Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: GVU-Trojaner 2.04 (mit Webcam)

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML

Antwort
Alt 29.12.2012, 12:20   #1
dim9r
 
GVU-Trojaner 2.04 (mit Webcam) - Ausrufezeichen

GVU-Trojaner 2.04 (mit Webcam)



Hallo liebe Forumuser!

Ich habe mir neulich einen GVU-Trojaner 2.04 eingefangen.

Habe daraufhin direkt das BS neu aufgesetzt und einen scan mit Malwarebytes gemacht. Es wurden auch ein paar Viren gefunden, die ich direkt gelöscht habe.

Mein System läuft jetzt stabil und es scheint alles in Ordnung zu sein. Dennoch habe ich Angst, dass Reste des Trojaners noch auf dem System sein könnten.

Ich poste mal meine Logdatein. Ich hoffe ihr könnt mir helfen.
_______________________

OTL logfile created on: 29.12.2012 11:54:40 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\dimer\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

8,00 Gb Total Physical Memory | 6,17 Gb Available Physical Memory | 77,12% Memory free
15,99 Gb Paging File | 13,54 Gb Available in Paging File | 84,63% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 195,21 Gb Total Space | 139,86 Gb Free Space | 71,64% Space Free | Partition Type: NTFS
Drive D: | 1201,96 Gb Total Space | 458,01 Gb Free Space | 38,11% Space Free | Partition Type: NTFS

Computer Name: DIMER-PC | User Name: dimer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012.12.29 11:47:22 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\dimer\Desktop\OTL.exe
PRC - [2012.12.25 08:15:12 | 000,034,784 | ---- | M] (GGS) -- C:\Users\dimer\AppData\Local\THORN\Thorn.exe
PRC - [2012.12.15 22:23:21 | 001,807,800 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_5_502_135.exe
PRC - [2012.12.14 20:32:29 | 003,084,688 | ---- | M] (Emsisoft GmbH) -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
PRC - [2012.12.12 16:30:38 | 000,085,280 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2012.12.12 16:30:34 | 000,384,800 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.12.12 16:30:34 | 000,109,344 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.11.29 14:50:25 | 003,463,080 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
PRC - [2012.11.29 09:26:08 | 000,916,960 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2012.10.02 23:21:00 | 001,258,856 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
PRC - [2012.10.02 13:15:38 | 000,382,824 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2012.10.02 12:13:44 | 003,064,000 | ---- | M] (Skype Technologies S.A.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2012.08.17 04:37:56 | 000,277,504 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2012.08.17 04:37:50 | 000,007,168 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe


========== Modules (No Company Name) ==========

MOD - [2012.12.15 22:23:21 | 014,586,296 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll
MOD - [2012.12.01 22:01:51 | 001,233,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.WorkflowServ#\4a0913362049e731bb14c6462c09dd80\System.WorkflowServices.ni.dll
MOD - [2012.12.01 22:01:33 | 001,153,536 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\949fb6acfbb4464bacdea87cc56b48b7\System.ServiceModel.Discovery.ni.dll
MOD - [2012.12.01 22:01:33 | 000,373,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\6fec75cf21e2a14009ae3944bccd6ae4\System.ServiceModel.Routing.ni.dll
MOD - [2012.12.01 22:01:32 | 000,084,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\c6063ba234104ac73a2ecca8efe29759\System.ServiceModel.Channels.ni.dll
MOD - [2012.12.01 22:01:26 | 001,089,024 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\3206b636a30b2fecbd492762874ffa05\System.ServiceModel.Web.ni.dll
MOD - [2012.12.01 22:00:14 | 001,550,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\ece50db06c9b24ff19502ae1cdae31b4\System.ServiceModel.Activities.ni.dll
MOD - [2012.12.01 22:00:11 | 001,079,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\d9877a55720fcb067c6ab36f34d88018\System.IdentityModel.ni.dll
MOD - [2012.12.01 22:00:10 | 018,208,256 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\4bddacaac6d3f45ecbed9973a86bf68b\System.ServiceModel.ni.dll
MOD - [2012.12.01 22:00:00 | 000,027,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\IAStorDataMgrSvcInt#\7895827530bc6b81f399858827c8a392\IAStorDataMgrSvcInterfaces.ni.dll
MOD - [2012.12.01 21:59:58 | 000,026,112 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\IAStorCommon\259e7f9290218b11c8e62d32c48c91b1\IAStorCommon.ni.dll
MOD - [2012.12.01 21:59:56 | 000,361,472 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\IAStorUtil\339755c5e8e0ff20154fef6740ed1a2d\IAStorUtil.ni.dll
MOD - [2012.12.01 21:59:50 | 001,812,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\5f1cf86d317a12ddd2b94066ddb6a82c\System.Xaml.ni.dll
MOD - [2012.12.01 21:59:42 | 001,031,680 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Dura#\35c86495069fb1731d13f370db1696d3\System.Runtime.DurableInstancing.ni.dll
MOD - [2012.12.01 21:59:41 | 002,659,328 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Seri#\9588de700ba160f3c26d2b9832c5ab90\System.Runtime.Serialization.ni.dll
MOD - [2012.12.01 21:59:41 | 000,143,360 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\6f9b75af8cb0cbc358430c76a245eb7a\SMDiagnostics.ni.dll
MOD - [2012.12.01 19:26:31 | 013,199,360 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\a9aa60064af8fb2fffa89a7e1ab9be48\System.Windows.Forms.ni.dll
MOD - [2012.12.01 19:26:29 | 007,070,720 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8eb5dedb7c678e5087c3ae109f345705\System.Core.ni.dll
MOD - [2012.12.01 19:26:26 | 005,618,176 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\1fea8d266adb312d528232fcc26accca\System.Xml.ni.dll
MOD - [2012.12.01 19:26:25 | 001,007,104 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\b8f79f40049d0d27685ac0c79c797fd8\System.Configuration.ni.dll
MOD - [2012.12.01 19:26:24 | 001,666,560 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\880ce3e4ae091231530c6c702061a154\System.Drawing.ni.dll
MOD - [2012.12.01 19:26:23 | 009,099,776 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\56445f55ce34159a972c3b252d6a298c\System.ni.dll
MOD - [2012.12.01 19:26:19 | 014,416,896 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\dbc34d53e1fbedabecd201fe4f264961\mscorlib.ni.dll
MOD - [2012.11.29 09:26:21 | 002,397,152 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2011.03.17 00:11:16 | 004,297,568 | ---- | M] () -- C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf


========== Services (SafeList) ==========

SRV:64bit: - [2009.07.14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2012.12.25 08:15:12 | 000,034,784 | ---- | M] (GGS) [Auto | Running] -- C:\Users\dimer\AppData\Local\THORN\Thorn.exe -- (Thorn)
SRV - [2012.12.15 22:23:21 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.12.14 20:32:29 | 003,084,688 | ---- | M] (Emsisoft GmbH) [Auto | Running] -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe -- (a2AntiMalware)
SRV - [2012.12.12 16:30:38 | 000,085,280 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.12.12 16:30:34 | 000,109,344 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.11.29 14:50:25 | 003,463,080 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe -- (TeamViewer8)
SRV - [2012.11.29 09:26:17 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.11.09 11:21:24 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.10.02 23:21:00 | 001,258,856 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012.10.02 13:15:38 | 000,382,824 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012.10.02 12:13:44 | 003,064,000 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2012.08.17 04:37:50 | 000,007,168 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2011.06.27 08:02:00 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.01.09 21:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2007.12.17 05:00:00 | 000,163,840 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE -- (EPSON_EB_RPCV4_01)
SRV - [2007.01.11 05:02:00 | 000,126,464 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE -- (EPSON_PM_RPCV4_01)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2012.12.12 16:30:40 | 000,129,216 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.12.12 16:30:40 | 000,099,912 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.12.09 12:21:26 | 000,283,200 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2012.11.16 20:17:15 | 000,027,800 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2012.08.23 15:12:16 | 000,029,696 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\terminpt.sys -- (terminpt)
DRV:64bit: - [2012.08.23 15:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2012.08.23 15:08:26 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2012.08.23 15:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2012.08.17 04:33:42 | 000,645,952 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStorA.sys -- (iaStorA)
DRV:64bit: - [2012.08.17 04:33:38 | 000,027,456 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStorF.sys -- (iaStorF)
DRV:64bit: - [2012.07.04 17:11:16 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2012.07.04 17:11:16 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2012.07.04 17:10:35 | 000,360,832 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vpcvmm.sys -- (vpcvmm)
DRV:64bit: - [2012.07.04 17:10:35 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vpcnfltr.sys -- (vpcnfltr)
DRV:64bit: - [2012.07.04 17:10:33 | 000,194,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vpchbus.sys -- (vpcbus)
DRV:64bit: - [2012.07.04 17:10:33 | 000,095,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vpcusb.sys -- (vpcusb)
DRV:64bit: - [2012.07.04 17:04:28 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.07.03 16:25:16 | 000,189,288 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2012.03.31 01:22:48 | 000,120,920 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\jraid.sys -- (JRAID)
DRV:64bit: - [2012.01.25 11:23:10 | 000,398,112 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7)
DRV:64bit: - [2010.11.21 04:23:48 | 000,117,248 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tsusbhub.sys -- (tsusbhub)
DRV:64bit: - [2010.11.21 04:23:48 | 000,088,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Synth3dVsc.sys -- (Synth3dVsc)
DRV:64bit: - [2010.11.21 04:23:48 | 000,071,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc)
DRV:64bit: - [2010.11.21 04:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2012.04.30 18:45:28 | 000,066,320 | ---- | M] (Emsisoft GmbH) [File_System | On_Demand | Running] -- C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys -- (a2acc)
DRV - [2011.05.19 14:10:34 | 000,023,208 | ---- | M] (Emsi Software GmbH) [Kernel | System | Running] -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys -- (A2DDA)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.1
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_135.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll ()
FF - HKLM\Software\MozillaPlugins\@idsoftware.com/QuakeLive: C:\ProgramData\id Software\QuakeLive\npquakezero.dll (id Software Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}: C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\ [2012.12.15 12:32:56 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.12.04 18:42:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

[2012.12.01 11:17:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\dimer\AppData\Roaming\mozilla\Extensions
[2012.12.01 11:17:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\dimer\AppData\Roaming\mozilla\Extensions\prism@developer.mozilla.org
[2012.12.16 13:59:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\dimer\AppData\Roaming\mozilla\Firefox\Profiles\z9ir7jeg.default\extensions
[2012.12.16 13:59:37 | 000,804,627 | ---- | M] () (No name found) -- C:\Users\dimer\AppData\Roaming\mozilla\firefox\profiles\z9ir7jeg.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012.12.04 18:42:08 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.11.29 09:26:57 | 000,262,112 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.11.29 10:19:31 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.11.29 10:19:31 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.11.29 10:19:31 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.11.29 10:19:32 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.11.29 10:19:31 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.11.29 10:19:31 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

========== Chrome ==========

CHR - homepage: hxxp://www.google.com/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{googleriginalQueryForSuggestion}{google:assistedQueryStats}{google:se archFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}
CHR - homepage: hxxp://www.google.com/
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\dimer\AppData\Local\Google\Chrome\Application\23.0.1271.97\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\dimer\AppData\Local\Google\Chrome\Application\23.0.1271.97\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\dimer\AppData\Local\Google\Chrome\Application\23.0.1271.97\pdf.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
CHR - plugin: Google Update (Enabled) = C:\Users\dimer\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll
CHR - Extension: Google Drive = C:\Users\dimer\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\dimer\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\dimer\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: AdBlock = C:\Users\dimer\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.54_0\
CHR - Extension: Skype Click to Call = C:\Users\dimer\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.3.0.11079_0\
CHR - Extension: DVDVideoSoft Browser Extension = C:\Users\dimer\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.1_0\
CHR - Extension: Google Mail = C:\Users\dimer\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe (Intel Corporation)
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~2\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\dimer\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~2\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~2\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\dimer\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~2\Office14\EXCEL.EXE/3000 File not found
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{76017C88-37EB-4179-9241-6B361870409A}: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{bf7ea3a1-41e5-11e2-a53a-000129a610b3}\Shell - "" = AutoRun
O33 - MountPoints2\{bf7ea3a1-41e5-11e2-a53a-000129a610b3}\Shell\AutoRun\command - "" = F:\SETUP.EXE
O33 - MountPoints2\{bf7ea3a1-41e5-11e2-a53a-000129a610b3}\Shell\configure\command - "" = F:\SETUP.EXE
O33 - MountPoints2\{bf7ea3a1-41e5-11e2-a53a-000129a610b3}\Shell\install\command - "" = F:\SETUP.EXE
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012.12.29 11:47:21 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\dimer\Desktop\OTL.exe
[2012.12.28 23:21:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVIedit by Alexander Milukov
[2012.12.28 23:19:20 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\IrfanView
[2012.12.28 23:19:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\IrfanView
[2012.12.23 08:49:32 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\ru-RU
[2012.12.23 08:49:32 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\ru
[2012.12.23 08:49:24 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\ru
[2012.12.23 08:49:19 | 000,000,000 | ---D | C] -- C:\Windows\ru-RU
[2012.12.23 08:45:58 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\uk-UA
[2012.12.23 08:45:58 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\en-US
[2012.12.23 08:45:58 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\en
[2012.12.23 08:45:58 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\0409
[2012.12.23 08:45:51 | 000,000,000 | ---D | C] -- C:\Windows\uk-UA
[2012.12.23 08:45:50 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\en
[2012.12.23 08:45:50 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\0409
[2012.12.23 08:45:41 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\uk-UA
[2012.12.21 16:13:16 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\Epson
[2012.12.21 13:49:59 | 000,000,000 | ---D | C] -- C:\ProgramData\UDL
[2012.12.21 13:49:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epson Software
[2012.12.21 13:48:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Epson Software
[2012.12.21 13:48:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ABBYY FineReader 6.0 Sprint
[2012.12.21 13:48:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ABBYY FineReader 6.0 Sprint
[2012.12.21 13:25:55 | 000,000,000 | ---D | C] -- C:\ProgramData\EPSON
[2012.12.21 13:25:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON
[2012.12.21 13:25:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\epson
[2012.12.21 13:23:41 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Local\ElevatedDiagnostics
[2012.12.18 19:02:43 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Local\THORN
[2012.12.15 22:23:51 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Local\Macromedia
[2012.12.15 22:23:23 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee
[2012.12.15 12:33:00 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.12.15 12:32:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
[2012.12.15 12:32:53 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\DVDVideoSoft
[2012.12.15 12:32:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DVDVideoSoft
[2012.12.15 12:32:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DVDVideoSoft
[2012.12.14 20:25:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware
[2012.12.14 20:25:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Emsisoft Anti-Malware
[2012.12.14 20:25:35 | 000,000,000 | ---D | C] -- C:\Users\dimer\Documents\Anti-Malware
[2012.12.14 14:20:25 | 000,000,000 | ---D | C] -- C:\Users\dimer\Documents\Downloads
[2012.12.14 14:20:23 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Local\sabnzbd
[2012.12.12 17:51:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\i4j_jres
[2012.12.09 12:32:14 | 000,000,000 | ---D | C] -- C:\Users\dimer\Documents\Outlook-Dateien
[2012.12.09 12:25:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SharePoint
[2012.12.09 12:25:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2012.12.09 12:25:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Synchronization Services
[2012.12.09 12:25:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DESIGNER
[2012.12.09 12:25:03 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH
[2012.12.09 12:25:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Sync Framework
[2012.12.09 12:25:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
[2012.12.09 12:24:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Visual Studio 8
[2012.12.09 12:24:00 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2012.12.09 12:23:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Analysis Services
[2012.12.09 12:23:49 | 000,000,000 | ---D | C] -- C:\Windows\SHELLNEW
[2012.12.09 12:23:33 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Local\Microsoft Help
[2012.12.09 12:23:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Office
[2012.12.09 12:23:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help
[2012.12.09 12:23:10 | 000,000,000 | RH-D | C] -- C:\MSOCache
[2012.12.09 12:21:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite
[2012.12.09 12:21:26 | 000,283,200 | ---- | C] (DT Soft Ltd) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys
[2012.12.09 12:21:23 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\DAEMON Tools Lite
[2012.12.09 12:21:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DAEMON Tools Lite
[2012.12.09 12:20:44 | 000,000,000 | ---D | C] -- C:\ProgramData\DAEMON Tools Lite
[2012.12.08 14:51:05 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\BullGuard
[2012.12.08 14:51:00 | 000,000,000 | ---D | C] -- C:\ProgramData\BullGuard
[2012.12.07 20:14:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\uTorrent
[2012.12.07 20:13:36 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\uTorrent
[2012.12.06 21:04:47 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\ImgBurn
[2012.12.06 20:57:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImgBurn
[2012.12.06 20:57:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ImgBurn
[2012.12.04 19:27:29 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\Wargaming.net
[2012.12.04 18:42:11 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Local\Mozilla
[2012.12.04 18:42:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2012.12.04 18:36:13 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\directx
[2012.12.02 13:50:14 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\dvdcss
[2012.12.02 13:50:05 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\vlc
[2012.12.02 13:50:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2012.12.02 13:49:55 | 000,000,000 | ---D | C] -- C:\Program Files\VideoLAN
[2012.12.01 19:03:48 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Local\Diagnostics
[2012.12.01 18:52:22 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\Macromedia
[2012.12.01 18:52:19 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\Adobe
[2012.12.01 18:51:58 | 000,000,000 | ---D | C] -- C:\Program Files\Google
[2012.12.01 18:51:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google
[2012.12.01 18:51:45 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Macromed
[2012.12.01 18:51:44 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed
[2012.12.01 18:51:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe
[2012.12.01 11:45:00 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\Thunderbird
[2012.12.01 11:45:00 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Local\Thunderbird
[2012.12.01 11:44:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service
[2012.12.01 11:44:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2012.12.01 11:22:08 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\TeamViewer
[2012.12.01 11:20:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\id Software
[2012.12.01 11:20:10 | 000,000,000 | ---D | C] -- C:\ProgramData\id Software
[2012.12.01 11:19:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TeamViewer
[2012.12.01 11:19:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
[2012.12.01 11:19:19 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip
[2012.12.01 11:17:31 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\Mozilla
[2012.12.01 11:17:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QLPrism
[2012.12.01 10:48:55 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Local\Abelssoft
[2012.11.30 23:58:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Syncopate
[2012.11.30 23:58:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Nexon
[2012.11.30 23:54:14 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\Avira
[2012.11.30 23:53:56 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\TS3Client
[2012.11.30 23:53:45 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\NVIDIA
[2012.11.30 23:53:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\GameNet
[2012.11.30 23:53:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Combat Arms
[2012.11.30 23:50:56 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\Skype
[2012.11.30 23:50:52 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype
[2012.11.30 23:50:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2012.11.30 23:50:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2012.11.30 23:50:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype
[2012.11.30 23:50:08 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
[2012.11.30 23:50:07 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Local\TeamSpeak 3 Client
[2012.11.30 23:48:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2012.11.30 23:48:50 | 000,129,216 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys
[2012.11.30 23:48:50 | 000,099,912 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2012.11.30 23:48:50 | 000,027,800 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2012.11.30 23:48:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2012.11.30 23:48:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira
[2012.11.30 23:40:37 | 000,000,000 | ---D | C] -- C:\NVIDIA
[2012.11.30 23:38:13 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\InstallShield
[2012.11.30 23:30:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Intel Corporation
[2012.11.30 23:29:45 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\Intel Corporation
[2012.11.30 23:29:30 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Local\Google
[2012.11.30 23:29:18 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Local\Deployment
[2012.11.30 23:29:18 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Local\Apps
[2012.11.30 23:23:23 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\RTCOM
[2012.11.30 23:23:23 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek
[2012.11.30 23:23:16 | 002,080,120 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\WavesGUILib64.dll
[2012.11.30 23:23:15 | 000,518,896 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSX64.dll
[2012.11.30 23:23:15 | 000,211,184 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSH64.dll
[2012.11.30 23:23:15 | 000,198,896 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSHP64.dll
[2012.11.30 23:23:15 | 000,155,888 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSWOW64.dll
[2012.11.30 23:23:14 | 002,028,920 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioEQ64.dll
[2012.11.30 23:23:14 | 000,834,936 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPOShell64.dll
[2012.11.30 23:23:14 | 000,375,128 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEP64A.dll
[2012.11.30 23:23:14 | 000,318,808 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO20.dll
[2012.11.30 23:23:14 | 000,310,104 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DHT64.dll
[2012.11.30 23:23:14 | 000,310,104 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DAA64.dll
[2012.11.30 23:23:14 | 000,204,120 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEED64A.dll
[2012.11.30 23:23:14 | 000,101,208 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEL64A.dll
[2012.11.30 23:23:14 | 000,078,680 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEG64A.dll
[2012.11.30 23:23:13 | 002,535,008 | ---- | C] (Fortemedia Corporation) -- C:\Windows\SysNative\FMAPO64.dll
[2012.11.30 23:23:12 | 000,110,592 | ---- | C] (Real Sound Lab SIA) -- C:\Windows\SysNative\CONEQMSAPOGUILibrary.dll
[2012.11.30 23:23:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Realtek
[2012.11.30 23:23:11 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Temp
[2012.11.30 23:22:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Marvell
[2012.11.30 23:22:35 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\InstallShield Installation Information
[2012.11.30 23:22:35 | 000,000,000 | ---D | C] -- C:\RaidTool
[2012.11.30 23:22:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JMicron Technology Corp
[2012.11.30 23:22:28 | 000,000,000 | ---D | C] -- C:\Windows\RaidTool
[2012.11.30 23:22:12 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel
[2012.11.30 23:16:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
[2012.11.30 23:13:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\InstallShield
[2012.11.30 23:12:33 | 000,053,248 | ---- | C] (Windows XP Bundled build C-Centric Single User) -- C:\Windows\SysWow64\CSVer.dll
[2012.11.30 23:12:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Intel
[2012.11.30 23:12:22 | 000,000,000 | ---D | C] -- C:\Intel
[2012.11.30 23:00:28 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\DriverGenius
[2012.11.30 22:59:37 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA
[2012.11.30 22:59:10 | 000,000,000 | ---D | C] -- C:\ProgramData\DriverGenius
[2012.11.30 22:59:07 | 000,060,776 | ---- | C] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll
[2012.11.30 22:59:07 | 000,052,584 | ---- | C] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll
[2012.11.30 22:58:48 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA Corporation
[2012.11.30 22:58:46 | 000,000,000 | ---D | C] -- C:\Program Files\NVIDIA Corporation
[2012.11.30 22:58:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NVIDIA Corporation
[2012.11.30 22:58:06 | 000,000,000 | R--D | C] -- C:\Users\dimer\Virtual Machines
[2012.11.30 22:58:06 | 000,000,000 | R--D | C] -- C:\Users\dimer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2012.11.30 22:58:06 | 000,000,000 | R--D | C] -- C:\Users\dimer\Searches
[2012.11.30 22:58:06 | 000,000,000 | R--D | C] -- C:\Users\dimer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2012.11.30 22:57:59 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\Identities
[2012.11.30 22:57:58 | 000,000,000 | R--D | C] -- C:\Users\dimer\Contacts
[2012.11.30 22:57:56 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Local\VirtualStore
[2012.11.30 22:57:51 | 000,000,000 | --SD | C] -- C:\Users\dimer\AppData\Roaming\Microsoft
[2012.11.30 22:57:51 | 000,000,000 | R--D | C] -- C:\Users\dimer\Videos
[2012.11.30 22:57:51 | 000,000,000 | R--D | C] -- C:\Users\dimer\Saved Games
[2012.11.30 22:57:51 | 000,000,000 | R--D | C] -- C:\Users\dimer\Pictures
[2012.11.30 22:57:51 | 000,000,000 | R--D | C] -- C:\Users\dimer\Music
[2012.11.30 22:57:51 | 000,000,000 | R--D | C] -- C:\Users\dimer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2012.11.30 22:57:51 | 000,000,000 | R--D | C] -- C:\Users\dimer\Links
[2012.11.30 22:57:51 | 000,000,000 | R--D | C] -- C:\Users\dimer\Favorites
[2012.11.30 22:57:51 | 000,000,000 | R--D | C] -- C:\Users\dimer\Downloads
[2012.11.30 22:57:51 | 000,000,000 | R--D | C] -- C:\Users\dimer\Documents
[2012.11.30 22:57:51 | 000,000,000 | R--D | C] -- C:\Users\dimer\Desktop
[2012.11.30 22:57:51 | 000,000,000 | R--D | C] -- C:\Users\dimer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2012.11.30 22:57:51 | 000,000,000 | -HSD | C] -- C:\Users\dimer\Vorlagen
[2012.11.30 22:57:51 | 000,000,000 | -HSD | C] -- C:\Users\dimer\AppData\Local\Verlauf
[2012.11.30 22:57:51 | 000,000,000 | -HSD | C] -- C:\Users\dimer\AppData\Local\Temporary Internet Files
[2012.11.30 22:57:51 | 000,000,000 | -HSD | C] -- C:\Users\dimer\Startmenü
[2012.11.30 22:57:51 | 000,000,000 | -HSD | C] -- C:\Users\dimer\SendTo
[2012.11.30 22:57:51 | 000,000,000 | -HSD | C] -- C:\Users\dimer\Recent
[2012.11.30 22:57:51 | 000,000,000 | -HSD | C] -- C:\Users\dimer\Netzwerkumgebung
[2012.11.30 22:57:51 | 000,000,000 | -HSD | C] -- C:\Users\dimer\Lokale Einstellungen
[2012.11.30 22:57:51 | 000,000,000 | -HSD | C] -- C:\Users\dimer\Documents\Eigene Videos
[2012.11.30 22:57:51 | 000,000,000 | -HSD | C] -- C:\Users\dimer\Documents\Eigene Musik
[2012.11.30 22:57:51 | 000,000,000 | -HSD | C] -- C:\Users\dimer\Eigene Dateien
[2012.11.30 22:57:51 | 000,000,000 | -HSD | C] -- C:\Users\dimer\Documents\Eigene Bilder
[2012.11.30 22:57:51 | 000,000,000 | -HSD | C] -- C:\Users\dimer\Druckumgebung
[2012.11.30 22:57:51 | 000,000,000 | -HSD | C] -- C:\Users\dimer\Cookies
[2012.11.30 22:57:51 | 000,000,000 | -HSD | C] -- C:\Users\dimer\AppData\Local\Anwendungsdaten
[2012.11.30 22:57:51 | 000,000,000 | -HSD | C] -- C:\Users\dimer\Anwendungsdaten
[2012.11.30 22:57:51 | 000,000,000 | -H-D | C] -- C:\Users\dimer\AppData
[2012.11.30 22:57:51 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Local\Temp
[2012.11.30 22:57:51 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Local\Microsoft
[2012.11.30 22:50:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET
[2012.11.30 22:49:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2012.11.30 22:49:02 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight
[2012.11.30 22:49:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight
[2012.11.30 22:48:46 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
[2012.11.30 22:48:46 | 000,000,000 | ---D | C] -- C:\Program Files\Windows XP Mode
[2012.11.30 22:47:41 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen
[2012.11.30 22:47:41 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü
[2012.11.30 22:47:41 | 000,000,000 | -HSD | C] -- C:\Recovery
[2012.11.30 22:47:41 | 000,000,000 | -HSD | C] -- C:\Programme
[2012.11.30 22:47:41 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien
[2012.11.30 22:47:41 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten
[2012.11.30 22:47:41 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos
[2012.11.30 22:47:41 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik
[2012.11.30 22:47:41 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder
[2012.11.30 22:47:41 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen
[2012.11.30 22:47:41 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente
[2012.11.30 22:47:41 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten
[2012.11.30 22:47:40 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2012.11.30 22:41:30 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch
[2012.11.30 22:41:01 | 000,000,000 | -HSD | C] -- C:\System Volume Information
[2012.11.30 22:40:03 | 000,000,000 | ---D | C] -- C:\Windows\Panther

========== Files - Modified Within 30 Days ==========

[2012.12.29 11:53:20 | 000,000,000 | ---- | M] () -- C:\Users\dimer\defogger_reenable
[2012.12.29 11:47:22 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\dimer\Desktop\OTL.exe
[2012.12.29 11:47:15 | 000,050,477 | ---- | M] () -- C:\Users\dimer\Desktop\Defogger.exe
[2012.12.29 11:06:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.12.29 10:55:20 | 000,023,872 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.12.29 10:55:20 | 000,023,872 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.12.29 10:54:43 | 002,491,104 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.12.29 10:54:43 | 000,718,106 | ---- | M] () -- C:\Windows\SysNative\perfh019.dat
[2012.12.29 10:54:43 | 000,702,554 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.12.29 10:54:43 | 000,655,930 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.12.29 10:54:43 | 000,150,586 | ---- | M] () -- C:\Windows\SysNative\perfc019.dat
[2012.12.29 10:54:43 | 000,149,608 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.12.29 10:54:43 | 000,122,300 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.12.29 10:47:57 | 000,000,288 | ---- | M] () -- C:\Windows\tasks\CheckDriveBackgroundGuard.job
[2012.12.29 10:47:46 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.12.29 10:47:42 | 2146,021,375 | -HS- | M] () -- C:\hiberfil.sys
[2012.12.28 23:35:45 | 1686,039,324 | ---- | M] () -- C:\Users\dimer\Desktop\shot0262.avi
[2012.12.23 08:49:13 | 000,336,704 | ---- | M] () -- C:\Windows\SysNative\perfi019.dat
[2012.12.23 08:49:13 | 000,039,446 | ---- | M] () -- C:\Windows\SysNative\perfd019.dat
[2012.12.21 16:12:23 | 000,409,312 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.12.21 13:46:14 | 000,000,934 | ---- | M] () -- C:\Users\Public\Desktop\EPSON Scan.lnk
[2012.12.18 15:26:56 | 000,000,382 | ---- | M] () -- C:\Windows\SysWow64\SystemPreferences.xml
[2012.12.18 09:32:04 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2012.12.15 12:32:57 | 000,001,402 | ---- | M] () -- C:\Users\dimer\Desktop\Free YouTube to MP3 Converter.lnk
[2012.12.14 20:25:58 | 000,001,095 | ---- | M] () -- C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
[2012.12.12 18:35:40 | 001,645,800 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.12.12 18:35:24 | 000,001,090 | ---- | M] () -- C:\Users\Public\Desktop\TeamViewer 8.lnk
[2012.12.12 16:30:40 | 000,129,216 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys
[2012.12.12 16:30:40 | 000,099,912 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2012.12.09 12:25:37 | 000,003,231 | ---- | M] () -- C:\Users\dimer\Desktop\Microsoft Outlook 2010.lnk
[2012.12.09 12:21:55 | 000,001,954 | ---- | M] () -- C:\Users\Public\Desktop\DAEMON Tools Lite.lnk
[2012.12.09 12:21:26 | 000,283,200 | ---- | M] (DT Soft Ltd) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys
[2012.12.07 20:14:20 | 000,000,947 | ---- | M] () -- C:\Users\Public\Desktop\µTorrent.lnk
[2012.12.06 20:57:55 | 000,001,869 | ---- | M] () -- C:\Users\Public\Desktop\ImgBurn.lnk
[2012.12.01 11:17:25 | 000,255,468 | ---- | M] () -- C:\Windows\QLPrism Uninstaller.exe
[2012.12.01 11:17:25 | 000,000,836 | ---- | M] () -- C:\Users\Public\Desktop\QLPrism Config Utility.lnk
[2012.12.01 11:17:25 | 000,000,743 | ---- | M] () -- C:\Users\Public\Desktop\QLPrism.lnk
[2012.11.30 23:53:40 | 000,000,753 | ---- | M] () -- C:\Users\dimer\Desktop\Combat Arms.lnk
[2012.11.30 23:53:40 | 000,000,605 | ---- | M] () -- C:\Users\dimer\Desktop\GameNet.lnk
[2012.11.30 23:50:52 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2012.11.30 23:50:09 | 000,001,211 | ---- | M] () -- C:\Users\dimer\Desktop\TeamSpeak 3 Client.lnk
[2012.11.30 22:44:32 | 000,161,548 | ---- | M] () -- C:\Windows\SysWow64\license.rtf
[2012.11.30 22:44:32 | 000,161,548 | ---- | M] () -- C:\Windows\SysNative\license.rtf

========== Files Created - No Company Name ==========

[2012.12.29 11:53:20 | 000,000,000 | ---- | C] () -- C:\Users\dimer\defogger_reenable
[2012.12.29 11:47:08 | 000,050,477 | ---- | C] () -- C:\Users\dimer\Desktop\Defogger.exe
[2012.12.28 23:35:26 | 1686,039,324 | ---- | C] () -- C:\Users\dimer\Desktop\shot0262.avi
[2012.12.23 08:49:57 | 000,336,704 | ---- | C] () -- C:\Windows\SysNative\perfi019.dat
[2012.12.23 08:49:56 | 000,718,106 | ---- | C] () -- C:\Windows\SysNative\perfh019.dat
[2012.12.23 08:49:56 | 000,150,586 | ---- | C] () -- C:\Windows\SysNative\perfc019.dat
[2012.12.23 08:49:56 | 000,039,446 | ---- | C] () -- C:\Windows\SysNative\perfd019.dat
[2012.12.21 13:47:01 | 000,111,932 | ---- | C] () -- C:\Windows\SysWow64\EPPICPrinterDB.dat
[2012.12.21 13:47:01 | 000,031,053 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern131.dat
[2012.12.21 13:47:01 | 000,027,417 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern121.dat
[2012.12.21 13:47:01 | 000,026,154 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern1.dat
[2012.12.21 13:47:01 | 000,024,903 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern3.dat
[2012.12.21 13:47:01 | 000,021,390 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern5.dat
[2012.12.21 13:47:01 | 000,020,148 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern2.dat
[2012.12.21 13:47:01 | 000,013,732 | ---- | C] () -- C:\Windows\SysWow64\EPPICLocal_EN.cfg
[2012.12.21 13:47:01 | 000,011,811 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern4.dat
[2012.12.21 13:47:01 | 000,006,442 | ---- | C] () -- C:\Windows\SysWow64\EPPICLocal_IT.cfg
[2012.12.21 13:47:01 | 000,006,347 | ---- | C] () -- C:\Windows\SysWow64\EPPICLocal_PT.cfg
[2012.12.21 13:47:01 | 000,006,347 | ---- | C] () -- C:\Windows\SysWow64\EPPICLocal_BP.cfg
[2012.12.21 13:47:01 | 000,006,335 | ---- | C] () -- C:\Windows\SysWow64\EPPICLocal_GE.cfg
[2012.12.21 13:47:01 | 000,006,195 | ---- | C] () -- C:\Windows\SysWow64\EPPICLocal_FR.cfg
[2012.12.21 13:47:01 | 000,006,195 | ---- | C] () -- C:\Windows\SysWow64\EPPICLocal_CF.cfg
[2012.12.21 13:47:01 | 000,006,122 | ---- | C] () -- C:\Windows\SysWow64\EPPICLocal_DU.cfg
[2012.12.21 13:47:01 | 000,006,103 | ---- | C] () -- C:\Windows\SysWow64\EPPICLocal_ES.cfg
[2012.12.21 13:47:01 | 000,005,817 | ---- | C] () -- C:\Windows\SysWow64\EPPICLocal_KO.cfg
[2012.12.21 13:47:01 | 000,005,436 | ---- | C] () -- C:\Windows\SysWow64\EPPICLocal_SC.cfg
[2012.12.21 13:47:01 | 000,004,943 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern6.dat
[2012.12.21 13:47:01 | 000,002,889 | ---- | C] () -- C:\Windows\SysWow64\EPPICLocal_RU.cfg
[2012.12.21 13:47:01 | 000,002,426 | ---- | C] () -- C:\Windows\SysWow64\EPPICLocal_TC.cfg
[2012.12.21 13:47:01 | 000,001,146 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_DU.dat
[2012.12.21 13:47:01 | 000,001,139 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_PT.dat
[2012.12.21 13:47:01 | 000,001,139 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_BP.dat
[2012.12.21 13:47:01 | 000,001,136 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_ES.dat
[2012.12.21 13:47:01 | 000,001,129 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_FR.dat
[2012.12.21 13:47:01 | 000,001,129 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_CF.dat
[2012.12.21 13:47:01 | 000,001,120 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_IT.dat
[2012.12.21 13:47:01 | 000,001,107 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_GE.dat
[2012.12.21 13:47:01 | 000,001,104 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_EN.dat
[2012.12.21 13:47:01 | 000,000,097 | ---- | C] () -- C:\Windows\SysWow64\PICSDK.ini
[2012.12.21 13:25:27 | 000,000,934 | ---- | C] () -- C:\Users\Public\Desktop\EPSON Scan.lnk
[2012.12.18 15:26:56 | 000,000,382 | ---- | C] () -- C:\Windows\SysWow64\SystemPreferences.xml
[2012.12.18 09:32:04 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2012.12.15 12:32:57 | 000,001,402 | ---- | C] () -- C:\Users\dimer\Desktop\Free YouTube to MP3 Converter.lnk
[2012.12.14 20:25:58 | 000,001,095 | ---- | C] () -- C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
[2012.12.12 18:35:24 | 000,001,102 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 8.lnk
[2012.12.12 18:35:24 | 000,001,090 | ---- | C] () -- C:\Users\Public\Desktop\TeamViewer 8.lnk
[2012.12.09 12:25:37 | 000,003,231 | ---- | C] () -- C:\Users\dimer\Desktop\Microsoft Outlook 2010.lnk
[2012.12.09 12:21:55 | 000,001,954 | ---- | C] () -- C:\Users\Public\Desktop\DAEMON Tools Lite.lnk
[2012.12.07 20:14:20 | 000,000,947 | ---- | C] () -- C:\Users\Public\Desktop\µTorrent.lnk
[2012.12.06 20:57:55 | 000,001,881 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImgBurn.lnk
[2012.12.06 20:57:55 | 000,001,869 | ---- | C] () -- C:\Users\Public\Desktop\ImgBurn.lnk
[2012.12.04 18:42:09 | 000,001,163 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012.12.01 18:51:46 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.12.01 11:17:25 | 000,255,468 | ---- | C] () -- C:\Windows\QLPrism Uninstaller.exe
[2012.12.01 11:17:25 | 000,000,836 | ---- | C] () -- C:\Users\Public\Desktop\QLPrism Config Utility.lnk
[2012.12.01 11:17:25 | 000,000,743 | ---- | C] () -- C:\Users\Public\Desktop\QLPrism.lnk
[2012.12.01 10:48:57 | 000,000,288 | ---- | C] () -- C:\Windows\tasks\CheckDriveBackgroundGuard.job
[2012.11.30 23:53:40 | 000,000,753 | ---- | C] () -- C:\Users\dimer\Desktop\Combat Arms.lnk
[2012.11.30 23:53:40 | 000,000,605 | ---- | C] () -- C:\Users\dimer\Desktop\GameNet.lnk
[2012.11.30 23:53:40 | 000,000,605 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GameNet.lnk
[2012.11.30 23:50:52 | 000,002,517 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk
[2012.11.30 23:50:09 | 000,001,211 | ---- | C] () -- C:\Users\dimer\Desktop\TeamSpeak 3 Client.lnk
[2012.11.30 23:23:46 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
[2012.11.30 23:23:14 | 000,336,393 | ---- | C] () -- C:\Windows\SysNative\drivers\RTAIODAT.DAT
[2012.11.30 23:20:03 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
[2012.11.30 22:59:20 | 003,536,817 | ---- | C] () -- C:\Windows\SysNative\nvcoproc.bin
[2012.11.30 22:58:12 | 000,001,409 | ---- | C] () -- C:\Users\dimer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
[2012.11.30 22:58:08 | 000,001,443 | ---- | C] () -- C:\Users\dimer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2012.11.30 22:57:38 | 000,210,944 | ---- | C] () -- C:\Windows\SysWow64\msvcrt10.dll
[2012.11.30 22:54:51 | 001,645,800 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.11.30 22:43:59 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2012.11.30 22:41:01 | 2146,021,375 | -HS- | C] () -- C:\hiberfil.sys
[2011.12.14 04:55:24 | 000,081,920 | ---- | C] () -- C:\Windows\qlprism-uninstall.exe

========== ZeroAccess Check ==========

[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 04:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2012.12.09 12:33:57 | 000,000,000 | ---D | M] -- C:\Users\dimer\AppData\Roaming\BullGuard
[2012.12.09 12:22:43 | 000,000,000 | ---D | M] -- C:\Users\dimer\AppData\Roaming\DAEMON Tools Lite
[2012.12.16 21:39:31 | 000,000,000 | ---D | M] -- C:\Users\dimer\AppData\Roaming\DVDVideoSoft
[2012.12.15 12:33:00 | 000,000,000 | ---D | M] -- C:\Users\dimer\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.12.21 16:13:19 | 000,000,000 | ---D | M] -- C:\Users\dimer\AppData\Roaming\Epson
[2012.12.24 21:05:05 | 000,000,000 | ---D | M] -- C:\Users\dimer\AppData\Roaming\ImgBurn
[2012.12.28 23:19:20 | 000,000,000 | ---D | M] -- C:\Users\dimer\AppData\Roaming\IrfanView
[2012.12.12 22:12:13 | 000,000,000 | ---D | M] -- C:\Users\dimer\AppData\Roaming\TeamViewer
[2012.12.01 11:45:00 | 000,000,000 | ---D | M] -- C:\Users\dimer\AppData\Roaming\Thunderbird
[2012.12.28 22:43:11 | 000,000,000 | ---D | M] -- C:\Users\dimer\AppData\Roaming\TS3Client
[2012.12.29 00:37:33 | 000,000,000 | ---D | M] -- C:\Users\dimer\AppData\Roaming\uTorrent
[2012.12.04 19:27:29 | 000,000,000 | ---D | M] -- C:\Users\dimer\AppData\Roaming\Wargaming.net

========== Purity Check ==========



< End of report >
__________________

OTL Extras logfile created on: 29.12.2012 11:54:40 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\dimer\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

8,00 Gb Total Physical Memory | 6,17 Gb Available Physical Memory | 77,12% Memory free
15,99 Gb Paging File | 13,54 Gb Available in Paging File | 84,63% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 195,21 Gb Total Space | 139,86 Gb Free Space | 71,64% Space Free | Partition Type: NTFS
Drive D: | 1201,96 Gb Total Space | 458,01 Gb Free Space | 38,11% Space Free | Partition Type: NTFS

Computer Name: DIMER-PC | User Name: dimer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{09608106-555D-4409-9B7F-628164C1C7E7}" = lport=10243 | protocol=6 | dir=in | app=system |
"{1173AE40-F1DB-43D7-BB43-3CBE78A6F912}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\outlook.exe |
"{18382545-D3AF-4FE8-91D4-8E5B62747530}" = lport=139 | protocol=6 | dir=in | app=system |
"{1E372CCB-9734-492F-9988-F11C0078A98C}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{372FE31F-9F3A-43C8-A498-9C39DA9A1749}" = lport=445 | protocol=6 | dir=in | app=system |
"{3C6B3910-E2B8-4EFB-9B89-B5A76523DE2D}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{4C8F2E23-7FE2-489D-AF16-DD2CC05A408F}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{59212316-839B-4C8F-A8A8-ACFDFCF525D9}" = lport=138 | protocol=17 | dir=in | app=system |
"{594623C2-BCE6-4F62-808C-5161B8000053}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{72625E8D-59F7-4556-9043-5DAAE29FEBBC}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{898947B7-62D0-4AC4-8E4F-4C84B069A54C}" = lport=2869 | protocol=6 | dir=in | app=system |
"{8C24114A-85C6-4BBE-A80D-CD3EE9BE8A79}" = rport=137 | protocol=17 | dir=out | app=system |
"{8F67EB94-C7B4-4BA4-91AA-10B89A93258D}" = rport=139 | protocol=6 | dir=out | app=system |
"{91A13E47-B60A-4B25-A36B-A58E0C59323D}" = lport=137 | protocol=17 | dir=in | app=system |
"{961E5EE3-FD91-4C37-9C01-77B35954F2EB}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{B1C8F1D1-FB4B-4B3D-83C0-877E34DDCB66}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{BBC56CFC-5379-49D9-B2CB-8FDEA0C1EEF0}" = rport=10243 | protocol=6 | dir=out | app=system |
"{CAA982E6-AB62-46FC-9CFC-DAD9BD2AD469}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{CC659CA4-7CEE-46C6-9F42-D6256F9CED86}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{D46B0D46-3378-4EF5-A39E-CD82A328FAF9}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{DF30C633-F777-4819-B076-DF6438ADC861}" = rport=138 | protocol=17 | dir=out | app=system |
"{EC6688EF-710A-47F7-9415-F19C2A387A69}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F55CE29D-9D7E-4719-9E64-6985625445AD}" = rport=445 | protocol=6 | dir=out | app=system |
"{F71DFD39-F8E0-449A-9B28-2CD6205E736E}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01ECE994-96B4-4E6A-892A-6F714AFE2517}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{06E118DF-2165-411C-B26E-737D09EEE884}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer_service.exe |
"{13E38B4B-9917-460F-90CF-46A77ED86BC5}" = protocol=17 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
"{18A80F7D-70A1-46F3-91A3-BA9C28436DA8}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{24E62885-5289-4EA3-9D93-0D971B3690E6}" = protocol=6 | dir=in | app=d:\spiele\qgna\qgna.exe |
"{279651D0-6A2B-4852-A008-D5FB4ED5C941}" = protocol=6 | dir=in | app=c:\users\dimer\appdata\local\temp\is-6ka59.tmp\setup31533.tmp |
"{2803BB25-CEB6-424D-B44B-6A965DE96922}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{32B15FC6-6E91-48E6-AD22-027474003C67}" = protocol=6 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
"{32F5EA73-D926-4E01-B90C-7D8C20228530}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{377CEA38-2926-41ED-B7CD-CE0E34EBBBFC}" = protocol=17 | dir=in | app=d:\spiele\qgna\games\ca\live\nmservice.exe |
"{37D3FE7B-825D-41D1-94AD-2D2D34C76267}" = protocol=6 | dir=in | app=c:\users\dimer\appdata\local\temp\is-pnq4s.tmp\ca_install_1894711.tmp |
"{40C81F6B-3ED2-4D03-8FF1-B11A4DD0FABC}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{4C897053-AD4B-41D8-A14E-EC8656473D04}" = protocol=6 | dir=in | app=d:\spiele\qgna\games\ca\live\nmservice.exe |
"{4D7887ED-E676-4104-BDC0-28DE7FDED6A2}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{4EB5B319-88D8-45EE-BCAC-2C1DD9C50975}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{52149F76-8D08-4049-BC17-DDBDDCD5B7C4}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{615C5B89-1486-46A3-9BB3-4B3880825871}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |
"{6ADF39F5-851D-4250-83D8-7ABC901E2D6D}" = protocol=17 | dir=in | app=c:\users\dimer\appdata\local\temp\is-6ka59.tmp\setup31533.tmp |
"{7734CFBE-2F25-4D9F-864B-4702B534DB48}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer.exe |
"{7B5B9908-C711-4A5E-B008-AF9B7DAAFC7F}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{7D014E6D-EC2E-4AD0-8D34-85DAF968FF19}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{7D9D8A96-DB49-4451-BFDA-51C2C534D7E4}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{844BC7FE-0DC9-490A-BCE4-5BC3CED448D5}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe |
"{850E8545-E306-4439-AC67-8642349B8922}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{88F3F657-F731-4004-86C9-206BD0383768}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{8A864670-751F-4C35-AF63-C8B477D64D47}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{92267973-0B7B-406A-B7AC-5F8534022CFD}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{AC9F0C57-2B64-4836-AF46-9126D0E461AE}" = protocol=17 | dir=in | app=d:\spiele\qgna\qgna.exe |
"{B091D84C-76E2-4B84-B819-5457BA353F0B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{C3EFBBDB-8AE8-4159-B11F-97E16EE0330D}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer.exe |
"{C4CF85BB-374C-46CD-9067-85E7261B5CF8}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{CA2C23E7-F05E-49EB-A0F7-6C5D743C296C}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer_service.exe |
"{CC2478D2-127E-4FAC-9614-03FBC574E307}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe |
"{DBF49DF5-AE10-4105-BD0D-BC77B3F67AC0}" = protocol=58 | dir=in | app=system |
"{DED39017-FF5A-4456-8035-2B0702A52316}" = protocol=6 | dir=out | app=system |
"{E3D1FF1B-0B25-45DA-970F-30F434C170B6}" = protocol=17 | dir=in | app=c:\users\dimer\appdata\local\temp\is-pnq4s.tmp\ca_install_1894711.tmp |
"{F1340D31-1DB1-4D66-98CE-0CBE83197FA2}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |
"{F895E680-021C-41A4-B687-CA4108E7A8A5}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{F94A96FE-E0B4-4FD6-921F-B3D89DCAFBFA}" = protocol=58 | dir=out | name=@iphlpsvc.dll,-503 |
"{FCDCDEC9-6CA1-4CAF-9A67-A2F51D1ED98B}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"TCP Query User{060049A3-664B-4B6B-BE1B-B3BB8D5F0AFD}C:\program files (x86)\jdownloader 2\jdownloader 2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\jdownloader 2\jdownloader 2.exe |
"TCP Query User{49EE72DA-F96C-4D36-82D9-29ADF5FB624E}C:\users\dimer\appdata\local\temp\keygen.exe" = protocol=6 | dir=in | app=c:\users\dimer\appdata\local\temp\keygen.exe |
"TCP Query User{A14EB1D7-9B82-446A-9BF5-C29838EB4FF0}D:\spiele\wot\wotlauncher.exe" = protocol=6 | dir=in | app=d:\spiele\wot\wotlauncher.exe |
"TCP Query User{A5C93B01-1B0B-43B1-8BF6-D70934ACE133}D:\spiele\wot\worldoftanks.exe" = protocol=6 | dir=in | app=d:\spiele\wot\worldoftanks.exe |
"TCP Query User{FD2AA9C5-D8D4-4525-B4E1-0D9FEC98C567}C:\program files (x86)\epson software\event manager\eeventmanager.exe" = protocol=6 | dir=in | app=c:\program files (x86)\epson software\event manager\eeventmanager.exe |
"UDP Query User{06E00805-77B2-4683-8084-C94706F511F4}C:\program files (x86)\jdownloader 2\jdownloader 2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\jdownloader 2\jdownloader 2.exe |
"UDP Query User{15EAEDB7-BEFF-427A-B1B3-0716182CD668}D:\spiele\wot\wotlauncher.exe" = protocol=17 | dir=in | app=d:\spiele\wot\wotlauncher.exe |
"UDP Query User{7B18EF19-1C5A-478E-A302-B95958B21FDE}C:\program files (x86)\epson software\event manager\eeventmanager.exe" = protocol=17 | dir=in | app=c:\program files (x86)\epson software\event manager\eeventmanager.exe |
"UDP Query User{C04709A8-5397-4488-9349-C419AF5D67F1}D:\spiele\wot\worldoftanks.exe" = protocol=17 | dir=in | app=d:\spiele\wot\worldoftanks.exe |
"UDP Query User{DC4FB20E-3FA5-4C8F-BA65-2824B6021183}C:\users\dimer\appdata\local\temp\keygen.exe" = protocol=17 | dir=in | app=c:\users\dimer\appdata\local\temp\keygen.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1374CC63-B520-4f3f-98E8-E9020BF01CFF}" = Windows XP Mode
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6276
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B0A5A6EE-F8BA-48B1-BB32-BAC17E96C2B4}" = Microsoft Visual J# 2.0 Redistributable Package - SE (x64)
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.0604
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.3.18.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"A8C0F819-A08C-4F1A-95D1-B8ADAA6417B2_is1" = Combat Arms
"EPSON SX210 Series" = Druckerdeinstallation für EPSON SX210 Series
"VLC media player" = VLC media player 2.0.4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{2FDD750F-49B7-40C1-9D5E-D2955BC0E2D8}" = NVIDIA PhysX
"{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}" = JMicron JMB36X Driver
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{48F22622-1CC2-4A83-9C1E-644DD96F832D}" = Epson Event Manager
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{85467CBC-7A39-33C9-8940-D72D9269B84F}" = Microsoft Visual F# 2.0 Runtime
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{87C2248A-C7DD-49ED-9BCD-B312A9D0819E}" = Epson Easy Photo Print 2
"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUS_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUS_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUS_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.PROPLUS_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0407-1000-0000000FF1CE}_Office14.PROPLUS_{594128C9-2CDF-43CE-8103-DC100CF013B6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.PROPLUS_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.PROPLUS_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6276
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{BC30E5E7-047D-4232-A7E8-F2CB7CC7B2E0}_is1" = Emsisoft Anti-Malware
"{EA17F4FC-FDBF-4CF8-A529-2D983132D053}" = Skype™ 6.0
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FA66CFD7-0977-4C45-AACD-A8BB994B1A05}" = Quake Live Mozilla Plugin
"2DC74854-88F0-4543-9AC5-3ACABFABA8F4_is1" = QGNA
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Avira AntiVir Desktop" = Avira Free Antivirus
"DAEMON Tools Lite" = DAEMON Tools Lite
"EPSON Scanner" = EPSON Scan
"Epson Stylus SX210_SX410_TX210_TX410 Benutzerhandbuch" = Epson Stylus SX210_SX410_TX210_TX410 Handbuch
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.37.1212
"ImgBurn" = ImgBurn
"IrfanView" = IrfanView (remove only)
"Marvell Miniport Driver" = Marvell Miniport Driver
"Mozilla Firefox 17.0.1 (x86 de)" = Mozilla Firefox 17.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"QLPrism" = QLPrism
"TeamViewer 8" = TeamViewer 8
"uTorrent" = µTorrent

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"TeamSpeak 3 Client" = TeamSpeak 3 Client

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 23.12.2012 15:06:24 | Computer Name = dimer-PC | Source = MsiInstaller | ID = 11609
Description =

Error - 23.12.2012 15:07:15 | Computer Name = dimer-PC | Source = WinMgmt | ID = 10
Description =

Error - 23.12.2012 17:23:07 | Computer Name = dimer-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: engine.exe, Version: 0.0.0.0, Zeitstempel:
0x50d426e0 Name des fehlerhaften Moduls: nmconew.dll_unloaded, Version: 0.0.0.0,
Zeitstempel: 0x5006ab9b Ausnahmecode: 0xc0000005 Fehleroffset: 0x21f3009d ID des fehlerhaften
Prozesses: 0x6c4 Startzeit der fehlerhaften Anwendung: 0x01cde1410ffb1bd2 Pfad der
fehlerhaften Anwendung: D:\Spiele\QGNA\Games\CA\live\engine.exe Pfad des fehlerhaften
Moduls: nmconew.dll Berichtskennung: f128b949-4d46-11e2-b671-000129a610b3

Error - 24.12.2012 04:42:52 | Computer Name = dimer-PC | Source = WinMgmt | ID = 10
Description =

Error - 24.12.2012 16:10:47 | Computer Name = dimer-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: setup.exe_unknown, Version: 0.0.0.0,
Zeitstempel: 0x4b989e44 Name des fehlerhaften Moduls: setup.exe, Version: 0.0.0.0,
Zeitstempel: 0x4b989e44 Ausnahmecode: 0x40000015 Fehleroffset: 0x0000d8c5 ID des fehlerhaften
Prozesses: 0x7ec Startzeit der fehlerhaften Anwendung: 0x01cde212a2f37bca Pfad der
fehlerhaften Anwendung: E:\setup.exe Pfad des fehlerhaften Moduls: E:\setup.exe Berichtskennung:
00e33a02-4e06-11e2-8f83-000129a610b3

Error - 24.12.2012 16:11:54 | Computer Name = dimer-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: SETUP.EXE_unknown, Version: 0.0.0.0,
Zeitstempel: 0x4b989e44 Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.17965,
Zeitstempel: 0x506dbe50 Ausnahmecode: 0xe06d7363 Fehleroffset: 0x0000c41f ID des fehlerhaften
Prozesses: 0x944 Startzeit der fehlerhaften Anwendung: 0x01cde212dbc01c33 Pfad der
fehlerhaften Anwendung: E:\SETUP.EXE Pfad des fehlerhaften Moduls: C:\Windows\syswow64\KERNELBASE.dll
Berichtskennung:
2901bdf5-4e06-11e2-8f83-000129a610b3

Error - 25.12.2012 03:55:00 | Computer Name = dimer-PC | Source = WinMgmt | ID = 10
Description =

Error - 28.12.2012 09:13:27 | Computer Name = dimer-PC | Source = WinMgmt | ID = 10
Description =

Error - 28.12.2012 16:24:12 | Computer Name = dimer-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: engine.exe, Version: 0.0.0.0, Zeitstempel:
0x50d426e0 Name des fehlerhaften Moduls: nmconew.dll_unloaded, Version: 0.0.0.0,
Zeitstempel: 0x5006ab9b Ausnahmecode: 0xc0000005 Fehleroffset: 0x2203009d ID des fehlerhaften
Prozesses: 0xa90 Startzeit der fehlerhaften Anwendung: 0x01cde526cf3b26d2 Pfad der
fehlerhaften Anwendung: D:\Spiele\QGNA\Games\CA\live\engine.exe Pfad des fehlerhaften
Moduls: nmconew.dll Berichtskennung: 8a4d5c7c-512c-11e2-bb01-000129a610b3

Error - 29.12.2012 05:49:34 | Computer Name = dimer-PC | Source = WinMgmt | ID = 10
Description =

[ System Events ]
Error - 24.12.2012 15:51:36 | Computer Name = dimer-PC | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

Error - 24.12.2012 15:51:37 | Computer Name = dimer-PC | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

Error - 24.12.2012 16:10:01 | Computer Name = dimer-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.

Error - 24.12.2012 16:10:07 | Computer Name = dimer-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.

Error - 24.12.2012 16:10:16 | Computer Name = dimer-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.

Error - 24.12.2012 16:10:24 | Computer Name = dimer-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.

Error - 24.12.2012 16:10:32 | Computer Name = dimer-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.

Error - 24.12.2012 16:11:36 | Computer Name = dimer-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.

Error - 24.12.2012 16:11:43 | Computer Name = dimer-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.

Error - 24.12.2012 16:11:51 | Computer Name = dimer-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.


< End of report >

Alt 29.12.2012, 18:37   #2
markusg
/// Malware-holic
 
GVU-Trojaner 2.04 (mit Webcam) - Standard

GVU-Trojaner 2.04 (mit Webcam)



Hi
also wenn du schon nach dem neu aufsätzen schadsoftware hast, hast du was falsch gemacht, und solltest evtl. noch mal neu aufsetzem.
Schau wir mal.
http://www.trojaner-board.de/125889-...en-posten.html
poste Malwarebytes logs mit Funden
__________________

__________________

Antwort

Themen zu GVU-Trojaner 2.04 (mit Webcam)
adblock, antivir, autorun, avira, bho, converter, emsisoft, error, firefox, flash player, helper, homepage, installation, jdownloader, logfile, mozilla, mp3, msiinstaller, msvcrt, nvidia update, plug-in, realtek, registry, scan, security, senden, svchost.exe, system, teamspeak, viren, visual studio, windows, windows xp



Ähnliche Themen: GVU-Trojaner 2.04 (mit Webcam)


  1. GVU Trojaner hat Windows 7 gesperrt - Webcam - paysafecard oder ukash - Trojaner-Board
    Plagegeister aller Art und deren Bekämpfung - 26.06.2013 (3)
  2. GVU - Trojaner mit Webcam
    Plagegeister aller Art und deren Bekämpfung - 23.12.2012 (23)
  3. GVU-Trojaner mit Webcam
    Plagegeister aller Art und deren Bekämpfung - 25.11.2012 (3)
  4. GVU Trojaner mit Webcam
    Plagegeister aller Art und deren Bekämpfung - 21.11.2012 (4)
  5. GVU Trojaner mit Webcam
    Log-Analyse und Auswertung - 11.11.2012 (3)
  6. GVU Trojaner mit Webcam
    Log-Analyse und Auswertung - 26.10.2012 (6)
  7. GVU Trojaner mit Webcam
    Plagegeister aller Art und deren Bekämpfung - 18.09.2012 (39)
  8. GVU Trojaner mit Webcam
    Plagegeister aller Art und deren Bekämpfung - 14.09.2012 (1)
  9. GVU-Trojaner mit Webcam
    Log-Analyse und Auswertung - 11.09.2012 (9)
  10. GVU Webcam Trojaner
    Plagegeister aller Art und deren Bekämpfung - 07.09.2012 (7)
  11. GVU-Trojaner mit Webcam
    Log-Analyse und Auswertung - 03.09.2012 (14)
  12. BSI Trojaner mit Webcam
    Log-Analyse und Auswertung - 21.08.2012 (16)
  13. GVU Trojaner + Webcam
    Log-Analyse und Auswertung - 16.08.2012 (8)
  14. GVU Trojaner mit webcam
    Log-Analyse und Auswertung - 13.08.2012 (24)
  15. GVU Trojaner mit Webcam
    Plagegeister aller Art und deren Bekämpfung - 30.07.2012 (11)
  16. GVU Trojaner mit Webcam
    Plagegeister aller Art und deren Bekämpfung - 22.06.2012 (2)
  17. Webcam trojaner?
    Mülltonne - 12.02.2008 (0)

Zum Thema GVU-Trojaner 2.04 (mit Webcam) - Hallo liebe Forumuser! Ich habe mir neulich einen GVU-Trojaner 2.04 eingefangen. Habe daraufhin direkt das BS neu aufgesetzt und einen scan mit Malwarebytes gemacht. Es wurden auch ein paar Viren - GVU-Trojaner 2.04 (mit Webcam)...
Archiv
Du betrachtest: GVU-Trojaner 2.04 (mit Webcam) auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.