Hallo liebe TB Community,

ich habe mich vor ein paar Tagen mit dem GVU Trojaner infiziert und diesen aber mit einem Wiederherstellungspunkt umgangen. Ich hatte dann meinen Laptop mithilfe von Malwarebytes und Microsoft Security Essentials gescannt und einige Schädlinge entfernt. Leider kann ich nicht mehr genau sagen was genau erkannt wurde, ich kann mich nur an Javascript Exploits erinnern.

Danach war eigentlich auch alles hübsch, bis mich ein User angeschrieben hat und mir sagte, das beim besuchen meiner Webseiten sich das Antivir meldet. Daraufhin habe ich meine Webseiten gescannt und Schadcode gefunden. Es hat nur Webseiten getroffen die ich mit FileZilla bearbeitet habe. Also gehe ich davon aus, das die Malware FTP Passörter ausliest und sich über Webseiten weiterverteilt.

Meine Webseiten konnte ich berenigen, trotzdem traue ich mich nicht mehr FileZilla zu benutzen da ich nicht weiß, was noch auf meinem PC schlummert..

OTL Scann

OTL logfile created on: 24.11.2012 00:49:37 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\NBLeipzig2\Desktop
 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,46 Gb Total Physical Memory | 2,32 Gb Available Physical Memory | 67,06% Memory free
6,91 Gb Paging File | 5,55 Gb Available in Paging File | 80,25% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 218,20 Gb Total Space | 164,64 Gb Free Space | 75,46% Space Free | Partition Type: NTFS
Drive D: | 489,50 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: NB16NGLEI2 | User Name: NBLeipzig2 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.11.24 00:47:12 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\NBLeipzig2\Desktop\OTL.exe
PRC - [2012.10.30 23:50:59 | 004,297,136 | ---- | M] (AVAST Software) -- C:\Programme\AVAST Software\Avast\AvastUI.exe
PRC - [2012.10.30 23:50:59 | 000,044,808 | ---- | M] (AVAST Software) -- C:\Programme\AVAST Software\Avast\AvastSvc.exe
PRC - [2012.09.29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2012.09.12 17:25:22 | 000,020,472 | ---- | M] (Microsoft Corporation) -- c:\Programme\Microsoft Security Client\MsMpEng.exe
PRC - [2012.09.12 17:19:44 | 000,947,176 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\msseces.exe
PRC - [2012.08.20 18:37:58 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.02.27 04:14:40 | 000,038,248 | ---- | M] (Mindjet) -- C:\Programme\Mindjet\MindManager 10\MmReminderService.exe
PRC - [2012.02.10 10:28:06 | 000,240,408 | ---- | M] (Microsoft Corporation.) -- C:\Programme\Microsoft\BingBar\7.1.361.0\SeaPort.EXE
PRC - [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.12.10 18:30:50 | 000,086,880 | ---- | M] (Microsoft Corporation) -- c:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe
PRC - [2010.12.10 18:29:30 | 000,238,944 | ---- | M] (Microsoft Corporation) -- c:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe
PRC - [2010.11.20 13:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2010.11.20 13:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010.01.23 00:07:07 | 004,562,944 | ---- | M] (Dell Inc.) -- C:\Programme\Dell\Dell Wireless WLAN Card\WLTRAY.EXE
PRC - [2010.01.23 00:07:07 | 000,026,112 | ---- | M] () -- C:\Programme\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE
PRC - [2010.01.23 00:07:06 | 003,086,848 | ---- | M] (Dell Inc.) -- C:\Programme\Dell\Dell Wireless WLAN Card\BCMWLTRY.EXE
PRC - [2009.12.22 03:31:26 | 000,217,088 | ---- | M] (Teruten) -- C:\Windows\System32\FsUsbExService.Exe
PRC - [2009.12.22 03:31:02 | 000,095,568 | ---- | M] (Devguru Co., Ltd.) -- C:\Windows\System32\dgdersvc.exe
PRC - [2009.10.06 02:40:58 | 001,826,816 | ---- | M] (Smith Micro Software, Inc.) -- C:\Programme\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe
PRC - [2009.10.06 02:40:40 | 000,076,288 | ---- | M] (Smith Micro Software, Inc.) -- C:\Programme\Dell\Dell ControlPoint\Connection Manager\SMManager.exe
PRC - [2009.08.28 15:33:28 | 000,116,032 | ---- | M] (Dell Inc.) -- C:\Programme\Dell Printers\Additional Color Laser Software\Status Monitor\dlpwdnt.exe
PRC - [2009.08.18 10:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
PRC - [2009.08.18 10:29:22 | 000,183,152 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
PRC - [2009.08.14 19:30:56 | 000,015,872 | ---- | M] (Broadcom Corporation) -- C:\Programme\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe
PRC - [2009.08.07 12:29:54 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2009.08.07 12:29:36 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2009.08.01 01:16:12 | 000,458,844 | ---- | M] (IDT, Inc.) -- C:\Programme\IDT\WDM\sttray.exe
PRC - [2009.08.01 01:16:12 | 000,221,266 | ---- | M] (IDT, Inc.) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_450b431403c091e3\stacsv.exe
PRC - [2009.07.27 19:18:02 | 000,134,656 | ---- | M] (Wave Systems Corp.) -- C:\Programme\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe
PRC - [2009.07.16 19:13:34 | 001,245,472 | ---- | M] (Dell Inc.) -- C:\Programme\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe
PRC - [2009.07.16 19:10:22 | 000,382,752 | ---- | M] (Dell Inc.) -- c:\Programme\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe
PRC - [2009.07.08 09:12:00 | 000,243,008 | ---- | M] (Dell Inc.) -- C:\Programme\Dell Printers\Additional Color Laser Software\Updater\dlupdr.exe
PRC - [2009.07.08 09:11:32 | 000,406,840 | ---- | M] (Dell Inc.) -- C:\Programme\Dell Printers\Additional Color Laser Software\Status Monitor\dlpsp.exe
PRC - [2009.06.25 03:19:50 | 000,140,520 | ---- | M] (CyberLink Corp.) -- C:\Programme\CyberLink\PowerDVD DX\PDVDDXSrv.exe
PRC - [2009.06.19 23:57:40 | 000,249,856 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Programme\DellTPad\Apoint.exe
PRC - [2009.06.12 04:46:46 | 000,656,384 | ---- | M] (Dell Inc.) -- C:\Programme\Dell\Dell ControlPoint\Dell.ControlPoint.exe
PRC - [2009.06.12 01:43:08 | 001,622,016 | ---- | M] (Wave Systems Corp.) -- C:\Programme\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
PRC - [2009.05.16 00:33:40 | 001,803,512 | ---- | M] (AuthenTec, Inc.) -- C:\Programme\Fingerprint Sensor\AtService.exe
PRC - [2009.04.27 20:40:26 | 000,293,968 | ---- | M] (Dell Inc.) -- C:\Programme\Dell\Dell ControlPoint\DCPButtonSvc.exe
PRC - [2009.02.23 18:48:50 | 000,030,312 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
PRC - [2009.02.01 09:15:38 | 000,049,152 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Programme\DellTPad\ApntEx.exe
PRC - [2009.02.01 07:43:30 | 000,049,250 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Programme\DellTPad\hidfind.exe
PRC - [2009.01.26 14:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy\SDWinSec.exe
PRC - [2008.11.24 22:56:46 | 000,054,568 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Programme\DellTPad\ApMsgFwd.exe
PRC - [2006.12.07 16:52:14 | 000,140,184 | ---- | M] (Dell Inc.) -- C:\Programme\Dell Printers\Additional Color Laser Software\Status Monitor\dlsdbnt.exe
PRC - [1997.08.28 04:20:00 | 000,021,504 | ---- | M] () -- C:\Windows\System32\drivers\trcboot.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.11.20 04:50:22 | 001,051,136 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\66694f9192bd0dddc2eaf90fbcbcd555\System.Management.ni.dll
MOD - [2012.11.20 03:21:14 | 011,833,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\03cfab5534482e8fc313ead6edc19100\System.Web.ni.dll
MOD - [2012.11.20 03:21:08 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\413288993ff690e8251d2dbe32bee01f\System.Runtime.Remoting.ni.dll
MOD - [2012.11.20 03:20:40 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d040079bc7148afeca03c5abb6fc3c61\System.Windows.Forms.ni.dll
MOD - [2012.11.20 03:20:32 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\4e80768a2d88c7a333e43cbb7a6c0705\System.Drawing.ni.dll
MOD - [2012.11.20 03:20:10 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\25e672ea505e50ab058258ac72a54f02\System.Xml.ni.dll
MOD - [2012.11.20 03:20:06 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\c64ca3678261c8ffcd9e7efd1af6ed54\System.Configuration.ni.dll
MOD - [2012.11.20 03:20:05 | 007,988,736 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9dd758ac0bf7358ac6e4720610fcc63c\System.ni.dll
MOD - [2012.11.20 03:19:53 | 011,493,376 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\187d7c66735c533de851c76384f86912\mscorlib.ni.dll
MOD - [2012.11.10 20:57:08 | 000,093,696 | ---- | M] () -- C:\Programme\FileZilla FTP Client\fzshellext.dll
MOD - [2012.02.27 04:13:54 | 000,151,376 | ---- | M] () -- C:\Programme\Mindjet\MindManager 10\zlib.dll
MOD - [2012.02.20 20:29:04 | 000,087,912 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012.02.20 20:28:42 | 001,242,472 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2012.02.17 19:55:35 | 000,166,912 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
MOD - [2010.11.13 01:02:21 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010.01.23 00:13:39 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\Status Lib\1.6.320.13950__f25c74fcad379103\Status Lib.dll
MOD - [2010.01.23 00:13:39 | 000,008,192 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\StatusInterfaces\1.6.320.13949__4ca2a925deedf37d\StatusInterfaces.dll
MOD - [2010.01.23 00:07:06 | 000,055,808 | ---- | M] () -- C:\Programme\Dell\Dell Wireless WLAN Card\bcmwlrmt.dll
MOD - [2009.10.06 02:36:48 | 000,569,344 | ---- | M] () -- C:\Programme\Dell\Dell ControlPoint\Connection Manager\SmithMicro.Message.XmlSerializers.dll
MOD - [2009.07.27 19:17:10 | 000,249,856 | ---- | M] () -- C:\Programme\Wave Systems Corp\Services Manager\DocMgr\bin\ContextMenuItem.dll
MOD - [2009.07.27 19:15:32 | 000,249,856 | ---- | M] () -- C:\Windows\System32\wxvault.dll
MOD - [2009.06.03 19:07:50 | 000,010,752 | ---- | M] () -- C:\Windows\System32\Wavx_ESC_Logging.dll
MOD - [2008.11.12 20:29:06 | 000,004,608 | ---- | M] () -- C:\Programme\NTRU Cryptosystems\NTRU TCG Software Stack\bin\TspPopup_DEU.dll
 
 
========== Services (SafeList) ==========
 
SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SBSDWSCService)
SRV - [2012.10.30 23:50:59 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Programme\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2012.10.10 16:42:06 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.09.29 19:54:26 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.09.29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012.09.12 17:25:24 | 000,287,824 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Programme\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV - [2012.09.12 17:25:22 | 000,020,472 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.07.21 02:59:55 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.02.10 10:28:06 | 000,240,408 | ---- | M] (Microsoft Corporation.) [On_Demand | Running] -- C:\Programme\Microsoft\BingBar\7.1.361.0\SeaPort.EXE -- (BBUpdate)
SRV - [2012.02.10 10:28:06 | 000,193,816 | ---- | M] (Microsoft Corporation.) [Auto | Stopped] -- C:\Programme\Microsoft\BingBar\7.1.361.0\BBSvc.EXE -- (BBSvc)
SRV - [2011.07.20 04:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2010.12.10 18:30:50 | 000,086,880 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter)
SRV - [2010.12.10 18:29:30 | 029,293,408 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe -- (MSSQL$MSSMLBIZ)
SRV - [2010.12.10 18:29:30 | 000,238,944 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe -- (SQLBrowser)
SRV - [2010.12.10 18:29:30 | 000,044,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Programme\Microsoft SQL Server\90\Shared\sqladhlp90.exe -- (MSSQLServerADHelper)
SRV - [2010.11.20 13:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2010.01.23 00:07:07 | 000,026,112 | ---- | M] () [Auto | Running] -- C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE -- (wltrysvc)
SRV - [2010.01.15 13:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Programme\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2009.12.22 03:31:26 | 000,217,088 | ---- | M] (Teruten) [Auto | Running] -- C:\Windows\System32\FsUsbExService.Exe -- (FsUsbExService)
SRV - [2009.12.22 03:31:02 | 000,095,568 | ---- | M] (Devguru Co., Ltd.) [Auto | Running] -- C:\Windows\System32\dgdersvc.exe -- (dgdersvc)
SRV - [2009.10.06 02:40:40 | 000,076,288 | ---- | M] (Smith Micro Software, Inc.) [Auto | Running] -- C:\Programme\Dell\Dell ControlPoint\Connection Manager\SMManager.exe -- (SMManager)
SRV - [2009.08.28 15:33:28 | 000,116,032 | ---- | M] (Dell Inc.) [Auto | Running] -- C:\Programme\Dell Printers\Additional Color Laser Software\Status Monitor\dlpwdnt.exe -- (DLPWD)
SRV - [2009.08.18 10:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2009.08.07 12:29:36 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON)
SRV - [2009.08.01 01:16:12 | 000,221,266 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_450b431403c091e3\stacsv.exe -- (STacSV)
SRV - [2009.07.16 19:10:22 | 000,382,752 | ---- | M] (Dell Inc.) [Auto | Running] -- c:\Programme\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe -- (dcpsysmgrsvc)
SRV - [2009.07.14 02:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009.06.12 01:43:08 | 001,622,016 | ---- | M] (Wave Systems Corp.) [Auto | Running] -- C:\Programme\Wave Systems Corp\Trusted Drive Manager\TdmService.exe -- (TdmService)
SRV - [2009.06.03 19:15:24 | 001,019,904 | ---- | M] (Wave Systems Corp.) [On_Demand | Stopped] -- C:\Programme\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe -- (SecureStorageService)
SRV - [2009.05.16 00:33:40 | 001,803,512 | ---- | M] (AuthenTec, Inc.) [Auto | Running] -- C:\Programme\Fingerprint Sensor\AtService.exe -- (ATService)
SRV - [2009.04.27 20:40:26 | 000,293,968 | ---- | M] (Dell Inc.) [Auto | Running] -- C:\Programme\Dell\Dell ControlPoint\DCPButtonSvc.exe -- (buttonsvc32)
SRV - [2009.02.23 18:48:50 | 000,030,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe -- (BcmSqlStartupSvc)
SRV - [2008.11.12 20:25:48 | 001,273,856 | ---- | M] () [Auto | Stopped] -- C:\Programme\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe -- (tcsd_win32.exe)
SRV - [2008.11.11 08:38:06 | 000,620,544 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2008.10.24 15:17:52 | 000,145,248 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
SRV - [2006.12.07 16:52:14 | 000,140,184 | ---- | M] (Dell Inc.) [Auto | Running] -- C:\Programme\Dell Printers\Additional Color Laser Software\Status Monitor\dlsdbnt.exe -- (DLSDB)
SRV - [1997.08.28 04:20:00 | 000,021,504 | ---- | M] () [Auto | Running] -- C:\Windows\System32\drivers\trcboot.exe -- (TrcBoot)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\swvnic.sys -- (SWVNIC)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\NvtSp50.sys -- (NvtSp50)
DRV - [2012.10.30 23:51:58 | 000,738,504 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2012.10.30 23:51:58 | 000,361,032 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2012.10.30 23:51:58 | 000,054,232 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2012.10.30 23:51:57 | 000,058,680 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2012.10.30 23:51:56 | 000,021,256 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2012.10.15 17:59:28 | 000,044,784 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr2.sys -- (aswRdr)
DRV - [2012.09.29 19:54:26 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012.08.30 22:03:50 | 000,099,272 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2010.11.20 13:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010.11.20 13:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010.11.20 13:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010.11.20 11:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.11.20 10:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010.11.20 10:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010.11.20 10:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010.01.23 00:07:06 | 000,018,424 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\bcm42rly.sys -- (BCM42RLY)
DRV - [2009.12.22 03:31:26 | 000,036,640 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\FsUsbExDisk.Sys -- (FsUsbExDisk)
DRV - [2009.12.22 03:31:02 | 000,018,136 | ---- | M] (Devguru Co., Ltd) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\dgderdrv.sys -- (dgderdrv)
DRV - [2009.11.20 05:30:42 | 000,215,088 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2009.09.19 06:30:10 | 000,123,648 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bmdm.sys -- (ss_bmdm)
DRV - [2009.09.19 06:30:10 | 000,100,224 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bserd.sys -- (ss_bserd)
DRV - [2009.09.19 06:30:10 | 000,098,432 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bbus.sys -- (ss_bbus)
DRV - [2009.09.19 06:30:10 | 000,014,848 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bmdfl.sys -- (ss_bmdfl)
DRV - [2009.08.01 01:16:12 | 000,409,088 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA)
DRV - [2009.07.27 19:17:56 | 000,200,192 | ---- | M] (Wave Systems Corp.) [File_System | Auto | Running] -- C:\Windows\System32\drivers\WavxDMgr.sys -- (WavxDMgr)
DRV - [2009.07.14 00:45:20 | 000,007,680 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\acpials.sys -- (acpials)
DRV - [2009.07.05 03:37:08 | 000,038,400 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rixdpe86.sys -- (rixdpcie)
DRV - [2009.07.02 17:50:16 | 000,047,104 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rimspe86.sys -- (rimspci)
DRV - [2009.07.01 04:28:28 | 000,049,152 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\risdpe86.sys -- (risdpcie)
DRV - [2009.06.26 01:58:10 | 000,048,128 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2009.06.26 01:25:58 | 000,038,400 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2009.06.26 01:10:48 | 000,044,544 | ---- | M] (REDC) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2009.05.26 20:12:36 | 000,122,368 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService)
DRV - [2009.05.11 18:55:12 | 000,084,992 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\basp.sys -- (Blfp)
DRV - [2008.11.16 18:39:44 | 000,131,984 | ---- | M] (Deterministic Networks, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\dne2000.sys -- (DNE)
DRV - [2008.08.26 08:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008.06.04 21:14:00 | 000,026,608 | ---- | M] (Dell Inc) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\PBADRV.sys -- (PBADRV)
DRV - [1997.08.28 04:20:00 | 000,022,600 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\klognt.sys -- (KLOGNT)
DRV - [1997.08.28 04:20:00 | 000,015,360 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\pcscoax.sys -- (pcscoax)
DRV - [1997.08.28 04:20:00 | 000,011,488 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\nstrcnt.sys -- (NsTrcNT)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {B6AAF1CD-8016-481C-9D47-DEDB01BAE019}
IE - HKLM\..\SearchScopes\{B6AAF1CD-8016-481C-9D47-DEDB01BAE019}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=DLRDF8&pc=MDDR&src=IE-SearchBox
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/USREL/8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\..\SearchScopes,DefaultScope = {F16811EB-8618-4404-85C0-EE21B5673048}
IE - HKCU\..\SearchScopes\{F16811EB-8618-4404-85C0-EE21B5673048}: "URL" = hxxp://www.google.de/search?q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledAddons: {7822cf50-08ee-4915-9872-ee92472df6cb}:0.986
FF - prefs.js..extensions.enabledAddons: {3b56bcc7-54e5-44a2-9b44-66c3ef58c13e}:0.9.5.1
FF - prefs.js..extensions.enabledAddons: {c151d79e-e61b-4a90-a887-5a46d38fba99}:2.8
FF - prefs.js..extensions.enabledAddons: {9A207F60-3F1C-4ED0-972D-0A4CDFBFF803}:1.0
FF - prefs.js..extensions.enabledAddons: {81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}:7.6.0.0
FF - prefs.js..extensions.enabledAddons: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.6.1
FF - prefs.js..extensions.enabledItems: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:1.0.7
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}:6.0.31
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012.08.05 16:20:14 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012.11.20 03:33:15 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.07.21 02:59:56 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.08.16 21:59:26 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\extensions\\{9A207F60-3F1C-4ED0-972D-0A4CDFBFF803}: C:\Users\NBLeipzig2\AppData\Roaming\14001.006 [2012.07.29 18:35:20 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012.08.05 16:20:14 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.07.21 02:59:56 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.08.16 21:59:26 | 000,000,000 | ---D | M]
 
[2010.02.08 14:34:38 | 000,000,000 | ---D | M] (No name found) -- C:\Users\NBLeipzig2\AppData\Roaming\mozilla\Extensions
[2012.11.20 03:51:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\NBLeipzig2\AppData\Roaming\mozilla\Firefox\Profiles\uadx3b8s.default\extensions
[2012.05.10 00:37:42 | 000,000,000 | ---D | M] (Html Validator) -- C:\Users\NBLeipzig2\AppData\Roaming\mozilla\Firefox\Profiles\uadx3b8s.default\extensions\{3b56bcc7-54e5-44a2-9b44-66c3ef58c13e}
[2012.03.30 21:50:16 | 000,000,000 | ---D | M] (affilorama) -- C:\Users\NBLeipzig2\AppData\Roaming\mozilla\Firefox\Profiles\uadx3b8s.default\extensions\{7822cf50-08ee-4915-9872-ee92472df6cb}
[2012.10.31 21:14:43 | 000,000,000 | ---D | M] (iMacros for Firefox) -- C:\Users\NBLeipzig2\AppData\Roaming\mozilla\Firefox\Profiles\uadx3b8s.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}
[2012.04.02 14:09:57 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\NBLeipzig2\AppData\Roaming\mozilla\Firefox\Profiles\uadx3b8s.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.11.17 03:28:07 | 000,012,413 | ---- | M] () (No name found) -- C:\Users\NBLeipzig2\AppData\Roaming\mozilla\firefox\profiles\uadx3b8s.default\extensions\suspendbackgroundtabs@adblockplus.org.xpi
[2012.11.20 03:51:56 | 000,530,679 | ---- | M] () (No name found) -- C:\Users\NBLeipzig2\AppData\Roaming\mozilla\firefox\profiles\uadx3b8s.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2012.07.15 18:09:54 | 000,112,944 | ---- | M] () (No name found) -- C:\Users\NBLeipzig2\AppData\Roaming\mozilla\firefox\profiles\uadx3b8s.default\extensions\{c151d79e-e61b-4a90-a887-5a46d38fba99}.xpi
[2012.09.04 13:49:36 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.07.29 18:35:20 | 000,000,000 | ---D | M] (Java Link Helper) -- C:\USERS\NBLEIPZIG2\APPDATA\ROAMING\14001.006
[2012.07.21 02:59:56 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.03.13 06:23:34 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.03.13 06:06:36 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.03.13 06:23:34 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.03.13 06:23:34 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.03.13 06:23:34 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.03.13 06:23:34 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - homepage: hxxp://www.google.com/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: hxxp://www.google.com/
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\21.0.1180.83\PepperFlash\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\23.0.1271.64\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\23.0.1271.64\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\23.0.1271.64\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.89\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 6 U33 (Enabled) = C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: Java Deployment Toolkit 6.0.330.5 (Enabled) = C:\Windows\system32\npdeployJava1.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - Extension: avast! WebRep = C:\Users\NBLeipzig2\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1466_0\
CHR - Extension: DvdVideoSoft Free Youtube Download = C:\Users\NBLeipzig2\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.0.0_0\
 
O1 HOSTS File: ([2009.06.10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (CmjBrowserHelperObject Object) - {6FE6A929-59D1-4763-91AD-29B61CFFB35B} - C:\Programme\Mindjet\MindManager 10\Mm8InternetExplorer.dll (Mindjet)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Programme\Microsoft\BingBar\7.1.361.0\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\7.1.361.0\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Apoint] C:\Programme\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Broadcom Wireless Manager UI] C:\Programme\Dell\Dell Wireless WLAN Card\WLTRAY.EXE (Dell Inc.)
O4 - HKLM..\Run: [ChangeTPMAuth] C:\Program Files\Wave Systems Corp\Common\ChangeTPMAuth.exe (Wave Systems Corp.)
O4 - HKLM..\Run: [DellConnectionManager] C:\Program Files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe (Smith Micro Software, Inc.)
O4 - HKLM..\Run: [DellControlPoint] c:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe (Dell Inc.)
O4 - HKLM..\Run: [DLPSP] C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE (Dell Inc.)
O4 - HKLM..\Run: [DLQLU] C:\Program Files\Dell Printers\Additional Color Laser Software\Launcher\DLQLU.EXE (Dell Inc.)
O4 - HKLM..\Run: [DLUPDR] C:\Program Files\Dell Printers\Additional Color Laser Software\Updater\DLUPDR.EXE (Dell Inc.)
O4 - HKLM..\Run: [IAAnotif] C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [MMReminderService] C:\Programme\Mindjet\MindManager 10\MmReminderService.exe (Mindjet)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [USCService] C:\Programme\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe (Broadcom Corporation)
O4 - HKLM..\Run: [WavXMgr] C:\Programme\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe (Wave Systems Corp.)
O4 - HKCU..\Run: [Infium] C:\Program Files\QIP 2012\qip.exe (QIP)
O4 - HKCU..\Run: [InversMonitor] "C:\Program Files\klickTel\Inverssuche Sommer 2009\KMON.EXE" /MONITOR" File not found
O4 - HKCU..\Run: [KiesTrayAgent] C:\Program Files\Samsung\Kies\/\KiesTrayAgent.exe ()
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\Windows\System32\Macromed\Flash\FlashUtil32_11_4_402_287_Plugin.exe (Adobe Systems Incorporated)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Bild an MindManager senden - C:\Program Files\Mindjet\MindManager 10\Mm8InternetExplorer.dll (Mindjet)
O8 - Extra context menu item: Free YouTube Download - C:\Users\NBLeipzig2\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\NBLeipzig2\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Link an MindManager senden - C:\Program Files\Mindjet\MindManager 10\Mm8InternetExplorer.dll (Mindjet)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Seite an MindManager senden - C:\Program Files\Mindjet\MindManager 10\Mm8InternetExplorer.dll (Mindjet)
O8 - Extra context menu item: Text an MindManager senden - C:\Program Files\Mindjet\MindManager 10\Mm8InternetExplorer.dll (Mindjet)
O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: An Mindjet MindManager senden - {2F72393D-2472-4F82-B600-ED77F354B7FF} - C:\Programme\Mindjet\MindManager 10\Mm8InternetExplorer.dll (Mindjet)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7D4F6C15-4857-4180-8BEC-AABE97F72336}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O30 - LSA: Authentication Packages - (wvauth) - C:\Windows\System32\wvauth.dll (Wave Systems Corp.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2010.03.31 15:11:57 | 000,641,198 | R--- | M] () - D:\Autorun.inf -- [ CDFS ]
O33 - MountPoints2\{6a4c101e-71fe-11e0-a8c0-a4badba0b4ca}\Shell - "" = AutoRun
O33 - MountPoints2\{6a4c101e-71fe-11e0-a8c0-a4badba0b4ca}\Shell\AutoRun\command - "" = E:\SafeStick.exe
O33 - MountPoints2\{d5b0638f-076e-11df-88a1-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{d5b0638f-076e-11df-88a1-806e6f6e6963}\Shell\AutoRun\command - "" = D:\Setup.exe -- [2010.03.07 22:26:05 | 001,139,048 | R--- | M] (Hewlett-Packard)
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.11.24 00:47:12 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\NBLeipzig2\Desktop\OTL.exe
[2012.11.22 00:24:31 | 000,000,000 | ---D | C] -- C:\Users\NBLeipzig2\AppData\Roaming\Malwarebytes
[2012.11.22 00:23:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.11.22 00:23:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.11.22 00:23:45 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.11.22 00:23:45 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.11.21 22:14:44 | 000,000,000 | ---D | C] -- C:\Users\NBLeipzig2\Desktop\Hack
[2012.11.21 16:34:54 | 000,000,000 | ---D | C] -- C:\Users\NBLeipzig2\Desktop\cakifo
[2012.11.21 01:19:17 | 000,000,000 | ---D | C] -- C:\Users\NBLeipzig2\Desktop\creative-commons-license-manager
[2012.11.20 01:07:06 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client
[2012.11.17 21:20:39 | 000,000,000 | ---D | C] -- C:\Users\NBLeipzig2\AppData\Local\fontconfig
[2012.11.17 21:20:38 | 000,000,000 | ---D | C] -- C:\Users\NBLeipzig2\AppData\Local\gegl-0.2
[2012.11.17 21:20:38 | 000,000,000 | ---D | C] -- C:\Users\NBLeipzig2\.gimp-2.8
[2012.11.17 20:59:29 | 000,000,000 | ---D | C] -- C:\Program Files\GIMP 2
[2012.11.16 01:46:20 | 000,000,000 | ---D | C] -- C:\Users\NBLeipzig2\Desktop\Going Green Theme German
[2012.11.16 01:42:01 | 000,000,000 | ---D | C] -- C:\Users\NBLeipzig2\Desktop\Genesis German
[2012.11.16 01:05:55 | 000,000,000 | ---D | C] -- C:\Program Files\Poedit
[2012.10.31 21:14:48 | 000,000,000 | ---D | C] -- C:\Users\NBLeipzig2\Documents\iMacros
[2012.10.31 17:41:52 | 000,000,000 | ---D | C] -- C:\Program Files\Tweet Adder 3
[2012.10.31 17:41:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweet Adder 3
[1 C:\Users\NBLeipzig2\AppData\Roaming\*.tmp files -> C:\Users\NBLeipzig2\AppData\Roaming\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.11.24 00:47:12 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\NBLeipzig2\Desktop\OTL.exe
[2012.11.24 00:46:00 | 000,000,000 | ---- | M] () -- C:\Users\NBLeipzig2\defogger_reenable
[2012.11.24 00:45:15 | 000,050,477 | ---- | M] () -- C:\Users\NBLeipzig2\Desktop\Defogger.exe
[2012.11.24 00:42:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.11.24 00:05:00 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.11.23 23:37:20 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.11.23 23:27:21 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.11.22 16:03:41 | 000,014,032 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.11.22 16:03:41 | 000,014,032 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.11.22 16:00:59 | 000,714,918 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.11.22 16:00:59 | 000,665,892 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.11.22 16:00:59 | 000,154,814 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.11.22 16:00:59 | 000,125,026 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.11.22 15:56:48 | 000,000,000 | ---- | M] () -- C:\Users\NBLeipzig2\AppData\Local\WavXMapDrive.bat
[2012.11.22 15:56:08 | 000,001,024 | ---- | M] () -- C:\.rnd
[2012.11.22 15:56:01 | 2783,313,920 | -HS- | M] () -- C:\hiberfil.sys
[2012.11.22 03:43:34 | 000,512,000 | ---- | M] () -- C:\Users\NBLeipzig2\Documents\sumaop.ps6
[2012.11.22 03:43:26 | 001,627,872 | ---- | M] () -- C:\Users\NBLeipzig2\Desktop\pwd-backup.psx
[2012.11.22 02:23:39 | 000,001,441 | ---- | M] () -- C:\scu.dat
[2012.11.22 00:23:52 | 000,001,073 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.11.21 00:28:01 | 000,146,786 | ---- | M] () -- C:\Users\NBLeipzig2\Desktop\Pilze in der Ernährung.jpg
[2012.11.21 00:27:00 | 000,581,035 | ---- | M] () -- C:\Users\NBLeipzig2\Desktop\pilze-ernährung1.jpg
[2012.11.20 03:33:16 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2012.11.20 03:18:01 | 000,414,360 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.11.20 01:07:29 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif
[2012.11.20 01:00:24 | 000,002,041 | ---- | M] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2012.11.20 00:50:36 | 095,023,320 | ---- | M] () -- C:\ProgramData\dsgsdgdsgdsgw.pad
[2012.11.18 01:26:45 | 000,584,824 | ---- | M] () -- C:\Users\NBLeipzig2\Desktop\4449735635_e26c03b4d3_b.jpg
[2012.11.18 01:22:03 | 000,145,950 | ---- | M] () -- C:\Users\NBLeipzig2\Desktop\Pilze zubereiten.jpg
[2012.11.17 21:53:38 | 000,011,186 | ---- | M] () -- C:\Users\NBLeipzig2\Desktop\im3242354.png
[2012.11.17 21:53:38 | 000,002,000 | ---- | M] () -- C:\Users\NBLeipzig2\AppData\Local\recently-used.xbel
[2012.11.17 21:27:13 | 000,000,000 | ---- | M] () -- C:\Users\NBLeipzig2\Desktop\sitemap.xml.gz
[2012.11.16 00:10:35 | 000,085,052 | ---- | M] () -- C:\Users\NBLeipzig2\Desktop\Pilze.jpg
[2012.11.15 23:58:54 | 000,410,032 | ---- | M] () -- C:\Users\NBLeipzig2\Desktop\Pilze2.jpg
[2012.11.02 03:44:41 | 000,140,923 | ---- | M] () -- C:\Users\NBLeipzig2\Desktop\xtc1.jpg
[2012.10.31 17:41:53 | 000,000,979 | ---- | M] () -- C:\Users\Public\Desktop\TweetAdder3.lnk
[2012.10.30 23:51:58 | 000,738,504 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys
[2012.10.30 23:51:58 | 000,361,032 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys
[2012.10.30 23:51:58 | 000,054,232 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswTdi.sys
[2012.10.30 23:51:57 | 000,058,680 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswMonFlt.sys
[2012.10.30 23:51:56 | 000,021,256 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswFsBlk.sys
[2012.10.30 23:51:07 | 000,041,224 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr
[2012.10.30 23:50:59 | 000,227,648 | ---- | M] (AVAST Software) -- C:\Windows\System32\aswBoot.exe
[1 C:\Users\NBLeipzig2\AppData\Roaming\*.tmp files -> C:\Users\NBLeipzig2\AppData\Roaming\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.11.24 00:46:00 | 000,000,000 | ---- | C] () -- C:\Users\NBLeipzig2\defogger_reenable
[2012.11.24 00:45:14 | 000,050,477 | ---- | C] () -- C:\Users\NBLeipzig2\Desktop\Defogger.exe
[2012.11.22 15:51:23 | 000,001,024 | ---- | C] () -- C:\.rnd
[2012.11.22 03:43:18 | 001,627,872 | ---- | C] () -- C:\Users\NBLeipzig2\Desktop\pwd-backup.psx
[2012.11.22 02:19:24 | 000,001,441 | ---- | C] () -- C:\scu.dat
[2012.11.22 00:23:52 | 000,001,073 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.11.21 00:28:01 | 000,146,786 | ---- | C] () -- C:\Users\NBLeipzig2\Desktop\Pilze in der Ernährung.jpg
[2012.11.21 00:26:59 | 000,581,035 | ---- | C] () -- C:\Users\NBLeipzig2\Desktop\pilze-ernährung1.jpg
[2012.11.20 01:07:29 | 000,001,912 | ---- | C] () -- C:\Windows\epplauncher.mif
[2012.11.20 01:07:18 | 000,002,119 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
[2012.11.20 01:06:40 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
[2012.11.20 01:05:40 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
[2012.11.20 01:00:24 | 000,002,041 | ---- | C] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2012.11.19 03:18:26 | 095,023,320 | ---- | C] () -- C:\ProgramData\dsgsdgdsgdsgw.pad
[2012.11.18 01:26:43 | 000,584,824 | ---- | C] () -- C:\Users\NBLeipzig2\Desktop\4449735635_e26c03b4d3_b.jpg
[2012.11.18 01:20:47 | 000,145,950 | ---- | C] () -- C:\Users\NBLeipzig2\Desktop\Pilze zubereiten.jpg
[2012.11.17 21:53:38 | 000,002,000 | ---- | C] () -- C:\Users\NBLeipzig2\AppData\Local\recently-used.xbel
[2012.11.17 21:53:37 | 000,011,186 | ---- | C] () -- C:\Users\NBLeipzig2\Desktop\im3242354.png
[2012.11.17 21:27:13 | 000,000,000 | ---- | C] () -- C:\Users\NBLeipzig2\Desktop\sitemap.xml.gz
[2012.11.16 01:05:57 | 000,001,139 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Poedit.lnk
[2012.11.15 23:58:52 | 000,410,032 | ---- | C] () -- C:\Users\NBLeipzig2\Desktop\Pilze2.jpg
[2012.11.15 23:58:52 | 000,085,052 | ---- | C] () -- C:\Users\NBLeipzig2\Desktop\Pilze.jpg
[2012.11.02 03:44:41 | 000,140,923 | ---- | C] () -- C:\Users\NBLeipzig2\Desktop\xtc1.jpg
[2012.08.05 16:14:30 | 000,238,316 | ---- | C] () -- C:\Windows\hpoins52.dat
[2012.07.29 18:35:11 | 000,000,034 | ---- | C] () -- C:\Users\NBLeipzig2\AppData\Roaming\blckdom.res
[2012.04.23 23:10:29 | 000,110,592 | ---- | C] () -- C:\Windows\System32\FsUsbExDevice.Dll
[2012.04.23 23:10:29 | 000,036,640 | ---- | C] () -- C:\Windows\System32\FsUsbExDisk.Sys
[2012.04.17 04:43:10 | 000,007,680 | ---- | C] () -- C:\Users\NBLeipzig2\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.03.23 15:02:12 | 000,000,181 | ---- | C] () -- C:\Windows\WININIT.INI
[2012.03.23 11:29:28 | 000,007,597 | ---- | C] () -- C:\Users\NBLeipzig2\AppData\Local\Resmon.ResmonCfg
[2011.06.23 09:02:44 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2010.02.08 12:45:25 | 000,000,000 | ---- | C] () -- C:\Users\NBLeipzig2\AppData\Local\WavXMapDrive.bat
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2012.07.29 18:35:20 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\14001.006
[2010.02.08 12:45:25 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\Broadcom
[2012.09.06 23:40:54 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\DVDVideoSoft
[2012.04.12 21:35:46 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.08.29 19:12:02 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\EurekaLog
[2012.11.21 22:23:37 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\FileZilla
[2012.03.23 15:04:59 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\klickTel
[2012.07.29 18:34:58 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\kock
[2012.09.06 23:40:53 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\OpenCandy
[2012.03.23 16:06:25 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\PasswordSafe
[2012.04.23 23:12:20 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\PC Suite
[2012.04.12 20:24:43 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\QIP
[2011.05.11 12:26:45 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\SafeStick
[2012.04.23 23:08:33 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\Samsung
[2012.05.09 13:33:53 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\ScrapeBox Link Checker Free Edition
[2010.12.10 20:49:51 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\T-Online
[2010.02.08 13:36:04 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\TeamViewer
[2012.11.17 03:37:31 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\TweetAdder3
[2010.02.08 12:45:25 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\Wave Systems Corp
[2012.08.05 20:27:25 | 000,000,000 | ---D | M] -- C:\Users\NBLeipzig2\AppData\Roaming\xmldm
 
========== Purity Check ==========
 
< End of report >
         

OTL Extras

OTL Extras logfile created on: 24.11.2012 00:49:37 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\NBLeipzig2\Desktop
 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,46 Gb Total Physical Memory | 2,32 Gb Available Physical Memory | 67,06% Memory free
6,91 Gb Paging File | 5,55 Gb Available in Paging File | 80,25% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 218,20 Gb Total Space | 164,64 Gb Free Space | 75,46% Space Free | Partition Type: NTFS
Drive D: | 489,50 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: NB16NGLEI2 | User Name: NBLeipzig2 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{10FCC9DE-19FB-4DC1-BBB7-4F4FE571A509}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{14E48BDC-77D4-4454-873C-146FE30C7B9D}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{1B44AD70-CE98-403B-8F38-707CAEF06604}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{1FB7D17F-65F3-45A8-9598-EE688F88E6E4}" = rport=137 | protocol=17 | dir=out | app=system | 
"{2C9BC5B9-D14E-4FE0-BECB-FEE74E42B57F}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | 
"{3DCC53A1-FFF8-485A-83C2-A4444BB79CD0}" = lport=445 | protocol=6 | dir=in | app=system | 
"{3DE64BC4-941F-41D5-A046-176B986A952C}" = rport=139 | protocol=6 | dir=out | app=system | 
"{3F3670F9-F2A0-4FBE-A848-44C1531786F7}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{4D497ACB-8AB1-4AAC-B071-4F09E127AEDF}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{570F9667-28DF-4AEC-B0DF-DEC11E96A23C}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{64DB6B0D-3DD1-4574-A0CF-093A9758A76F}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{719545AA-75DE-4517-8333-AC72F52BD7D1}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{7872993B-2713-40EE-8F4A-22C9552BC95B}" = rport=445 | protocol=6 | dir=out | app=system | 
"{87949095-9914-4542-867A-AE83AB067715}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{8B178DC6-90FC-435D-8351-C0F8C7793D48}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{A714DA95-8978-47B2-BAE5-8054C8072755}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{AF1CA909-B10D-45B1-8C9F-1AC75C5FCEEB}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{BA3491A2-80E5-46AC-8FA5-5C2D48C7D915}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{C1D64729-80C3-4CFE-9AC3-713483AE9D2C}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{C67650EA-D89C-4479-B4E9-31069A0379FA}" = lport=139 | protocol=6 | dir=in | app=system | 
"{C6CF8E92-6D35-42F6-A5F3-6445F7BD8C19}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{C6FEDFD0-2176-452C-B8C1-2E04AD664243}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{C7CAE8C0-51F5-4EE0-802B-BF7420AD84A0}" = lport=137 | protocol=17 | dir=in | app=system | 
"{D0966346-F469-4621-A554-2C1441DCEE70}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{D5F25DFA-C7E2-41A1-B784-37442938CA57}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{D97528C2-5426-4B2F-B3BD-A6053C9FFFCE}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{DE26578D-9946-4B2B-ABA0-15E709C4BF7F}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{E0846E71-85E0-4F24-972F-891CA49C9C17}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{E87CF183-8006-4F17-82E0-24367C682F8D}" = lport=138 | protocol=17 | dir=in | app=system | 
"{EF31F68C-AA31-40B2-88AF-3D935D18FEAA}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{EF3AAAE4-1A48-42DD-A198-09887D5E9633}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{F40336AF-F1E4-4FC1-A586-B837ED68FA16}" = rport=138 | protocol=17 | dir=out | app=system | 
"{F4D9857F-D21B-44FF-9D56-72F69BDDB7E0}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{F8B69A1B-E8E0-45A2-96D8-060F809907C6}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{FA2C8F1D-6A43-4321-B379-BF21DB48338C}" = rport=427 | protocol=17 | dir=in | svc=hpslpsvc | app=c:\windows\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02B2A826-93B5-4A53-8C17-F1D46A1A4F23}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{02D011E4-D129-40B3-B090-034842A046C8}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{08E5C140-AC6F-41EC-9C50-FD19C2D7CEA2}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpoews01.exe | 
"{0C832737-44E4-4350-9C93-07F5FA8D5FCA}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpofxs08.exe | 
"{14C7E6A5-AC0C-457A-BDC4-E823E3B33847}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{1A386D90-7F5C-4E38-ABC3-32231D4C6189}" = dir=in | app=c:\program files\hp\digital imaging\bin\hposfx08.exe | 
"{1EFE2CE4-D3CF-4EE1-B375-13B14115380E}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpzwiz01.exe | 
"{1F863032-ED56-43A8-ADB8-B4A8203CAF6F}" = dir=in | app=c:\program files\itunes\itunes.exe | 
"{2542B3E6-AEEF-413E-90B3-D70020FBB47B}" = dir=in | app=d:\setup\hpznui01.exe | 
"{302646C1-43FB-4E98-8F04-17112C3AF125}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgplgtupl.exe | 
"{31C3F79A-D5EA-4FBB-8253-57534EC36197}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{345A41D9-3112-4F16-97C6-28DC5CCA581F}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{3526BED8-F6BF-4995-92EB-DB7FC9124EB5}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgh.exe | 
"{3C348BD9-C37E-4A01-AEA4-827230F126DD}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{4534D2BD-58CE-49A3-8895-D28FCD3D8449}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{49EAB568-933D-46FA-BC0C-81DEB7CE2C24}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{5415B0D5-B8DD-46A8-B80F-B6B82BE667BD}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{577CA849-8EC3-4B69-B128-A58224F2CE20}" = dir=in | app=c:\program files\hp\hp software update\hpwucli.exe | 
"{5D3CB888-4895-49E8-85F0-A2E5DBA9DE77}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqfxt08.exe | 
"{5E847563-84BA-4CED-BFF0-7B16327D69DA}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{6268F960-FAE7-4A8C-9C61-9AC34FA67E4F}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{665A8423-CCEE-4922-B2A6-71B1615DA823}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{6A193C85-5147-4FF8-B647-0DA605411BA5}" = protocol=17 | dir=in | app=c:\program files\remote mouse\server\server.exe | 
"{73D312F4-479E-4027-B5ED-20E5FD0E9053}" = protocol=17 | dir=in | app=c:\windows\system32\muzapp.exe | 
"{762121CD-A209-46D4-8552-A086B0F7E321}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{81CE1DBE-6C55-427E-A2F1-1220ABB9B645}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{81DFA2CF-3F7F-4A61-96C7-CC2AC4043C31}" = dir=in | app=c:\program files\cyberlink\powerdvd dx\pdvddxsrv.exe | 
"{84ADE377-7385-4BD7-B65A-7D266790406A}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | 
"{89EF09CD-6B7B-4A77-AB40-58C4F9F15DF0}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgpc01.exe | 
"{8A312657-A3B7-42A3-8DE9-54CCDAE9AA60}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqtra08.exe | 
"{8DD79004-7A3F-4751-8B39-B9FBBDC389EB}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{8F9D1239-31C3-42BC-B5F1-A95EE8D749DA}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe | 
"{9686A9AC-B83C-4158-9494-E5431AC38899}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{9F12D5BC-2394-41C7-864B-632834987664}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgm.exe | 
"{A4298224-C3A8-4C7B-85F4-BE56EA8C2B5C}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{A71AB1FF-14EF-4AC6-99CD-FA492AFF656C}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpfccopy.exe | 
"{A9A50840-33CD-4895-AC2D-AD3691A70790}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{B1FDEA83-D304-488B-A5D3-1BE38D86CBDF}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe | 
"{BA56BE1B-0F79-4A03-A51B-76EA7791C36B}" = protocol=6 | dir=in | app=c:\program files\remote mouse\server\server.exe | 
"{BD4E0AEA-FC74-47A6-A908-E78B0A2101CB}" = dir=in | app=c:\program files\hp\digital imaging\bin\hposid01.exe | 
"{C6230025-E91E-4244-93DE-44A4AF072ECE}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqste08.exe | 
"{CED834B8-E18D-489E-9C70-FCEA48FCEBA3}" = protocol=6 | dir=in | app=c:\windows\system32\muzapp.exe | 
"{DE80F8B3-5F33-4E32-8C10-C64989BCFEBB}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpiscnapp.exe | 
"{E0291266-49FF-46B6-A745-805C319D4497}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpofxm08.exe | 
"{E5752CF5-7179-4A06-B102-FC1A8A4B9159}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqkygrp.exe | 
"{E737B441-789B-41E7-A28D-A25F98D07DA0}" = protocol=6 | dir=out | app=system | 
"{F78DB339-50E8-412A-941B-6F6C84D22567}" = dir=in | app=c:\program files\hp\digital imaging\smart web printing\smartwebprintexe.exe | 
"{F9E4A9EE-6682-4479-9644-A08101A124C5}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{FC211991-69C9-4004-8C75-0A83F4DF38CD}" = dir=in | app=c:\program files\cyberlink\powerdvd dx\powerdvd.exe | 
"TCP Query User{01BFF384-391B-4F5A-A491-4811B17549EC}C:\users\nbleipzig2\appdata\local\temp\seteb78.tmp" = protocol=6 | dir=in | app=c:\users\nbleipzig2\appdata\local\temp\seteb78.tmp | 
"TCP Query User{09A77C23-4862-47B4-92FA-0464999EB647}C:\users\nbleipzig2\appdata\local\temp\setb3f4.tmp" = protocol=6 | dir=in | app=c:\users\nbleipzig2\appdata\local\temp\setb3f4.tmp | 
"TCP Query User{0BB98D59-8B74-4EE8-B662-3E7446E5E922}C:\program files\sonicwall\sonicwall global vpn client\swgvc.exe" = protocol=6 | dir=in | app=c:\program files\sonicwall\sonicwall global vpn client\swgvc.exe | 
"TCP Query User{122FE04B-9284-4DA6-B7BE-484C4E3472D9}C:\users\nbleipzig2\appdata\local\temp\set11bb.tmp" = protocol=6 | dir=in | app=c:\users\nbleipzig2\appdata\local\temp\set11bb.tmp | 
"TCP Query User{4BC8A140-3A31-41B8-8772-0CF8CB1F3A2B}C:\users\nbleipzig2\appdata\local\temp\setc61d.tmp" = protocol=6 | dir=in | app=c:\users\nbleipzig2\appdata\local\temp\setc61d.tmp | 
"TCP Query User{736F3C07-5F32-4041-9701-A765EF5870B2}C:\program files\remote mouse\server\server.exe" = protocol=6 | dir=in | app=c:\program files\remote mouse\server\server.exe | 
"TCP Query User{8266E0BC-620E-4076-A588-F5601316E4DF}C:\program files\qip 2012\qip.exe" = protocol=6 | dir=in | app=c:\program files\qip 2012\qip.exe | 
"TCP Query User{D8E44668-A45E-465A-AFC8-12AA57180806}C:\users\nbleipzig2\appdata\local\temp\setb54b.tmp" = protocol=6 | dir=in | app=c:\users\nbleipzig2\appdata\local\temp\setb54b.tmp | 
"UDP Query User{181F45B0-7A95-40E4-A8C6-2173457D2F95}C:\users\nbleipzig2\appdata\local\temp\setc61d.tmp" = protocol=17 | dir=in | app=c:\users\nbleipzig2\appdata\local\temp\setc61d.tmp | 
"UDP Query User{2416EBA1-1FEF-48B5-99AA-0840DBF7FDCA}C:\program files\remote mouse\server\server.exe" = protocol=17 | dir=in | app=c:\program files\remote mouse\server\server.exe | 
"UDP Query User{614B9EE3-4322-4261-BA83-5201E5709BF3}C:\program files\qip 2012\qip.exe" = protocol=17 | dir=in | app=c:\program files\qip 2012\qip.exe | 
"UDP Query User{ABCE0243-60B0-4FCE-B0F3-A4E8D1146538}C:\program files\sonicwall\sonicwall global vpn client\swgvc.exe" = protocol=17 | dir=in | app=c:\program files\sonicwall\sonicwall global vpn client\swgvc.exe | 
"UDP Query User{AD08D7D5-3779-4A00-9B5B-C71645A6CB06}C:\users\nbleipzig2\appdata\local\temp\set11bb.tmp" = protocol=17 | dir=in | app=c:\users\nbleipzig2\appdata\local\temp\set11bb.tmp | 
"UDP Query User{EA85DB8D-2AF7-4D3C-8AFB-115DBEFBC2FC}C:\users\nbleipzig2\appdata\local\temp\setb3f4.tmp" = protocol=17 | dir=in | app=c:\users\nbleipzig2\appdata\local\temp\setb3f4.tmp | 
"UDP Query User{F0E335B2-01BE-498C-B8FE-F447ABDE9A59}C:\users\nbleipzig2\appdata\local\temp\seteb78.tmp" = protocol=17 | dir=in | app=c:\users\nbleipzig2\appdata\local\temp\seteb78.tmp | 
"UDP Query User{FFB7BE11-DAF8-49C9-9800-B3A400B1842D}C:\users\nbleipzig2\appdata\local\temp\setb54b.tmp" = protocol=17 | dir=in | app=c:\users\nbleipzig2\appdata\local\temp\setb54b.tmp | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{028ED9C4-25EE-4DEE-9CF4-91034BC89B18}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{06A1D88C-E102-4527-AF70-29FFD7AF215A}" = Scan
"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
"{07D618CD-B016-438A-ADC9-A75BD23F85CE}" = Wave Support Software
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant
"{097CDB1E-07C9-40F1-9972-F0F9F3A287E4}" = Network
"{0B0A2153-58A6-4244-B458-25EDF5FCD809}" = Private Information Manager
"{0F6F6876-6334-4977-B5DD-CFC12E193420}" = iTunes
"{105F3CE5-FE55-408E-BF30-E78F85BA0B12}" = Dell-Druckersoftware
"{10668AA3-490D-46C1-B606-A621451998EF}" = Password Safe and Repository 6
"{11DB380B-48CF-46EA-8B03-51874E2733C9}" = Dell Control Point
"{1458BB78-1DC5-4BC0-B9A3-2B644F5A8105}" = DeviceDiscovery
"{150B6201-E9E6-4DFB-960E-CCBD53FBDDED}" = HPProductAssistant
"{1DDDFDF2-4A92-4E77-959F-59D196B99C0C}" = C410
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{2220CF3A-EBD6-4070-94D0-0C7337B537A7}" = All Day Battery Life Configuration
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 7
"{292F0F52-B62D-4E71-921B-89A682402201}" = Toolbox
"{2BA722D1-48D1-406E-9123-8AE5431D63EF}" = Windows Live Fotogalerie
"{2E92BEE2-9D81-426D-9B6C-B96B6673C51F}" = Tweet Adder 3
"{2E98C5B7-D64C-4D7E-BFC3-A7D078569F28}" = Broadcom NetXtreme-I Netlink Driver and Management Installer
"{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}" = HP Update
"{3138EAD3-700B-4A10-B617-B3F8096EE30D}" = Dell Edoc Viewer
"{3237887D-8AC4-4C27-BDF4-57D7CB0351D6}" = SO32MMWrapper
"{34610DE0-3C13-42CA-8E32-01FFA38AB6E8}" = PC Connectivity Solution
"{3A6BE9F4-5FC8-44BB-BE7B-32A29607FEF6}" = Preboot Manager
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3EFEF049-23D4-4B46-8903-4592FEA51018}" = Windows Live Movie Maker
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4cb9f93c-9edc-4be9-ae61-af128ddbecfa}" = Business Contact Manager für Outlook 2007 SP2
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{51AE9E42-640D-4C14-A9B6-43F64AA4E3E2}" = Document Manager Lite
"{51C7AD07-C3F6-4635-8E8A-231306D810FE}" = Cisco LEAP Module
"{53333479-6A52-4816-8497-5C52B67ED339}" = EMBASSY Security Setup
"{565E7B0E-B76B-4EAD-9753-F1E72A5CF12E}" = HPAppStudio
"{59333B51-EA3C-4D7B-9AFE-96AD51B3C266}" = AuthenTec Fingerprint Software
"{5B025634-7D5B-4B8D-BE2A-7943C1CF2D5D}" = Status
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{63EC2120-1742-4625-AA47-C6A8AEC9C64C}" = Apple Application Support
"{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}" = Cisco EAP-FAST Module
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD DX
"{68EB2C37-083A-4303-B5D8-41FA67E50B8F}_is1" = Poedit
"{71084075-ABA7-48BC-9733-F56A9ABD184D}" = DCP32MMWrapper
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{79B520D5-CE72-4661-A054-804BC3412516}" = Wave Infrastructure Installer
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8EE94FD8-5F52-4463-A340-185D16328158}" = WebReg
"{8FF6F5CA-4E30-4E3B-B951-204CAAA2716A}" = SmartWebPrinting
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001C-0407-0000-0000000FF1CE}" = Microsoft Office Access Runtime (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_SMALLBUSINESSR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_SMALLBUSINESSR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_SMALLBUSINESSR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{90A40407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components
"{91120000-00CA-0000-0000-0000000FF1CE}" = Microsoft Office Small Business 2007
"{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{9143F2FA-BF20-4311-8618-4CCF51B1B80C}" = Dell ControlPoint System Manager
"{9294F169-72EE-4D74-AE92-CA25F64B4FF8}" = Fax
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{98EABC7F-B1A1-43A5-B505-5B4EC3908DCD}" = Microsoft Security Client
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B362566-EC1B-4700-BB9C-EC661BDE2175}" = DocProc
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Dell Touchpad
"{A093D83F-429A-4AB2-A0CD-1F7E9C7B764A}" = Trusted Drive Manager
"{A80FA752-C491-4ED9-ABF0-4278563160B2}" = 32 Bit HP CIO Components Installer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{ABBA2EA4-740E-4052-902B-9CA70B081E3F}" = Dell Embassy Trust Suite by Wave Systems
"{AC35A885-0F8F-4857-B7DA-6E8DFB43E6B3}" = HPSSupply
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{AF7E4468-E364-4991-BC2A-6E8293E1055B}" = BioAPI Framework
"{B1FD6060-8DF9-4C67-AF5E-7D25A54D1854}" = Mindjet MindManager 2012
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{BB3447F6-9553-4AA9-960E-0DB5310C5779}" = GPBaseService2
"{BB93D30B-B395-44BB-A9ED-A0E057F07E53}" = NTRU TCG Software Stack
"{BC52E419-B185-488F-9973-049A88E5DCBE}" = Gemalto
"{BC5DD87B-0143-4D14-AAE6-97109614DC6B}" = SolutionCenter
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{C1164ED0-EF08-4B0B-8084-3BDAEAAEFD8D}" = HP Photosmart Prem C410 All-In-One Driver Software 14.0 Rel. 7
"{C3FA63E2-AFD3-41FD-B48F-1D942CC71943}" = UPEK TouchChip Fingerprint Reader
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{CAE4213F-F797-439D-BD9E-79B71D115BE3}" = HPPhotoGadget
"{CD31E63D-47FD-491C-8117-CF201D0AFAB5}" = TrayApp
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D360FA88-17C8-4F14-B67F-13AAF9607B12}" = MarketResearch
"{D4DDFAA1-EC37-4529-AD5B-A433ADE68662}" = Apple Mobile Device Support
"{D6C3C9E7-D334-4918-BD57-5B1EF14C207D}" = Bing Bar
"{D6CD26FD-CD7F-4C86-96A3-EEBFABE5FE47}" = Kies
"{DE042823-C359-4B87-B66B-308057E8B6AF}" = Camtasia Studio 7
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E517094C-06B6-419F-8FFD-EF4F57972130}" = QuickTransfer
"{E63A7E64-AD93-47E7-AC5C-BA042AA740CA}" = Dell ControlPoint Connection Manager
"{E738A392-F690-4A9D-808E-7BAF80E0B398}" = ESC Home Page Plugin
"{EBBB1DEF-8878-4CB8-BC0D-1196B30E7527}" = ANNO 1503
"{EC84E3E6-C2D6-4DFB-81E0-448324C8FDF4}" = Security Wizards
"{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}" = Cisco PEAP Module
"{EEAFE1E5-076B-430A-96D9-B567792AFA88}" = EMBASSY Security Center
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F217D8AF-965B-4D3E-8F14-AC47B9CA535B}" = PS_AIO_07_C410_SW_Min
"{F34EE6D2-9356-4294-B3B3-AE04428C8C43}_is1" = Remote Mouse version 1.50
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F4487649-7368-4217-AEA3-1E04DB3E2C5C}" = Dell ControlPoint Security Manager
"{F46E21DF-5BE1-48E2-8390-5EEA8B25E36A}" = Microsoft SQL Server Native Client
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{FA0FF682-CC70-4C57-93CD-E276F3E7537E}" = BufferChm
"{FDE96E86-7780-431C-92F7-679C6A7CEC51}" = Microsoft SQL Server VSS Writer
"{FF1DDCF4-3A28-4F7F-96D8-E3F4BD1C1702}" = Dell Security Device Driver Pack
"3GP Media Player_is1" = 3GP Media Player 1.0.1
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"9D57DE505B6D8C710EF3B74BE638DBB936EED8A3" = Windows-Treiberpaket - Dell Inc. PBADRV System  (01/07/2008 1.0.1.5)
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"avast" = avast! Free Antivirus
"Business Contact Manager" = Business Contact Manager für Outlook 2007 SP2
"D3F88C3864C8C031A7C5D5E63A76571EC1B047DF" = Windows-Treiberpaket - AuthenTec Inc. (ATSwpWDF) Biometric  (05/13/2009 8.4.2.0)
"Dell Wireless WLAN Card Utility" = Dell Wireless WLAN Card Utility
"FileZilla Client" = FileZilla Client 3.6.0
"Free YouTube Download_is1" = Free YouTube Download version 3.1.23.403
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.30.903
"Google Chrome" = Google Chrome
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HP Imaging Device Functions" = HP Imaging Device Functions 14.0
"HP Smart Web Printing" = HP Smart Web Printing 4.60
"HP Solution Center & Imaging Support Tools" = HP Solution Center 14.0
"HPExtendedCapabilities" = HP Customer Participation Program 14.0
"HPOCR" = OCR Software by I.R.I.S. 14.0
"IBM Personal Communications De-install Key" = IBM Personal Communications
"InstallShield_{07D618CD-B016-438A-ADC9-A75BD23F85CE}" = Wave Support Software
"InstallShield_{0B0A2153-58A6-4244-B458-25EDF5FCD809}" = Private Information Manager
"InstallShield_{51AE9E42-640D-4C14-A9B6-43F64AA4E3E2}" = Document Manager Lite
"InstallShield_{53333479-6A52-4816-8497-5C52B67ED339}" = EMBASSY Security Setup
"InstallShield_{D6CD26FD-CD7F-4C86-96A3-EEBFABE5FE47}" = Kies
"InstallShield_{E738A392-F690-4A9D-808E-7BAF80E0B398}" = ESC Home Page Plugin
"InstallShield_{EC84E3E6-C2D6-4DFB-81E0-448324C8FDF4}" = Security Wizards
"InstallShield_{EEAFE1E5-076B-430A-96D9-B567792AFA88}" = EMBASSY Security Center
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.1.1000
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft Security Client" = Microsoft Security Essentials
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"PDF-XChange 3_is1" = PDF-XChange 3
"Shop for HP Supplies" = Shop for HP Supplies
"SMALLBUSINESSR" = Microsoft Office Small Business 2007
"TVWiz" = Intel(R) TV Wizard
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR 4.11 (32-Bit)
"WordFlood 1.2" = WordFlood 1.2 (remove only)
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"QIP 2012" = QIP 2012 4.0.7221
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 05.10.2012 21:17:46 | Computer Name = NB16NGLei2 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 22866658
 
Error - 06.10.2012 12:45:45 | Computer Name = NB16NGLei2 | Source = Wave TCG Client Services | ID = 123
Description = The NTRU TSS is not running, Wave Software is unable to communicate
 to TPM
 
Error - 06.10.2012 13:57:52 | Computer Name = NB16NGLei2 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 06.10.2012 13:57:52 | Computer Name = NB16NGLei2 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 1108
 
Error - 06.10.2012 13:57:52 | Computer Name = NB16NGLei2 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 1108
 
Error - 06.10.2012 13:57:53 | Computer Name = NB16NGLei2 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 06.10.2012 13:57:53 | Computer Name = NB16NGLei2 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 2153
 
Error - 06.10.2012 13:57:53 | Computer Name = NB16NGLei2 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 2153
 
Error - 08.10.2012 22:29:33 | Computer Name = NB16NGLei2 | Source = Wave TCG Client Services | ID = 123
Description = The NTRU TSS is not running, Wave Software is unable to communicate
 to TPM
 
Error - 10.10.2012 11:21:16 | Computer Name = NB16NGLei2 | Source = Wave TCG Client Services | ID = 123
Description = The NTRU TSS is not running, Wave Software is unable to communicate
 to TPM
 
[ OSession Events ]
Error - 22.08.2012 18:49:18 | Computer Name = NB16NGLei2 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 5
 seconds with 0 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 07.07.2012 13:20:40 | Computer Name = NB16NGLei2 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "NTRU TSS v1.2.1.29 TCS" ist vom Dienst "TPM-Basisdienste"
 abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%0
 
Error - 08.07.2012 15:03:22 | Computer Name = NB16NGLei2 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "NTRU TSS v1.2.1.29 TCS" ist vom Dienst "TPM-Basisdienste"
 abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%0
 
Error - 08.07.2012 17:44:03 | Computer Name = NB16NGLei2 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "NTRU TSS v1.2.1.29 TCS" ist vom Dienst "TPM-Basisdienste"
 abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%0
 
Error - 09.07.2012 07:47:51 | Computer Name = NB16NGLei2 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "NTRU TSS v1.2.1.29 TCS" ist vom Dienst "TPM-Basisdienste"
 abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%0
 
Error - 10.07.2012 14:56:01 | Computer Name = NB16NGLei2 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "NTRU TSS v1.2.1.29 TCS" ist vom Dienst "TPM-Basisdienste"
 abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%0
 
Error - 10.07.2012 21:37:39 | Computer Name = NB16NGLei2 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "NTRU TSS v1.2.1.29 TCS" ist vom Dienst "TPM-Basisdienste"
 abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%0
 
Error - 11.07.2012 16:55:12 | Computer Name = NB16NGLei2 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "NTRU TSS v1.2.1.29 TCS" ist vom Dienst "TPM-Basisdienste"
 abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%0
 
Error - 13.07.2012 11:05:16 | Computer Name = NB16NGLei2 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "NTRU TSS v1.2.1.29 TCS" ist vom Dienst "TPM-Basisdienste"
 abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%0
 
Error - 15.07.2012 13:08:52 | Computer Name = NB16NGLei2 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "NTRU TSS v1.2.1.29 TCS" ist vom Dienst "TPM-Basisdienste"
 abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%0
 
Error - 17.07.2012 07:23:19 | Computer Name = NB16NGLei2 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "NTRU TSS v1.2.1.29 TCS" ist vom Dienst "TPM-Basisdienste"
 abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%0
 
 
< End of report >
         

Wäre über Hilfe sehr dankbar.

Bitte das Malwarebytes Logfile posten!
(Reiter Logdateien)


danach:

Downloade dir bitte Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

• Entpacke das Archiv auf deinem Desktop.
• Im neu erstellten Ordner starte bitte die mbar.exe.
• Folge den Anweisungen auf deinem Bildschirm und erlaube dem Tool, dein System zu scannen.
• Klicke auf den CleanUp Button und erlaube den Neustart.
• Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
• Nach dem Neustart starte die mbar.exe erneut.
• Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Hey,

danke das du dich meinem Problem annimmst.

Alter Malwarebytes Log

 Malwarebytes Anti-Malware  (Test) 1.65.1.1000
www.malwarebytes.org

Datenbank Version: v2012.11.21.09

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
NBLeipzig2 :: NB16NGLEI2 [Administrator]

Schutz: Aktiviert

22.11.2012 00:25:54
mbam-log-2012-11-22 (00-25-54).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 353026
Laufzeit: 1 Stunde(n), 11 Minute(n), 16 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Windows\REG.REG (Malware.Trace) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
         

Malwarebytes Anti Rootkit Log

Malwarebytes Anti-Rootkit 1.1.0.1009
www.malwarebytes.org

Database version: v2012.11.24.05

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
NBLeipzig2 :: NB16NGLEI2 [administrator]

24.11.2012 15:58:47
mbar-log-2012-11-24 (15-58-47).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: PUP | PUM | P2P
Objects scanned: 28190
Time elapsed: 8 minute(s), 27 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
         

Malware mit Combofix beseitigen

Lade Combofix von einem der folgenden Download-Spiegel herunter:

BleepingComputer.com - ForoSpyware.com

und speichere das Programm auf den Desktop, nicht woanders hin, das ist wichtig!
Beachte die ausführliche Original-Anleitung.

Zurzeit ist Combofix auf folgenden Windows-Versionen lauffähig:

• Windows XP (nur 32-bit)
• Windows Vista (32-bit/64-bit)
• Windows 7 (32-bit/64-bit)

Vorbereitung und wichtige Hinweise

• Bitte während des Scans mit Combofix Antiviren- sowie Antispy-Programme, die Firewall und evtl. vorhandenes Skript-Blocking (Norton) deaktivieren.
• Liste der zu deaktivierenden Programme.
  Bei Unklarheiten bitte fragen.

• ComboFix wird Deine Einstellungen in Bezug auf den Bildschirmschoner zurücksetzen.
• Diese Einstellungen kannst Du nach Beendigung unserer Bereinigung wieder ändern.
• Mache nichts anderes, wenn es Dir nicht gelungen ist, Combofix laufen zu lassen.
• Teile uns das mit und warte auf unsere Anweisungen.

• Starte die Combofix.exe mit Rechtsklick => Als Administrator ausführen und folge den Anweisungen.
• Während des Laufs von Combofix nichts anderes am Computer machen!
• Akzeptiere die Bedingungen (Disclaimer) mit "Ja".

• Sollte Combofix eine aktuellere Version anbieten, Downlaod erlauben.
• Klicke "Ja", um mit dem Suchlauf nach Malware fortzufahren.
• Es erscheint eine blaue Eingabeaufforderung, Combofix wird für den Suchlauf vorbereitet.
• Bitte nicht in dieses Combofix-Fenster klicken.
• Das könnte Dein System einfrieren oder hängen bleiben lassen.
• Es wird ein Backup Deiner Registry erstellt.
• Nun werden die einzelnen Stufen des Programms abgearbeitet, das kann eine Weile dauern.

• Wenn ComboFix fertig ist, wird es ein Log erstellen (bitte warten, das dauert einen Moment).
• Unbedingt warten, bis sich das Combofix-Fenster geschlossen hat und das Logfile im Editor erscheint.
• Bitte poste die Log-Dateien C:\ComboFix.txt und C:\Qoobox\Add-Remove Programs.txt in Code-Tags hier in den Thread.

• Hinweis: Combofix macht aus verschiedenen Gründen den Internet Explorer zum Standard-Browser und erstellt ein IE-Icon auf dem Desktop.
• Das IE-Desktop-Icon kannst Du nach der Bereinigung wieder löschen und Deinen bevorzugten Browser wieder als Standard-Browser einstellen.

Combofix nicht auf eigene Faust einsetzen. Wenn keine entsprechende Infektion vorliegt, kann das den Rechner lahmlegen und/oder nachhaltig schädigen!

Leider stützt mein PC jedesmal ab nachdem die Eingabeaufforderung erscheint. Im Combofix-Fenster steht: "Versuche, einen Wiederherstellungspunkt zu erstellen" danach wechselt die Eingabeaufforderung zum fullscreen und danach stürzt mein PC ab.

Rechner neustarten, Combofix neu runterladen (wichtig: auf Desktop) und nochmal versuchen.

Okay habe ich gemacht, der Computer ist wieder abgestürzt. Beim Neustart kam folgende Meldung:

Problemsignatur:
  Problemereignisname:	BlueScreen
  Betriebsystemversion:	6.1.7601.2.1.0.256.48
  Gebietsschema-ID:	1031

Zusatzinformationen zum Problem:
  BCCode:	76
  BCP1:	00000000
  BCP2:	88601D40
  BCP3:	00000010
  BCP4:	00000000
  OS Version:	6_1_7601
  Service Pack:	1_0
  Product:	256_1

Dateien, die bei der Beschreibung des Problems hilfreich sind:
  C:\Windows\Minidump\112612-17347-01.dmp
  C:\Users\NBLeipzig2\AppData\Local\Temp\WER-44148-0.sysdata.xml
         

ps.: Nachträglich Glückwunsch zu 13.000 Beiträgen

Deinstalliere Spybot und alle Antiviren-Software, dann neustarten, nochmal versuchen.

Okay habe alles Deinstalliert und neugestartet, Computer ist wieder abgestürzt und zeigt beim Neustart wieder folgende Meldung:

Problemsignatur:
  Problemereignisname:	BlueScreen
  Betriebsystemversion:	6.1.7601.2.1.0.256.48
  Gebietsschema-ID:	1031

Zusatzinformationen zum Problem:
  BCCode:	76
  BCP1:	00000000
  BCP2:	8845F8B0
  BCP3:	00000010
  BCP4:	00000000
  OS Version:	6_1_7601
  Service Pack:	1_0
  Product:	256_1

Dateien, die bei der Beschreibung des Problems hilfreich sind:
  C:\Windows\Minidump\112612-20264-01.dmp
  C:\Users\NBLeipzig2\AppData\Local\Temp\WER-40887-0.sysdata.xml
         

Hatte alle Programme geschlossen, nix am PC gemacht nichteinmal die Maus bewegt. Firewall ist auch aus.

Und ComboFix natürlich als Admin ausgeführt.

Die letzte Aktion von ComboFix im Bluescreen ist "dumping physical memory" bei 100% stürzt der Computer dann ab.

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

• Starte die aswMBR.exe - (aswMBR.exe Anleitung)
  Vista und Win7 User mit Rechtsklick "als Admininstartor starten"
• Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. ( Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
  Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
• Klicke auf Scan.
• Warte bitte bis Scan finished successfully im DOS Fenster steht.
• Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

So, das hat zum Glück diesmal geklappt.

aswMBR Log

aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
Run date: 2012-11-27 15:39:35
-----------------------------
15:39:35.729    OS Version: Windows 6.1.7601 Service Pack 1
15:39:35.729    Number of processors: 2 586 0x170A
15:39:35.729    ComputerName: NB16NGLEI2  UserName: NBLeipzig2
15:40:07.678    Initialize success
15:40:52.268    AVAST engine defs: 12112700
15:41:21.613    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
15:41:21.613    Disk 0 Vendor: WDC_WD25 11.0 Size: 238475MB BusType: 3
15:41:21.628    Disk 0 MBR read successfully
15:41:21.628    Disk 0 MBR scan
15:41:21.628    Disk 0 Windows VISTA default MBR code
15:41:21.628    Disk 0 Partition 1 00     DE Dell Utility Dell 8.0       39 MB offset 63
15:41:21.644    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS        15000 MB offset 81920
15:41:21.659    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS       223434 MB offset 30801920
15:41:21.659    Disk 0 scanning sectors +488395120
15:41:21.706    Disk 0 scanning C:\Windows\system32\drivers
15:41:33.219    Service scanning
15:41:59.553    Modules scanning
15:42:08.819    Disk 0 trace - called modules:
15:42:09.365    ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys halmacpi.dll 
15:42:09.381    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8703b738]
15:42:09.396    3 CLASSPNP.SYS[8c99e59e] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x86652028]
15:42:10.332    AVAST engine scan C:\Windows
15:42:13.172    AVAST engine scan C:\Windows\system32
15:44:57.797    AVAST engine scan C:\Windows\system32\drivers
15:45:09.294    AVAST engine scan C:\Users\NBLeipzig2
15:50:40.305    AVAST engine scan C:\ProgramData
15:51:24.816    Scan finished successfully
15:55:59.533    Disk 0 MBR has been saved successfully to "C:\Users\NBLeipzig2\Desktop\MBR.dat"
15:55:59.548    The log file has been saved successfully to "C:\Users\NBLeipzig2\Desktop\aswMBR.txt"
         

Sehr gut!

Wie laeuft der Rechner?


Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html

Hey, also soweit läuft alles ganz gut eigentlich. Emisoft hat aber was gefunden, habe leider nicht sofort nach dem Scan auf "Bericht anzeigen" gedrückt.... Ist das sehr schlimm?

Aber habe hier das Quaratäne Protokoll. Emisoft hat zum Ende des Scans gesagt, 8 Funde und 1 wurde entfernt. Hatte aber auf "Ausgewähltes in Quarantäne" geklickt.

Emsisoft Anti-Malware - Version 7.0
quarantine log

Datum	Ursprung	Vorgang	Verhalten/Infektion
29.11.2012 01:14:27	C:\Users\NBLeipzig2\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\530159b8-7be54d97	In Quarantäne gestellt	Exploit.Java.CVE-2012-1723.P (B)
         

Schaue bitte in der Anleitung (http://www.trojaner-board.de/103809-...i-malware.html) nach, wo du die Logfiles finden kannst.
Poste das Logfile bitte.

Oh Sorry, dachte das funktioniert nur direkt nach dem Scan...

Emsisoft Anti-Malware - Version 7.0
Letztes Update: 29.11.2012 00:20:56

Scan Einstellungen:

Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\

Riskware-Erkennung: Aus
Archiv Scan: An
ADS Scan: An
Dateitypen-Filter: Aus
Erweitertes Caching: An
Direkter Festplattenzugriff: Aus

Scan Beginn:	29.11.2012 00:22:16

C:\Users\NBLeipzig2\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\530159b8-7be54d97 -> mljkccgatytdpepmqr/avbrwneevbmdsajhwrnmg.class 	gefunden: Exploit.Java.CVE-2012-1723.P (B)
C:\Users\NBLeipzig2\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\530159b8-7be54d97 -> mljkccgatytdpepmqr/emmvuynwdtvevtvpgd.class 	gefunden: Exploit.Java.CVE-2012-1723.P (B)
C:\Users\NBLeipzig2\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\530159b8-7be54d97 -> mljkccgatytdpepmqr/frkegksrybmvqatwnqasnbvdn.class 	gefunden: Exploit.Java.CVE-2012-1723.P (B)
C:\Users\NBLeipzig2\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\530159b8-7be54d97 -> mljkccgatytdpepmqr/gvaqehmjdcqmrvegth.class 	gefunden: Exploit.Java.CVE-2012-1723.P (B)
C:\Users\NBLeipzig2\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\530159b8-7be54d97 -> mljkccgatytdpepmqr/hmkshqqlldbcfeypmllnygtnk.class 	gefunden: Exploit.Java.CVE-2012-1723.P (B)
C:\Users\NBLeipzig2\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\530159b8-7be54d97 -> mljkccgatytdpepmqr/hstndyvqyphwhahphmlhaflp.class 	gefunden: Exploit.Java.CVE-2012-1723.P (B)
C:\Users\NBLeipzig2\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\530159b8-7be54d97 -> mljkccgatytdpepmqr/lcphgvyrrgjsgknpmjmherj.class 	gefunden: Exploit.Java.CVE-2012-1723.P (B)
C:\Users\NBLeipzig2\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\530159b8-7be54d97 -> mljkccgatytdpepmqr/vmnpeehevclys.class 	gefunden: Exploit.Java.CVE-2012-1723.P (B)

Gescannt	457694
Gefunden	8

Scan Ende:	29.11.2012 01:02:40
Scan Zeit:	0:40:24

C:\Users\NBLeipzig2\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\530159b8-7be54d97 -> mljkccgatytdpepmqr/avbrwneevbmdsajhwrnmg.class	Quarantäne Exploit.Java.CVE-2012-1723.P (B)

Quarantäne	1