:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.10.10 16:01:41 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.10.10 15:20:59 | 000,000,000 | ---D | C] -- C:\Users\meric\Desktop\backups
[2012.10.10 15:01:33 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\meric\Desktop\HijackThis.exe
[2012.10.10 14:46:18 | 000,424,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll
[2012.10.10 14:46:17 | 001,162,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll
[2012.10.10 14:46:17 | 000,338,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\conhost.exe
[2012.10.10 14:46:17 | 000,215,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll
[2012.10.10 14:46:14 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll
[2012.10.10 14:46:13 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe
[2012.10.10 14:46:13 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll
[2012.10.10 14:46:13 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll
[2012.10.10 14:46:12 | 000,362,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll
[2012.10.10 14:46:12 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll
[2012.10.10 14:46:12 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe
[2012.10.10 14:46:12 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll
[2012.10.10 14:46:12 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2012.10.10 14:46:12 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2012.10.10 14:46:12 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012.10.10 14:46:11 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2012.10.10 14:46:10 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2012.10.10 14:46:09 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2012.10.10 14:46:09 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2012.10.10 14:46:08 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2012.10.10 14:46:08 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2012.10.10 14:46:07 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2012.10.10 14:46:07 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2012.10.10 14:46:07 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2012.10.10 14:46:07 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2012.10.10 14:46:07 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2012.10.10 14:46:07 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2012.10.10 14:46:06 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2012.10.10 14:46:06 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2012.10.10 14:46:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2012.10.10 14:46:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2012.10.10 14:46:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2012.10.10 14:46:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2012.10.10 14:46:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2012.10.10 14:46:05 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe
[2012.10.10 14:45:24 | 001,464,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll
[2012.10.10 14:45:23 | 000,140,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll
[2012.10.10 14:45:01 | 000,220,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll
[2012.10.10 14:44:21 | 005,559,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2012.10.10 14:44:20 | 003,914,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2012.10.10 14:44:19 | 003,968,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2012.10.07 04:57:11 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Local\SCE
[2012.10.07 04:57:11 | 000,000,000 | ---D | C] -- C:\Crash
[2012.10.05 17:44:27 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Logishrd
[2012.10.03 16:44:17 | 000,000,000 | ---D | C] -- C:\ProgramData\MAGIX
[2012.10.03 16:44:16 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Local\Xara
[2012.10.03 16:44:16 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Roaming\MAGIX
[2012.10.03 16:43:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Xara
[2012.10.03 16:43:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xara
[2012.09.29 15:31:59 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Local\Solid State Networks
[2012.09.29 15:31:52 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Meteor Entertainment
[2012.09.26 11:14:27 | 000,245,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\OxpsConverter.exe
[2012.09.22 11:51:09 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012.09.22 11:51:09 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012.09.22 11:51:08 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012.09.22 11:51:08 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012.09.22 11:51:08 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2012.09.22 11:51:08 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2012.09.22 11:51:07 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2012.09.22 11:51:07 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012.09.22 11:51:07 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012.09.22 11:51:07 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012.09.22 11:51:06 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2012.09.22 11:51:06 | 000,729,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2012.09.22 11:51:04 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2012.09.22 11:51:04 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012.09.22 11:51:04 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2012.09.19 10:02:08 | 000,102,368 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudbus.sys
[2012.09.19 10:02:06 | 000,203,104 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudmdm.sys
[2012.09.15 03:50:21 | 000,000,000 | --SD | C] -- C:\Users\meric\Documents\Eigene Datenquellen
[2012.09.12 12:44:00 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\RNDISMP.sys
[2012.09.12 12:43:59 | 000,574,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10level9.dll
[2012.09.12 12:43:58 | 000,376,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\netio.sys
[2012.09.12 12:43:58 | 000,288,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\FWPKCLNT.SYS
 
========== Files - Modified Within 30 Days ==========
 
[2012.10.11 17:00:29 | 000,007,631 | ---- | M] () -- C:\Users\meric\AppData\Local\Resmon.ResmonCfg
[2012.10.11 16:06:27 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.10.11 10:29:42 | 000,000,306 | ---- | M] () -- C:\Windows\tasks\GlaryInitialize.job
[2012.10.11 10:25:12 | 000,013,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.10.11 10:25:12 | 000,013,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.10.11 10:16:56 | 004,983,856 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.10.11 10:16:47 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.10.11 10:16:32 | 3220,037,632 | -HS- | M] () -- C:\hiberfil.sys
[2012.10.11 10:15:59 | 000,062,308 | ---- | M] () -- C:\Windows\SysNative\BMXStateBkp-{00000002-00000000-00000000-00001102-0000000B-00411102}.rfx
[2012.10.11 10:15:59 | 000,062,308 | ---- | M] () -- C:\Windows\SysNative\BMXState-{00000002-00000000-00000000-00001102-0000000B-00411102}.rfx
[2012.10.11 10:15:59 | 000,000,820 | ---- | M] () -- C:\Windows\SysNative\DVCState-{00000002-00000000-00000000-00001102-0000000B-00411102}.rfx
[2012.10.11 10:13:46 | 000,376,550 | ---- | M] () -- C:\Users\meric\Desktop\cc_20121011_101328.reg
[2012.10.11 10:05:24 | 000,108,008 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\WindowsAccessBridge-64.dll
[2012.10.11 10:05:20 | 000,289,768 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\javaws.exe
[2012.10.11 10:05:20 | 000,189,416 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\javaw.exe
[2012.10.11 10:05:19 | 001,034,216 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\npDeployJava1.dll
[2012.10.11 10:05:19 | 000,916,456 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\deployJava1.dll
[2012.10.11 10:05:19 | 000,188,904 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\java.exe
[2012.10.11 10:04:15 | 000,095,208 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2012.10.11 10:04:12 | 000,246,760 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2012.10.11 10:04:12 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2012.10.11 10:04:11 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2012.10.11 10:04:10 | 000,821,736 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\npDeployJava1.dll
[2012.10.11 10:04:10 | 000,746,984 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\deployJava1.dll
[2012.10.11 09:33:53 | 000,002,083 | ---- | M] () -- C:\Users\meric\Desktop\stolencamerafinder.lnk
[2012.10.10 20:56:20 | 000,986,624 | ---- | M] () -- C:\Users\meric\Desktop\MicrosoftFixit50844.msi
[2012.10.10 18:52:10 | 000,281,120 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2012.10.10 18:52:10 | 000,281,120 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012.10.10 17:38:22 | 003,941,312 | ---- | M] (Piriform Ltd) -- C:\Users\meric\Desktop\ccsetup323.exe
[2012.10.10 17:00:10 | 000,856,244 | ---- | M] () -- C:\Users\meric\Desktop\svchost.exe_clients.your-server.de.png
[2012.10.10 16:53:01 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\meric\Desktop\OTL.exe
[2012.10.10 16:13:21 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Users\meric\Desktop\aswMBR.exe
[2012.10.10 16:02:47 | 000,646,577 | ---- | M] () -- C:\Users\meric\Desktop\svchost.exe_redstation.net.uk.png
[2012.10.10 15:01:34 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\meric\Desktop\HijackThis.exe
[2012.10.10 03:29:07 | 000,281,120 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0
[2012.10.09 18:10:11 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
[2012.10.09 17:14:28 | 000,696,760 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012.10.09 17:14:28 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012.10.08 09:04:12 | 000,053,095 | ---- | M] () -- C:\Users\meric\Desktop\Hochschulsport - Anmeldebestätigung.pdf
[2012.10.07 04:56:54 | 000,000,707 | ---- | M] () -- C:\Users\meric\Desktop\PlanetSide 2 Beta.lnk
[2012.10.05 17:45:08 | 000,018,960 | ---- | M] (Logitech, Inc.) -- C:\Windows\SysNative\drivers\LNonPnP.sys
[2012.10.03 17:07:09 | 000,010,387 | ---- | M] () -- C:\Users\meric\Desktop\sdfsdf.png
[2012.10.01 23:26:20 | 001,517,344 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.10.01 23:26:20 | 000,653,918 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.10.01 23:26:20 | 000,614,770 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.10.01 23:26:20 | 000,129,718 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.10.01 23:26:20 | 000,106,012 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.10.01 21:13:21 | 001,594,114 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.10.01 21:13:08 | 000,265,598 | ---- | M] () -- C:\Users\meric\Desktop\dotnetfx_cleanup_tool.zip
[2012.09.26 18:33:12 | 000,617,992 | ---- | M] () -- C:\Users\meric\Desktop\parken.jpg
[2012.09.25 16:47:17 | 000,000,248 | ---- | M] () -- C:\Users\meric\Desktop\dbscheme.ase
[2012.09.24 23:15:52 | 000,176,169 | ---- | M] () -- C:\Users\meric\Desktop\gangnamstyle.mp3
[2012.09.19 10:02:08 | 000,102,368 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudbus.sys
[2012.09.19 10:02:06 | 000,203,104 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudmdm.sys
 
========== Files Created - No Company Name ==========
 
[2012.10.11 10:13:32 | 000,376,550 | ---- | C] () -- C:\Users\meric\Desktop\cc_20121011_101328.reg
[2012.10.11 09:33:53 | 000,002,083 | ---- | C] () -- C:\Users\meric\Desktop\stolencamerafinder.lnk
[2012.10.10 20:56:25 | 000,986,624 | ---- | C] () -- C:\Users\meric\Desktop\MicrosoftFixit50844.msi
[2012.10.10 17:00:10 | 000,856,244 | ---- | C] () -- C:\Users\meric\Desktop\svchost.exe_clients.your-server.de.png
[2012.10.10 16:02:46 | 000,646,577 | ---- | C] () -- C:\Users\meric\Desktop\svchost.exe_redstation.net.uk.png
[2012.10.08 09:04:11 | 000,053,095 | ---- | C] () -- C:\Users\meric\Desktop\Hochschulsport - Anmeldebestätigung.pdf
[2012.10.07 04:56:54 | 000,000,707 | ---- | C] () -- C:\Users\meric\Desktop\PlanetSide 2 Beta.lnk
[2012.10.07 04:56:54 | 000,000,707 | ---- | C] () -- C:\Users\meric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PlanetSide 2 Beta.lnk
[2012.10.03 17:05:26 | 000,010,387 | ---- | C] () -- C:\Users\meric\Desktop\sdfsdf.png
[2012.10.01 21:13:24 | 000,265,598 | ---- | C] () -- C:\Users\meric\Desktop\dotnetfx_cleanup_tool.zip
[2012.09.29 16:22:19 | 001,594,114 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.09.26 18:33:09 | 000,617,992 | ---- | C] () -- C:\Users\meric\Desktop\parken.jpg
[2012.09.25 16:47:16 | 000,000,248 | ---- | C] () -- C:\Users\meric\Desktop\dbscheme.ase
[2012.09.24 23:15:51 | 000,176,169 | ---- | C] () -- C:\Users\meric\Desktop\gangnamstyle.mp3
[2012.05.29 19:59:33 | 000,003,193 | ---- | C] () -- C:\Users\meric\.TransferManager.db
[2012.05.14 04:45:43 | 000,000,703 | ---- | C] () -- C:\Windows\NewsRover.INI
[2012.03.26 01:16:02 | 000,645,632 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2012.03.26 01:16:02 | 000,240,640 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2012.03.03 16:30:28 | 000,577,536 | ---- | C] () -- C:\Windows\SysWow64\ChilkatCsv.dll
[2012.02.29 18:14:42 | 000,000,060 | ---- | C] () -- C:\Windows\picture2avi.ini
[2011.10.15 15:41:55 | 000,002,560 | ---- | C] () -- C:\Windows\SysWow64\CTXFIGER.DLL
[2011.10.15 14:24:42 | 000,164,864 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2011.10.15 14:24:42 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2011.09.28 18:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011.09.22 12:29:58 | 000,321,856 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2011.09.19 09:07:46 | 000,015,360 | ---- | C] () -- C:\Windows\SysWow64\bdmjpeg.dll
[2011.09.19 09:07:32 | 000,058,368 | ---- | C] () -- C:\Windows\SysWow64\bdmpegv.dll
[2011.09.16 11:54:48 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2011.09.16 11:54:44 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2011.09.16 11:54:44 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2011.09.16 11:54:44 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2011.09.16 11:54:44 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2011.09.14 11:36:30 | 000,000,184 | ---- | C] () -- C:\Users\meric\AppData\Roaming\3a99ed39.dat
[2011.05.12 01:10:29 | 000,000,600 | ---- | C] () -- C:\Users\meric\AppData\Roaming\winscp.rnd
[2011.04.22 01:53:09 | 000,010,240 | ---- | C] () -- C:\Users\meric\qlgt.db
[2011.04.17 18:34:36 | 000,000,132 | ---- | C] () -- C:\Users\meric\AppData\Roaming\Adobe GIF Format CS5 Prefs
[2011.04.16 16:16:51 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll
[2011.04.03 20:23:51 | 000,015,873 | ---- | C] () -- C:\Windows\SysWow64\Inetde.dll
[2011.03.10 22:53:14 | 000,000,600 | ---- | C] () -- C:\Users\meric\AppData\Local\PUTTY.RND
[2011.03.05 00:41:26 | 000,007,631 | ---- | C] () -- C:\Users\meric\AppData\Local\Resmon.ResmonCfg
[2011.02.25 07:51:49 | 000,000,132 | ---- | C] () -- C:\Users\meric\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2011.02.19 19:30:01 | 000,281,120 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011.02.19 19:30:00 | 000,837,192 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe
[2011.02.19 19:30:00 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 05:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2011.11.22 23:53:29 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft
[2011.11.22 23:47:21 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft - 1.0 aktuell
[2011.03.04 13:23:26 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft - john smith texture pack v7
[2011.03.04 13:22:58 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft - misa's texture pack
[2012.09.24 23:28:07 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Audacity
[2011.05.04 21:05:29 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Avnex
[2012.04.28 05:12:56 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\BANDISOFT
[2011.10.20 05:29:38 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Beat Hazard
[2011.04.13 03:07:11 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Bridge!
[2011.03.02 21:12:17 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Canon
[2011.04.15 21:18:40 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2012.03.03 21:42:36 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\EurekaLog
[2012.10.11 10:12:51 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\FileZilla
[2011.08.21 15:46:14 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\flightgear.org
[2011.02.26 21:08:06 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GARMIN
[2012.03.03 16:51:09 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GeoSetter
[2011.02.21 19:32:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GetRight
[2011.08.15 02:12:07 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GlarySoft
[2012.05.17 19:30:34 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GrabIt
[2012.07.17 17:53:03 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\gslist
[2011.12.27 20:46:27 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Highresolution Enterprises
[2012.05.29 13:49:48 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\ijjigame
[2011.02.23 18:24:43 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\ImgBurn
[2011.04.14 01:02:14 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\JAM Software
[2011.09.22 13:04:12 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\JOSM
[2011.02.19 05:17:20 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Leadertech
[2012.07.13 21:51:22 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\LolClient
[2012.06.04 00:45:51 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\LolClient2
[2012.10.03 16:44:17 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\MAGIX
[2011.04.15 02:06:11 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\mirkes.de
[2011.02.20 07:14:12 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Mp3tag
[2011.03.12 16:55:07 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\net.tw.Boks.7C34F9BA9FAD6689FAABBE85F1F5B46BA5A32DE5.1
[2011.02.20 02:07:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Notepad++
[2011.06.05 16:36:43 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\OpenOffice.org
[2011.02.26 20:56:52 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Opera
[2011.04.15 20:58:26 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\PACE Anti-Piracy
[2011.03.18 19:27:45 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\PC Suite
[2011.02.24 18:28:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\POV-Ray
[2011.11.20 03:52:57 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\pymclevel
[2011.10.20 21:30:41 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Samsung
[2012.07.17 03:41:36 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\six-updater
[2012.07.17 02:38:53 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\six-zsync
[2012.07.16 00:15:08 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\SplitMediaLabs
[2012.06.02 14:43:42 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Spotify
[2011.02.23 16:52:00 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2011.08.21 15:45:04 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Subversion
[2011.08.03 23:55:14 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\System
[2012.06.03 21:03:45 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\TeamViewer
[2012.07.10 13:32:48 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Temp
[2012.05.17 19:14:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Thunderbird
[2011.08.11 02:27:43 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Tropico 4 Demo
[2012.06.29 19:17:56 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\ts3overlay
[2011.10.07 23:33:58 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Unity
[2012.04.30 15:42:37 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Wireshark
[2011.10.19 18:15:14 | 000,000,000 | -HSD | M] -- C:\Users\meric\AppData\Roaming\wyUpdate AU
[2012.01.19 23:25:41 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\XMedia Recode
 
========== Purity Check ==========
 
 < End of report >
         
4.
Nein, diese Sites hatte ich nicht zu den Vertrauenswürdigen hinzugefügt. Hab sie entfernt.

5.
Die alten Java-Versionen (32bit/64bit) hab ich deinstalliert und nach einem Neustart die aktuellen aufgespielt.

6.
Open Office ebenfalls aktualisiert.

7.
Internet Explorer ist auf dem neusten Stand.

8.
CCleaner hab ich laufenlassen. Hat etliche überflüssige Einträge entfernt.

9.
ESET Online Scan hab ich laufen lassen. Hat fast 7 Stunden gedauert. Hier die gefundenen Schädlinge:

Code:
ATTFilter
C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\qlps-qlipso-sntb.exe	Win32/Toolbar.Zugo application	cleaned by deleting - quarantined
D:\Programme\PDFCreator\Toolbar\pdfforge Toolbar-4_4_0_setup.exe	Win32/Toolbar.Widgi application	cleaned by deleting - quarantined
D:\Programme\Win7codecs\Tools\Settings32.exe	Win32/Packed.Autoit.C.Gen application	cleaned by deleting - quarantined
D:\Progz\davinci_client_22.35.exe	a variant of Win32/Packed.Themida application	cleaned by deleting - quarantined
D:\Progz\gamebooster.exe	a variant of Win32/Toolbar.Widgi application	cleaned by deleting - quarantined
D:\Progz\HSS-1.30-install-anchorfree-76-conduit.exe	a variant of Win32/HotSpotShield application	cleaned by deleting - quarantined
D:\Progz\HSS-1.37-install-anchorfree-76-conduit.exe	a variant of Win32/HotSpotShield application	cleaned by deleting - quarantined
D:\Progz\JAF_Suite_Setup_1.1.1.exe	a variant of Win32/Packed.Themida application	cleaned by deleting - quarantined
D:\Progz\JAF_Virtual_PKEY_V5.zip	a variant of Win32/Packed.Themida application	deleted - quarantined
D:\Progz\PDFCreator-1_2_2_setup.exe	Win32/Toolbar.Widgi application	cleaned by deleting - quarantined
D:\Progz\picture2avi-setup_exe.exe	a variant of Win32/InstallCore.D application	cleaned by deleting - quarantined
D:\Progz\RarRecoveryToolboxv1147.rar	probably a variant of Win32/Agent.DJCXUEH trojan	deleted - quarantined
D:\Progz\Setup_FreeFlvConverter.exe	Win32/Toolbar.Widgi application	cleaned by deleting - quarantined
D:\Progz\stylexp_Longhorn-Aero-PDC.exe	multiple threats	cleaned by deleting - quarantined
D:\Progz\VeohWebPlayer138Setup_eng.exe	Win32/Toolbar.Zugo application	cleaned by deleting - quarantined
D:\tmpDIR\BetterInstaller.exe	a variant of Win32/Somoto.A application	cleaned by deleting - quarantined
         
Bei manchen Sachen war's zwar wahrscheinlich nur n heuristischer Treffer, hab aber trotzdem alles löschen lassen.


weiter im nächsten Posting =>


Alt 12.10.2012, 00:48   #6
meric
 
Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk) - Standard

Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk)



10.
Hier die beiden Logfiles des OTL-Scans. OTL-Logfile:

Code:
ATTFilter
OTL logfile created on: 11.10.2012 17:01:58 - Run 3
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\meric\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 1,64 Gb Available Physical Memory | 40,95% Memory free
6,00 Gb Paging File | 3,86 Gb Available in Paging File | 64,33% Paging File free
Paging file location(s): d:\pagefile.sys 2048 2048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 40,43 Gb Total Space | 2,29 Gb Free Space | 5,66% Space Free | Partition Type: NTFS
Drive D: | 425,33 Gb Total Space | 30,44 Gb Free Space | 7,16% Space Free | Partition Type: NTFS
Drive E: | 149,04 Gb Total Space | 4,55 Gb Free Space | 3,05% Space Free | Partition Type: NTFS
Drive F: | 3,85 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: CHOSENONE | User Name: meric | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.10.10 16:53:01 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\meric\Desktop\OTL.exe
PRC - [2012.10.09 16:06:31 | 000,692,152 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_4_402_287_ActiveX.exe
PRC - [2012.08.29 12:03:38 | 001,996,200 | ---- | M] (LogMeIn Inc.) -- D:\Programme\LogMeIn Hamachi\hamachi-2-ui.exe
PRC - [2012.08.21 11:12:26 | 004,282,728 | ---- | M] (AVAST Software) -- D:\Programme\avast Antivirus\AvastUI.exe
PRC - [2012.08.21 11:12:25 | 000,044,808 | ---- | M] (AVAST Software) -- D:\Programme\avast Antivirus\AvastSvc.exe
PRC - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.05.29 17:09:57 | 000,076,888 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2011.11.15 19:20:26 | 000,095,608 | ---- | M] (Dyn, Inc.) -- D:\Programme\DynDNS Updater\DynUpSvc.exe
PRC - [2011.11.15 19:20:26 | 000,078,192 | ---- | M] (Dyn, Inc.) -- D:\Programme\DynDNS Updater\DynTray.exe
PRC - [2011.03.07 15:33:08 | 000,089,456 | ---- | M] (Elaborate Bytes AG) -- D:\Programme\VirtualCloneDrive\VCDDaemon.exe
PRC - [2010.07.07 21:27:16 | 001,268,224 | ---- | M] (Creative Technology Ltd) -- C:\Windows\SysWOW64\CTxfispi.exe
PRC - [2010.02.12 10:23:12 | 000,286,720 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
PRC - [2009.12.21 09:00:50 | 000,081,920 | ---- | M] (Realtime Soft Ltd) -- C:\Program Files (x86)\Common Files\Realtime Soft\RTSHookInterop\x32\RTSHookInterop.exe
PRC - [2007.07.18 09:19:02 | 000,057,344 | ---- | M] (Creative Technology Ltd.) -- C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2009.06.29 10:54:08 | 000,164,864 | ---- | M] () -- C:\Windows\SysWOW64\APOMngr.DLL
MOD - [2009.02.06 18:52:24 | 000,073,728 | ---- | M] () -- C:\Windows\SysWOW64\CmdRtr.DLL
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2012.10.09 17:14:30 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.09.15 02:02:29 | 000,529,744 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.08.29 12:03:36 | 002,369,960 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- D:\Programme\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2012.08.21 11:12:25 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Running] -- D:\Programme\avast Antivirus\AvastSvc.exe -- (avast! Antivirus)
SRV - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.07.12 15:16:56 | 000,008,704 | ---- | M] (Hi-Rez Studios) [On_Demand | Stopped] -- D:\Spiele\Hi-Rez Studios\HiPatchService.exe -- (HiPatchService)
SRV - [2012.06.07 19:12:14 | 000,160,944 | R--- | M] (Skype Technologies) [Disabled | Stopped] -- D:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.05.29 17:09:57 | 000,076,888 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2012.03.06 17:19:00 | 003,953,632 | ---- | M] (INCA Internet Co., Ltd.) [Disabled | Stopped] -- C:\Windows\SysWOW64\GameMon.des -- (npggsvc)
SRV - [2012.01.25 10:56:30 | 009,690,112 | ---- | M] () [On_Demand | Stopped] -- c:\wamp\bin\mysql\mysql5.5.20\bin\mysqld.exe -- (wampmysqld)
SRV - [2011.11.15 19:20:26 | 000,095,608 | ---- | M] (Dyn, Inc.) [Auto | Running] -- D:\Programme\DynDNS Updater\DynUpSvc.exe -- (Dyn Updater)
SRV - [2011.10.15 16:04:37 | 000,079,360 | ---- | M] (Creative Labs) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service)
SRV - [2011.10.15 15:40:18 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe -- (Creative ALchemy AL6 Licensing Service)
SRV - [2011.09.27 21:04:08 | 000,359,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2011.09.26 11:06:54 | 000,021,504 | ---- | M] (Apache Software Foundation) [On_Demand | Stopped] -- c:\wamp\bin\apache\Apache2.2.21\bin\httpd.exe -- (wampapache)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.19 14:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2010.02.12 10:23:12 | 000,286,720 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService)
SRV - [2009.08.18 12:48:02 | 002,291,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008.11.11 09:38:06 | 000,620,544 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.09.19 10:02:08 | 000,102,368 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudbus.sys -- (dg_ssudbus)
DRV:64bit: - [2012.09.19 10:02:06 | 000,203,104 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudmdm.sys -- (ssudmdm)
DRV:64bit: - [2012.08.21 11:13:13 | 000,969,200 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx)
DRV:64bit: - [2012.08.21 11:13:13 | 000,359,464 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswSP.sys -- (aswSP)
DRV:64bit: - [2012.08.21 11:13:13 | 000,059,728 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswTdi.sys -- (aswTdi)
DRV:64bit: - [2012.08.21 11:13:12 | 000,071,600 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV:64bit: - [2012.08.21 11:13:12 | 000,054,072 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr)
DRV:64bit: - [2012.08.21 11:13:11 | 000,025,232 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV:64bit: - [2012.07.26 21:32:08 | 000,066,728 | ---- | M] (Eugene V. Muzychenko) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vrtaucbl.sys -- (EuMusDesignVirtualAudioCableWdm)
DRV:64bit: - [2012.03.07 01:02:45 | 000,028,504 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswKbd.sys -- (aswKbd)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.11.16 15:35:58 | 000,054,400 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbfilter.sys -- (usbfilter)
DRV:64bit: - [2011.10.29 03:41:28 | 000,042,624 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amd_xata.sys -- (amd_xata)
DRV:64bit: - [2011.10.29 03:41:26 | 000,080,512 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amd_sata.sys -- (amd_sata)
DRV:64bit: - [2011.09.02 08:30:36 | 000,060,696 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt)
DRV:64bit: - [2011.09.02 08:30:24 | 000,066,840 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)
DRV:64bit: - [2011.07.26 19:49:12 | 000,037,888 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\taphss.sys -- (taphss)
DRV:64bit: - [2011.06.02 07:47:22 | 000,177,640 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadmdm.sys -- (ssadmdm)
DRV:64bit: - [2011.06.02 07:47:22 | 000,157,672 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadbus.sys -- (ssadbus)
DRV:64bit: - [2011.06.02 07:47:22 | 000,016,872 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadmdfl.sys -- (ssadmdfl)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.02.19 05:18:18 | 000,022,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGBusEnum.sys -- (LGBusEnum)
DRV:64bit: - [2011.02.19 05:18:18 | 000,016,008 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGVirHid.sys -- (LGVirHid)
DRV:64bit: - [2011.01.15 18:21:04 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone)
DRV:64bit: - [2010.12.21 07:55:02 | 000,161,280 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sscemdm.sys -- (sscemdm)
DRV:64bit: - [2010.12.21 07:55:02 | 000,129,024 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssceserd.sys -- (ssceserd)
DRV:64bit: - [2010.12.21 07:55:02 | 000,127,488 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sscebus.sys -- (sscebus)
DRV:64bit: - [2010.12.21 07:55:02 | 000,036,328 | ---- | M] (Google Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadadb.sys -- (androidusb)
DRV:64bit: - [2010.12.21 07:55:02 | 000,018,944 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sscemdfl.sys -- (sscemdfl)
DRV:64bit: - [2010.12.17 00:58:14 | 000,040,816 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO)
DRV:64bit: - [2010.11.20 15:34:04 | 000,360,832 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vpcvmm.sys -- (vpcvmm)
DRV:64bit: - [2010.11.20 15:34:04 | 000,194,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vpchbus.sys -- (vpcbus)
DRV:64bit: - [2010.11.20 13:35:34 | 000,095,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vpcusb.sys -- (vpcusb)
DRV:64bit: - [2010.11.20 13:35:26 | 000,016,384 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vpcuxd.sys -- (vpcuxd)
DRV:64bit: - [2010.11.20 13:35:22 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vpcnfltr.sys -- (vpcnfltr)
DRV:64bit: - [2010.11.20 06:33:36 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 04:07:06 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.07.12 20:36:10 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2010.07.07 23:21:18 | 001,612,888 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ha20x22k.sys -- (ha20x22k)
DRV:64bit: - [2010.07.07 23:21:06 | 001,567,832 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ha20x2k.sys -- (ha20x2k)
DRV:64bit: - [2010.07.07 23:20:56 | 000,118,360 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\emupia2k.sys -- (emupia)
DRV:64bit: - [2010.07.07 23:20:48 | 000,213,080 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctsfm2k.sys -- (ctsfm2k)
DRV:64bit: - [2010.07.07 23:20:40 | 000,015,960 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctprxy2k.sys -- (ctprxy2k)
DRV:64bit: - [2010.07.07 23:16:32 | 000,179,288 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctoss2k.sys -- (ossrv)
DRV:64bit: - [2010.07.07 23:16:24 | 000,697,816 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctaud2k.sys -- (ctaud2k)
DRV:64bit: - [2010.07.07 23:16:14 | 000,580,696 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ctac32k.sys -- (ctac32k)
DRV:64bit: - [2010.07.07 23:16:06 | 001,445,976 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CTEXFIFX.sys -- (CTEXFIFX.SYS)
DRV:64bit: - [2010.07.07 23:16:06 | 001,445,976 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTEXFIFX.sys -- (CTEXFIFX)
DRV:64bit: - [2010.07.07 23:15:56 | 000,095,320 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CTHWIUT.sys -- (CTHWIUT.SYS)
DRV:64bit: - [2010.07.07 23:15:56 | 000,095,320 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTHWIUT.sys -- (CTHWIUT)
DRV:64bit: - [2010.07.07 23:15:50 | 000,230,488 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CT20XUT.sys -- (CT20XUT.SYS)
DRV:64bit: - [2010.07.07 23:15:50 | 000,230,488 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CT20XUT.sys -- (CT20XUT)
DRV:64bit: - [2010.06.17 11:15:36 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie64.sys -- (AtiPcie)
DRV:64bit: - [2009.12.30 11:21:26 | 000,031,800 | ---- | M] (VS Revo Group) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\revoflt.sys -- (Revoflt)
DRV:64bit: - [2009.08.24 11:36:00 | 000,010,752 | ---- | M] (hxxp://www.recursion.jp/avrcdc/) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lowcdc.sys -- (lowcdc)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.18 14:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009.05.08 17:08:00 | 000,020,520 | ---- | M] (GARMIN Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\grmnusb.sys -- (grmnusb)
DRV:64bit: - [2009.03.18 17:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)
DRV:64bit: - [2009.03.02 00:05:32 | 000,187,392 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2008.12.26 12:56:04 | 000,021,504 | ---- | M] (Avnex) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vcsvad.sys -- (VCSVADHWSer)
DRV:64bit: - [2008.08.28 11:44:42 | 000,025,600 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys -- (pccsmcfd)
DRV:64bit: - [2007.05.02 16:34:30 | 000,171,008 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nmwcdsax64.sys -- (nmwcdsax64)
DRV:64bit: - [2007.05.02 16:33:38 | 000,017,408 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nmwcdsacjx64.sys -- (nmwcdsacjx64)
DRV:64bit: - [2007.05.02 16:33:36 | 000,012,288 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nmwcdsacx64.sys -- (nmwcdsacx64)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2008.11.14 03:11:42 | 000,020,512 | ---- | M] (Realtime Soft Ltd) [Kernel | Auto | Running] -- C:\Program Files (x86)\Common Files\Realtime Soft\UltraMonMirrorDrv\x64\UltraMonUtility.sys -- (UltraMonUtility)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 51 07 D0 4F 35 A4 CD 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "chrome://speeddial/content/speeddial.xul"
FF - prefs.js..extensions.enabledAddons: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E}:3.0.1
FF - prefs.js..extensions.enabledAddons: {8b86149f-01fb-4842-9dd8-4d7eb02fd055}:0.22.1
FF - prefs.js..extensions.enabledAddons: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.10
FF - prefs.js..extensions.enabledAddons: {dc572301-7619-498c-a57d-39143191b318}:0.4.0.3
FF - prefs.js..extensions.enabledAddons: ich@maltegoetz.de:1.4.3
FF - prefs.js..extensions.enabledAddons: yetanothersmoothscrolling@kataho:3.0.24
FF - prefs.js..extensions.enabledAddons: {64161300-e22b-11db-8314-0800200c9a66}:0.9.6.10
FF - prefs.js..extensions.enabledAddons: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:1.4
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_287.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1165635.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.0: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=0.80.0: C:\Program Files (x86)\Battlelog Web Plugins\0.80.0\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@garmin.com/GpsControl: C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: D:\Programme\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: D:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\meric\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011.08.05 04:20:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: D:\Programme\avast Antivirus\WebRep\FF [2012.09.07 06:02:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Components: D:\Programme\Mozilla Firefox 4\components [2012.09.07 19:37:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Plugins: D:\Programme\Mozilla Firefox 4\plugins [2012.10.11 10:04:29 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: D:\Programme\Mozilla Firefox 4\components [2012.09.07 19:37:21 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: D:\Programme\Mozilla Firefox 4\plugins [2012.10.11 10:04:29 | 000,000,000 | ---D | M]
 
[2011.02.19 06:14:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\Extensions
[2012.10.11 08:59:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions
[2011.08.26 14:05:17 | 000,000,000 | ---D | M] (Garmin Communicator) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2011.06.29 22:54:50 | 000,000,000 | ---D | M] (All-in-One Gestures) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\{8b86149f-01fb-4842-9dd8-4d7eb02fd055}
[2012.09.16 02:47:33 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012.10.02 23:00:12 | 000,000,000 | ---D | M] (FoxyProxy Standard) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\foxyproxy-basic@eric.h.jung
[2012.09.15 12:21:45 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\ich@maltegoetz.de
[2012.02.23 17:04:32 | 000,164,722 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\compatibility@addons.mozilla.org.xpi
[2012.10.10 04:24:53 | 001,626,141 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\firebug@software.joehewitt.com.xpi
[2012.09.15 12:21:45 | 000,066,522 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\yetanothersmoothscrolling@kataho.xpi
[2012.10.10 14:30:49 | 000,281,285 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{64161300-e22b-11db-8314-0800200c9a66}.xpi
[2012.10.10 04:24:51 | 000,529,404 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2012.09.05 13:40:27 | 001,268,546 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}.xpi
[2012.07.25 05:41:33 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2011.11.05 14:28:38 | 000,434,392 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi
[2012.07.21 13:05:28 | 000,702,524 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi
[2012.09.13 01:44:36 | 000,698,867 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi
[2012.10.11 08:59:30 | 000,252,340 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: chrome://speeddial/content/speeddial.xul
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\meric\AppData\Local\Google\Chrome\Application\17.0.963.78\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.240.7 (Enabled) = D:\Programme\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U24 (Enabled) = D:\Programme\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = D:\Programme\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\np-mswmp.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\meric\AppData\Local\Google\Chrome\Application\17.0.963.78\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\meric\AppData\Local\Google\Chrome\Application\17.0.963.78\pdf.dll
CHR - plugin: Google Talk Plugin (Enabled) = C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: Garmin Communicator Plug-In (Enabled) = C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
CHR - plugin: Windows Activation Technologies (Enabled) = C:\Windows\system32\Wat\npWatWeb.dll
CHR - plugin: Picasa (Enabled) = D:\Programme\Google\Picasa3\npPicasa3.dll
CHR - plugin: iTunes Application Detector (Enabled) = D:\Programme\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: TooManyTabs f\u00FCr Chrome = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\amigcgbheognjmfkaieeeadojiibgbdp\1.9.1_0\
CHR - Extension: TooManyTabs f\u00FCr Chrome = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\amigcgbheognjmfkaieeeadojiibgbdp\1.9.2_0\
CHR - Extension: Turn Off the Lights = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfbmjmiodbnnpllbbbfblcplfjjepjdn\2.0.0.81_0\
CHR - Extension: GCVote = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\boingbkmoapffongfpcancmephhnmehp\2.4.5_0\
CHR - Extension: GCVote = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\boingbkmoapffongfpcancmephhnmehp\2.4.5_0\~
CHR - Extension: SmoothScroll = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\cccpiddacjljmfbbgeimpelpndgpoknn\1.0.6_0\
CHR - Extension: Adblock Plus f\u00FCr Google Chrome\u2122 (Beta) = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.1.3_0\
CHR - Extension: Session Buddy = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\edacconmaakjimmfgnblocblbcdcpbko\2.1.2_0\
CHR - Extension: Direkt Werbung auf YouTube = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\epbmnbdplhcomkedpjfceakddnbgfjmf\1.199_0\
CHR - Extension: Direkt Werbung auf YouTube = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\epbmnbdplhcomkedpjfceakddnbgfjmf\1.52_0\
CHR - Extension: AdBlock = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.33_0\
CHR - Extension: avast! WebRep = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\
CHR - Extension: Speed Dial 2 = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpfpebmajhhopeonhlcgidhclcccjcik\1.6.0.8_0\
CHR - Extension: Smooth Gestures = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfkgmnnajiljnolcgolmmgnecgldgeld\0.15.4.13_0\
CHR - Extension: GC little helper = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\nagohipignfajbmgdcedbnmafoebnnjg\1.0_0\
CHR - Extension: New Tabs Always Last = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\nldmhfnlbkkdhboedalogjpeedjbmjgi\0.1_0\
CHR - Extension: Mehr Leistung und Videoformate f\u00FCr dein HTML5 \u003Cvideo\u003E = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.126_0\
 
O1 HOSTS File: ([2012.10.11 09:57:32 | 000,000,771 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - D:\Programme\avast Antivirus\aswWebRepIE64.dll (AVAST Software)
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\avast Antivirus\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - D:\Programme\avast Antivirus\aswWebRepIE64.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\avast Antivirus\aswWebRepIE.dll (AVAST Software)
O4:64bit: - HKLM..\Run: [EvtMgr6] D:\Programme\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [Launch LCore] C:\Program Files\Logitech Gaming Software\LCore.exe (Logitech Inc.)
O4 - HKLM..\Run: [avast] D:\Programme\avast Antivirus\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] D:\Programme\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [Module Loader] C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [VirtualCloneDrive] D:\Programme\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG)
O4 - Startup: C:\Users\meric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\launch.jnlp ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1
O8:64bit: - Extra context menu item: add to &BOM - D:\\PROGRA~1\\BIET-O~1\\\\AddToBOM.hta ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: add to &BOM - D:\\PROGRA~1\\BIET-O~1\\\\AddToBOM.hta ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15114/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7261E20A-4D13-42CD-AACA-ADDBC90946B2}: NameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\gopher - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\AutorunsDisabled: DllName - (Reg Error: Value error.) - Reg Error: Value error. File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.10.11 10:35:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.10.11 10:09:10 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.4.1
[2012.10.11 10:05:34 | 001,034,216 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\npDeployJava1.dll
[2012.10.11 10:05:34 | 000,289,768 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\javaws.exe
[2012.10.11 10:05:29 | 000,189,416 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\javaw.exe
[2012.10.11 10:05:29 | 000,188,904 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\java.exe
[2012.10.11 10:05:29 | 000,108,008 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\WindowsAccessBridge-64.dll
[2012.10.11 10:05:17 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2012.10.11 10:04:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2012.10.11 10:04:29 | 000,821,736 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\npDeployJava1.dll
[2012.10.11 10:04:29 | 000,246,760 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2012.10.11 10:04:21 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2012.10.11 10:04:21 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2012.10.11 10:04:21 | 000,095,208 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2012.10.11 10:04:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2012.10.11 09:26:20 | 000,000,000 | ---D | C] -- C:\_OTL
[2012.10.10 17:38:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012.10.10 17:38:39 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012.10.10 17:38:22 | 003,941,312 | ---- | C] (Piriform Ltd) -- C:\Users\meric\Desktop\ccsetup323.exe
[2012.10.10 16:53:00 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\meric\Desktop\OTL.exe
[2012.10.10 16:33:54 | 000,000,000 | ---D | C] -- C:\Users\meric\Desktop\OSAM
[2012.10.10 16:13:14 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Users\meric\Desktop\aswMBR.exe
[2012.10.10 16:01:56 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Roaming\Malwarebytes
[2012.10.10 16:01:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.10.10 16:01:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.10.10 16:01:41 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.10.10 15:20:59 | 000,000,000 | ---D | C] -- C:\Users\meric\Desktop\backups
[2012.10.10 15:01:33 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\meric\Desktop\HijackThis.exe
[2012.10.10 14:46:18 | 000,424,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll
[2012.10.10 14:46:17 | 001,162,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll
[2012.10.10 14:46:17 | 000,338,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\conhost.exe
[2012.10.10 14:46:17 | 000,215,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll
[2012.10.10 14:46:14 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll
[2012.10.10 14:46:13 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe
[2012.10.10 14:46:13 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll
[2012.10.10 14:46:13 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll
[2012.10.10 14:46:12 | 000,362,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll
[2012.10.10 14:46:12 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll
[2012.10.10 14:46:12 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe
[2012.10.10 14:46:12 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll
[2012.10.10 14:46:12 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2012.10.10 14:46:12 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2012.10.10 14:46:12 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012.10.10 14:46:11 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2012.10.10 14:46:10 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2012.10.10 14:46:09 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2012.10.10 14:46:09 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2012.10.10 14:46:08 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2012.10.10 14:46:08 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2012.10.10 14:46:07 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2012.10.10 14:46:07 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2012.10.10 14:46:07 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2012.10.10 14:46:07 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2012.10.10 14:46:07 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2012.10.10 14:46:07 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2012.10.10 14:46:06 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2012.10.10 14:46:06 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2012.10.10 14:46:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2012.10.10 14:46:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2012.10.10 14:46:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2012.10.10 14:46:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2012.10.10 14:46:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2012.10.10 14:46:05 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe
[2012.10.10 14:45:24 | 001,464,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll
[2012.10.10 14:45:23 | 000,140,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll
[2012.10.10 14:45:01 | 000,220,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll
[2012.10.10 14:44:21 | 005,559,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2012.10.10 14:44:20 | 003,914,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2012.10.10 14:44:19 | 003,968,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2012.10.07 04:57:11 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Local\SCE
[2012.10.07 04:57:11 | 000,000,000 | ---D | C] -- C:\Crash
[2012.10.05 17:44:27 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Logishrd
[2012.10.03 16:44:17 | 000,000,000 | ---D | C] -- C:\ProgramData\MAGIX
[2012.10.03 16:44:16 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Local\Xara
[2012.10.03 16:44:16 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Roaming\MAGIX
[2012.10.03 16:43:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Xara
[2012.10.03 16:43:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xara
[2012.09.29 15:31:59 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Local\Solid State Networks
[2012.09.29 15:31:52 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Meteor Entertainment
[2012.09.26 11:14:27 | 000,245,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\OxpsConverter.exe
[2012.09.22 11:51:09 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012.09.22 11:51:09 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012.09.22 11:51:08 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012.09.22 11:51:08 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012.09.22 11:51:08 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2012.09.22 11:51:08 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2012.09.22 11:51:07 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2012.09.22 11:51:07 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012.09.22 11:51:07 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012.09.22 11:51:07 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012.09.22 11:51:06 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2012.09.22 11:51:06 | 000,729,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2012.09.22 11:51:04 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2012.09.22 11:51:04 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012.09.22 11:51:04 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2012.09.19 10:02:08 | 000,102,368 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudbus.sys
[2012.09.19 10:02:06 | 000,203,104 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudmdm.sys
[2012.09.15 03:50:21 | 000,000,000 | --SD | C] -- C:\Users\meric\Documents\Eigene Datenquellen
[2012.09.12 12:44:00 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\RNDISMP.sys
[2012.09.12 12:43:59 | 000,574,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10level9.dll
[2012.09.12 12:43:58 | 000,376,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\netio.sys
[2012.09.12 12:43:58 | 000,288,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\FWPKCLNT.SYS
 
========== Files - Modified Within 30 Days ==========
 
[2012.10.11 17:00:29 | 000,007,631 | ---- | M] () -- C:\Users\meric\AppData\Local\Resmon.ResmonCfg
[2012.10.11 16:06:27 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.10.11 10:29:42 | 000,000,306 | ---- | M] () -- C:\Windows\tasks\GlaryInitialize.job
[2012.10.11 10:25:12 | 000,013,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.10.11 10:25:12 | 000,013,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.10.11 10:16:56 | 004,983,856 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.10.11 10:16:47 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.10.11 10:16:32 | 3220,037,632 | -HS- | M] () -- C:\hiberfil.sys
[2012.10.11 10:15:59 | 000,062,308 | ---- | M] () -- C:\Windows\SysNative\BMXStateBkp-{00000002-00000000-00000000-00001102-0000000B-00411102}.rfx
[2012.10.11 10:15:59 | 000,062,308 | ---- | M] () -- C:\Windows\SysNative\BMXState-{00000002-00000000-00000000-00001102-0000000B-00411102}.rfx
[2012.10.11 10:15:59 | 000,000,820 | ---- | M] () -- C:\Windows\SysNative\DVCState-{00000002-00000000-00000000-00001102-0000000B-00411102}.rfx
[2012.10.11 10:13:46 | 000,376,550 | ---- | M] () -- C:\Users\meric\Desktop\cc_20121011_101328.reg
[2012.10.11 10:05:24 | 000,108,008 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\WindowsAccessBridge-64.dll
[2012.10.11 10:05:20 | 000,289,768 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\javaws.exe
[2012.10.11 10:05:20 | 000,189,416 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\javaw.exe
[2012.10.11 10:05:19 | 001,034,216 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\npDeployJava1.dll
[2012.10.11 10:05:19 | 000,916,456 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\deployJava1.dll
[2012.10.11 10:05:19 | 000,188,904 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\java.exe
[2012.10.11 10:04:15 | 000,095,208 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2012.10.11 10:04:12 | 000,246,760 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2012.10.11 10:04:12 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2012.10.11 10:04:11 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2012.10.11 10:04:10 | 000,821,736 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\npDeployJava1.dll
[2012.10.11 10:04:10 | 000,746,984 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\deployJava1.dll
[2012.10.11 09:33:53 | 000,002,083 | ---- | M] () -- C:\Users\meric\Desktop\stolencamerafinder.lnk
[2012.10.10 20:56:20 | 000,986,624 | ---- | M] () -- C:\Users\meric\Desktop\MicrosoftFixit50844.msi
[2012.10.10 18:52:10 | 000,281,120 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2012.10.10 18:52:10 | 000,281,120 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012.10.10 17:38:22 | 003,941,312 | ---- | M] (Piriform Ltd) -- C:\Users\meric\Desktop\ccsetup323.exe
[2012.10.10 17:00:10 | 000,856,244 | ---- | M] () -- C:\Users\meric\Desktop\svchost.exe_clients.your-server.de.png
[2012.10.10 16:53:01 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\meric\Desktop\OTL.exe
[2012.10.10 16:13:21 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Users\meric\Desktop\aswMBR.exe
[2012.10.10 16:02:47 | 000,646,577 | ---- | M] () -- C:\Users\meric\Desktop\svchost.exe_redstation.net.uk.png
[2012.10.10 15:01:34 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\meric\Desktop\HijackThis.exe
[2012.10.10 03:29:07 | 000,281,120 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0
[2012.10.09 18:10:11 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
[2012.10.09 17:14:28 | 000,696,760 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012.10.09 17:14:28 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012.10.08 09:04:12 | 000,053,095 | ---- | M] () -- C:\Users\meric\Desktop\Hochschulsport - Anmeldebestätigung.pdf
[2012.10.07 04:56:54 | 000,000,707 | ---- | M] () -- C:\Users\meric\Desktop\PlanetSide 2 Beta.lnk
[2012.10.05 17:45:08 | 000,018,960 | ---- | M] (Logitech, Inc.) -- C:\Windows\SysNative\drivers\LNonPnP.sys
[2012.10.03 17:07:09 | 000,010,387 | ---- | M] () -- C:\Users\meric\Desktop\sdfsdf.png
[2012.10.01 23:26:20 | 001,517,344 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.10.01 23:26:20 | 000,653,918 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.10.01 23:26:20 | 000,614,770 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.10.01 23:26:20 | 000,129,718 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.10.01 23:26:20 | 000,106,012 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.10.01 21:13:21 | 001,594,114 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.10.01 21:13:08 | 000,265,598 | ---- | M] () -- C:\Users\meric\Desktop\dotnetfx_cleanup_tool.zip
[2012.09.26 18:33:12 | 000,617,992 | ---- | M] () -- C:\Users\meric\Desktop\parken.jpg
[2012.09.25 16:47:17 | 000,000,248 | ---- | M] () -- C:\Users\meric\Desktop\dbscheme.ase
[2012.09.24 23:15:52 | 000,176,169 | ---- | M] () -- C:\Users\meric\Desktop\gangnamstyle.mp3
[2012.09.19 10:02:08 | 000,102,368 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudbus.sys
[2012.09.19 10:02:06 | 000,203,104 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudmdm.sys
 
========== Files Created - No Company Name ==========
 
[2012.10.11 10:13:32 | 000,376,550 | ---- | C] () -- C:\Users\meric\Desktop\cc_20121011_101328.reg
[2012.10.11 09:33:53 | 000,002,083 | ---- | C] () -- C:\Users\meric\Desktop\stolencamerafinder.lnk
[2012.10.10 20:56:25 | 000,986,624 | ---- | C] () -- C:\Users\meric\Desktop\MicrosoftFixit50844.msi
[2012.10.10 17:00:10 | 000,856,244 | ---- | C] () -- C:\Users\meric\Desktop\svchost.exe_clients.your-server.de.png
[2012.10.10 16:02:46 | 000,646,577 | ---- | C] () -- C:\Users\meric\Desktop\svchost.exe_redstation.net.uk.png
[2012.10.08 09:04:11 | 000,053,095 | ---- | C] () -- C:\Users\meric\Desktop\Hochschulsport - Anmeldebestätigung.pdf
[2012.10.07 04:56:54 | 000,000,707 | ---- | C] () -- C:\Users\meric\Desktop\PlanetSide 2 Beta.lnk
[2012.10.07 04:56:54 | 000,000,707 | ---- | C] () -- C:\Users\meric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PlanetSide 2 Beta.lnk
[2012.10.03 17:05:26 | 000,010,387 | ---- | C] () -- C:\Users\meric\Desktop\sdfsdf.png
[2012.10.01 21:13:24 | 000,265,598 | ---- | C] () -- C:\Users\meric\Desktop\dotnetfx_cleanup_tool.zip
[2012.09.29 16:22:19 | 001,594,114 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.09.26 18:33:09 | 000,617,992 | ---- | C] () -- C:\Users\meric\Desktop\parken.jpg
[2012.09.25 16:47:16 | 000,000,248 | ---- | C] () -- C:\Users\meric\Desktop\dbscheme.ase
[2012.09.24 23:15:51 | 000,176,169 | ---- | C] () -- C:\Users\meric\Desktop\gangnamstyle.mp3
[2012.05.29 19:59:33 | 000,003,193 | ---- | C] () -- C:\Users\meric\.TransferManager.db
[2012.05.14 04:45:43 | 000,000,703 | ---- | C] () -- C:\Windows\NewsRover.INI
[2012.03.26 01:16:02 | 000,645,632 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2012.03.26 01:16:02 | 000,240,640 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2012.03.03 16:30:28 | 000,577,536 | ---- | C] () -- C:\Windows\SysWow64\ChilkatCsv.dll
[2012.02.29 18:14:42 | 000,000,060 | ---- | C] () -- C:\Windows\picture2avi.ini
[2011.10.15 15:41:55 | 000,002,560 | ---- | C] () -- C:\Windows\SysWow64\CTXFIGER.DLL
[2011.10.15 14:24:42 | 000,164,864 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2011.10.15 14:24:42 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2011.09.28 18:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011.09.22 12:29:58 | 000,321,856 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2011.09.19 09:07:46 | 000,015,360 | ---- | C] () -- C:\Windows\SysWow64\bdmjpeg.dll
[2011.09.19 09:07:32 | 000,058,368 | ---- | C] () -- C:\Windows\SysWow64\bdmpegv.dll
[2011.09.16 11:54:48 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2011.09.16 11:54:44 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2011.09.16 11:54:44 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2011.09.16 11:54:44 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2011.09.16 11:54:44 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2011.09.14 11:36:30 | 000,000,184 | ---- | C] () -- C:\Users\meric\AppData\Roaming\3a99ed39.dat
[2011.05.12 01:10:29 | 000,000,600 | ---- | C] () -- C:\Users\meric\AppData\Roaming\winscp.rnd
[2011.04.22 01:53:09 | 000,010,240 | ---- | C] () -- C:\Users\meric\qlgt.db
[2011.04.17 18:34:36 | 000,000,132 | ---- | C] () -- C:\Users\meric\AppData\Roaming\Adobe GIF Format CS5 Prefs
[2011.04.16 16:16:51 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll
[2011.04.03 20:23:51 | 000,015,873 | ---- | C] () -- C:\Windows\SysWow64\Inetde.dll
[2011.03.10 22:53:14 | 000,000,600 | ---- | C] () -- C:\Users\meric\AppData\Local\PUTTY.RND
[2011.03.05 00:41:26 | 000,007,631 | ---- | C] () -- C:\Users\meric\AppData\Local\Resmon.ResmonCfg
[2011.02.25 07:51:49 | 000,000,132 | ---- | C] () -- C:\Users\meric\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2011.02.19 19:30:01 | 000,281,120 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011.02.19 19:30:00 | 000,837,192 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe
[2011.02.19 19:30:00 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 05:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2011.11.22 23:53:29 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft
[2011.11.22 23:47:21 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft - 1.0 aktuell
[2011.03.04 13:23:26 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft - john smith texture pack v7
[2011.03.04 13:22:58 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft - misa's texture pack
[2012.09.24 23:28:07 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Audacity
[2011.05.04 21:05:29 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Avnex
[2012.04.28 05:12:56 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\BANDISOFT
[2011.10.20 05:29:38 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Beat Hazard
[2011.04.13 03:07:11 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Bridge!
[2011.03.02 21:12:17 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Canon
[2011.04.15 21:18:40 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2012.03.03 21:42:36 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\EurekaLog
[2012.10.11 10:12:51 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\FileZilla
[2011.08.21 15:46:14 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\flightgear.org
[2011.02.26 21:08:06 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GARMIN
[2012.03.03 16:51:09 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GeoSetter
[2011.02.21 19:32:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GetRight
[2011.08.15 02:12:07 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GlarySoft
[2012.05.17 19:30:34 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GrabIt
[2012.07.17 17:53:03 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\gslist
[2011.12.27 20:46:27 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Highresolution Enterprises
[2012.05.29 13:49:48 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\ijjigame
[2011.02.23 18:24:43 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\ImgBurn
[2011.04.14 01:02:14 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\JAM Software
[2011.09.22 13:04:12 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\JOSM
[2011.02.19 05:17:20 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Leadertech
[2012.07.13 21:51:22 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\LolClient
[2012.06.04 00:45:51 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\LolClient2
[2012.10.03 16:44:17 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\MAGIX
[2011.04.15 02:06:11 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\mirkes.de
[2011.02.20 07:14:12 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Mp3tag
[2011.03.12 16:55:07 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\net.tw.Boks.7C34F9BA9FAD6689FAABBE85F1F5B46BA5A32DE5.1
[2011.02.20 02:07:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Notepad++
[2011.06.05 16:36:43 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\OpenOffice.org
[2011.02.26 20:56:52 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Opera
[2011.04.15 20:58:26 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\PACE Anti-Piracy
[2011.03.18 19:27:45 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\PC Suite
[2011.02.24 18:28:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\POV-Ray
[2011.11.20 03:52:57 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\pymclevel
[2011.10.20 21:30:41 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Samsung
[2012.07.17 03:41:36 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\six-updater
[2012.07.17 02:38:53 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\six-zsync
[2012.07.16 00:15:08 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\SplitMediaLabs
[2012.06.02 14:43:42 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Spotify
[2011.02.23 16:52:00 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2011.08.21 15:45:04 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Subversion
[2011.08.03 23:55:14 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\System
[2012.06.03 21:03:45 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\TeamViewer
[2012.07.10 13:32:48 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Temp
[2012.05.17 19:14:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Thunderbird
[2011.08.11 02:27:43 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Tropico 4 Demo
[2012.06.29 19:17:56 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\ts3overlay
[2011.10.07 23:33:58 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Unity
[2012.04.30 15:42:37 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Wireshark
[2011.10.19 18:15:14 | 000,000,000 | -HSD | M] -- C:\Users\meric\AppData\Roaming\wyUpdate AU
[2012.01.19 23:25:41 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\XMedia Recode
 
========== Purity Check ==========
 
 
< End of report >
         
weiter im nächsten Posting =>

Alt 12.10.2012, 00:51   #7
meric
 
Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk) - Standard

Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk)



Extras-Logfile:
Code:
ATTFilter
OTL Extras logfile created on: 11.10.2012 17:01:58 - Run 3
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\meric\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 1,64 Gb Available Physical Memory | 40,95% Memory free
6,00 Gb Paging File | 3,86 Gb Available in Paging File | 64,33% Paging File free
Paging file location(s): d:\pagefile.sys 2048 2048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 40,43 Gb Total Space | 2,29 Gb Free Space | 5,66% Space Free | Partition Type: NTFS
Drive D: | 425,33 Gb Total Space | 30,44 Gb Free Space | 7,16% Space Free | Partition Type: NTFS
Drive E: | 149,04 Gb Total Space | 4,55 Gb Free Space | 3,05% Space Free | Partition Type: NTFS
Drive F: | 3,85 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: CHOSENONE | User Name: meric | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- D:\Programme\Mozilla Firefox 4\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "D:\Programme\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "D:\Programme\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "D:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- D:\Programme\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [Browse with FastStone] -- "D:\Programme\FastStone Image Viewer\FSViewer.exe" "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "D:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "D:\Programme\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "D:\Programme\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "D:\Programme\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "D:\Programme\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "D:\Programme\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "D:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- D:\Programme\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [Browse with FastStone] -- "D:\Programme\FastStone Image Viewer\FSViewer.exe" "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "D:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "D:\Programme\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "D:\Programme\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "D:\Programme\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00508039-7CF1-4A2C-9DDB-BA202FB11D07}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{0AD1D6F1-8B78-4BE7-90E5-AA00AD50BB9B}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{0E3E5C01-558C-4E58-AE8D-10A8FB13B6FC}" = lport=56406 | protocol=6 | dir=in | name=pando media booster | 
"{19251F23-146A-4C42-BB9F-54C418947D24}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{2497FCF4-0595-401D-A11C-CAF861688655}" = lport=138 | protocol=17 | dir=in | app=system | 
"{41C26ECF-D38C-4A4C-9778-DF38B1A2FF6A}" = rport=137 | protocol=17 | dir=out | app=system | 
"{50D58C32-8ED7-4F95-8A02-C2F11AB77006}" = lport=137 | protocol=17 | dir=in | app=system | 
"{58A51194-6747-4239-A2CB-6614F91FF310}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{6886AE2F-C3B0-4EAC-B9D9-78ED8CF314EE}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{6B15977B-73D3-4063-A46C-1AF3C47B5653}" = lport=6004 | protocol=17 | dir=in | app=d:\programme\microsoft office\office12\outlook.exe | 
"{74FF7201-FA07-4C18-A5C4-87CC4C1EE689}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{77431649-43C3-4F98-9AC6-D695D8226A80}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{78F06AC8-06FC-4048-868F-24037BE6BD73}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{7BB96959-6746-4BF3-96A3-D18A64D81F0B}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{857A2DB8-3106-42FF-B15B-77A0C3EB0A2D}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{8F431EC4-7011-4C0C-B714-BDF81538A796}" = rport=25565 | protocol=6 | dir=out | name=tcp 25565 | 
"{A06D7DD6-593B-4E77-BDB1-B4672B0768C3}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{A5E152E1-AA2D-402D-B60F-9FE11CEC0C11}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{A9DFEA34-35CB-4093-A081-15FFB425892C}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{AAA8F1D8-7F06-410A-8898-3446EB827C68}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=%systemroot%\microsoft.net\framework64\v3.0\windows communication foundation\smsvchost.exe | 
"{AF560F43-DA77-4C76-8F2F-5DC06794EF6B}" = lport=56406 | protocol=6 | dir=in | name=pando media booster | 
"{BEE8FAD8-E981-4A5F-ACCB-FC25CA2BB322}" = lport=445 | protocol=6 | dir=in | app=system | 
"{D4A4AD24-E93A-4A7F-8BF4-A000252D4252}" = lport=56406 | protocol=17 | dir=in | name=pando media booster | 
"{D833835F-EF23-4C01-973B-D8B1F0CC9C8D}" = lport=139 | protocol=6 | dir=in | app=system | 
"{E5D6481D-9499-44FB-9CA7-05EF8D6BFCFC}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{E72DC097-A4B2-4A5D-8A53-FB7B15BE83F0}" = rport=139 | protocol=6 | dir=out | app=system | 
"{ECCBCF7F-0229-4C71-843D-C1EC918EA5E3}" = rport=138 | protocol=17 | dir=out | app=system | 
"{EE3D1011-B499-4C13-9AA1-0C92A5E588B9}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{F5B4A3DB-C610-4892-8D0F-CC0531C4DC9B}" = rport=445 | protocol=6 | dir=out | app=system | 
"{F7712D9A-C937-4CB9-85CA-6807BDA44E27}" = lport=25565 | protocol=6 | dir=in | name=tcp 25565 | 
"{F8C72413-CFDF-47A0-830E-D61FC759BA73}" = lport=56406 | protocol=17 | dir=in | name=pando media booster | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0541A680-5679-46CD-9F05-6EA5C9FA9211}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{128ED864-5D52-4993-98FF-E984F9D0EB31}" = protocol=6 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\arma 2 operation arrowhead\besetup\setup_battleyearma2oa.exe | 
"{1B194C32-114B-4802-8788-32055BB3F9D3}" = protocol=17 | dir=in | app=d:\programme\utorrent\utorrent.exe | 
"{1C7E83FF-1339-4FA9-A982-0A222EA37C40}" = protocol=6 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\arma 2 operation arrowhead\arma2oa.exe | 
"{1E7C91EC-F2AC-4223-A755-F5964A2BF6CE}" = protocol=6 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\counter-strike global offensive\csgo.exe | 
"{232639FF-C8A5-49FB-A940-95D59001CD60}" = dir=in | app=d:\programme\itunes\itunes.exe | 
"{292F9C47-D5FC-4755-8FD7-39E508D03779}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{2E2FABB2-E15E-4B55-9EED-5FD49CBEBAFC}" = protocol=6 | dir=in | app=c:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001c_366d3edf94a00510\launcher.exe | 
"{32D13DF9-16A0-4292-974D-CFF0B645CA1E}" = protocol=6 | dir=in | app=%appdata%\.minecraft\minecraft.exe | 
"{38096B87-6A24-4179-B6D2-3397947EFC13}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{3972BAE7-4924-4B2E-AC3F-F94C2E3A0E47}" = dir=out | app=d:\programme\bandicam\bdcam.exe | 
"{3C18229F-BE22-4322-A59F-0DACFE1A71A7}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{3C9FE258-4B52-4DE5-B9AC-F908F7C5F393}" = protocol=6 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\arma 2 operation arrowhead\_runa2co.cmd | 
"{3CA6BBF9-8ACC-482E-831A-0DFA9DB3E80B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{3F85FBED-9575-4DA9-8F9D-7800EDE7259A}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{409C291A-451E-4E66-9EB5-AFBDC0B6B8DD}" = protocol=17 | dir=in | app=d:\programme\utorrent\utorrent.exe | 
"{42E35E42-03F2-4617-8CD0-0B474FC58F05}" = protocol=17 | dir=in | app=d:\programme\opera\opera.exe | 
"{45795116-8D63-43E1-BEB7-33261B6AE7BA}" = protocol=17 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\arma 2 operation arrowhead\arma2oa.exe | 
"{45E2B776-DFE4-44EA-8DBF-638AA0403219}" = protocol=6 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.0\sonarhost.exe | 
"{4600DB1D-4F72-4090-92C9-ABC11508C64E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{48AB5A0D-9B8C-49B0-AFDE-34306B020C06}" = protocol=6 | dir=in | app=d:\programme\mirc\mirc.exe | 
"{4B1F2338-EA1A-4A3D-9EA0-A7F3D2976CBE}" = protocol=6 | dir=in | app=d:\programme\six updater\tools\bin\rsync.exe | 
"{4D4A6D8C-4906-4CB7-A9E5-F55192EF1301}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{4E2CF5B4-AF4D-400C-921D-5EF72BE3288B}" = protocol=6 | dir=in | app=d:\spiele\ghost recon online\pdc-live\ghostrecononline.exe | 
"{4F2C1B34-CB8F-4E14-8F47-F2A5190EE24E}" = dir=in | app=d:\programme\skype\phone\skype.exe | 
"{50C9B3BD-6D71-4DC5-A8ED-46CC57FF85CC}" = protocol=6 | dir=in | app=d:\programme\utorrent\utorrent.exe | 
"{51F73730-BAE1-4BD2-B9B8-F59D3B7E3239}" = protocol=6 | dir=in | app=c:\users\meric\appdata\roaming\spotify\spotify.exe | 
"{523F97E7-CFF7-4639-A187-A475F58E9839}" = protocol=17 | dir=in | app=c:\users\meric\appdata\roaming\spotify\spotify.exe | 
"{54C08B16-255F-4494-AD20-2181E309FEA5}" = protocol=17 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe | 
"{59AB37DC-D664-48D1-BD84-492322DFC932}" = protocol=6 | dir=in | app=d:\programme\utorrent\utorrent.exe | 
"{60151BC5-6C29-4B16-807B-FDE600F9652C}" = protocol=6 | dir=in | app=d:\spiele\hawken\installedhawkenfiles\binaries\win32\hawkengame-win32-shipping.exe | 
"{6043A5D8-D09E-4D70-B126-394026DD94D9}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{60BBE5AC-84C7-45D4-B7D9-8CA73AE4BF6D}" = protocol=17 | dir=in | app=d:\programme\six updater\tools\bin\rsync.exe | 
"{63EEFB3D-47AD-44B8-846E-247C49834C1A}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{663BD697-6B65-4A4E-A4CF-3AD3BD05C3F4}" = protocol=6 | dir=out | app=system | 
"{67228BA5-5C05-46B5-B203-608AA6689771}" = protocol=17 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\counter-strike global offensive\csgo.exe | 
"{689556B1-0C8D-40D3-82DC-C663F5CFE5EF}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{6A9F9CA3-E1FD-42F3-8C59-B9D4FDF0EB90}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{6BAF1994-7340-42AE-BCB6-E6711EB7119E}" = protocol=6 | dir=in | app=d:\programme\adobe\adobe dreamweaver cs5\dreamweaver.exe | 
"{6D4065DD-76BC-49AC-B248-95E2277599D7}" = protocol=6 | dir=in | app=d:\spiele\half-life 2\steam\steam.exe | 
"{6EDABEEC-B0C3-46B0-928D-6ADFEE1034B7}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | 
"{6F34A2F6-228B-43C8-9380-7F7A6F4380CE}" = protocol=17 | dir=in | app=d:\programme\videolan\vlc\vlc.exe | 
"{70DF4D72-5879-4E19-BD2B-B4330FCC4971}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | 
"{721E2DD3-3951-47BE-B89B-4D9DD49D9B77}" = protocol=6 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe | 
"{74B6C7ED-AEEC-402C-A6D6-1624F1521DFC}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{759636B5-F6B9-4AC3-9EFD-76BEFB0E08C2}" = protocol=6 | dir=in | app=d:\programme\mirc nn\mirc.exe | 
"{80DA9889-85BE-4011-9306-50E796B75DAF}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{810B4719-9B73-4808-A668-875786030376}" = protocol=17 | dir=in | app=d:\programme\mirc\mirc.exe | 
"{84C5E22B-0BCF-49EB-AF47-F54A53DC60CE}" = protocol=17 | dir=in | app=d:\spiele\ghost recon online\pdc-live\ghostrecononline.exe | 
"{85573977-50B5-45E6-B256-724E3EE2763C}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{868939A6-920F-4F50-BC63-7C54FCA98051}" = protocol=17 | dir=in | app=d:\spiele\planetside 2\planetside2.exe | 
"{873A0F0D-E456-4FFF-A4C7-8513376B6F22}" = protocol=17 | dir=in | app=c:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001b_817f604b896cb110\launcher.exe | 
"{87BAEDE9-AE7B-43F3-8658-B7800C5EACB7}" = protocol=6 | dir=in | app=c:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001b_817f604b896cb110\launcher.exe | 
"{88E1BCFE-9C27-4151-8481-30A791988AA4}" = protocol=6 | dir=in | app=d:\programme\sabnzbd\sabnzbd.exe | 
"{90D1D022-5467-4478-AA78-5EF0B9672A5B}" = protocol=17 | dir=in | app=d:\spiele\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe | 
"{92325F97-578F-4276-A205-CF98AFF17283}" = protocol=17 | dir=in | app=d:\programme\opera\opera.exe | 
"{966637B1-0925-4932-A5FF-4749B3DD82C9}" = protocol=17 | dir=in | app=d:\spiele\hawken\installedhawkenfiles\binaries\win32\hawkengame-win32-shipping.exe | 
"{968E650E-E618-4143-A122-62CE5A24E800}" = protocol=17 | dir=in | app=d:\programme\sabnzbd\sabnzbd.exe | 
"{97A1D593-C13D-4C9E-B2D7-3ED85EB0228B}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{9AAF83B3-8C5A-48B3-92BB-034D3C219BCE}" = protocol=17 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\arma 2 operation arrowhead\_runa2co.cmd | 
"{9E41013B-8475-4B4F-8671-1AA42E30F40C}" = protocol=6 | dir=in | app=d:\spiele\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe | 
"{A2933AA3-FDD8-4B43-B6BC-FC22EDCB22E0}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{A3F03CE0-BDB8-405C-A52C-2A30108FE2B3}" = protocol=58 | dir=out | name=@iphlpsvc.dll,-503 | 
"{A6B38796-C8FA-4626-BD35-4ABBD9400A42}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{AB43B80F-3416-49FB-8350-6BD74E824EAC}" = protocol=6 | dir=in | app=d:\spiele\half-life 2\steam\steam.exe | 
"{B655970A-F4C8-47F0-8756-72E951D1D9C6}" = protocol=6 | dir=in | app=c:\users\meric\appdata\local\google\google talk plugin\googletalkplugin.exe | 
"{BA2E2033-4E6E-42A4-A439-577820857BB8}" = protocol=17 | dir=in | app=d:\spiele\half-life 2\steam\steam.exe | 
"{BE852182-C99E-440B-A72D-CF65A1689D5D}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{BF6923CA-DCA3-40A5-B25E-256E9A35530A}" = protocol=6 | dir=in | app=d:\programme\opera\opera.exe | 
"{C07BC1CB-8676-44E2-BBB2-5EC5AE384D73}" = protocol=6 | dir=in | app=d:\programme\videolan\vlc\vlc.exe | 
"{C2163DA1-099D-4523-9141-448007248F05}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | 
"{C7D0B286-8586-431B-B699-8FFA8A9E4AD9}" = protocol=17 | dir=in | app=c:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001c_366d3edf94a00510\launcher.exe | 
"{C8A68D35-64B2-42D9-BFDB-2D62766469AF}" = protocol=6 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe | 
"{C9817132-B0FC-481A-9FAE-0F2D8475005E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{CD583279-8BED-4288-9755-52497C9ABB3D}" = protocol=6 | dir=in | app=c:\windows\syswow64\muzapp.exe | 
"{CD83B2F5-E38A-4280-9D1B-8AA6F08D9224}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{CFB7A880-EB69-4091-AE83-4069766BED99}" = protocol=17 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe | 
"{D074A86B-5CAB-4FB3-BBD1-30640CCAE9DE}" = protocol=6 | dir=in | app=d:\spiele\planetside 2\planetside2.exe | 
"{D21A157A-4323-4ADF-B35A-523BDE243D34}" = protocol=17 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.0\sonarhost.exe | 
"{D40B643E-17DB-4E0D-99CB-FF214CD82A30}" = protocol=6 | dir=in | app=d:\programme\opera\opera.exe | 
"{D5249B07-BF7F-4C25-987B-9577F8A65085}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{D725C448-EC9C-424D-AB9E-9763F6BDDA75}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{DD4462C1-30AA-4B9E-A156-1B64AABC1FD8}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{DD6CA922-7A81-432B-AB49-A746F3E42ADD}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{E08287D2-0208-4270-B4C7-BE0035AE5F35}" = protocol=17 | dir=in | app=c:\users\meric\appdata\local\google\google talk plugin\googletalkplugin.exe | 
"{E3195CC5-E600-46DC-8C42-93F557154CC1}" = protocol=6 | dir=out | app=%appdata%\.minecraft\minecraft.exe | 
"{E7AA2864-DB9A-484D-B1BF-9F8B7C36FDED}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{E996E945-C9A1-4EDD-8702-191D3025ACCC}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{EB43F44C-93D2-4A17-8048-2C1E58A36AAE}" = protocol=58 | dir=in | app=system | 
"{ECB965A3-C8AA-4572-B7C9-DA3961F97718}" = protocol=17 | dir=in | app=d:\spiele\half-life 2\steam\steam.exe | 
"{EF0B9A79-29A9-4E78-9E9C-970C2E459999}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{EFC8C6B2-EE97-4FBF-9F50-5E616F438881}" = protocol=6 | dir=in | app=c:\wamp\bin\apache\apache2.2.21\bin\httpd.exe | 
"{EFCF9BE1-C770-4CC1-B092-E7C10CC64B5B}" = protocol=17 | dir=in | app=c:\wamp\bin\apache\apache2.2.21\bin\httpd.exe | 
"{F14194A5-E314-4F85-B8C9-691D73A99E07}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{F41A5B11-2863-4CD7-95DA-21DE69D7702C}" = protocol=17 | dir=in | app=d:\programme\adobe\adobe dreamweaver cs5\dreamweaver.exe | 
"{FAABDCD7-9C65-4EE8-849B-46E69CD4DC8A}" = protocol=17 | dir=in | app=d:\programme\mirc nn\mirc.exe | 
"{FACCC685-62E7-46BF-ABD8-A18B2D8AEEDB}" = dir=out | app=d:\spiele\half-life 2\steam\steamapps\common\arma 2 operation arrowhead\arma2oa.exe | 
"{FB348F75-F419-4743-8F5B-A30D546832DC}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{FD5093E3-1AD9-40BA-B5BF-B8E4C29F48A3}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{FD559FD5-3238-44B0-AF56-FCC1D58A882E}" = protocol=17 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\arma 2 operation arrowhead\besetup\setup_battleyearma2oa.exe | 
"{FD779045-5162-4D23-A2C4-8F219AC0FD88}" = protocol=17 | dir=in | app=c:\windows\syswow64\muzapp.exe | 
"TCP Query User{00228D16-0FC3-4B3D-A5FD-13929B8C6324}D:\spiele\quake3arena\quake3.exe" = protocol=6 | dir=in | app=d:\spiele\quake3arena\quake3.exe | 
"TCP Query User{00686F92-1199-49DF-AE15-941DF384A383}D:\spiele\audiosurf\engine\questviewer.exe" = protocol=6 | dir=in | app=d:\spiele\audiosurf\engine\questviewer.exe | 
"TCP Query User{093C9511-899C-4C5C-A8FF-918747DC4839}C:\program files (x86)\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files (x86)\google\google earth\client\googleearth.exe | 
"TCP Query User{0DF8A9B3-A9E7-4965-8AC1-B6A974438310}D:\spiele\hawken\installedhawkenfiles\binaries\win32\hawkengame-win32-shipping.exe" = protocol=6 | dir=in | app=d:\spiele\hawken\installedhawkenfiles\binaries\win32\hawkengame-win32-shipping.exe | 
"TCP Query User{1FBF7D4A-4082-4DC0-8D17-4791D6A59DA9}D:\programme\six updater\tools\bin\rsync.exe" = protocol=6 | dir=in | app=d:\programme\six updater\tools\bin\rsync.exe | 
"TCP Query User{25540708-4B09-4A79-AF1C-8C7371471CEA}C:\users\meric\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\meric\appdata\roaming\spotify\spotify.exe | 
"TCP Query User{25EF3598-AA5B-4CC1-ACF0-6A5B8BDBB654}C:\wamp\bin\apache\apache2.2.21\bin\httpd.exe" = protocol=6 | dir=in | app=c:\wamp\bin\apache\apache2.2.21\bin\httpd.exe | 
"TCP Query User{2A3C6D7E-B4AA-4B8F-8DCC-8C74EAAAD168}D:\programme\mirc\mirc.exe" = protocol=6 | dir=in | app=d:\programme\mirc\mirc.exe | 
"TCP Query User{4955611A-E2C2-43DD-9277-92C6605C2A16}C:\program files (x86)\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files (x86)\google\google earth\plugin\geplugin.exe | 
"TCP Query User{4F656317-8C2F-4634-ACB3-00CF5150DAFA}C:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001b_817f604b896cb110\launcher.exe" = protocol=6 | dir=in | app=c:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001b_817f604b896cb110\launcher.exe | 
"TCP Query User{5B2AD425-4187-4D3A-B8C5-23E9773BBE63}D:\spiele\planetside 2\planetside2.exe" = protocol=6 | dir=in | app=d:\spiele\planetside 2\planetside2.exe | 
"TCP Query User{6598E2D4-0561-4078-9CE8-262EDEB08865}D:\spiele\battlefield 2142 server\bf2142_w32ded.exe" = protocol=6 | dir=in | app=d:\spiele\battlefield 2142 server\bf2142_w32ded.exe | 
"TCP Query User{71B20AAD-CFDD-4056-9DB3-431DC842585F}D:\programme\miranda im\miranda32.exe" = protocol=6 | dir=in | app=d:\programme\miranda im\miranda32.exe | 
"TCP Query User{89F40BAE-FFFC-4610-B119-1F84E9695BB6}D:\programme\winamp\winamp.exe" = protocol=6 | dir=in | app=d:\programme\winamp\winamp.exe | 
"TCP Query User{8D330ABB-CBB8-4576-928A-1883FEA113CA}C:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001c_366d3edf94a00510\launcher.exe" = protocol=6 | dir=in | app=c:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001c_366d3edf94a00510\launcher.exe | 
"TCP Query User{99FA4863-BA1E-4C46-9BAD-B8D84FC2CAEC}D:\spiele\ghost recon online\pdc-live\ghostrecononline.exe" = protocol=6 | dir=in | app=d:\spiele\ghost recon online\pdc-live\ghostrecononline.exe | 
"TCP Query User{AE648ADB-4A3D-433C-95A6-84D8E3A6BDEC}D:\programme\miranda im\miranda32.exe" = protocol=6 | dir=in | app=d:\programme\miranda im\miranda32.exe | 
"TCP Query User{C0FDAA2B-F7ED-4FA6-9BE5-239E0FE27DA7}D:\programme\mirc nn\mirc.exe" = protocol=6 | dir=in | app=d:\programme\mirc nn\mirc.exe | 
"TCP Query User{C70DCF43-6A94-409B-865F-636101A2D428}D:\spiele\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe" = protocol=6 | dir=in | app=d:\spiele\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe | 
"TCP Query User{C8B71324-13F8-41F8-AA89-1BEBB8D5084F}D:\programme\sabnzbd\sabnzbd.exe" = protocol=6 | dir=in | app=d:\programme\sabnzbd\sabnzbd.exe | 
"TCP Query User{D094878D-0AA1-4CF6-9BA8-9ECB5084A5D1}D:\xampp\mysql\bin\mysqld.exe" = protocol=6 | dir=in | app=d:\xampp\mysql\bin\mysqld.exe | 
"TCP Query User{D83A90D7-77CE-43FC-A4D4-C4AF8331D490}D:\xampp\apache\bin\httpd.exe" = protocol=6 | dir=in | app=d:\xampp\apache\bin\httpd.exe | 
"TCP Query User{DD2A90FC-BA86-43B5-8AE9-426847F5A0A1}D:\spiele\battlefield 2142\bf2143.exe" = protocol=6 | dir=in | app=d:\spiele\battlefield 2142\bf2143.exe | 
"TCP Query User{E6FBA2E8-F0F4-4FAC-9DAE-3B72B69E6DE2}D:\programme\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=d:\programme\videolan\vlc\vlc.exe | 
"TCP Query User{ED739BF7-0345-4747-B859-EC2BA4F686CE}D:\programme\mozilla firefox 4\plugin-container.exe" = protocol=6 | dir=in | app=d:\programme\mozilla firefox 4\plugin-container.exe | 
"TCP Query User{F7B90FAB-B8E8-46E5-92CA-D2DC939139A7}D:\programme\adobe\adobe dreamweaver cs5\dreamweaver.exe" = protocol=6 | dir=in | app=d:\programme\adobe\adobe dreamweaver cs5\dreamweaver.exe | 
"UDP Query User{0712ABA5-2844-4017-B8E5-9F27E83BFC0E}D:\programme\mozilla firefox 4\plugin-container.exe" = protocol=17 | dir=in | app=d:\programme\mozilla firefox 4\plugin-container.exe | 
"UDP Query User{073FB327-3CFC-4817-AE0F-E8DAF16BEF19}D:\programme\sabnzbd\sabnzbd.exe" = protocol=17 | dir=in | app=d:\programme\sabnzbd\sabnzbd.exe | 
"UDP Query User{20218A3D-BE0F-433B-9C20-94015502C497}D:\spiele\planetside 2\planetside2.exe" = protocol=17 | dir=in | app=d:\spiele\planetside 2\planetside2.exe | 
"UDP Query User{3105E842-AEAC-496B-A555-3B16C6B08DE4}D:\programme\miranda im\miranda32.exe" = protocol=17 | dir=in | app=d:\programme\miranda im\miranda32.exe | 
"UDP Query User{3FE8DDEB-156E-491F-8EE7-9013CED354CB}D:\xampp\mysql\bin\mysqld.exe" = protocol=17 | dir=in | app=d:\xampp\mysql\bin\mysqld.exe | 
"UDP Query User{48509221-2EA6-4C62-A7A8-B6A664230C51}D:\spiele\ghost recon online\pdc-live\ghostrecononline.exe" = protocol=17 | dir=in | app=d:\spiele\ghost recon online\pdc-live\ghostrecononline.exe | 
"UDP Query User{5284B253-72A1-4C01-8BA4-87ACC24AB35E}D:\spiele\quake3arena\quake3.exe" = protocol=17 | dir=in | app=d:\spiele\quake3arena\quake3.exe | 
"UDP Query User{6E389CBB-DE9B-4CC4-AB27-F289383B982F}D:\programme\miranda im\miranda32.exe" = protocol=17 | dir=in | app=d:\programme\miranda im\miranda32.exe | 
"UDP Query User{78EED378-0881-4E04-8BE3-83DC037FAF27}D:\spiele\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe" = protocol=17 | dir=in | app=d:\spiele\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe | 
"UDP Query User{87E6F8C8-EF2C-422D-8EFF-D36B206074D5}C:\wamp\bin\apache\apache2.2.21\bin\httpd.exe" = protocol=17 | dir=in | app=c:\wamp\bin\apache\apache2.2.21\bin\httpd.exe | 
"UDP Query User{903370A3-1F24-4559-99B0-C33B4577DF57}D:\spiele\battlefield 2142 server\bf2142_w32ded.exe" = protocol=17 | dir=in | app=d:\spiele\battlefield 2142 server\bf2142_w32ded.exe | 
"UDP Query User{93E04D91-B7CC-45F7-86A2-16B8E4B7FC29}D:\spiele\audiosurf\engine\questviewer.exe" = protocol=17 | dir=in | app=d:\spiele\audiosurf\engine\questviewer.exe | 
"UDP Query User{97F03256-44CC-47C8-8F40-48119749BA67}C:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001b_817f604b896cb110\launcher.exe" = protocol=17 | dir=in | app=c:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001b_817f604b896cb110\launcher.exe | 
"UDP Query User{9886DE5C-F99C-4228-83D0-0DDF9331F4A6}C:\program files (x86)\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files (x86)\google\google earth\plugin\geplugin.exe | 
"UDP Query User{B5685612-6619-464A-8C3F-A410ED878C9D}D:\spiele\battlefield 2142\bf2143.exe" = protocol=17 | dir=in | app=d:\spiele\battlefield 2142\bf2143.exe | 
"UDP Query User{C32B6DAE-356E-4556-A75C-04B89AAF6123}D:\programme\winamp\winamp.exe" = protocol=17 | dir=in | app=d:\programme\winamp\winamp.exe | 
"UDP Query User{CF8B775D-4171-49A0-A3CD-9E361AD1C5BA}C:\users\meric\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\meric\appdata\roaming\spotify\spotify.exe | 
"UDP Query User{CFF0D63B-9B01-4FC4-B1F8-FC5B08111ECF}C:\program files (x86)\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files (x86)\google\google earth\client\googleearth.exe | 
"UDP Query User{D30CB98B-7313-4281-A3CA-F895EA70FEDE}D:\programme\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=d:\programme\videolan\vlc\vlc.exe | 
"UDP Query User{D6B4EAC1-74C7-4C49-A902-AF07210DBECB}D:\programme\mirc nn\mirc.exe" = protocol=17 | dir=in | app=d:\programme\mirc nn\mirc.exe | 
"UDP Query User{D7D32004-D441-4877-9A42-AEDFFA95B4F7}D:\programme\adobe\adobe dreamweaver cs5\dreamweaver.exe" = protocol=17 | dir=in | app=d:\programme\adobe\adobe dreamweaver cs5\dreamweaver.exe | 
"UDP Query User{DD17E047-308C-4CF4-AEB7-917D3D4B6B69}D:\programme\mirc\mirc.exe" = protocol=17 | dir=in | app=d:\programme\mirc\mirc.exe | 
"UDP Query User{E53D7B6A-FFED-445F-800D-07E60C3683B9}D:\programme\six updater\tools\bin\rsync.exe" = protocol=17 | dir=in | app=d:\programme\six updater\tools\bin\rsync.exe | 
"UDP Query User{EBB0E080-84A0-40E1-AD59-4841030ABEEE}D:\xampp\apache\bin\httpd.exe" = protocol=17 | dir=in | app=d:\xampp\apache\bin\httpd.exe | 
"UDP Query User{F476BB7A-69FB-4746-8C12-3256CE4EAC8C}D:\spiele\hawken\installedhawkenfiles\binaries\win32\hawkengame-win32-shipping.exe" = protocol=17 | dir=in | app=d:\spiele\hawken\installedhawkenfiles\binaries\win32\hawkengame-win32-shipping.exe | 
"UDP Query User{FA90199D-D869-4F86-957E-1F289B22F728}C:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001c_366d3edf94a00510\launcher.exe" = protocol=17 | dir=in | app=c:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001c_366d3edf94a00510\launcher.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{06B60360-9DBD-4593-90A0-FD237F0845A2}" = Topaz DeNoise 5 (64-bit)
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP620_series" = Canon MP620 series MP Drivers
"{1374CC63-B520-4f3f-98E8-E9020BF01CFF}" = Windows XP Mode
"{1CDE9DB9-7D47-46F8-83DC-9DD9899BBBFC}" = Topaz ReMask 3 (64-bit)
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)
"{26A24AE4-039D-4CA4-87B4-2F86417007FF}" = Java 7 Update 7 (64-bit)
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{4D668D4F-FAA2-4726-834C-31F4614F312E}" = MSVC80_x64_v2
"{537056B7-32A4-4408-9B54-0341963C7C9C}" = UltraMon
"{574CFBE2-E50C-A112-EA65-BA5AE7C3AB2C}" = AMD Catalyst Install Manager
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1" = Revo Uninstaller Pro 2.5.7
"{68660049-8D48-427C-9FF7-139D8340CDC0}" = MSVC80_x64
"{690285C2-2481-44FB-8402-162EA970A6DD}" = Logitech Gaming Software
"{77B8B4A5-EE79-4907-A318-2DA86325B8D7}" = iTunes
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8D93BD99-EECF-4812-B3BA-B8A2E7FEEA11}" = Topaz Simplify 3 (64-bit)
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{A981E64B-0F10-45D9-BD5C-A4DF7B87E218}" = Topaz Detail 2 (64-bit)
"{AB071C8B-873C-459F-ACA9-9EBE03C3E89B}" = MSVC90_x64
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.0213
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{BA3D5FF2-A405-4654-826E-A09FABB01853}" = Topaz Fusion Express 2 (64-bit)
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D0CE053E-0E5E-4C12-9BAE-D0F36021E911}" = POV-Ray for Windows v3.62
"{DC8F0C18-E6B0-4722-A4AB-D134473091C2}" = Topaz DeJpeg 4 (64-bit)
"{E44D14E2-A6D0-4F38-BF06-2E4244E23FED}" = Topaz InFocus (64-bit)
"{E5C95CA5-4565-4B9D-97ED-05088D775614}" = Apple Mobile Device Support
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FA85C599-2569-4C48-9AA6-2B8D8F029FA7}" = Topaz Clean 3 (64-bit)
"{FB237A35-F491-4AC1-95E0-85118D6751D9}" = Topaz Adjust 4 (64-bit)
"{FF0EBE64-45AA-4B16-A0CC-945CECDCA0B6}" = Topaz Lens Effects (64-bit)
"49CF605F02C7954F4E139D18828DE298CD59217C" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (06/03/2009 2.3.0.0)
"CCleaner" = CCleaner
"FCEC33AD40CEA5E0FC4CEE6E42041A0DA189652D" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"Logitech Gaming Software" = Logitech Gaming Software 8.20
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"sp6" = Logitech SetPoint 6.32
"Virtual Audio Cable 4.10" = Virtual Audio Cable 4.10
"WinRAR archiver" = WinRAR
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{024521CF-C07E-4F8E-8481-0D75695E03AF}" = PxMergeModule
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{0659E943-DDF4-44FC-9FEE-A13B09F8BB08}" = Adobe Flash Media Live Encoder 3.2
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0EDBEB2B-7C8D-42E6-8312-0F84394A3223}" = Windows Media Center Add-in for Silverlight
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{10ABE49D-343A-463E-9753-C4C5A05ECEF9}" = Sibelius Scorch (Firefox, Opera, Netscape only)
"{15C49338-59E5-472E-94F7-D5AE15EE23C9}" = XSplit
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{19B9DAD6-5E6E-4B80-8EFE-314B5638D6D4}" = Xara 3D Maker 7
"{1BBD8D70-721A-41AD-AC8F-7308A0C8FA92}" = Adobe Creative Suite 5 Master Collection
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20288888-A7AF-4B24-8AEB-398D20CD563C}" = Sound Blaster X-Fi
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}" = OpenOffice.org 3.4.1
"{266D79A6-3857-8A1F-3200-325F318208B4}" = Boks
"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 7
"{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}" = Microsoft XNA Framework Redistributable 4.0
"{2D8CED57-CCDB-4D86-9087-3BBCAE8F8F22}" = Six Updater
"{2FA75B40-17C9-4D22-88CA-80A5D52FAB13}" = LightScribe System Software
"{34610DE0-3C13-42CA-8E32-01FFA38AB6E8}" = PC Connectivity Solution
"{37EF63D9-3E31-45A9-A90F-BDE07CE88095}" = Sibelius Scorch (all browsers)
"{38EE230F-F631-451F-8800-E29F5E5C9E7D}" = iTunes Library Updater
"{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF010}" = Tribes Ascend
"{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}" = Hi-Rez Studios Authenticate and Update Service
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{4ECA4128-8B48-44A0-90E8-B93C6A69CE4B}" = LightScribe Template Designs - Music Pack 1
"{510D2239-6C2E-457B-9590-485EC552D94D}" = Garmin USB Drivers
"{5809E7CF-4DCF-11D4-9875-00105ACE7734}" = Logitech MouseWare 9.79.1 
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5A67D2EA-FB70-4033-A6F3-606AD85B2015}_is1" = Driver Sweeper Version 3.2.0
"{5BDA2F58-1F21-4D10-9910-92B01EBCC958}" = AMD USB Filter Driver
"{5BDEA9E0-E55B-45A7-93F7-6B8F68F851E5}" = Topaz InFocus
"{5E1375CB-6792-4464-8715-CC3EC83D48FA}" = VirtualDJ Home FREE
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{61F25370-7465-4404-BE28-4629BF808699}" = LightScribe Applications
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6A3F9D74-BB80-4451-8CA1-4B3A857F1359}" = Apple Application Support
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6E07CF4B-A9EB-45BF-BE74-613B3D708E13}" = Topaz Lens Effects
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{73E80655-FB3C-46F4-BE00-62D248BC490A}" = Visual C++ 2008 Runtime (x64)
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{770D3BDC-19D7-49D0-B60B-C5BB77553FBB}" = Topaz Fusion Express 2
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7E84FAC8-C518-40F9-9807-7455301D6D25}" = SamsungConnectivityCableDriver
"{8117EA22-035F-4880-86AE-AC7C4F1FA3E2}" = Topaz ReMask 3
"{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}" = Microsoft Games for Windows - LIVE Redistributable
"{83721450-E604-4C37-ABEB-CE7F18C587C8}" = LightScribe Template Labeler
"{85E00941-FDFF-4796-A3B8-3ACC766FFCA5}" = Topaz Clean 3
"{86CE1746-9EFF-3C9C-8755-81EA8903AC34}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{8A1EBF29-7CF8-471E-B90B-95FF36AC8248}" = Topaz Simplify 3
"{8BCD7AE7-F713-4D50-BAB9-7839B9386870}" = ImageShack Uploader 2.2.0
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0407-1000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{959FA9FB-ACFF-4C38-967E-5CB5DB3130AC}" = DayZ Commander
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D318C86-AF4C-409F-A6AC-7183FF4CF424}" = Internet-TV für Windows Media Center
"{9E146BA1-26DD-4C3B-9F0F-90F2E3CEC9D2}" = Topaz DeJpeg 4
"{9E82D1DB-3AFB-4D18-A221-081F1B4B4789}" = Topaz DeNoise 5
"{9FDC7042-CB9F-4336-A14C-DF10F53762E2}" = Topaz Adjust 4
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB6F6C80-1C35-4672-BDEF-F26FF214C409}" = Samsung PC Studio 7
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{AFBAB9A0-DDE8-49AE-8C17-A01B61BEE64B}" = Garmin MapSource
"{B1EE1CC5-6CED-4801-BFFF-8454F21A245A}" = Garmin Communicator Plugin
"{B8ABD8C7-991E-4A70-B5A3-20C6FC680680}" = LogMeIn Hamachi
"{C5AC39F1-001D-4338-84C6-35109525588A}" = TweetDeck
"{C921D7C4-24D7-4210-AEE9-DFC5DDC78428}" = Topaz Detail 2
"{C9E14402-3631-4182-B377-6B0DFB1C0339}" = QuickTime
"{CC23FF9A-989C-4DEB-8970-50E6E4862315}" = EOSInfo
"{CCF13D13-A87B-34E8-B689-1896D0C2DBA2}" = Google Talk Plugin
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D801B39E-CE01-409F-8E7C-B7976EA3C9DC}_is1" = Audiosurf
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DA909E62-3B45-4BA1-8B58-FCAEBA4BCEC9}" = NVIDIA PhysX
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR
"ABC Amber Nokia Converter" = ABC Amber Nokia Converter
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"ArmA 2" = ArmA 2 Uninstall
"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.14 (Unicode)
"Audacity_is1" = Audacity 2.0
"AudioCS" = Creative Audio-Systemsteuerung
"AutoHotkey" = AutoHotkey 1.0.48.05
"avast" = avast! Free Antivirus
"AVI Joiner_is1" = AVI Joiner
"bada SDK 2.0.5" = bada SDK 2.0.5
"Bandicam" = Bandicam
"BandiMPEG1" = Bandisoft MPEG-1 Decoder
"Battlelog Web Plugins" = Battlelog Web Plugins
"BattlEye for OA" = BattlEye for OA Uninstall
"Biet-O-Matic v2.14.8" = Biet-O-Matic v2.14.8
"Canon_IJ_Network_Scan_UTILITY" = Canon IJ Network Scan Utility
"Canon_IJ_Network_UTILITY" = Canon IJ Network Tool
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"Creative Software AutoUpdate" = Creative Software AutoUpdate
"Creative Sound Blaster Properties x64 Edition" = Creative Sound Blaster Properties x64 Edition
"DivX Setup" = DivX-Setup
"DTS Connect Pack" = DTS Connect Pack
"DynUpdater" = Dyn Updater
"ENTERPRISE" = Microsoft Office Enterprise 2007
"ESET Online Scanner" = ESET Online Scanner v3
"ESN Sonar-0.70.0" = ESN Sonar
"FastStone Image Viewer" = FastStone Image Viewer 4.3
"Fraps" = Fraps (remove only)
"FWTools247" = FWTools 2.4.7
"GeoSetter_is1" = GeoSetter 3.4.16
"Glary Utilities_is1" = Glary Utilities 2.38.0.1288
"GPS-Track-Analyse.NET 6.0_is1" = GPS-Track-Analyse.NET 6.0
"GrabIt_is1" = GrabIt 1.7.2 Beta 6 (build 1008)
"GSAK_is1" = GSAK 8.1.0.10 (Final)
"ImgBurn" = ImgBurn
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"JDownloader" = JDownloader
"LAME for Audacity_is1" = LAME v3.98.3 for Audacity
"LogMeIn Hamachi" = LogMeIn Hamachi
"MAGIX_MSI_Xara3D7" = Xara 3D Maker 7
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.0.1400
"Miranda IM" = Miranda IM 0.10.4
"mIRC" = mIRC
"Mozilla Firefox 6.0 (x86 de)" = Mozilla Firefox 6.0 (x86 de)
"MP Navigator EX 2.0" = Canon MP Navigator EX 2.0
"Mp3tag" = Mp3tag v2.48
"NAVIGON Fresh" = NAVIGON Fresh 3.4.1
"net.tw.Boks.7C34F9BA9FAD6689FAABBE85F1F5B46BA5A32DE5.1" = Boks
"Notepad++" = Notepad++
"OpenAL" = OpenAL
"Opera 12.02.1578" = Opera 12.02
"OSM" = JOSM 4399
"Picasa 3" = Picasa 3
"PunkBusterSvc" = PunkBuster Services
"RADVideo" = RAD Video Tools
"SABnzbd" = SABnzbd 0.7.3
"Samsung PC Studio 7" = Samsung PC Studio 7
"Spoiler Sync_is1" = Spoiler Sync
"Steam App 33930" = ARMA 2: Operation Arrowhead
"Steam App 730" = Counter-Strike: Global Offensive
"Time Stopper4.0" = Time Stopper
"Topaz Adjust 4" = Topaz Adjust 4
"Topaz Adjust 4 (64-bit)" = Topaz Adjust 4 (64-bit)
"Topaz Clean 3" = Topaz Clean 3
"Topaz Clean 3 (64-bit)" = Topaz Clean 3 (64-bit)
"Topaz DeJpeg 4" = Topaz DeJpeg 4
"Topaz DeJpeg 4 (64-bit)" = Topaz DeJpeg 4 (64-bit)
"Topaz DeNoise 5" = Topaz DeNoise 5
"Topaz DeNoise 5 (64-bit)" = Topaz DeNoise 5 (64-bit)
"Topaz Detail 2" = Topaz Detail 2
"Topaz Detail 2 (64-bit)" = Topaz Detail 2 (64-bit)
"Topaz Fusion Express 2" = Topaz Fusion Express 2
"Topaz Fusion Express 2 (64-bit)" = Topaz Fusion Express 2 (64-bit)
"Topaz InFocus" = Topaz InFocus
"Topaz InFocus (64-bit)" = Topaz InFocus (64-bit)
"Topaz Lens Effects" = Topaz Lens Effects
"Topaz Lens Effects (64-bit)" = Topaz Lens Effects (64-bit)
"Topaz ReMask 3" = Topaz ReMask 3
"Topaz ReMask 3 (64-bit)" = Topaz ReMask 3 (64-bit)
"Topaz Simplify 3" = Topaz Simplify 3
"Topaz Simplify 3 (64-bit)" = Topaz Simplify 3 (64-bit)
"Totalcmd" = Total Commander (Remove or Repair)
"uTorrent" = µTorrent
"VirtualCloneDrive" = VirtualCloneDrive
"VLC media player" = VLC media player 2.0.0
"WampServer 2_is1" = WampServer 2.2
"Winamp" = Winamp
"winscp3_is1" = WinSCP 4.3.7
"WinUAE" = WinUAE 2.3.3
"Wireshark" = Wireshark 1.6.7 (64-bit)
"xampp" = XAMPP 1.7.4
"XMedia Recode" = XMedia Recode 3.0.7.0
"xp-AntiSpy" = xp-AntiSpy 3.97-11
"Xvid Video Codec 1.3.2" = Xvid Video Codec
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{87686C21-8A15-4b4d-A3F1-11141D9BE094}" = Battlefield Play4Free
"d734575cd6cff35b" = Stegano.Net
"FileZilla Client" = FileZilla Client 3.4.0
"Google Chrome" = Google Chrome
"Hawken" = Hawken
"Kies Air Discovery Service" = Kies Air Discovery Service
"Mozilla Firefox 15.0.1 (x86 de)" = Mozilla Firefox 15.0.1 (x86 de)
"QLandkarte GT" = QLandkarte GT (remove only)
"SOE-PlanetSide 2 Beta" = PlanetSide 2 Beta
"Spotify" = Spotify
"stolencamerafinder" = stolencamerafinder
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"UnityWebPlayer" = Unity Web Player
"uTorrent" = µTorrent
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 01.10.2012 15:40:53 | Computer Name = ChosenOne | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "D:\Programme\XSplit\XSplitBroadcasterSrc.exe".
Die
 abhängige Assemblierung "Native.XSplitBroadcaster.exe,type="win32",version="1.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 01.10.2012 15:43:48 | Computer Name = ChosenOne | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "D:\Programme\Samsung\Samsung
 PC Studio 7\TIS_VistaPIM.dll".  Die abhängige Assemblierung "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 01.10.2012 18:48:19 | Computer Name = ChosenOne | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "D:\Programme\XSplit\XSplitBroadcasterSrc.exe".
Die
 abhängige Assemblierung "Native.XSplitBroadcaster.exe,type="win32",version="1.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 02.10.2012 19:58:47 | Computer Name = ChosenOne | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "D:\Programme\XSplit\XSplitBroadcasterSrc.exe".
Die
 abhängige Assemblierung "Native.XSplitBroadcaster.exe,type="win32",version="1.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 04.10.2012 19:25:00 | Computer Name = ChosenOne | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "D:\Programme\XSplit\XSplitBroadcasterSrc.exe".
Die
 abhängige Assemblierung "Native.XSplitBroadcaster.exe,type="win32",version="1.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 06.10.2012 19:25:20 | Computer Name = ChosenOne | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "D:\Programme\XSplit\XSplitBroadcasterSrc.exe".
Die
 abhängige Assemblierung "Native.XSplitBroadcaster.exe,type="win32",version="1.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 07.10.2012 17:12:24 | Computer Name = ChosenOne | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: PlanetSide2.exe, Version: 0.0.0.0,
 Zeitstempel: 0x5070c049  Name des fehlerhaften Moduls: PlanetSide2.exe, Version: 
0.0.0.0, Zeitstempel: 0x5070c049  Ausnahmecode: 0xc0000005  Fehleroffset: 0x012e61eb
ID
 des fehlerhaften Prozesses: 0x1824  Startzeit der fehlerhaften Anwendung: 0x01cda4ce24367f69
Pfad
 der fehlerhaften Anwendung: D:\Spiele\PlanetSide 2\PlanetSide2.exe  Pfad des fehlerhaften
 Moduls: D:\Spiele\PlanetSide 2\PlanetSide2.exe  Berichtskennung: aff5d9ed-10c3-11e2-bae0-00241ddbd724
 
Error - 08.10.2012 13:52:07 | Computer Name = ChosenOne | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "D:\Programme\XSplit\XSplitBroadcasterSrc.exe".
Die
 abhängige Assemblierung "Native.XSplitBroadcaster.exe,type="win32",version="1.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 09.10.2012 18:32:00 | Computer Name = ChosenOne | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "D:\Programme\XSplit\XSplitBroadcasterSrc.exe".
Die
 abhängige Assemblierung "Native.XSplitBroadcaster.exe,type="win32",version="1.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 10.10.2012 18:31:52 | Computer Name = ChosenOne | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "D:\Programme\XSplit\XSplitBroadcasterSrc.exe".
Die
 abhängige Assemblierung "Native.XSplitBroadcaster.exe,type="win32",version="1.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
[ Media Center Events ]
Error - 29.03.2011 12:11:19 | Computer Name = ChosenOne | Source = MCUpdate | ID = 0
Description = 18:11:19 - MCEClientUX konnte nicht abgerufen werden (Fehler: Die 
Verbindung mit dem Remoteserver kann nicht hergestellt werden.)  
 
Error - 31.03.2011 17:30:53 | Computer Name = ChosenOne | Source = MCUpdate | ID = 0
Description = 23:30:53 - MCEClientUX konnte nicht abgerufen werden (Fehler: Die 
Verbindung mit dem Remoteserver kann nicht hergestellt werden.)  
 
Error - 01.05.2011 06:21:56 | Computer Name = ChosenOne | Source = MCUpdate | ID = 0
Description = 12:21:56 - MCESpotlight konnte nicht abgerufen werden (Fehler: Die
 Verbindung mit dem Remoteserver kann nicht hergestellt werden.)  
 
Error - 05.05.2011 07:15:47 | Computer Name = ChosenOne | Source = MCUpdate | ID = 0
Description = 13:15:47 - MCESpotlight konnte nicht abgerufen werden (Fehler: Die
 Verbindung mit dem Remoteserver kann nicht hergestellt werden.)  
 
Error - 10.05.2011 10:33:27 | Computer Name = ChosenOne | Source = MCUpdate | ID = 0
Description = 16:33:26 - MCEClientUX konnte nicht abgerufen werden (Fehler: Die 
Verbindung mit dem Remoteserver kann nicht hergestellt werden.)  
 
Error - 17.05.2011 08:01:39 | Computer Name = ChosenOne | Source = MCUpdate | ID = 0
Description = 14:01:28 - MCEClientUX konnte nicht abgerufen werden (Fehler: Die 
Verbindung mit dem Remoteserver kann nicht hergestellt werden.)  
 
Error - 24.05.2011 16:08:28 | Computer Name = ChosenOne | Source = MCUpdate | ID = 0
Description = 22:08:19 - Broadband konnte nicht abgerufen werden (Fehler: Die Verbindung
 mit dem Remoteserver kann nicht hergestellt werden.)  
 
Error - 26.05.2011 08:49:00 | Computer Name = ChosenOne | Source = MCUpdate | ID = 0
Description = 14:48:59 - MCEClientUX konnte nicht abgerufen werden (Fehler: Die 
Verbindung mit dem Remoteserver kann nicht hergestellt werden.)  
 
Error - 18.09.2011 21:02:33 | Computer Name = ChosenOne | Source = MCUpdate | ID = 0
Description = 03:01:59 - MCEClientUX konnte nicht abgerufen werden (Fehler: Die 
Verbindung mit dem Remoteserver kann nicht hergestellt werden.)  
 
Error - 23.09.2011 05:23:06 | Computer Name = ChosenOne | Source = MCUpdate | ID = 0
Description = 11:23:06 - MCESpotlight konnte nicht abgerufen werden (Fehler: Die
 Verbindung mit dem Remoteserver kann nicht hergestellt werden.)  
 
[ OSession Events ]
Error - 09.03.2011 22:15:11 | Computer Name = ChosenOne | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
 12.0.6550.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 35530
 seconds with 60 seconds of active time.  This session ended with a crash.
 
Error - 18.03.2011 01:11:34 | Computer Name = ChosenOne | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
 12.0.6550.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 50556
 seconds with 120 seconds of active time.  This session ended with a crash.
 
Error - 28.03.2011 15:56:35 | Computer Name = ChosenOne | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
 12.0.6550.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 25290
 seconds with 360 seconds of active time.  This session ended with a crash.
 
Error - 05.05.2011 09:20:07 | Computer Name = ChosenOne | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
 12.0.6555.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 501
 seconds with 120 seconds of active time.  This session ended with a crash.
 
Error - 08.12.2011 15:48:26 | Computer Name = ChosenOne | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
 12.0.6562.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 6515
 seconds with 120 seconds of active time.  This session ended with a crash.
 
Error - 16.09.2012 16:13:29 | Computer Name = ChosenOne | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 6
 seconds with 0 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 10.10.2012 11:51:04 | Computer Name = ChosenOne | Source = Service Control Manager | ID = 7031
Description = Der Dienst "NLA (Network Location Awareness)" wurde unerwartet beendet.
 Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 100 Millisekunden
 durchgeführt: Neustart des Diensts.
 
Error - 10.10.2012 11:51:04 | Computer Name = ChosenOne | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Remotedesktopdienste" wurde unerwartet beendet. Dies ist
 bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden
 durchgeführt: Neustart des Diensts.
 
Error - 10.10.2012 11:53:04 | Computer Name = ChosenOne | Source = Service Control Manager | ID = 7032
Description = Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden
 des Dienstes "DNS-Client" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen,
 ist fehlgeschlagen. Fehler:   %%1056
 
Error - 10.10.2012 13:57:19 | Computer Name = ChosenOne | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
 nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
 
Error - 10.10.2012 15:51:14 | Computer Name = ChosenOne | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
 nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
 
Error - 11.10.2012 02:51:58 | Computer Name = ChosenOne | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde unerwartet
 beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden
 in 30000 Millisekunden durchgeführt: Neustart des Diensts.
 
Error - 11.10.2012 03:26:20 | Computer Name = ChosenOne | Source = Service Control Manager | ID = 7034
Description = Dienst "Creative Audio Service" wurde unerwartet beendet. Dies ist
 bereits 1 Mal passiert.
 
Error - 11.10.2012 04:01:14 | Computer Name = ChosenOne | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
 Windows Live ID Sign-in Assistant erreicht.
 
Error - 11.10.2012 04:01:14 | Computer Name = ChosenOne | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Windows Live ID Sign-in Assistant" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%1053
 
Error - 11.10.2012 11:03:57 | Computer Name = ChosenOne | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
 nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
 
 
< End of report >
         
Was für ein Wust an Informationen

Falls ich es noch nicht gesagt habe: Ein wirklich dickes, dickes Dankeschön für deine Hilfe!!!

Alt 12.10.2012, 07:29   #8
kira
/// Helfer-Team
 
Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk) - Standard

Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk)



** Lass dein System in der nächste Zeit noch unter Beobachtung!
wenn alles gut verlaufen ist und dein System läuft stabil,mache folgendes:

1.
Programme deinstallieren/entfernen, die wir verwendet haben und nicht brauchst, bis auf:
Code:
ATTFilter
CCleaner
         
- Zeitweise laufen lassen:-> Anleitung

2.
Tool-Bereinigung mit OTL

Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.
  • Bitte lade Dir (falls noch nicht vorhanden) OTL von OldTimer herunter.
  • Speichere es auf Deinem Desktop.
  • Doppelklick auf OTL.exe um das Programm auszuführen.
  • Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
  • Klicke auf den Button "Bereinigung"
  • OTL fragt eventuell nach einem Neustart.
    Sollte es dies tun, so lasse dies bitte zu.
Anmerkung: Nach dem Neustart werden OTL und andere Helferprogramme, die Du im Laufe der Bereinigung heruntergeladen hast, nicht mehr vorhanden sein. Sie wurden entfernt. Es ist daher Ok, wenn diese Programme nicht mehr vorhanden sind. Sollten noch welche übrig geblieben sein, lösche sie manuell.

3.
Windows legt beispielsweise regelmäßig Schattenkopien an (mindestens einmal täglich), die im Notfall zur Wiederherstellung des Systems und zum Zugriff auf ältere Dateiversionen dienen. Diese Funktion belegt sehr viel Speicherplatz. Standardmäßig beträgt der für Schattenkopien reservierte Speicherplatz 15 % der Volumegröße, so dass die Systemleistung auch beeinträchtigt wird. Außerdem gelöschte und ev. schädliche Objekte, die in der Systemwiederherstellung sitzen, müssen auch entfernt werden:
Also mach bitte folgendes: also zuerst deaktivieren-> dann aktivieren - also am Ende soll wieder "aktiviert" sein!

4.
Ich würde Dir vorsichtshalber raten, dein Passwort zu ändern (man sollte alle 3-4 Monate machen)
z.B. Login-, Mail- oder Website-Passwörter
Tipps:
Die sichere Passwort-Wahl - (sollte man eigentlich regelmäßigen Abständen ca. alle 3-5 Monate ändern)
auch noch hier unter: Sicheres Kennwort (Password)

5.
► Schaue bitte nach, ob für Windows neue Update gibt?!:-> - Microsoft Update hält Ihren Computer auf dem neuesten Stand!
-> Installiere jedes Update das Dir angeboten wird, wiederhole den Vorgang so oft, bis nicht mehr gibt

Lesestoff Nr.1:
Gib Kriminellen Handlungen keine Chance!
Zitat:
Sichere regelmäßig deine Daten (Bilder Musik, Dokumente, Mails (als Textdatei), im Browser Lesezeichen usw) auf CD/DVD, USB-Sticks oder externe Festplatten! Am besten 2x an verschiedenen Orten sichern!
  • Wie erstelle ich ein eingeschränktes Benutzerkonto?
  • Software immer auf dem neuesten Stand halten!:
    ALLE auf dem System installierten Programme und Treiber, sollten regelmäßig upgedatet werden um Sicherheitslücken zu vermeiden und um das reibungslose Arbeitsabläufe zu erreichen!
  • Firefox - FirefoxWiki/Einstellungen - Erweiterungen für Firefox
  • Sichere eMail Clients z.B. Thunderbird-->Erweiterungen für Mozilla Thunderbird
    - Unbekannten E-Mail-Anhang NICHT öffnen!
    - Mails besonders mit Anhang, nicht anklicken, sondern als Text oder in Druckversion anzeigen lassen
  • Sichere Paswort - Die sichere Passwort-Wahl - (sollte man eigentlich regelmäßigen Abständen ca. alle 3-5 Monate ändern)
    auch noch hier unter: Sicheres Kennwort (Password)
    Die fünf häufigsten Passwort-Fehler
  • "Never accept software from strangers" - Installiere grundsätzlich immer nur Programme, die Du auch wirklich benötigst und von denen Du überzeugt bist, dass sie seriös sind.
    Du hast die Wahl!, welche zusätzlichen Komponenten noch installiert werden sollen? -> Während der Installation immer mitlesen, Sponsoren und Partnerprogramme, Toolbars oder eventuell noch andere extra angebotene Programme möglichst abwählen!
    so wird oft Art von Adware/Spyware mitinstalliert!
  • NICHT irgendwelche Programme aus dem Netz laden, wenn nicht zu 100% fest steht, dass es sich dabei um saubere Software handelt. Nette Versprechen der Hersteller garantieren noch lange keine einwandfreie Funktionsweise, also vorher blättere die Seiten bei GOOGLE, da kannst Du Dir wertvolle Informationen holen!!!
  • Programme und Treiber:
    Nur vom Hersteller!
  • Onlinebanking:
    Gib deine Passwörter niemals preis!
    Seriöse Bankinstitute, E- Mail- Provider oder Online- Shops versenden grundsätzlich keine E- Mails, in denen Kunden aufgefordert werden, vertrauliche Daten wie Passwörter, Verfügernummer, PINs oder TANs preiszugeben. Bei dieser Art von E- Mails handelt es sich immer um Betrugsversuche, weshalb entsprechende Anfragen nicht beantwortet werden sollten. Sobald der Verdacht auf Betrug entsteht, melde deinen Verdacht der jeweiligen Bank- Hotline.
  • Computer, anderen (Gästen/Freunden) zur Nutzung überlassen überlassen - Nutze nur vertrauenswürdige Computer!
    Vergewissere dich, dass nur Personen deines Vertrauens deinen Computer nutzen oder verwalten und wickel niemals Bankgeschäfte über nicht vertrauenswürdige Computer - beispielsweise aus einem Internetcafé während des Urlaubs - ab
  • Wichtige Daten Regelmäßig sichern! - aber denk daran: dein Hauptsystem ist doch kein Lagerhalle!
  • Vorsicht bei der Nutzung fremder Computer und anschliessbare Externe Speichermedien wie Festplatte, USB Sticks, Speicherkarten usw![/color] - auch zeitweise anschließen und scannen lassen (sehe unter `kostenlose Online-Viren-Scanner`)
  • Webseiten ohne Gültiges Impressum nicht besuchen
    - Externe Geräte (Festplatte USB-Stick) nicht ständig am PC anschließen, sondern nur kurzfristig während Du etwas sichern möchtest
  • Lizenzkosten sparen? - Vorsicht bei Dateien/Programmen aus nicht vertrauenswürdigen Quellen! - "full Keygen, Crack, Serial, Warez, keygenerators" etc.
    Sind immer verseucht mit diverse Malware/Schadprogramme/Code, es gibt keine seite wo Viren frei ist. (Man sollte nicht absitlich der Teufel holen) Eine weitere höchst unsichere Quelle ist das File-Sharing der sog. (Musik-)Tauschbörse.
    ► Ausserdem machst Du dich damit strafbar!
  • Nur eine Firewall sowie ein Antiviren Programm verwenden, welche sich immer auf dem aktuellsten Stand befinden sollten!
    Das Installieren von `zuviel` Software beeinträchtigt die Systemleistung und Sicherheit, verlangsamt den Start-Vorgang enorm und belastet den Arbeitsspeicher (weil laufen ja die Programme nebeneinander gleichzeitig, die viel Performance fressen, aber wenig Qualität bringen). Im Laufe der Zeit wird der rechner durch zu viel unnötigen Ballast immer langsamer, und unsicherer. Um so mehr Programme installiert sind, um so häufiger treten Probleme auf, die dann unter Umständen nur schwer lösen können. Dazu kommt noch, das einige Programme große Sicherheitsrisiken mit sich bringen
  • Virenscanner
  • BSI für Bürger
  • SETI@home - [Sicherheit] Sicherheitskonzept

** Der gesunde Menschenverstand, Windows und Internet-Software sicher konfigurieren ist der beste Weg zur Sicherheit im Webverkehr ist !!
Zitat:
Da der Bestand der Datenbank wird täglich ergänzt und erweitert bzw werden mit der aktuellen Virendefinition die Informationen über den betroffenen Virus aufgenommen, empfehle ich dir mindestens einmal pro Woche (später genügt es sicherlich einmal im Monat) dein System Online Scannen lassen (immer mit einen anderen Scanner), um eine zweite Meinung einzuholen - Die auf dem Speichermedium gesicherten Daten sollten auch mit einbezogen werden!
(benutzen meist ActiveX und/oder Java): Kostenlose Online Scanner -
Lesestoff Nr.2:
► Kann sich auf Dauer eine Menge Datenmüll ansammeln, sich Fehlermeldungen häufen, der PC ist wahrscheinlich nicht mehr so schnell, wie früher:wünsch Dir alles Gute

Wenn Du uns unterstützen möchtest→ Spendekonto

gruß
kira
__________________

Warnung!:
Vorsicht beim Rechnungen per Email mit ZIP-Datei als Anhang! Kann mit einen Verschlüsselungs-Trojaner infiziert sein!
Anhang nicht öffnen, in unserem Forum erst nachfragen!

Sichere regelmäßig deine Daten, auf CD/DVD, USB-Sticks oder externe Festplatten, am besten 2x an verschiedenen Orten!
Bitte diese Warnung weitergeben, wo Du nur kannst!

Alt 12.10.2012, 20:37   #9
meric
 
Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk) - Standard

Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk)



So, habe alles genaustens befolgt! Passwörter sind geändert. System bereinigt. Fühlt sich alles sogar einen Hauch weniger träge an

Habe heute während des Tages immer ein halbes Auge auf den Ressourcenmonitor gehabt und es sind keine verdächtigen Verbindungen mehr aufgetaucht (Hab alle IPs mit tracert überprüft )!

Ich werd das ganze jetzt noch mal ein paar Tage weiter beobachten, aber momentan sieht alles wieder echt gut aus!

Noch einmal vielen Dank für die Hilfe!!!

Antwort

Themen zu Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk)
aswmbr, avast, bräuchte, computer, dringend, e-mail, entdeck, gelöscht, hallo zusammen, hijack, hijackthis, hosts-datei, internetverbindung, langsam, links, malware, mbam, namen, nichts, passwort, programme, trojaner, verbindung, verbindungen, virusscan, wurm




Ähnliche Themen: Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk)


  1. static.88-198-155-41.clients.your-server.de:4005
    Plagegeister aller Art und deren Bekämpfung - 15.04.2015 (11)
  2. Kalenderchen6, Malware, virus, wurm, was ist da los?
    Log-Analyse und Auswertung - 15.11.2014 (16)
  3. Russischer Tor-Server schleuste Malware in Programme
    Nachrichten - 25.10.2014 (0)
  4. Windows 7: Trojaner http://static.australianbrewingcompany.c om
    Log-Analyse und Auswertung - 05.01.2014 (5)
  5. Trojaner static.australienbrewingcompany.com
    Lob, Kritik und Wünsche - 24.12.2013 (0)
  6. Malware auf Server?
    Plagegeister aller Art und deren Bekämpfung - 19.03.2013 (11)
  7. 25 verschiedene Trojaner bzw. Malware,Exploit und backdoor server!
    Log-Analyse und Auswertung - 15.01.2013 (21)
  8. Trojaner gelöscht, kann jetzt surfen, doch alle E-Mail clients, Dropbox etc gehen nicht!
    Plagegeister aller Art und deren Bekämpfung - 30.07.2012 (1)
  9. Malware-Wurm
    Plagegeister aller Art und deren Bekämpfung - 28.04.2011 (1)
  10. Problem mit CTV****.exe Malware/Wurm
    Log-Analyse und Auswertung - 31.07.2010 (8)
  11. Wurm Malware.Trace was tun
    Log-Analyse und Auswertung - 18.07.2009 (1)
  12. Wurm und Malware
    Log-Analyse und Auswertung - 17.11.2008 (4)
  13. autorun.inf + dns server schäden (?) + andere malware?
    Log-Analyse und Auswertung - 20.10.2008 (3)
  14. Kann auf dem Server nicht surfen! Bei den anderen Clients schon!Hilfe!
    Log-Analyse und Auswertung - 18.10.2007 (17)
  15. Trojaner/Wurm? Firefox verschlingt 40%meiner Cpu und will als server agieren
    Log-Analyse und Auswertung - 24.07.2007 (4)
  16. Neuartiger Wurm oder Malware?
    Plagegeister aller Art und deren Bekämpfung - 09.09.2003 (1)
  17. NT 4 Clients und WinServer 2003
    Alles rund um Windows - 02.05.2003 (8)

Zum Thema Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk) - Hallo zusammen, ich bräuchte dringend Hilfe bzgl. der im Titel genannten Hosts. Ich habe heute eine E-Mail von Twitter erhalten, dass mein Account wohl kompromittiert und deshalb vorsorglich das Passwort - Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk)...
Archiv
Du betrachtest: Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk) auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.