Computer gesperrt - GVU mit Webcam & 100 € bezahlen

OTL logfile created on: 14.11.2012 23:16:40 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\***Username\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,75 Gb Total Physical Memory | 3,23 Gb Available Physical Memory | 86,10% Memory free
7,50 Gb Paging File | 7,01 Gb Available in Paging File | 93,50% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 48,83 Gb Total Space | 3,74 Gb Free Space | 7,66% Space Free | Partition Type: NTFS
Drive F: | 117,19 Gb Total Space | 21,73 Gb Free Space | 18,54% Space Free | Partition Type: NTFS
Drive G: | 57,77 Gb Total Space | 50,97 Gb Free Space | 88,24% Space Free | Partition Type: NTFS
 
Computer Name: ***PCName | User Name: ***Username | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.11.14 23:13:15 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\***Username\Desktop\OTL.exe
PRC - [2011.02.12 10:27:53 | 000,058,288 | ---- | M] (Absolute Software Corp.) -- C:\Windows\SysWOW64\rpcnet.exe
 
 
========== Modules (No Company Name) ==========
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2009.06.29 18:44:38 | 000,240,128 | ---- | M] (IDT, Inc.) [Auto | Stopped] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\stacsv64.exe -- (STacSV)
SRV:64bit: - [2009.03.02 19:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Stopped] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\AESTSr64.exe -- (AESTFilters)
SRV - [2012.11.11 13:00:49 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.10.16 18:06:12 | 000,084,256 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.10.16 17:57:04 | 000,108,320 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.07.13 12:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Online\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.06.28 17:31:12 | 000,692,432 | ---- | M] (Star Finanz - Software Entwicklung und Vertriebs GmbH) [Auto | Stopped] -- C:\Program Files (x86)\Office\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe -- (StarMoney 8.0 OnlineUpdate)
SRV - [2012.01.18 13:38:28 | 000,155,320 | ---- | M] (Avanquest Software) [On_Demand | Stopped] -- C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe -- (Sony PC Companion)
SRV - [2011.02.12 10:27:53 | 000,058,288 | ---- | M] (Absolute Software Corp.) [Auto | Running] -- C:\Windows\SysWOW64\rpcnet.exe -- (rpcnet)
SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.08.27 17:09:10 | 001,253,376 | ---- | M] (MAGIX AG) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe -- (Fabs)
SRV - [2009.07.16 10:59:00 | 000,648,432 | ---- | M] (SoftThinks) [Auto | Stopped] -- C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe -- (SftService)
SRV - [2009.06.29 18:44:38 | 000,240,128 | ---- | M] (IDT, Inc.) [Auto | Stopped] -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\STacSV64.exe -- (STacSV)
SRV - [2009.06.24 16:31:22 | 002,368,776 | ---- | M] (Sensible Vision ) [Auto | Stopped] -- C:\Program Files (x86)\Sicherheit\Sensible Vision\Fast Access\FAService.exe -- (FAService)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.03.02 19:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Stopped] -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\AESTSr64.exe -- (AESTFilters)
SRV - [2008.12.18 20:05:28 | 000,155,648 | ---- | M] (Stardock Corporation) [Auto | Stopped] -- C:\Programme\Dell\DellDock\DockLogin.exe -- (DockLoginService)
SRV - [2008.08.07 11:10:02 | 003,276,800 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance)
SRV - [2007.05.31 10:11:54 | 000,443,784 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007.05.31 10:11:46 | 000,225,672 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
SRV - [2006.12.19 17:23:20 | 000,094,208 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe -- (EpsonBidirectionalService)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.10.04 12:07:05 | 000,129,216 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.09.24 09:58:11 | 000,027,800 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2012.09.13 15:52:59 | 000,099,248 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Stopped] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.08.23 15:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2012.08.23 15:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2012.06.29 18:39:46 | 000,027,176 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ggsemc.sys -- (ggsemc)
DRV:64bit: - [2012.06.29 18:39:46 | 000,013,352 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ggflt.sys -- (ggflt)
DRV:64bit: - [2012.03.01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.07.09 00:32:08 | 000,769,816 | ---- | M] (www.ext2fsd.com) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ext2fsd.sys -- (Ext2Fsd)
DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.03.04 20:44:12 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 10:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2010.08.12 11:07:50 | 000,350,952 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvmf6264.sys -- (NVNET)
DRV:64bit: - [2010.06.07 15:45:00 | 000,174,848 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CtClsFlt.sys -- (CtClsFlt)
DRV:64bit: - [2010.04.29 05:55:42 | 000,032,768 | ---- | M] (Google Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\androidusb.sys -- (androidusb)
DRV:64bit: - [2009.10.24 00:49:46 | 001,542,656 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2009.08.05 20:37:04 | 000,046,792 | ---- | M] (GBM Software) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\GRemoteJoy64.sys -- (GRemoteJoy)
DRV:64bit: - [2009.08.05 20:37:04 | 000,027,336 | ---- | M] (GBM Software) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\GRemoteBus64.sys -- (GRemoteBus)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 01:09:50 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usb8023x.sys -- (usb_rndisx)
DRV:64bit: - [2009.06.29 18:44:38 | 000,487,424 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA)
DRV:64bit: - [2009.06.27 00:55:10 | 000,083,488 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2009.06.26 18:23:30 | 000,272,432 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2009.06.10 21:35:35 | 000,408,960 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvm62x64.sys -- (NVENETFD)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.03.24 15:43:54 | 000,059,392 | ---- | M] (ITE Tech. Inc. ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\itecir.sys -- (itecir)
DRV:64bit: - [2009.03.08 16:06:00 | 000,319,840 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\OA001Vid.sys -- (OA001Vid)
DRV:64bit: - [2009.03.06 06:33:58 | 000,159,840 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\OA001Ufd.sys -- (OA001Ufd)
DRV:64bit: - [2008.12.23 18:11:38 | 000,021,160 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid)
DRV:64bit: - [2008.12.23 18:11:34 | 000,036,392 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap)
DRV:64bit: - [2008.12.23 18:11:32 | 000,133,672 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt)
DRV:64bit: - [2008.12.23 18:11:30 | 000,095,784 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio)
DRV:64bit: - [2008.11.11 21:05:30 | 000,057,856 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rixdpx64.sys -- (rismxdp)
DRV:64bit: - [2008.11.11 21:05:28 | 000,062,976 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rimmpx64.sys -- (rimmptsk)
DRV:64bit: - [2008.11.11 21:05:26 | 000,055,296 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rimspx64.sys -- (rimsptsk)
DRV:64bit: - [2008.09.25 02:36:14 | 000,238,848 | ---- | M] (Sensible Vision ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\facap.sys -- (FACAP)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2009.06.24 20:19:48 | 000,146,928 | ---- | M] (CyberLink Corp.) [2009/12/23 18:13:32] [Kernel | Auto | Stopped] -- C:\Program Files (x86)\Video\CyberLink\PowerDVD DX\000.fcl -- ({1E444BE9-B8EC-4ce6-8C2B-6536FB7F4FB7})
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/USCON/8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/USCON/8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=DLCDF7&pc=MDDC&src=IE-SearchBox
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "AutoConfigURL" = file://G:/Musik/Temp/RT/WebRip/profile/rrproxy_ie_5065ca11.pac
 
========== FireFox ==========
 
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.controllingportal.de/"
FF - prefs.js..extensions.enabledAddons: jl@leimbach-it.de:2.5
FF - prefs.js..extensions.enabledAddons: youtube2mp3@mondayx.de:1.2.3
FF - prefs.js..extensions.enabledAddons: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:2.0.7
FF - prefs.js..extensions.enabledAddons: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:2.0.15
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:2.0.6
FF - prefs.js..extensions.enabledItems: {c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}:4.1
FF - prefs.js..extensions.enabledItems: jl@leimbach-it.de:2.5
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..network.proxy.type: 2
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_110.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_110.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@playstation.com/PsndlCheck,version=1.00: C:\Program Files (x86)\Sony\PLAYSTATION Network Downloader\nppsndl.dll (Sony Computer Entertainment Inc.)
FF - HKLM\Software\MozillaPlugins\@SonyCreativeSoftware.com/Media Go,version=1.0: C:\Program Files (x86)\Multimedia\Sony Media Go\npmediago.dll (Sony Network Entertainment International LLC)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.0.3: C:\Program Files (x86)\Media-Player\VideoLAN\npvlc.dll (the VideoLAN Team)
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Users\***Username\AppData\Roaming\Move Networks\plugins\071803000001\npqmp071803000001.dll (Move Networks)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\***Username\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{5FE7198A-5950-4068-9FBF-1A60395CC4E9}: C:\Program Files (x86)\Multimedia\1&1 SoftPhone\Firefox [2011.09.22 17:18:48 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Online\Mozilla Firefox\components [2012.08.05 11:16:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Online\Mozilla Firefox\plugins [2012.07.11 22:34:23 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 16.0.2\extensions\\Components: C:\Program Files (x86)\Office\Mozilla Thunderbird\components [2012.07.12 18:08:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 16.0.2\extensions\\Plugins: C:\Program Files (x86)\Office\Mozilla Thunderbird\plugins [2010.07.04 16:57:09 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Sunbird\Extensions\\{A69F5EC7-88F0-4902-A15C-E569DFA33C3A}: C:\Program Files (x86)\Office\BirdieSync\Sunbird Service [2010.01.13 22:12:20 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{A69F5EC7-88F0-4902-A15C-E569DFA33C3A}: C:\Program Files (x86)\Office\BirdieSync\Thunderbird Service [2010.01.13 22:12:19 | 000,000,000 | ---D | M]
 
[2009.12.23 17:09:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***Username\AppData\Roaming\mozilla\Extensions
[2009.12.10 21:24:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***Username\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.10.24 20:36:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***Username\AppData\Roaming\mozilla\Firefox\Profiles\mb3ab5xj.default\extensions
[2010.03.25 21:22:13 | 000,000,000 | ---D | M] (GutscheinRausch.de) -- C:\Users\***Username\AppData\Roaming\mozilla\Firefox\Profiles\mb3ab5xj.default\extensions\jl@leimbach-it.de
[2011.12.16 22:19:42 | 000,011,510 | ---- | M] () (No name found) -- C:\Users\***Username\AppData\Roaming\mozilla\firefox\profiles\mb3ab5xj.default\extensions\youtube2mp3@mondayx.de.xpi
[2012.08.23 16:24:39 | 000,341,143 | ---- | M] () (No name found) -- C:\Users\***Username\AppData\Roaming\mozilla\firefox\profiles\mb3ab5xj.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}.xpi
[2012.09.13 17:17:41 | 000,698,867 | ---- | M] () (No name found) -- C:\Users\***Username\AppData\Roaming\mozilla\firefox\profiles\mb3ab5xj.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi
[2011.04.25 11:23:02 | 000,001,782 | ---- | M] () -- C:\Users\***Username\AppData\Roaming\mozilla\firefox\profiles\mb3ab5xj.default\searchplugins\blindsearch.xml
[2011.04.25 11:23:02 | 000,003,485 | ---- | M] () -- C:\Users\***Username\AppData\Roaming\mozilla\firefox\profiles\mb3ab5xj.default\searchplugins\cutlistat.xml
[2011.04.25 11:23:02 | 000,006,224 | ---- | M] () -- C:\Users\***Username\AppData\Roaming\mozilla\firefox\profiles\mb3ab5xj.default\searchplugins\otr-searchcom.xml
 
O1 HOSTS File: ([2011.05.16 19:53:28 | 000,000,996 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O1 - Hosts: 127.0.0.1 im.adtech.de
O1 - Hosts: 127.0.0.1 adserver.adtech.de
O1 - Hosts: 127.0.0.1 adtech.de
O1 - Hosts: 127.0.0.1 atwola.com
O1 - Hosts: 127.0.0.1 adserver.71i.de
O1 - Hosts: 127.0.0.1 adicqserver.71i.de
O1 - Hosts: 127.0.0.1 71i.de
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (FAIESSOHelper Class) - {A2F122DA-055F-4df7-8F24-7354DBDBA85B} - C:\Program Files (x86)\Sicherheit\Sensible Vision\Fast Access\FAIESSO.dll (Sensible Vision )
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.dll (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [QuickSet] C:\Programme\Dell\QuickSet\quickset.exe (Dell Inc.)
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray64.exe (IDT, Inc.)
O4:64bit: - HKLM..\Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Dell Webcam Central] C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [EEventManager] C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [FAStartup]  File not found
O4 - HKLM..\Run: [FATrayAlert] C:\Program Files (x86)\Sicherheit\Sensible Vision\Fast Access\FATrayMon.exe (Sensible Vision )
O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKCU..\Run: [TrayBackup] C:\Program Files (x86)\Sicherheit\TrayBackup\traybackup.exe ((C) Michael Schiel)
O4 - HKLM..\RunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe (Softthinks)
O4 - Startup: C:\Users\***Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk = C:\ProgramData\lsass.exe (Microsoft Corporation)
O4 - Startup: C:\Users\***Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk =  File not found
O4 - Startup: C:\Users\***Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TrayIt!.lnk = C:\Program Files (x86)\System\TrayIt\trayit!.exe (Igor Nys)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Add to Evernote 4.0 - C:\Program Files (x86)\Office\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O8:64bit: - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\***Username\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8:64bit: - Extra context menu item: In 1&&1 SoftPhone wählen - C:\ProgramData\1&1\1&1 SoftPhone\ContextMenuHandler.html ()
O8:64bit: - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\Office\MICROS~1\Office10\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O8 - Extra context menu item: Add to Evernote 4.0 - C:\Program Files (x86)\Office\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Free YouTube Download - C:\Users\***Username\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: In 1&&1 SoftPhone wählen - C:\ProgramData\1&1\1&1 SoftPhone\ContextMenuHandler.html ()
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\Office\MICROS~1\Office10\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: @C:\Program Files (x86)\Office\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Office\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Office\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Office\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O9 - Extra Button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 10.7.2)
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15102/CTSUEng.cab (Creative Software AutoUpdate)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 10.7.2)
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/110926/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1D9CB218-DF4D-4049-89F7-DE75453B9A9A}: NameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F18E17F4-FD72-442E-93A2-2E916F6E9E34}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\cdo - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\mso-offdap - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\FastAccess: DllName - (C:\Program Files (x86)\Sicherheit\Sensible Vision\Fast Access\FALogNot.dll) - C:\Program Files (x86)\Sicherheit\Sensible Vision\Fast Access\FALogNot.dll ()
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O24 - Desktop WallPaper: 
O24 - Desktop BackupWallPaper: 
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{f852b626-99f6-11e1-87f0-00225ff7ce9d}\Shell - "" = AutoRun
O33 - MountPoints2\{f852b626-99f6-11e1-87f0-00225ff7ce9d}\Shell\AutoRun\command - "" = D:\Startme.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.11.14 23:13:15 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\***Username\Desktop\OTL.exe
[2012.11.13 21:04:55 | 000,000,000 | ---D | C] -- C:\Users\***Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
[2012.11.13 21:00:10 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\ProgramData\lsass.exe
[2012.11.04 20:43:27 | 000,000,000 | ---D | C] -- C:\Windows\Panther
[2012.11.04 10:46:37 | 000,000,000 | ---D | C] -- F:\Eigene Dateien\Programmieren
[2012.11.04 10:43:07 | 000,000,000 | ---D | C] -- C:\Users\***Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Programmieren
[2012.11.04 09:39:55 | 000,000,000 | ---D | C] -- C:\Users\***Username\AppData\Roaming\Avira
[2012.11.04 09:38:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2012.11.04 09:37:48 | 000,129,216 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys
[2012.11.04 09:37:48 | 000,099,248 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2012.11.04 09:37:48 | 000,027,800 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2012.11.04 09:37:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2012.11.04 09:37:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira
 
========== Files - Modified Within 30 Days ==========
 
[2012.11.14 23:13:15 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\***Username\Desktop\OTL.exe
[2012.11.14 23:08:43 | 000,000,000 | ---- | M] () -- C:\Users\***Username\defogger_reenable
[2012.11.14 23:08:13 | 000,050,477 | ---- | M] () -- C:\Users\***Username\Desktop\Defogger.exe
[2012.11.14 22:29:41 | 001,613,412 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.11.14 22:29:41 | 000,696,848 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.11.14 22:29:41 | 000,652,166 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.11.14 22:29:41 | 000,148,144 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.11.14 22:29:41 | 000,121,098 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.11.14 22:25:12 | 000,017,408 | ---- | M] () -- C:\Windows\SysNative\rpcnetp.exe
[2012.11.14 22:25:10 | 000,058,288 | ---- | M] (Absolute Software Corp.) -- C:\Windows\SysWow64\rpcnet.dll
[2012.11.14 22:25:08 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.11.14 22:25:02 | 3018,608,640 | -HS- | M] () -- C:\hiberfil.sys
[2012.11.14 22:24:14 | 095,023,320 | ---- | M] () -- C:\ProgramData\dsgsdgdsgdsgw.pad
[2012.11.14 22:23:38 | 000,001,128 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.11.14 21:49:02 | 000,001,132 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.11.13 21:02:27 | 604,572,920 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012.11.13 21:00:16 | 000,000,828 | ---- | M] () -- C:\Users\***Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.11.13 19:21:43 | 000,010,896 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.11.13 19:21:43 | 000,010,896 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.11.04 20:39:13 | 000,072,822 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf
[2012.11.04 20:39:12 | 000,072,822 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf
 
========== Files Created - No Company Name ==========
 
[2012.11.14 23:08:43 | 000,000,000 | ---- | C] () -- C:\Users\***Username\defogger_reenable
[2012.11.14 23:08:12 | 000,050,477 | ---- | C] () -- C:\Users\***Username\Desktop\Defogger.exe
[2012.11.13 21:02:27 | 604,572,920 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2012.11.13 21:00:16 | 000,000,828 | ---- | C] () -- C:\Users\***Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.11.13 21:00:13 | 095,023,320 | ---- | C] () -- C:\ProgramData\dsgsdgdsgdsgw.pad
[2012.11.04 20:39:13 | 000,072,822 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf
[2012.11.04 20:39:12 | 000,072,822 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf
[2012.09.28 14:58:42 | 001,591,306 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.01.22 13:36:10 | 000,000,890 | ---- | C] () -- C:\Windows\wiso.ini
[2011.10.07 19:15:11 | 000,017,408 | ---- | C] () -- C:\Users\***Username\AppData\Local\WebpageIcons.db
[2010.12.29 16:27:34 | 000,233,542 | ---- | C] () -- C:\Windows\SysWow64\vcdll.dll
[2010.12.29 16:27:34 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\GkSui20.EXE
[2010.12.29 16:26:42 | 000,028,672 | ---- | C] () -- C:\Windows\SysWow64\astro32.dll
[2009.12.31 10:37:39 | 000,025,600 | ---- | C] () -- C:\Users\***Username\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.12.23 17:28:07 | 000,002,342 | ---- | C] () -- C:\Users\***Username\AppData\Local\Win7_tmp1.htm
[2009.12.20 16:57:14 | 000,009,347 | ---- | C] () -- C:\Users\***Username\AppData\Roaming\Kommagetrennte Werte (Windows).EML
[2009.12.16 22:41:47 | 000,038,447 | ---- | C] () -- C:\Users\***Username\AppData\Roaming\Tabulatorgetrennte Werte (Windows).ADR
[2009.12.15 01:56:57 | 000,030,446 | ---- | C] () -- C:\Users\***Username\AppData\Roaming\Kommagetrennte Werte (Windows).ADR
[2009.10.18 20:15:27 | 000,000,000 | ---- | C] () -- C:\Users\***Username\AppData\Roaming\wklnhst.dat
[2008.10.30 10:49:34 | 000,000,022 | ---- | C] () -- C:\ProgramData\8f01a90e-7eb3-48d3-93b1-50d88fd146fb
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2011.09.22 17:21:40 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\1&1
[2011.07.30 21:10:43 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\ASCON Installer
[2012.05.09 17:57:42 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\BirdieSync
[2012.01.22 13:37:55 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\Buhl Data Service
[2009.12.30 20:33:00 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\COWON
[2010.12.25 14:19:12 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.09.24 20:27:43 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\Epson
[2009.12.23 17:09:37 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\EssentialPIM
[2010.07.26 22:09:19 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\FileZilla
[2010.06.30 09:11:17 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\Foxit Software
[2011.11.30 23:04:11 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\FreePDF
[2010.01.03 11:04:46 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\GBM Software
[2012.11.11 15:57:24 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\ICQ
[2009.12.23 17:09:38 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\ImgBurn
[2011.01.25 23:37:36 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\LibreOffice
[2011.01.13 21:50:40 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\MAGIX
[2009.12.26 13:48:10 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\Mp3tag
[2012.11.12 22:08:43 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\MyPhoneExplorer
[2011.04.23 11:23:52 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\OCS
[2009.12.23 17:09:44 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\OpenOffice.org
[2011.04.23 11:23:54 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\Opera
[2009.12.25 23:15:30 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\RapidSolution
[2012.09.28 17:58:53 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\Sony
[2011.09.11 21:56:56 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\Template
[2009.12.23 17:09:46 | 000,000,000 | ---D | M] -- C:\Users\***Username\AppData\Roaming\Thunderbird
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 143 bytes -> C:\Users\***Username\AppData\Roaming\Kommagetrennte Werte (Windows).EML:OECustomProperty
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:302A9871

< End of report >
         

OTL Extras logfile created on: 14.11.2012 23:16:40 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\***Username\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,75 Gb Total Physical Memory | 3,23 Gb Available Physical Memory | 86,10% Memory free
7,50 Gb Paging File | 7,01 Gb Available in Paging File | 93,50% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 48,83 Gb Total Space | 3,74 Gb Free Space | 7,66% Space Free | Partition Type: NTFS
Drive F: | 117,19 Gb Total Space | 21,73 Gb Free Space | 18,54% Space Free | Partition Type: NTFS
Drive G: | 57,77 Gb Total Space | 50,97 Gb Free Space | 88,24% Space Free | Partition Type: NTFS
 
Computer Name: ***PCName | User Name: ***Username | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Online\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "C:\Program Files (x86)\Office\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files (x86)\Office\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\Media-Player\VideoLAN\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\Media-Player\VideoLAN\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "C:\Program Files (x86)\Office\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files (x86)\Office\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\Media-Player\VideoLAN\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\Media-Player\VideoLAN\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{17233E4E-5257-4B01-A814-F32473E71B7D}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{191FA77D-442E-4453-9B3B-13C5849A982C}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{1FAADFE4-ECE3-484F-B5A3-F8F5D59370A1}" = lport=445 | protocol=6 | dir=in | app=system | 
"{2485D6E1-E351-44DF-BC76-C3EBC967030C}" = lport=138 | protocol=17 | dir=in | app=system | 
"{2798C2D9-3DC5-44AD-8750-8A57F9AF1368}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{2ECE6BE7-CEF8-4AA7-BA2B-061147EABC6C}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe | 
"{3EB5DCBC-4D0B-4835-AFCE-951F99E49BCF}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{48D57AA1-A9F2-4DCE-B724-A64018BAF8F6}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{535BCFB7-B564-4E33-9E76-008FCADC0A10}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{5650C46C-5BC0-42BA-8A2A-7A3F233BD1CC}" = rport=138 | protocol=17 | dir=out | app=system | 
"{61812BAA-5E0B-47EC-B540-8C0E20E19B04}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdcbase.exe,-4006 | 
"{61FD1420-13E2-4C07-BA7E-388A8FE070B0}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{64EE3BDF-6F96-44D2-A0F4-B65A5342EA98}" = lport=58927 | protocol=6 | dir=in | app=c:\program files (x86)\office\birdiesync\birdiesync.exe | 
"{6501E33F-A1DA-428C-AAFC-BD207168531F}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe | 
"{6AE5A3C1-3426-4806-90E7-BE4E0658BE43}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{6FBE38F2-E01C-4180-A8D7-1AFF4D4F22E3}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{775F35C9-1F1A-4B71-8380-C9742D3F98AD}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{77D50C52-BFAA-488C-8F37-375CC31780F7}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{7C0852B4-6CD9-448A-A1EF-C42BA833227E}" = lport=5721 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{816D0516-72E5-4B91-9AA9-CBD2B3514C18}" = rport=445 | protocol=6 | dir=out | app=system | 
"{858535CC-244E-4BEC-A92D-E5528885C5C9}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{869585AA-50BF-4C75-8251-4D1EA22257C4}" = lport=137 | protocol=17 | dir=in | app=system | 
"{8A1E4731-64ED-4153-8C3D-DE68AE6DCE11}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{8C50CEBE-4E01-4334-8568-5D6C4AA819D0}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdcbase.exe,-4006 | 
"{962664D8-AEEB-481B-B192-E264EF7F6BEE}" = rport=139 | protocol=6 | dir=out | app=system | 
"{96BCAC0A-8983-40BB-AA92-83812DDCC903}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{9D8E505D-82BF-482D-8DF2-EAF1FFFE4EC2}" = lport=139 | protocol=6 | dir=in | app=system | 
"{A158B2AE-04D6-4DB1-B882-D565AE3AB315}" = rport=137 | protocol=17 | dir=out | app=system | 
"{A84FEBF1-FF13-402D-B788-57DE0C8FBBA5}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{A86ED0DD-3FDF-4F1E-A73D-38C8BEDEC363}" = lport=5656 | protocol=17 | dir=in | name=gremoteserver udp port | 
"{B37DEFF7-749E-4E26-9168-3BF34B7CDBF3}" = lport=5721 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{B53C561F-A498-42C5-A30C-0EB9EACD1E81}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{B5955F7E-F3D3-4934-BCF3-659D8FA256A4}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{C0910BAA-C263-4D17-BD9F-DB3CE56E9D68}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{C1366744-2AB7-49CC-8460-0992DF5B5A95}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{C3E78876-8443-4046-BAD6-73E93A8597A3}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{CA1594AA-9A4E-4942-8352-B1615514572D}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe | 
"{CC2F63EE-C5BD-437A-9117-0DD43CC3188E}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{CEA96809-7F00-4DF7-A97E-D2FEA95ED4B4}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{CEFD0DEB-2B13-45E0-B857-DFBA6E3166F4}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{D1BAE988-323E-467C-BB38-A1566EF8E54B}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{E90981ED-2778-486E-BDA8-B86502E0DD74}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe | 
"{FBFB0F25-4540-45A1-B8C6-53286D5999CC}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01624781-C976-4B69-A4C1-477EC77ED15D}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.5\icq.exe | 
"{04D19486-F586-45CF-AFB7-A7897E7FA455}" = protocol=6 | dir=in | app=c:\program files (x86)\handy\gbm\gremote pro\gremoteserver.exe | 
"{05798A42-8B96-401B-AF99-26C41B54D6C3}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{072C4D5D-BA18-4E83-A38F-E73EDDFF479F}" = protocol=6 | dir=in | app=c:\program files (x86)\office\starmoney 8.0\ouservice\starmoneyonlineupdate.exe | 
"{0F92CF40-E1BC-4484-A63C-C08AAA395CDB}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{11DC5F00-0E1E-4B5F-AFE8-E6865FFFF543}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{147F70FF-7E40-42B0-8C62-2E3959AD22D6}" = protocol=17 | dir=in | app=c:\program files (x86)\office\starmoney 8.0\ouservice\starmoneyonlineupdate.exe | 
"{168B5C71-042E-4C7F-B70A-8F52C66AD5AC}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{1E1EF038-B6B7-4508-A3D9-BD5C04638280}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{223155F0-7393-485D-B84F-208C88E561E6}" = dir=in | app=c:\program files (x86)\online\skype\phone\skype.exe | 
"{24A9E62C-1A57-4E5C-BAF7-89B217F874E4}" = dir=in | app=c:\program files (x86)\video\cyberlink\powerdvd dx\powerdvd.exe | 
"{26E107BC-8EDE-4D94-8F6B-D987CC154C1E}" = protocol=6 | dir=in | app=c:\program files (x86)\handy\gremote\gremoteserver.exe | 
"{3153B669-B4F4-41C9-8627-7C902A22F2AB}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{33354798-D9EA-43BF-97A1-EF4837800147}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{39DB4859-7CDF-4D82-A264-21FCA400AEF5}" = protocol=17 | dir=in | app=c:\program files (x86)\epsonnet\epsonnet setup\tool10\eneasyapp.exe | 
"{3A62A98B-F155-44CA-ADC1-AD22B1014E82}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.5\icq.exe | 
"{3C1EB222-975C-44B5-8615-EF3096F6F62D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{3EF459A2-CD49-419B-8180-F27303B90C3F}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{415E1F6E-CCFD-4D22-A0EF-5176D13720DB}" = protocol=17 | dir=in | app=c:\program files (x86)\office\starmoney 8.0\app\starmoney.exe | 
"{46C97196-2722-4770-8BA1-5F834523E883}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{47280596-4F01-4B11-882C-A783D1393CD5}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{476831B7-20B7-4162-A4BE-EF6D216C6547}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{494020F4-250A-4AF5-9E38-ECCF270BDAB3}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{4B99A9BB-997A-48C6-884F-DC61BFD204D8}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{5140136F-93C9-4E96-B452-DB77CE6A6A10}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{53830BEC-6B70-47A0-8A65-A4E9F2906682}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{5880A7F0-F84D-47A7-97E0-D34DC4FE3EA8}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{593705D5-C9D3-4DFD-B6B3-9C8464C9DE2B}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{5C6B5CBA-7E4D-422D-83EA-FD1B54811073}" = protocol=6 | dir=in | app=c:\program files (x86)\epsonnet\epsonnet setup\tool10\eneasyapp.exe | 
"{5EE8E3DC-DA5E-424D-9861-51B152FFEF37}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.5\icq.exe | 
"{5FA9EF2A-8E05-490F-94D2-F2892D0385E1}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{6D669035-5777-475D-8AD6-183CD04602B5}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{6E856B5E-BCAC-4962-B74C-EB39FD70E5EC}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{6EBDB818-91EA-4EAB-82F9-B52D941BC9DF}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{710C2244-DD54-40CB-AE72-1FDBDB270784}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{71BACBA6-69EF-433C-9852-43679F17A6AA}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{728FF455-F8E0-4EBB-B360-D8570A8B29F4}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{7886C0FF-CA6D-4058-9FCD-142307325B21}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{7A7AB98C-8101-4F24-A5E7-FB967837A31E}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{7E77FB2D-CD13-4E0A-9F3F-BD5440FED80A}" = protocol=17 | dir=in | app=c:\program files (x86)\handy\gremote pro\gremoteserver.exe | 
"{7F853F03-6F5B-4223-8D60-1CF68B09BC86}" = dir=in | app=c:\program files (x86)\video\cyberlink\powerdvd dx\pdvddxsrv.exe | 
"{8048EF02-AA64-4080-ADE5-87880C09A0A2}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{87ED95C0-B278-4A4B-A6BF-6BC2A2D65D91}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{8F2E2DA1-C448-43A4-89AA-0699C1024510}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{93565783-83F1-43D2-939B-94E64D9CAE06}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{965A333A-9677-4131-B528-2D1CC527203A}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{9D9E9806-EE5A-4C20-917E-EA63E2785273}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{9DEECF1B-0C12-412D-BC9F-1DEF6376573E}" = protocol=17 | dir=in | app=c:\program files (x86)\handy\gbm\gremote pro\gremoteserver.exe | 
"{A6ED0468-2172-4469-8A97-DC2B2BF1C913}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{A7048A63-2BC9-4268-9CFF-9E63DF9D5F8B}" = protocol=6 | dir=in | app=c:\program files (x86)\office\starmoney 8.0\app\starmoney.exe | 
"{A7F6613E-660C-4E1B-97CA-0AB4652F010F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{A89DCACE-C30B-4679-BBBC-A2555581BF0F}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{AF845DC7-8F70-4CC6-9AFB-EE7CA4CA6A70}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{BDE91CF0-7799-4CC1-AC95-874B1ED7007F}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{C6C63B1D-B8AE-400A-8E47-3A3E22CB70F7}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{C7431933-BF58-4138-9D4C-4A7C23B0E2FE}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{C8FD4036-DED6-428C-9BBE-5706294FFCA3}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{CA946333-C1A8-4BFB-980A-2DC981445CDB}" = protocol=6 | dir=out | app=system | 
"{CC5E4BBC-C72B-452E-8AAE-CCA757E4BAEF}" = dir=in | app=c:\program files (x86)\windows live\sync\windowslivesync.exe | 
"{CDA0E7A0-92D6-4CE8-8D17-E8612269C2DC}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.5\icq.exe | 
"{CE024D0E-9804-4FE5-8A36-2443C171A597}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{CFF76665-CA9F-4CB2-BF2D-23E7EB68F19E}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{D40F6629-A3ED-400B-A15F-E75EFF8E4869}" = protocol=6 | dir=in | app=c:\program files (x86)\sony ericsson\update engine\sony ericsson update engine.exe | 
"{D60A7915-EF06-4E79-A536-69B8A1EBAC7B}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{D75E1999-EEF9-4F43-A8EA-137C79923EAA}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{DFD5CFFF-4533-42F7-84BA-3755C8EF795A}" = protocol=6 | dir=in | app=c:\program files (x86)\handy\gremote pro\gremoteserver.exe | 
"{E183440D-1990-4763-AF28-6235DA1EDE8A}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{E729489A-6B77-4EC5-895E-3647EB127D79}" = protocol=17 | dir=in | app=c:\program files (x86)\sony ericsson\update engine\sony ericsson update engine.exe | 
"{F634F111-015C-456A-A2C9-DD1BD4E86B31}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{FA8EBE58-A063-40FF-8FC1-BEDDF6B206AB}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{FD8445B1-3FA7-4AB1-B622-40287F7859A3}" = protocol=17 | dir=in | app=c:\program files (x86)\handy\gremote\gremoteserver.exe | 
"TCP Query User{2295ABC3-B3C5-44DD-BFB2-964A6CD01F5B}E:\windows\dsassistant\dsassistant.exe" = protocol=6 | dir=in | app=e:\windows\dsassistant\dsassistant.exe | 
"TCP Query User{2E368572-ACE2-4D30-AC09-664263927BC3}C:\program files (x86)\handy\my mobile\mymobiler\mexplorer.exe" = protocol=6 | dir=in | app=c:\program files (x86)\handy\my mobile\mymobiler\mexplorer.exe | 
"TCP Query User{4686A310-6522-4983-89A7-E305B2323494}C:\program files (x86)\multimedia\1&1 softphone\ipphoneui.exe" = protocol=6 | dir=in | app=c:\program files (x86)\multimedia\1&1 softphone\ipphoneui.exe | 
"TCP Query User{5EF05458-7072-4936-A0C1-56D310CE12A2}C:\program files (x86)\office\mozilla thunderbird\thunderbird.exe" = protocol=6 | dir=in | app=c:\program files (x86)\office\mozilla thunderbird\thunderbird.exe | 
"TCP Query User{68BDD28E-4571-48E8-8159-2404D5C1D1DD}C:\program files (x86)\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files (x86)\google\google earth\plugin\geplugin.exe | 
"TCP Query User{695D8E55-4516-4CB2-AB38-60D952355F04}C:\program files (x86)\handy\gremote\gremoteserver.exe" = protocol=6 | dir=in | app=c:\program files (x86)\handy\gremote\gremoteserver.exe | 
"TCP Query User{7211E9AC-A256-410C-8F6D-EFBEC1F6421A}C:\program files (x86)\handy\myphoneexplorer\myphoneexplorer.exe" = protocol=6 | dir=in | app=c:\program files (x86)\handy\myphoneexplorer\myphoneexplorer.exe | 
"TCP Query User{73EAA63E-3FBB-4824-96BC-5227B75ABB34}C:\program files (x86)\handy\gremote pro\gremoteserver.exe" = protocol=6 | dir=in | app=c:\program files (x86)\handy\gremote pro\gremoteserver.exe | 
"TCP Query User{7CF3075E-B88B-48D2-99A4-ED1065EC0083}C:\program files (x86)\video\tvants\tvants.exe" = protocol=6 | dir=in | app=c:\program files (x86)\video\tvants\tvants.exe | 
"TCP Query User{7D08C9D2-24F4-4705-90A1-19C7F74534F6}C:\program files (x86)\epson software\event manager\eeventmanager.exe" = protocol=6 | dir=in | app=c:\program files (x86)\epson software\event manager\eeventmanager.exe | 
"TCP Query User{7F88EB5A-07E8-4810-B7C1-3E147BAEF8A0}C:\program files (x86)\handy\my mobile\mymobiler\mymobiler.exe" = protocol=6 | dir=in | app=c:\program files (x86)\handy\my mobile\mymobiler\mymobiler.exe | 
"TCP Query User{8C24C7E8-E1E6-45E6-99E0-7B6D6FE1655F}C:\program files (x86)\handy\gbm\gremote pro\gremoteserver.exe" = protocol=6 | dir=in | app=c:\program files (x86)\handy\gbm\gremote pro\gremoteserver.exe | 
"TCP Query User{A1A73229-6580-4AFC-8572-43639D21F7E3}C:\program files (x86)\epson software\event manager\eeventmanager.exe" = protocol=6 | dir=in | app=c:\program files (x86)\epson software\event manager\eeventmanager.exe | 
"TCP Query User{AADA3FC2-D86E-45EA-903A-0073211E2062}C:\program files (x86)\office\mozilla thunderbird\thunderbird.exe" = protocol=6 | dir=in | app=c:\program files (x86)\office\mozilla thunderbird\thunderbird.exe | 
"TCP Query User{BC90EA98-7088-4720-982C-ADD2E4A42B51}C:\program files (x86)\netzwerk\synology assistant\dsassistant.exe" = protocol=6 | dir=in | app=c:\program files (x86)\netzwerk\synology assistant\dsassistant.exe | 
"TCP Query User{BD73B45E-60D0-4DB1-BEC8-147DA1A2176C}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"TCP Query User{C0FB2EFA-7E13-42A6-AB39-7EF0C62E980B}C:\program files (x86)\media-player\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files (x86)\media-player\winamp\winamp.exe | 
"TCP Query User{C32C48D0-529C-4F22-8845-0EB92A3D62C0}C:\program files (x86)\multimedia\1&1 softphone\ipphoneui.exe" = protocol=6 | dir=in | app=c:\program files (x86)\multimedia\1&1 softphone\ipphoneui.exe | 
"TCP Query User{C91A3819-C5F4-48BD-BD6F-522F020B9C1F}C:\program files (x86)\online\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files (x86)\online\icq6.5\icq.exe | 
"TCP Query User{CB6E718C-711E-4E23-A2EC-4BFBAFB092E7}C:\program files (x86)\online\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files (x86)\online\icq6.5\icq.exe | 
"UDP Query User{04140D95-6A12-4C66-996E-C0558BBC3518}C:\program files (x86)\netzwerk\synology assistant\dsassistant.exe" = protocol=17 | dir=in | app=c:\program files (x86)\netzwerk\synology assistant\dsassistant.exe | 
"UDP Query User{250F1C3A-7D73-4A72-BD2E-44E67F47FF77}C:\program files (x86)\online\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files (x86)\online\icq6.5\icq.exe | 
"UDP Query User{30173F94-D3D6-453E-87CA-97FCD76AC25D}C:\program files (x86)\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files (x86)\google\google earth\plugin\geplugin.exe | 
"UDP Query User{37B5821F-D210-4FFB-A419-8925619A73F6}C:\program files (x86)\office\mozilla thunderbird\thunderbird.exe" = protocol=17 | dir=in | app=c:\program files (x86)\office\mozilla thunderbird\thunderbird.exe | 
"UDP Query User{40FAE7E4-D11D-4F2C-8367-88E55D05C7FE}C:\program files (x86)\media-player\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files (x86)\media-player\winamp\winamp.exe | 
"UDP Query User{4C198F28-3BB1-4470-B6B5-F0B3FA43C4D8}C:\program files (x86)\handy\my mobile\mymobiler\mymobiler.exe" = protocol=17 | dir=in | app=c:\program files (x86)\handy\my mobile\mymobiler\mymobiler.exe | 
"UDP Query User{5D474EE9-71E1-4D04-B3DC-F5ED05520E42}C:\program files (x86)\multimedia\1&1 softphone\ipphoneui.exe" = protocol=17 | dir=in | app=c:\program files (x86)\multimedia\1&1 softphone\ipphoneui.exe | 
"UDP Query User{693C5AD4-243F-4194-A5B3-83A3102535B5}C:\program files (x86)\handy\gremote pro\gremoteserver.exe" = protocol=17 | dir=in | app=c:\program files (x86)\handy\gremote pro\gremoteserver.exe | 
"UDP Query User{6D1B2DCD-7E97-480F-B206-F83EA76E027D}C:\program files (x86)\epson software\event manager\eeventmanager.exe" = protocol=17 | dir=in | app=c:\program files (x86)\epson software\event manager\eeventmanager.exe | 
"UDP Query User{7A65BB26-734E-4398-9762-FE480A43A1B9}C:\program files (x86)\office\mozilla thunderbird\thunderbird.exe" = protocol=17 | dir=in | app=c:\program files (x86)\office\mozilla thunderbird\thunderbird.exe | 
"UDP Query User{8192F374-7E64-414F-8675-E15643E247C9}E:\windows\dsassistant\dsassistant.exe" = protocol=17 | dir=in | app=e:\windows\dsassistant\dsassistant.exe | 
"UDP Query User{9069E265-8468-4C60-BA64-BEFCAE0D2505}C:\program files (x86)\epson software\event manager\eeventmanager.exe" = protocol=17 | dir=in | app=c:\program files (x86)\epson software\event manager\eeventmanager.exe | 
"UDP Query User{924D6205-1576-4C82-A60A-5F151B2732CD}C:\program files (x86)\handy\gbm\gremote pro\gremoteserver.exe" = protocol=17 | dir=in | app=c:\program files (x86)\handy\gbm\gremote pro\gremoteserver.exe | 
"UDP Query User{B0BA44A7-A167-4401-8A5B-9D4E591CFAF2}C:\program files (x86)\video\tvants\tvants.exe" = protocol=17 | dir=in | app=c:\program files (x86)\video\tvants\tvants.exe | 
"UDP Query User{B9940188-883D-4BAB-B454-AAFF6D0F2E9E}C:\program files (x86)\handy\gremote\gremoteserver.exe" = protocol=17 | dir=in | app=c:\program files (x86)\handy\gremote\gremoteserver.exe | 
"UDP Query User{BE6D5633-CA1A-40A6-A231-61540852E627}C:\program files (x86)\multimedia\1&1 softphone\ipphoneui.exe" = protocol=17 | dir=in | app=c:\program files (x86)\multimedia\1&1 softphone\ipphoneui.exe | 
"UDP Query User{CAE4A98C-B1D6-487F-AEA6-20A8F5A1B89F}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"UDP Query User{D0E3FFD6-8D26-4E15-AEF4-2125A46B1F90}C:\program files (x86)\handy\myphoneexplorer\myphoneexplorer.exe" = protocol=17 | dir=in | app=c:\program files (x86)\handy\myphoneexplorer\myphoneexplorer.exe | 
"UDP Query User{E05390CF-726F-4A3C-8CB7-69EBCF8599D0}C:\program files (x86)\online\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files (x86)\online\icq6.5\icq.exe | 
"UDP Query User{EF8221A2-4BF1-46F1-8030-971D00FCE0BC}C:\program files (x86)\handy\my mobile\mymobiler\mexplorer.exe" = protocol=17 | dir=in | app=c:\program files (x86)\handy\my mobile\mymobiler\mexplorer.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{26A24AE4-039D-4CA4-87B4-2F86416013FF}" = Java(TM) 6 Update 13 (64-bit)
"{26A24AE4-039D-4CA4-87B4-2F86417007FF}" = Java 7 Update 7 (64-bit)
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{626672CD-BFCF-49A9-AEFE-AB0FED3BFC5B}" = Windows Mobile-Gerätecenter
"{64A3A4F4-B792-11D6-A78A-00B0D0170070}" = Java SE Development Kit 7 Update 7 (64-bit)
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{87CF757E-C1F1-4D22-865C-00C6950B5258}" = Quickset64
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}" = Dell Edoc Viewer
"{92DBCA36-9B41-4DD1-941A-AED149DD37F0}" = Windows Mobile-Gerätecenter: Treiberupdate
"{ACE2E009-67B9-4CE9-A743-18A8D06910BA}" = FastAccess
"{E464702F-5433-46EC-8F65-159276C0A54F}" = WIDCOMM Bluetooth Software 6.2.0.6600
"{E60B7350-EA5F-41E0-9D6F-E508781E36D2}" = Dell Dock
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Creative OA001" = Integrated Webcam Driver (1.06.03.0309)  
"EPSON BX620FWD Series" = EPSON BX620FWD Series Printer Uninstall
"Ext2Fsd_is1" = Ext2Fsd 0.51
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"NVIDIA Drivers" = NVIDIA Drivers
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"SynTPDeinstKey" = Dell Touchpad
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{03B8AA32-F23C-4178-B8E6-09ECD07EAA47}" = Epson Event Manager
"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Creator Data
"{095B1DCF-5E8B-47EC-9B18-481918A731DB}" = Microsoft Default Manager
"{09760D42-E223-42AD-8C3E-55B47D0DDAC3}" = Roxio Creator DE
"{0A35B15C-9CCD-4C0C-BD5B-34ABF8C95813}_is1" = ICQ 7.5 Build #5238 Banner Remover 1.0
"{0CBE6C93-CB2E-4378-91EE-12BE6D4E2E4A}" = Epson FAX Utility
"{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}" = PlayStation(R)Store
"{0E806605-5B82-4A4F-BC31-AA4FADA03C42}" = t@x 2012
"{0ED7EE95-6A97-47AA-AD73-152C08A15B04}" = Dell DataSafe Local Backup
"{105CFC7C-6992-11D5-BD9D-000102C10FD8}" = LizardTech DjVu Control
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Creator Tools
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{26A24AE4-039D-4CA4-87B4-2F83216013F0}" = Java(TM) 6 Update 13
"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 7
"{2987EE84-C4EE-4FF5-8160-32DE00D6ABC6}" = GTA2
"{2BF9702B-52EE-4841-83C4-B5E640B6C97A}" = Media Go
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{310C1558-F6B5-4889-98B0-7471966BA7F2}" = Epson Easy Photo Print 2
"{31877B1E-6950-4E76-BBE7-ACD612586F8E}" = MAGIX Screenshare
"{34EB6245-C8D0-4D8A-B8D8-EEBFF7A91485}" = Firebird SQL Server - MAGIX Edition
"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works
"{3E0E4F57-8FE0-4812-840B-56EB8CC3DB7B}" = MAGIX Online Druck Service
"{3E31400D-274E-4647-916C-2CACC3741799}" = EpsonNet Print
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{52306338-9945-41A5-A021-25739C852B58}" = StarMoney
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5B23E5AD-23E2-45C8-A24C-97D3A23FB6EE}" = Carcassonne
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{625C2964-B137-4BA4-9C56-FC8F12185212}" = StarMoney 8.0 
"{65D0C510-D7B6-4438-9FC8-E6B91115AB0D}" = Live! Cam Avatar Creator
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD DX
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Creator Audio
"{7578ADEA-D65F-4C89-A249-B1C88B6FFC20}" = ICQ7.5
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7B63B2922B174135AFC0E1377DD81EC2}" = 
"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}" = Windows Live Anmelde-Assistent
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8C1E2925-14F8-45AA-B999-1E2A74BF5607}" = Windows Live Sync
"{8CCA4800-152A-4C51-8569-5803FBD67CC9}" = LibreOffice 3.3
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage
"{943A8D28-80D6-41DC-AE94-81FEB42041BF}" = System Requirements Lab CYRI
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{97C82B44-D408-4F14-9252-47FC1636D23E}_is1" = IZArc 4.1
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9AA5A9B8-2AB6-4CE6-ACAA-8AAE727A87FD}" = Radiotracker
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C450606-ED24-4958-92BA-B8940C99D441}" = PixiePack Codec Pack
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A4F094CE-9B05-FB0C-DD73-A85DE5D8D283}" = Media Go Video Playback Engine 1.92.167.06150
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9668246-FB70-4103-A1E3-66C9BC2EFB49}" = Dell DataSafe Local Backup - Support Software
"{A9AD487E-9E66-4214-A0B4-93981A12A2FE}" = MAGIX Foto Manager 10
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.2 - Deutsch
"{B0414A3B-3AE3-47B8-8FC0-2129781FF425}" = t@x 2011
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B2D55EB8-32C5-4B43-9006-9E97DECBA178}" = Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser)
"{B6659DD8-00A7-4A24-BBFB-C1F6982E5D66}" = PlayStation(R)Network Downloader
"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Creator Copy
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Plus Web Player
"{C9D8A041-2963-4B31-8FFC-1500F3DB9293}" = EpsonNet Setup 3.3
"{D1F7C704-99F2-11E1-9C74-984BE15F174E}" = Evernote v. 4.5.6
"{DF8195AF-8E6F-4487-A0EE-196F7E3F4B8A}" = jetAudio Plus VX
"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio
"{E8D82F42-EBD8-478C-917B-28F5BA6EAAAA}" = StarMoney
"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Creator DE
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}" = Sony PC Companion 2.10.094
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F6BB6248-C507-46FE-8A35-1B16F35E0441}" = ITECIR
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"1&1 SoftPhone" = 1&1 SoftPhone
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Advanced Audio FX Engine" = Advanced Audio FX Engine
"Android SDK Tools" = Android SDK Tools
"Avira AntiVir Desktop" = Avira Free Antivirus
"BirdieSync" = BirdieSync 2.1.0.1
"CamSpace" = CamSpace
"Das Planetarium 1900 - 2100" = Das Planetarium 1900 - 2100
"Dell Webcam Central" = Dell Webcam Central
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup.divx.com" = DivX-Setup
"DjVuLibre+DjView" = DjVuLibre+DjView
"EPSON BX620FWD Series Manual" = EPSON BX620FWD Series Handbuch
"EPSON BX620FWD Series Network Guide" = EPSON BX620FWD Series Netzwerk-Handbuch
"EPSON PC-FAX Driver 2" = Epson PC-FAX Driver
"EPSON Scanner" = EPSON Scan
"FileZilla Client" = FileZilla Client 3.3.3
"Foxit Reader" = Foxit Reader
"FreePDF_XP" = FreePDF (Remove only)
"GPL Ghostscript 8.71" = GPL Ghostscript 8.71
"GRemoteServer" = GRemoteServer Pro(remove only)
"ImgBurn" = ImgBurn
"MAGIX_MSI_Foto_Manager_10" = MAGIX Foto Manager 10
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"Mozilla Thunderbird 16.0.2 (x86 de)" = Mozilla Thunderbird 16.0.2 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Mp3tag" = Mp3tag v2.45a
"MPE" = MyPhoneExplorer
"MyMDb_0" = MyMDb 3.6
"NAVIGON Fresh" = NAVIGON Fresh 3.2.0
"Sweet Home 3D_is1" = Sweet Home 3D version 3.3
"Synology Assistant" = Synology Assistant (remove only)
"TVAnts 1.0" = TVAnts 1.0
"Uninstall_is1" = Uninstall 1.0.0.1
"Update Engine" = Sony Ericsson Update Engine
"VLC media player" = VLC media player 1.0.3
"Winamp" = Winamp
"Zattoo4" = Zattoo4 4.0.4
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Move Media Player" = Move Media Player
"UnityWebPlayer" = Unity Web Player
"Winamp Detect" = Winamp Anwendungserkennung
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 23.10.2011 08:49:15 | Computer Name = ***PCName | Source = WinMgmt | ID = 10
Description = 
 
Error - 23.10.2011 12:22:24 | Computer Name = ***PCName | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: plugin-container.exe, Version: 5.0.0.4183,
 Zeitstempel: 0x4df952a0  Name des fehlerhaften Moduls: FOXITR~1.OCX, Version: 1.0.1.224,
 Zeitstempel: 0x4b849404  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00002dce  ID des fehlerhaften
 Prozesses: 0x106c  Startzeit der fehlerhaften Anwendung: 0x01cc919ff1a093d0  Pfad der
 fehlerhaften Anwendung: C:\Program Files\Online\Mozilla Firefox\plugin-container.exe
Pfad
 des fehlerhaften Moduls: C:\PROGRA~2\Office\FOXITR~1\plugins\FOXITR~1.OCX  Berichtskennung:
 30923170-fd93-11e0-9a32-00225ff7ce9d
 
Error - 23.10.2011 14:06:22 | Computer Name = ***PCName | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: LogonUI.exe, Version: 6.1.7601.17514,
 Zeitstempel: 0x4ce79f70  Name des fehlerhaften Moduls: MSVCR80.dll, Version: 8.0.50727.4940,
 Zeitstempel: 0x4ca2b4dd  Ausnahmecode: 0xc000000d  Fehleroffset: 0x000000000001df67
ID
 des fehlerhaften Prozesses: 0x35c  Startzeit der fehlerhaften Anwendung: 0x01cc91ae6e0e84a0
Pfad
 der fehlerhaften Anwendung: C:\Windows\system32\LogonUI.exe  Pfad des fehlerhaften
 Moduls: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\MSVCR80.dll
Berichtskennung:
 b6aa6080-fda1-11e0-a570-00225ff7ce9d
 
Error - 23.10.2011 14:06:29 | Computer Name = ***PCName | Source = WinMgmt | ID = 10
Description = 
 
Error - 24.10.2011 01:11:51 | Computer Name = ***PCName | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: LogonUI.exe, Version: 6.1.7601.17514,
 Zeitstempel: 0x4ce79f70  Name des fehlerhaften Moduls: MSVCR80.dll, Version: 8.0.50727.4940,
 Zeitstempel: 0x4ca2b4dd  Ausnahmecode: 0xc000000d  Fehleroffset: 0x000000000001df67
ID
 des fehlerhaften Prozesses: 0x3c0  Startzeit der fehlerhaften Anwendung: 0x01cc920b679b8a20
Pfad
 der fehlerhaften Anwendung: C:\Windows\system32\LogonUI.exe  Pfad des fehlerhaften
 Moduls: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\MSVCR80.dll
Berichtskennung:
 adc7bdc0-fdfe-11e0-9946-00225ff7ce9d
 
Error - 24.10.2011 01:12:01 | Computer Name = ***PCName | Source = WinMgmt | ID = 10
Description = 
 
Error - 24.10.2011 13:55:34 | Computer Name = ***PCName | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: LogonUI.exe, Version: 6.1.7601.17514,
 Zeitstempel: 0x4ce79f70  Name des fehlerhaften Moduls: MSVCR80.dll, Version: 8.0.50727.4940,
 Zeitstempel: 0x4ca2b4dd  Ausnahmecode: 0xc000000d  Fehleroffset: 0x000000000001df67
ID
 des fehlerhaften Prozesses: 0x3b8  Startzeit der fehlerhaften Anwendung: 0x01cc92761920d4c0
Pfad
 der fehlerhaften Anwendung: C:\Windows\system32\LogonUI.exe  Pfad des fehlerhaften
 Moduls: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\MSVCR80.dll
Berichtskennung:
 5ed140e0-fe69-11e0-9813-00225ff7ce9d
 
Error - 24.10.2011 13:55:45 | Computer Name = ***PCName | Source = WinMgmt | ID = 10
Description = 
 
Error - 24.10.2011 13:59:34 | Computer Name = ***PCName | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: plugin-container.exe, Version: 5.0.0.4183,
 Zeitstempel: 0x4df952a0  Name des fehlerhaften Moduls: FOXITR~1.OCX, Version: 1.0.1.224,
 Zeitstempel: 0x4b849404  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00002dce  ID des fehlerhaften
 Prozesses: 0x9b4  Startzeit der fehlerhaften Anwendung: 0x01cc9276ae689ef0  Pfad der
 fehlerhaften Anwendung: C:\Program Files\Online\Mozilla Firefox\plugin-container.exe
Pfad
 des fehlerhaften Moduls: C:\PROGRA~2\Office\FOXITR~1\plugins\FOXITR~1.OCX  Berichtskennung:
 ed7601f0-fe69-11e0-9813-00225ff7ce9d
 
Error - 25.10.2011 01:13:26 | Computer Name = ***PCName | Source = WinMgmt | ID = 10
Description = 
 
Error - 25.10.2011 15:24:09 | Computer Name = ***PCName | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: LogonUI.exe, Version: 6.1.7601.17514,
 Zeitstempel: 0x4ce79f70  Name des fehlerhaften Moduls: MSVCR80.dll, Version: 8.0.50727.4940,
 Zeitstempel: 0x4ca2b4dd  Ausnahmecode: 0xc000000d  Fehleroffset: 0x000000000001df67
ID
 des fehlerhaften Prozesses: 0x3c0  Startzeit der fehlerhaften Anwendung: 0x01cc934ba2240e60
Pfad
 der fehlerhaften Anwendung: C:\Windows\system32\LogonUI.exe  Pfad des fehlerhaften
 Moduls: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\MSVCR80.dll
Berichtskennung:
 e9111160-ff3e-11e0-b0bc-00225ff7ce9d
 
[ System Events ]
Error - 14.11.2012 18:09:05 | Computer Name = ***PCName | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 14.11.2012 18:14:05 | Computer Name = ***PCName | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 14.11.2012 18:14:05 | Computer Name = ***PCName | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 14.11.2012 18:14:05 | Computer Name = ***PCName | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 14.11.2012 18:16:13 | Computer Name = ***PCName | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 14.11.2012 18:16:13 | Computer Name = ***PCName | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 14.11.2012 18:16:13 | Computer Name = ***PCName | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 14.11.2012 18:21:12 | Computer Name = ***PCName | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 14.11.2012 18:21:12 | Computer Name = ***PCName | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 14.11.2012 18:21:12 | Computer Name = ***PCName | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
 
< End of report >