| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: PUP.Datamngr nicht entfernbarWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
11.02.2013, 14:18
| #16 |
| /// Winkelfunktion /// TB-Süch-Tiger™   |  PUP.Datamngr nicht entfernbarCode:
ATTFilter Scan Mode: Current user
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
11.02.2013, 18:26
| #17 |
 | PUP.Datamngr nicht entfernbar OTL-Logdateien:
__________________OTL Logfile: Code:
ATTFilter OTL logfile created on: 11.02.2013 18:11:23 - Run 3 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\***\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 8.0.7601.17514) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 1,95 Gb Available Physical Memory | 48,71% Memory free 8,00 Gb Paging File | 5,71 Gb Available in Paging File | 71,44% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 931,51 Gb Total Space | 682,75 Gb Free Space | 73,30% Space Free | Partition Type: NTFS Drive D: | 392,05 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: UDF Computer Name: PC-2010 | User Name: *** | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - File not found PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_5_502_149_ActiveX.exe (Adobe Systems Incorporated) PRC - C:\Users\Schenkel\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\14.0.1\ToolbarUpdater.exe () PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) PRC - C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe (TeamViewer GmbH) PRC - C:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe () PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation) PRC - C:\Users\Schenkel\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.) PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) PRC - C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe (Nokia) PRC - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe (Nokia) PRC - C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe (Nokia) PRC - C:\Program Files (x86)\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe (Star Finanz - Software Entwicklung und Vertriebs GmbH) PRC - C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated) PRC - C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated) PRC - C:\Windows\SysWOW64\cjpcsc.exe (REINER SCT) PRC - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) PRC - C:\Program Files (x86)\Iomega StorCenter\sohoclient.exe (EMC) PRC - C:\Program Files (x86)\Retrospect\Retrospect Express HD 2.5\retrorun.exe (EMC Corporation) PRC - C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.) PRC - C:\Program Files (x86)\ScanSoft\OmniPageSE4\OpWareSE4.exe (Nuance Communications, Inc.) PRC - C:\Program Files (x86)\FRITZ!Box-Kindersicherung\avmident.exe (AVM Berlin) ========== Modules (No Company Name) ========== MOD - C:\Program Files (x86)\Nokia\Nokia Suite\phonon4.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\QtXmlPatterns4.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\QtXml4.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\QtWebKit4.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\QtSql4.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\QtScript4.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\QtOpenGL4.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\QtGui4.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\QtNetwork4.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\QtMultimediaKit1.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\QtDeclarative4.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\QtCore4.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\sqldrivers\qsqlite4.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\imageformats\qjpeg4.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\imageformats\qico4.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\imageformats\qgif4.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\NService.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\CommonUpdateChecker.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\ssoengine.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\securestorage.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\mediaservice\dsengine.dll () MOD - C:\Program Files (x86)\Iomega StorCenter\wxmsw28u_vc_custom.dll () ========== Services (SafeList) ========== SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (vToolbarUpdater14.0.1) -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\14.0.1\ToolbarUpdater.exe () SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (TeamViewer8) -- C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe (TeamViewer GmbH) SRV - (AVGIDSAgent) -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.) SRV - (Akamai) -- c:\program files (x86)\common files\akamai/netsession_win_ce5ba24.dll () SRV - (avgwd) -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.) SRV - (vToolbarUpdater13.2.0) -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe () SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation) SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) SRV - (ServiceLayer) -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe (Nokia) SRV - (StarMoney 7.0 OnlineUpdate) -- C:\Program Files (x86)\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe (Star Finanz - Software Entwicklung und Vertriebs GmbH) SRV - (AdobeActiveFileMonitor10.0) -- C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated) SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) SRV - (AdobeActiveFileMonitor9.0) -- C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated) SRV - (wlcrasvc) -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation) SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.) SRV - (cjpcsc) -- C:\Windows\SysWOW64\cjpcsc.exe (REINER SCT) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (RetroExp Helper) -- C:\Program Files (x86)\Retrospect\Retrospect Express HD 2.5\rthlpsvc.exe (EMC Corporation) SRV - (RetroExpLauncher) -- C:\Program Files (x86)\Retrospect\Retrospect Express HD 2.5\retrorun.exe (EMC Corporation) SRV - (PSI_SVC_2) -- C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.) SRV - (avmidentd) -- C:\Program Files (x86)\FRITZ!Box-Kindersicherung\avmident.exe (AVM Berlin) ========== Driver Services (SafeList) ========== DRV:64bit: - (avgtp) -- C:\Windows\SysNative\drivers\avgtpx64.sys (AVG Technologies) DRV:64bit: - (Avgmfx64) -- C:\Windows\SysNative\drivers\avgmfx64.sys (AVG Technologies CZ, s.r.o.) DRV:64bit: - (AVGIDSDriver) -- C:\Windows\SysNative\drivers\avgidsdrivera.sys (AVG Technologies CZ, s.r.o. ) DRV:64bit: - (AVGIDSHA) -- C:\Windows\SysNative\drivers\avgidsha.sys (AVG Technologies CZ, s.r.o. ) DRV:64bit: - (Avgldx64) -- C:\Windows\SysNative\drivers\avgldx64.sys (AVG Technologies CZ, s.r.o.) DRV:64bit: - (Avgtdia) -- C:\Windows\SysNative\drivers\avgtdia.sys (AVG Technologies CZ, s.r.o.) DRV:64bit: - (Avgloga) -- C:\Windows\SysNative\drivers\avgloga.sys (AVG Technologies CZ, s.r.o.) DRV:64bit: - (Avgrkx64) -- C:\Windows\SysNative\drivers\avgrkx64.sys (AVG Technologies CZ, s.r.o.) DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation) DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV:64bit: - (pccsmcfd) -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys (Nokia) DRV:64bit: - (fssfltr) -- C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (nmwcdnsux64) -- C:\Windows\SysNative\drivers\nmwcdnsux64.sys (Nokia) DRV:64bit: - (nmwcd) -- C:\Windows\SysNative\drivers\ccdcmbx64.sys (Nokia) DRV:64bit: - (nmwcdnsucx64) -- C:\Windows\SysNative\drivers\nmwcdnsucx64.sys (Nokia) DRV:64bit: - (UsbserFilt) -- C:\Windows\SysNative\drivers\usbser_lowerfltjx64.sys (Nokia) DRV:64bit: - (upperdev) -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys (Nokia) DRV:64bit: - (nmwcdc) -- C:\Windows\SysNative\drivers\ccdcmbox64.sys (Nokia) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (usbser) -- C:\Windows\SysNative\drivers\usbser.sys (Microsoft Corporation) DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions) DRV:64bit: - (cjusb) -- C:\Windows\SysNative\drivers\cjusb.sys (REINER SCT) DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (WSDPrintDevice) -- C:\Windows\SysNative\drivers\WSDPrint.sys (Microsoft Corporation) DRV:64bit: - (TPM) -- C:\Windows\SysNative\drivers\tpm.sys (Microsoft Corporation) DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation) DRV:64bit: - (e1express) -- C:\Windows\SysNative\drivers\e1e6032e.sys (Intel Corporation) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (Atc002) -- C:\Windows\SysNative\drivers\l260x64.sys (Atheros Communications, Inc.) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (regi) -- C:\Windows\SysNative\drivers\regi.sys (InterVideo) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = IE:64bit: - HKLM\..\SearchScopes\{C9CEDD57-223D-484F-BF8A-DDBD5672BAA3}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=MNMTDF&pc=MANM&src=IE-SearchBox; IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{2FC6DA2B-6916-43C3-9D70-59CFD1B2063D}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=MNMTDF&pc=MANM&src=IE-SearchBox; IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-383967239-2986141260-540713063-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://nmd.msn.com/ IE - HKU\S-1-5-21-383967239-2986141260-540713063-1001\..\SearchScopes,DefaultScope = {2FC6DA2B-6916-43C3-9D70-59CFD1B2063D} IE - HKU\S-1-5-21-383967239-2986141260-540713063-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-383967239-2986141260-540713063-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1:9421;<local> IE - HKU\S-1-5-21-383967239-2986141260-540713063-1006\..\SearchScopes,DefaultScope = ========== FireFox ========== FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_149.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\system32\npDeployJava1.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_149.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nokia.com/EnablerPlugin: C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( ) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2013.01.08 21:28:39 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 17.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2013.01.08 21:28:39 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 17.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2013.01.25 21:05:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Schenkel\AppData\Roaming\mozilla\Extensions [2010.07.09 18:29:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Schenkel\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2013.01.25 21:06:00 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2011.05.17 22:44:56 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2010.03.31 10:09:22 | 010,437,264 | ---- | M] (PDFTron Systems Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\PDFNetC.dll [2010.04.08 12:36:02 | 000,107,760 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\plugins\ScorchPDFWrapper.dll O1 HOSTS File: ([2013.02.11 09:31:11 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll File not found O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation) O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll File not found O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKU\S-1-5-21-383967239-2986141260-540713063-1001\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated) O4:64bit: - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.) O4:64bit: - HKLM..\Run: [CanonSolutionMenu] C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.) O4:64bit: - HKLM..\Run: [WrtMon.exe] C:\Windows\SysNative\spool\drivers\x64\3\WrtMon.exe () O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [AVG_UI] C:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [OpwareSE4] C:\Program Files (x86)\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.) O4 - HKLM..\Run: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe" File not found O4 - HKU\S-1-5-21-383967239-2986141260-540713063-1001..\Run: [Akamai NetSession Interface] C:\Users\Schenkel\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.) O4 - HKU\S-1-5-21-383967239-2986141260-540713063-1001..\Run: [CAHeadless] C:\Program Files (x86)\Adobe\Elements 10 Organizer\CAHeadless\ElementsAutoAnalyzer.exe (Adobe Systems Incorporated) O4 - HKU\S-1-5-21-383967239-2986141260-540713063-1001..\Run: [NokiaSuite.exe] C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe (Nokia) O4 - HKU\S-1-5-21-383967239-2986141260-540713063-1006..\Run: [ROC_JAN2013_TB] "C:\Program Files (x86)\AVG Secure Search\ROC_JAN2013_TB.exe" /PROMPT /CMPID=JAN2013_TB File not found O4 - HKU\S-1-5-21-383967239-2986141260-540713063-1006..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-383967239-2986141260-540713063-1006..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - Startup: C:\Users\Kinder\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () O4 - Startup: C:\Users\Vogelhäuschen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-383967239-2986141260-540713063-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-383967239-2986141260-540713063-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-383967239-2986141260-540713063-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKU\S-1-5-21-383967239-2986141260-540713063-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2 O7 - HKU\S-1-5-21-383967239-2986141260-540713063-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1 O7 - HKU\S-1-5-21-383967239-2986141260-540713063-1006\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\Schenkel\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm () O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Free YouTube Download - C:\Users\Schenkel\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm () O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 File not found O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O13 - gopher Prefix: missing O15 - HKU\S-1-5-21-383967239-2986141260-540713063-1001\..Trusted Domains: fritz.box ([]* in Lokales Intranet) O15 - HKU\S-1-5-21-383967239-2986141260-540713063-1001\..Trusted Ranges: Range1 ([*] in Lokales Intranet) O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.7.cab (DLM Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25) O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25) O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} https://secure.logmein.com//activex/ractrl.cab?lmi=972 (Performance Viewer Activex Control) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2669C220-BB99-429D-97D2-C470043BC6CD}: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgppa.dll File not found O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll File not found O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (c:\progra~3\browse~1\261070~1.41\{c16c1~1\browse~1.dll) - File not found O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.02.11 18:07:48 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{0DEE2914-01D9-4650-9448-197CA24D573E} [2013.02.11 13:08:39 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{FB882446-A7E4-4E9C-A147-11A6560EDB3B} [2013.02.11 13:08:15 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN [2013.02.11 09:36:18 | 000,000,000 | ---D | C] -- C:\Windows\temp [2013.02.11 09:01:27 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{07BCFBD6-0259-469B-8207-D0F7ABAC11BB} [2013.02.11 09:01:25 | 005,030,592 | R--- | C] (Swearware) -- C:\Users\Schenkel\Desktop\ComboFix.exe [2013.02.11 08:57:54 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{59DA3CB9-3374-407F-8B7B-F430406594E3} [2013.02.08 20:12:30 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{7842D2F0-1B5A-401C-BE03-6BD326E0FC34} [2013.02.08 20:00:45 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe [2013.02.08 20:00:45 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe [2013.02.08 20:00:45 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe [2013.02.08 20:00:34 | 000,000,000 | ---D | C] -- C:\Qoobox [2013.02.08 20:00:00 | 000,000,000 | ---D | C] -- C:\Windows\erdnt [2013.02.08 08:11:54 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{915BA8C1-54B9-462C-BF4E-6A3E9A866F5F} [2013.02.07 20:05:55 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{F60D843A-10DE-4889-87AB-EA1F8B8A4A96} [2013.02.07 16:11:58 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{EB3F6BD3-A1E3-4F96-B866-72226212C5F9} [2013.02.06 23:26:54 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\Desktop\mbar-1.01.0.1017 [2013.02.06 17:25:15 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GeoGebra 4.2 [2013.02.06 13:27:35 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Schenkel\Desktop\OTL.exe [2013.02.06 13:18:42 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{C5F145B9-BDB2-4929-992A-42F8256355A4} [2013.02.05 20:37:02 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{47519D04-F33D-4386-826A-F88149368530} [2013.02.05 02:07:18 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{19F8254E-453A-4EEC-98F4-0017FFA2B8B6} [2013.02.04 14:06:44 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{30FEEF74-5BEB-4225-B739-FCB590A53CD3} [2013.02.02 10:16:01 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{982692AB-35AA-4939-B54C-2849CAA09076} [2013.02.01 09:35:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG [2013.02.01 08:33:30 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{018403E4-670A-46C3-A3BB-BDA59F522173} [2013.01.31 15:03:04 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{F1BF9CDD-A5FE-4858-829D-C1236EB4AD4D} [2013.01.31 15:02:52 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{82FFA2D1-ED22-40A4-A1E8-EB2D1D5FFC5C} [2013.01.30 22:02:50 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{D47B6F6C-9ECF-4BE6-8F6C-99DB3DA514B1} [2013.01.30 21:59:20 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{19308E01-1A57-4F90-A336-64E87271773F} [2013.01.30 08:22:26 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{6DD607ED-E650-4829-8B3E-52C5168E372F} [2013.01.29 21:21:02 | 000,000,000 | ---D | C] -- C:\ProgramData\SecTaskMan [2013.01.29 21:20:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security Task Manager [2013.01.29 21:20:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Security Task Manager [2013.01.29 20:31:11 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\Desktop\Biologie [2013.01.29 20:21:59 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{818F3531-3E17-424B-B7E1-D560AFCF4EB1} [2013.01.28 14:44:17 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{437FAF35-2948-446E-BBDD-70AD485E0923} [2013.01.27 22:44:03 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{F3FF40F4-82B0-41A5-B65B-715997467179} [2013.01.27 10:43:39 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{FB409ADC-6ED8-49D1-9A1E-5F04F0E8F7FD} [2013.01.26 14:24:58 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{C22F4D45-7C32-4E49-B14C-E66C98D1861E} [2013.01.26 02:24:22 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{AE6BBB3C-342E-47A5-9F59-946B96379171} [2013.01.25 14:23:58 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{EFC3E380-5968-4EB6-98D7-8056B1EAB2C3} [2013.01.24 14:23:23 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{A20CA695-12A9-492C-B021-146CA61252D5} [2013.01.23 23:59:27 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{2B93B16D-56BE-4E33-B3AB-7E2F588E57B0} [2013.01.22 23:58:25 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{D4F5282F-5EDF-482D-AC97-41897FE16E77} [2013.01.21 23:57:41 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{658086ED-C8AE-408A-9AE9-E9854B4E05A6} [2013.01.20 23:56:53 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{0B2ED45F-F322-4F87-AB67-005A66C6967E} [2013.01.20 12:48:52 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\Desktop\Fotobuch 2. Wahl [2013.01.20 11:56:25 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{AEA48709-C095-4D87-A910-C3A18289086B} [2013.01.19 10:52:41 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{001D7526-1D6E-45EB-86C5-E2B05457E298} [2013.01.18 15:13:09 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{3CD56E0B-38E2-4D4D-9887-A577BD85D6F2} [2013.01.18 03:12:34 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{D1430FDC-D6BF-42AE-8177-534946FD0C6E} [2013.01.17 15:11:56 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{DA3EF255-6F50-4B15-AB78-4A5AAB1FAACC} [2013.01.16 15:21:58 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{793A7E63-8748-400A-B35F-7C8E279A496E} [2013.01.15 14:31:29 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{76F26267-5908-4A72-B895-9A50F1495CE5} [2013.01.15 02:31:18 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{7804998A-A028-4501-9B47-3F83390EC59B} [2013.01.14 22:51:25 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\Desktop\Fotokunst Indien [2013.01.14 14:30:41 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{42FB7ED4-D9AB-4B16-931D-881E49372DEE} [2013.01.13 17:26:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Wincert [2013.01.13 11:36:28 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{C0A9430A-32F0-4B48-B7F0-6DCCD3E4FCD2} [2010.09.07 20:46:39 | 000,089,680 | ---- | C] (Microsoft Corporation) -- C:\Users\Schenkel\MSSSerif120.fon [2010.07.18 20:09:45 | 001,228,400 | ---- | C] (Adobe Systems Incorporated) -- C:\Users\Schenkel\Photoshop_12_LS1.exe ========== Files - Modified Within 30 Days ========== [2013.02.11 18:14:25 | 000,000,680 | RHS- | M] () -- C:\Users\Schenkel\ntuser.pol [2013.02.11 18:07:23 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2013.02.11 18:07:23 | 000,000,354 | ---- | M] () -- C:\Windows\tasks\ROC_JAN2013_TB_rmv.job [2013.02.11 18:07:00 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.02.11 18:06:55 | 3220,627,456 | -HS- | M] () -- C:\hiberfil.sys [2013.02.11 13:36:10 | 000,001,114 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2013.02.11 13:14:39 | 000,013,232 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.02.11 13:14:39 | 000,013,232 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.02.11 13:04:11 | 000,000,166 | ---- | M] () -- C:\Windows\DeleteOnReboot.bat [2013.02.11 12:48:08 | 000,587,659 | ---- | M] () -- C:\Users\Schenkel\Desktop\adwcleaner.exe [2013.02.11 12:43:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2013.02.11 09:41:53 | 000,008,487 | ---- | M] () -- C:\Users\Schenkel\Desktop\combofix log.zip [2013.02.11 09:31:11 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts [2013.02.11 09:02:20 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2013.02.11 09:02:20 | 000,654,478 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2013.02.11 09:02:20 | 000,616,342 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2013.02.11 09:02:20 | 000,130,536 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2013.02.11 09:02:20 | 000,106,722 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2013.02.11 08:57:14 | 005,030,592 | R--- | M] (Swearware) -- C:\Users\Schenkel\Desktop\ComboFix.exe [2013.02.08 09:43:18 | 000,697,712 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2013.02.08 09:43:18 | 000,074,096 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2013.02.07 20:32:12 | 000,014,808 | ---- | M] () -- C:\Users\Schenkel\Desktop\GMER-Logdatei.7z [2013.02.07 20:28:22 | 000,009,276 | ---- | M] () -- C:\Users\Schenkel\Desktop\GMER-Logdatei.zip [2013.02.07 17:30:26 | 000,000,512 | ---- | M] () -- C:\Users\Schenkel\Desktop\MBR.dat [2013.02.06 23:26:49 | 013,562,257 | ---- | M] () -- C:\Users\Schenkel\Desktop\mbar-1.01.0.1017.zip [2013.02.06 17:25:15 | 000,002,096 | ---- | M] () -- C:\Users\Schenkel\Desktop\GeoGebra 4.2.lnk [2013.02.06 13:27:49 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Schenkel\Desktop\OTL.exe [2013.02.03 23:19:22 | 004,966,784 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2013.02.01 09:35:04 | 000,001,020 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2013.lnk [2013.01.27 18:57:19 | 000,604,658 | ---- | M] () -- C:\Users\Schenkel\Desktop\IMG.jpg [2013.01.26 14:47:10 | 000,000,146 | ---- | M] () -- C:\Users\Schenkel\Desktop\Windows Defender - Verknüpfung.lnk [2013.01.25 21:13:51 | 000,001,129 | ---- | M] () -- C:\Users\Public\Desktop\TeamViewer 8.lnk [2013.01.23 18:15:00 | 000,000,328 | ---- | M] () -- C:\Windows\tasks\ROC_JAN2013_TB_Kinder.job [2013.01.21 21:51:54 | 000,000,571 | ---- | M] () -- C:\Windows\SysNative\MyDefrag.debuglog [2013.01.21 13:38:23 | 000,037,720 | ---- | M] (AVG Technologies) -- C:\Windows\SysNative\drivers\avgtpx64.sys [2013.01.15 00:00:16 | 000,002,076 | ---- | M] () -- C:\Users\Schenkel\Desktop\Entfernen des Avira DE-Cleaners.lnk [2013.01.15 00:00:16 | 000,002,005 | ---- | M] () -- C:\Users\Schenkel\Desktop\Avira DE-Cleaner.lnk [2013.01.14 21:19:10 | 000,041,085 | ---- | M] () -- C:\Users\Schenkel\Desktop\dreamweaver-ornamente9.jpg [2013.01.12 19:12:41 | 000,001,106 | ---- | M] () -- C:\Users\Schenkel\Desktop\Bilder - Verknüpfung.lnk ========== Files Created - No Company Name ========== [2013.02.11 13:03:57 | 000,000,166 | ---- | C] () -- C:\Windows\DeleteOnReboot.bat [2013.02.11 13:02:45 | 000,587,659 | ---- | C] () -- C:\Users\Schenkel\Desktop\adwcleaner.exe [2013.02.11 09:41:53 | 000,008,487 | ---- | C] () -- C:\Users\Schenkel\Desktop\combofix log.zip [2013.02.08 20:00:45 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe [2013.02.08 20:00:45 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe [2013.02.08 20:00:45 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe [2013.02.08 20:00:45 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe [2013.02.08 20:00:45 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe [2013.02.07 20:29:39 | 000,014,808 | ---- | C] () -- C:\Users\Schenkel\Desktop\GMER-Logdatei.7z [2013.02.07 20:28:22 | 000,009,276 | ---- | C] () -- C:\Users\Schenkel\Desktop\GMER-Logdatei.zip [2013.02.07 17:30:26 | 000,000,512 | ---- | C] () -- C:\Users\Schenkel\Desktop\MBR.dat [2013.02.06 23:26:21 | 013,562,257 | ---- | C] () -- C:\Users\Schenkel\Desktop\mbar-1.01.0.1017.zip [2013.02.06 17:25:15 | 000,002,096 | ---- | C] () -- C:\Users\Schenkel\Desktop\GeoGebra 4.2.lnk [2013.01.27 18:57:19 | 000,604,658 | ---- | C] () -- C:\Users\Schenkel\Desktop\IMG.jpg [2013.01.26 14:47:10 | 000,000,146 | ---- | C] () -- C:\Users\Schenkel\Desktop\Windows Defender - Verknüpfung.lnk [2013.01.25 21:13:51 | 000,001,141 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 8.lnk [2013.01.25 21:13:51 | 000,001,129 | ---- | C] () -- C:\Users\Public\Desktop\TeamViewer 8.lnk [2013.01.23 18:05:45 | 000,000,328 | ---- | C] () -- C:\Windows\tasks\ROC_JAN2013_TB_Kinder.job [2013.01.21 21:51:54 | 000,000,571 | ---- | C] () -- C:\Windows\SysNative\MyDefrag.debuglog [2013.01.21 13:39:06 | 000,000,354 | ---- | C] () -- C:\Windows\tasks\ROC_JAN2013_TB_rmv.job [2013.01.14 21:19:08 | 000,041,085 | ---- | C] () -- C:\Users\Schenkel\Desktop\dreamweaver-ornamente9.jpg [2013.01.12 19:12:41 | 000,001,106 | ---- | C] () -- C:\Users\Schenkel\Desktop\Bilder - Verknüpfung.lnk [2012.07.20 15:09:42 | 000,000,021 | ---- | C] () -- C:\Windows\preview.ini [2011.07.14 20:42:08 | 000,947,408 | ---- | C] () -- C:\Windows\Diercke Globus Online Uninstaller.exe.bak [2011.07.12 19:32:45 | 000,000,000 | ---- | C] () -- C:\Users\Schenkel\AppData\Local\{EBADA874-5CEF-4BAD-989A-62FA3244C962} [2011.04.10 11:27:53 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll [2010.12.02 19:58:07 | 000,000,680 | RHS- | C] () -- C:\Users\Schenkel\ntuser.pol [2010.10.24 19:54:22 | 000,021,504 | ---- | C] () -- C:\Users\Schenkel\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.07.18 20:42:26 | 000,007,601 | ---- | C] () -- C:\Users\Schenkel\AppData\Local\Resmon.ResmonCfg [2010.07.18 20:09:45 | 1026,293,791 | ---- | C] () -- C:\Users\Schenkel\Photoshop_12_LS1.7z [2010.07.15 14:31:43 | 000,000,008 | RHS- | C] () -- C:\ProgramData\3E504D73F4.sys [2010.07.15 14:31:42 | 000,002,516 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys ========== ZeroAccess Check ========== [2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== Alternate Data Streams ========== @Alternate Data Stream - 60 bytes -> C:\Users\Public\Documents\.DS_Store:AFP_AfpInfo @Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:C3AE45C9 < End of report > Logdatei Extras: OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 11.02.2013 18:11:24 - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\***\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
4,00 Gb Total Physical Memory | 1,95 Gb Available Physical Memory | 48,71% Memory free
8,00 Gb Paging File | 5,71 Gb Available in Paging File | 71,44% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 931,51 Gb Total Space | 682,75 Gb Free Space | 73,30% Space Free | Partition Type: NTFS
Drive D: | 392,05 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: UDF
Computer Name: PC-2010 | User Name: Schenkel | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- Reg Error: Value error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~2\Office12\ONENOTE.EXE "%L"
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- Reg Error: Value error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~2\Office12\ONENOTE.EXE "%L"
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
========== Firewall Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1A4C2864-9C24-4EDB-ACC8-773E329A0092}" = lport=90 | protocol=6 | dir=out | app=c:\program files (x86)\nch swift sound\axon\axon.exe |
"{1BAE9C4D-1348-4CB2-99C5-7FACB27F0212}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{2AF35438-DAA3-4B0F-BA89-BAFC66CFA13E}" = lport=139 | protocol=6 | dir=in | app=system |
"{2E12A0F0-6496-41DD-9C7A-4CB69B8774D8}" = lport=8001 | protocol=17 | dir=out | app=c:\program files (x86)\nch swift sound\axon\axon.exe |
"{2E4C4BC3-5278-4BBA-996D-E7580187BCC7}" = lport=49164 | protocol=6 | dir=in | name=akamai netsession interface |
"{4354E357-616A-4519-8327-3AFC5A8EFFE6}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{4B78255E-32EE-41DC-9424-5334B59A32BD}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{5384EC1D-B36C-42F4-B91D-98F748AD803F}" = lport=5060 | protocol=17 | dir=out | app=c:\program files (x86)\nch swift sound\axon\axon.exe |
"{586EE2A0-546A-4DDC-A10B-6A16181D0081}" = rport=10243 | protocol=6 | dir=out | app=system |
"{58D79ACA-1E83-419F-B939-767D4138C336}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{5B84CBD1-1718-4D23-B28F-262BDCB5B87C}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{69288171-0E4F-428E-8D9A-CD8544E6097E}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{70C781FF-5512-47F2-BB81-2D8F0A391202}" = lport=8009 | protocol=17 | dir=out | app=c:\program files (x86)\nch swift sound\axon\axon.exe |
"{71ADE422-8BB2-4800-BA35-61870253FFAC}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{75D9F355-742D-4426-9E54-ACD2E93CB5A2}" = lport=8005 | protocol=17 | dir=out | app=c:\program files (x86)\nch swift sound\axon\axon.exe |
"{7973CA64-EA13-4CDA-A69B-42D5B5DEE738}" = lport=2869 | protocol=6 | dir=in | app=system |
"{807AC634-E744-4970-9A14-675CA852F453}" = lport=8007 | protocol=17 | dir=out | app=c:\program files (x86)\nch swift sound\axon\axon.exe |
"{82CB5605-19FF-4728-A5E0-2E34EB7412E4}" = lport=8003 | protocol=17 | dir=out | app=c:\program files (x86)\nch swift sound\axon\axon.exe |
"{84833571-0D0A-45B0-8ACE-1D2E3E44A89D}" = lport=445 | protocol=6 | dir=in | app=system |
"{87A73A38-5975-44D0-BE06-DDFDDF8CC781}" = lport=2869 | protocol=6 | dir=in | app=system |
"{8CA5A914-8553-4FA7-8862-E75925ADAAF1}" = lport=5700 | protocol=17 | dir=out | app=c:\program files (x86)\nch swift sound\axon\axon.exe |
"{8CAE880F-839D-424B-ADAE-EF418EFA7AB7}" = lport=5701 | protocol=17 | dir=out | app=c:\program files (x86)\nch swift sound\axon\axon.exe |
"{913A4245-D630-49DF-BB16-287AEF755E1F}" = lport=137 | protocol=17 | dir=in | app=system |
"{963D1DC4-59F7-48BA-A03A-21D52D7D60C4}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{9CE84869-FDA5-40C7-8A7E-44A17D50E79F}" = rport=138 | protocol=17 | dir=out | app=system |
"{A0F18B00-E5EE-4815-9988-A04F6D5E12F7}" = lport=8008 | protocol=17 | dir=out | app=c:\program files (x86)\nch swift sound\axon\axon.exe |
"{A892E647-4398-4CCC-9652-ADC248D9FAB6}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{AA617257-F9C0-4833-BA91-3903FED28017}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{AF32CC5F-B762-4165-9A22-278EDB4E2550}" = lport=49174 | protocol=6 | dir=in | name=akamai netsession interface |
"{B0218086-E661-48BD-8602-820F4D56EB29}" = lport=138 | protocol=17 | dir=in | app=system |
"{B402DA86-F6A0-4172-AC83-A72729EBB2B0}" = rport=139 | protocol=6 | dir=out | app=system |
"{BB551F3B-C67A-4FFD-ABE1-4E55B31F4423}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{C4FA0C16-F516-4AD5-9D74-FE1F9E98BEC9}" = rport=445 | protocol=6 | dir=out | app=system |
"{D076BB77-ACCF-4DD6-A2AA-0C97A918A8B9}" = lport=8006 | protocol=17 | dir=out | app=c:\program files (x86)\nch swift sound\axon\axon.exe |
"{D5C0092D-3B33-4950-8D57-BA3F030D5A84}" = lport=81 | protocol=6 | dir=out | app=c:\program files (x86)\nch swift sound\axon\axon.exe |
"{D8244568-E85A-40B4-A7A1-E2CBAB166E44}" = lport=8004 | protocol=17 | dir=out | app=c:\program files (x86)\nch swift sound\axon\axon.exe |
"{DAD5B1E9-7B4D-4F06-9D27-2DD57C2E82D2}" = lport=8000 | protocol=17 | dir=out | app=c:\program files (x86)\nch swift sound\axon\axon.exe |
"{DC7F2519-A9E7-40BA-8885-1FA3D599AAC0}" = lport=8002 | protocol=17 | dir=out | app=c:\program files (x86)\nch swift sound\axon\axon.exe |
"{DCEE2704-6A76-4097-B23E-17EB016633E7}" = rport=137 | protocol=17 | dir=out | app=system |
"{E1C31ECC-2B42-485E-AF04-22073D0F1A90}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface |
"{E7633334-4F3D-425A-87D1-C8566643AACF}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{E775D87C-5607-43DC-94BC-84816B833453}" = lport=10243 | protocol=6 | dir=in | app=system |
"{F4916B74-98E3-4FB1-8779-AF7C034370EE}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F85DC256-42A9-4565-A447-8FD2D7FC5C40}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface |
"{F9398EA5-B92F-4517-A4B9-931524BCA4BA}" = lport=4100 | protocol=17 | dir=out | app=c:\program files (x86)\nch swift sound\axon\axon.exe |
"{FBC605A6-0D3B-47AB-8AED-5FAEC08D1D7A}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{FC6D464C-F44A-4C37-8F95-9AA1789ED138}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04A70BC1-211E-41A8-AAC2-D64F9FE2FE10}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgemca.exe |
"{064AE009-11EA-434F-8247-BC5D10F9D8FE}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgdiagex.exe |
"{0760A5A3-7318-48BE-B266-CE1E232152E5}" = protocol=17 | dir=in | app=c:\users\schenkel\appdata\local\akamai\netsession_win.exe |
"{0AD57D2F-582D-45B6-B14C-ADD857E09FA2}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{0BD3B5BF-A137-4D8D-B685-E1BAE9C33E03}" = dir=in | app=c:\program files (x86)\nokia\nokia ovi suite\nokiaovisuite.exe |
"{0F05C151-97DE-444E-986E-552C4999AA79}" = dir=in | app=c:\program files (x86)\nokia\nokia suite\nokiasuite.exe |
"{123AF159-56A9-4BCA-8102-C780B7442109}" = protocol=6 | dir=out | app=system |
"{136AE384-4E2C-48CF-9C59-B9F455B7611A}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{14C7AEC1-66BE-45D1-B999-8DB4AD138DA6}" = protocol=6 | dir=in | app=c:\program files (x86)\landwirtschafts simulator 2013\farmingsimulator2013.exe |
"{1FFBEE92-B460-4365-ADDB-70AD211F199B}" = protocol=6 | dir=in | app=c:\program files (x86)\starmoney 7.0\ouservice\starmoneyonlineupdate.exe |
"{2058ED56-0086-4FBA-B188-637425D3C21A}" = dir=in | app=c:\program files (x86)\windows live\sync\windowslivesync.exe |
"{22386482-0096-47FC-8968-8D4EE9D2E80E}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{28B5E37C-7130-44B1-9A6E-31675F808D8B}" = protocol=6 | dir=in | app=c:\program files (x86)\fritz!box-kindersicherung\avmident.exe |
"{2AC56292-9F1C-4DD7-8C70-FB0D055B1889}" = dir=in | app=c:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe |
"{315D5CC4-6213-4AD7-A8A3-ED98388A336A}" = dir=in | app=c:\program files (x86)\nokia\nokia suite\nokiasuite.exe |
"{31C19C2A-EEBB-4B3D-BA35-B71B5AFE0822}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{362ED14F-F031-4618-9531-9F1C84DAB7A2}" = protocol=17 | dir=in | app=c:\program files (x86)\retrospect\retrospect express hd 2.5\retrospect.exe |
"{433B8C5E-10FD-44CF-A3EC-8B63163483EB}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2012\avgmfapx.exe |
"{4463A591-B7E7-471D-8B52-AF749DD2494D}" = dir=in | app=c:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe |
"{452AB12F-D3D8-40D4-8BC9-0ED4C6D31A95}" = protocol=17 | dir=in | app=c:\program files (x86)\landwirtschafts simulator 2013\farmingsimulator2013game.exe |
"{46921EA8-759B-412D-9F4E-83EA1D7719DB}" = protocol=6 | dir=in | app=c:\program files (x86)\retrospect\retrospect express hd 2.5\retrospect.exe |
"{4D06B143-AF1A-440D-BFCD-CD965FDFEC6B}" = dir=in | app=c:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe |
"{4F9EBFC6-FD56-46B8-AD2E-F6E4EDF2314F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{52119E8B-B389-4B93-805B-BC09339CE05A}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{6EBEB905-CBA2-4742-B853-09CD9E50C242}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgmfapx.exe |
"{749A3F38-019C-4308-8D0B-0CCAC23D41F8}" = protocol=6 | dir=in | app=c:\program files (x86)\starmoney 7.0\app\starmoney.exe |
"{774AB72B-A746-457F-B70D-13F25318FD26}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgemca.exe |
"{78245546-1DAF-4D5D-914F-D3A684C54AD7}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgnsa.exe |
"{78B7AAFB-6BE9-49DA-A264-BE021D32C5E9}" = dir=in | app=c:\program files (x86)\nokia\nokia ovi suite\nokiaovisuite.exe |
"{78BF8A33-8BD0-481F-A95E-18606DC67EDC}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgmfapx.exe |
"{7A37DE53-1CE3-4A22-8309-97B3A22AF015}" = dir=in | app=c:\program files (x86)\nokia\nokia suite\nokiasuite.exe |
"{7BF68B6D-D7CF-4990-9BF6-1FF052C7B8BC}" = protocol=6 | dir=in | app=c:\program files (x86)\retrospect\retrospect express hd 2.5\retrorun.exe |
"{7E3EE99C-31B8-4CE7-8B3A-728BFF727972}" = protocol=17 | dir=in | app=c:\program files (x86)\starmoney 7.0\ouservice\starmoneyonlineupdate.exe |
"{82AC653B-10CB-46E5-AF54-81F969D7288A}" = protocol=6 | dir=in | app=c:\users\schenkel\appdata\local\akamai\netsession_win.exe |
"{8442F9E2-6E5D-4906-BA60-DF3283036EFC}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer.exe |
"{8632FBBD-4676-427E-819F-7DFF7A04B182}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{87C9C7A4-C0C4-46D1-99D5-EE9A1FA7D154}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{891D6D81-ADDD-4DD5-A145-1CCB98A5C0C0}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8F0B2805-DEB5-4485-9578-665D8A35FA08}" = protocol=17 | dir=in | app=c:\program files (x86)\fritz!box-kindersicherung\avmident.exe |
"{9159C465-9355-4C9A-BE8F-3603AF5C104E}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgdiagex.exe |
"{937BE8E6-2B67-4A49-BD06-8ACCADB597D9}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{95E3796B-87F7-453F-8EFD-CF1374C31DF8}" = protocol=17 | dir=in | app=c:\program files (x86)\windows searchqu toolbar\datamngr\toolbar\dtuser.exe |
"{96C868DF-A4C1-44A0-BEB7-DE899DC6E937}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{97092E14-BC90-4D4B-B038-A8F5795FDB42}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer_service.exe |
"{A0D4F026-7B8A-4710-9175-6DE824D1457C}" = dir=in | app=c:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe |
"{A1DAD40D-23F0-4247-A70F-A9AE7376C604}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{A3C178A8-FED7-4CD3-A692-17BCEB76C626}" = protocol=6 | dir=in | app=c:\program files (x86)\landwirtschafts simulator 2013\farmingsimulator2013game.exe |
"{A81AA9A1-54B6-451A-BEF8-773622D0439A}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer.exe |
"{A99A7AD5-D445-4077-A72E-7D8EA90103ED}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{AAC50861-287D-4E5E-8FCA-AD90E9E20547}" = dir=in | app=c:\program files (x86)\nokia\nokia ovi suite\nokiaovisuite.exe |
"{AE62C652-DBFA-423E-8FBE-4E549C41CC4C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{B8AAD8B9-FA50-4ADE-A703-77B3C58DAA27}" = protocol=17 | dir=in | app=c:\program files (x86)\retrospect\retrospect express hd 2.5\retrorun.exe |
"{C142764E-A8FC-47CA-9A03-E26A91A9BA90}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe |
"{C2CF07DE-A1B3-43C8-BAD5-FB6B1C8B9106}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{C3D70162-D888-483D-9E9A-08E5BCCB5FB8}" = protocol=17 | dir=in | app=c:\program files (x86)\search results toolbar\datamngr\srtool~1\dtuser.exe |
"{C410CBA3-3CB6-44F2-A563-0650443BF937}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{C650D05A-F4E0-470B-A090-AB9C04358317}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{C73087A2-B473-421E-963F-0F5EC6F2435D}" = protocol=17 | dir=in | app=c:\program files (x86)\starmoney 7.0\app\starmoney.exe |
"{C8297549-C2E1-404A-AB78-1EAAFE886224}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2012\avgmfapx.exe |
"{C890D422-54E6-45BD-B76A-D4D1DE01FA94}" = dir=in | app=c:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe |
"{CDC8B04D-ACAF-4864-8A85-27F03FB29F2A}" = dir=in | app=c:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe |
"{D3F32183-D006-4CF9-842F-E6219D9DC908}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{DAF68664-4200-4925-8E4A-4C89217B120C}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgnsa.exe |
"{E3B14026-18FA-4240-A1CB-83F7E714F21C}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{E4515328-BA3D-4E3A-9570-DB7BE88D1835}" = protocol=17 | dir=in | app=c:\program files (x86)\landwirtschafts simulator 2013\farmingsimulator2013.exe |
"{E7B8E6F2-60F7-4467-B61C-997BBEBC63A6}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{EBEA4D8A-E579-43F7-9C91-4023286DB79C}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{EF582B93-3FEB-44A2-BB0F-16CEE9A6DEAB}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{F2B9D674-8648-4AC7-90C3-3A8EAA421050}" = protocol=6 | dir=in | app=c:\program files (x86)\search results toolbar\datamngr\srtool~1\dtuser.exe |
"{F4226EB5-EE14-4B87-8AC0-645E5BD85AC8}" = protocol=6 | dir=in | app=c:\program files (x86)\windows searchqu toolbar\datamngr\toolbar\dtuser.exe |
"{F5262082-7E27-4D39-A3AF-B325C725A779}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer_service.exe |
"{FF5A1BB9-9F43-47CB-ADAA-BAE6612CEA75}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"TCP Query User{3B748D98-1971-4538-9108-5F657522619D}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |
"TCP Query User{8C03311C-741A-4AAB-8DC7-527971B045A4}C:\users\schenkel\appdata\local\akamai\netsession_win.exe" = protocol=6 | dir=in | app=c:\users\schenkel\appdata\local\akamai\netsession_win.exe |
"TCP Query User{9412F77C-1DC3-4C2E-BB39-42DA44B6DEC2}C:\program files (x86)\iomega storcenter\sohoclient.exe" = protocol=6 | dir=in | app=c:\program files (x86)\iomega storcenter\sohoclient.exe |
"TCP Query User{A03E0F06-8EBF-4C33-A926-160862BCF724}C:\program files (x86)\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe |
"TCP Query User{B42362ED-3B3C-4482-A6E1-A383E360A0CB}C:\program files (x86)\iomega storcenter\sohoclient.exe" = protocol=6 | dir=in | app=c:\program files (x86)\iomega storcenter\sohoclient.exe |
"TCP Query User{CA0B0AB4-3467-445C-8BDE-0B4B8D76DCA9}C:\program files (x86)\tmnationsforever\tmforever.exe" = protocol=6 | dir=in | app=c:\program files (x86)\tmnationsforever\tmforever.exe |
"TCP Query User{D03B5BFD-A7EE-4243-B26D-5259FCC2C80F}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe |
"TCP Query User{FD780EC3-D825-4CE5-BF0C-B3E2931CE90B}C:\users\schenkel\appdata\local\mozilla firefox\plugin-container.exe" = protocol=6 | dir=in | app=c:\users\schenkel\appdata\local\mozilla firefox\plugin-container.exe |
"TCP Query User{FF9FC55D-849F-4665-B0C2-B181D7F8489D}C:\program files (x86)\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files (x86)\google\google earth\plugin\geplugin.exe |
"UDP Query User{15FC5F5E-2FB1-4BAB-87C9-099D29B8A84F}C:\program files (x86)\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe |
"UDP Query User{1F638718-F558-4D76-B30E-0603656400FB}C:\program files (x86)\iomega storcenter\sohoclient.exe" = protocol=17 | dir=in | app=c:\program files (x86)\iomega storcenter\sohoclient.exe |
"UDP Query User{2E6868FF-B7C5-4265-BDC7-FCDF9E4C202D}C:\program files (x86)\tmnationsforever\tmforever.exe" = protocol=17 | dir=in | app=c:\program files (x86)\tmnationsforever\tmforever.exe |
"UDP Query User{457CC601-297B-4F90-BF3B-46E2D20BCE41}C:\users\schenkel\appdata\local\akamai\netsession_win.exe" = protocol=17 | dir=in | app=c:\users\schenkel\appdata\local\akamai\netsession_win.exe |
"UDP Query User{6C331B50-B762-4DA0-9D0C-80A859E5C354}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe |
"UDP Query User{BD79705A-677E-4125-9E05-641B7ED7470B}C:\program files (x86)\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files (x86)\google\google earth\plugin\geplugin.exe |
"UDP Query User{BEAA26D1-9842-4D1A-B0F5-3DBE7132B455}C:\users\schenkel\appdata\local\mozilla firefox\plugin-container.exe" = protocol=17 | dir=in | app=c:\users\schenkel\appdata\local\mozilla firefox\plugin-container.exe |
"UDP Query User{C488CDF6-AF68-414E-98F2-69519CD3C0C7}C:\program files (x86)\iomega storcenter\sohoclient.exe" = protocol=17 | dir=in | app=c:\program files (x86)\iomega storcenter\sohoclient.exe |
"UDP Query User{CEEAC6C7-7CB9-4C36-9055-93935F21A58E}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{058EB68D-8F07-4E07-BD3B-B97D18E092F0}" = AVG 2013
"{0D87AE67-14EB-4C10-88A5-DA6C3181EB18}" = Windows Live Family Safety
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX7600_series" = Canon MX7600 series
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{2128559D-BBCD-4744-87F0-7C0CD5CFB464}" = Windows Live Family Safety
"{21B133D6-5979-47F0-BE1C-F6A6B304693F}" = Visual Studio 2010 x64 Redistributables
"{26A24AE4-039D-4CA4-87B4-2F86417009FF}" = Java 7 Update 9 (64-bit)
"{26F481C6-8DBE-4F8B-9D8D-715081C23ADE}" = Adobe Premiere Elements 10
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{3DAE9A67-DD8D-4EDB-91F7-7B5132B1864D}" = SmartSound Premiere Elements 10 x64 Plugin
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{4D668D4F-FAA2-4726-834C-31F4614F312E}" = MSVC80_x64_v2
"{502275B0-3DA3-44D8-8702-066525CAAE98}" = AVG 2013
"{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}" = Paint.NET v3.5.10
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{680EDA59-9266-44B4-949E-0C24F65DFF82}" = Microsoft_VC100_CRT_SP1_x64
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{AB071C8B-873C-459F-ACA9-9EBE03C3E89B}" = MSVC90_x64
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{D5876F0A-B2E9-4376-B9F5-CD47B7B8D820}" = Windows Live Remote Client Resources
"{D930AF5C-5193-4616-887D-B974CEFC4970}" = Windows Live Remote Service Resources
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"62BBD193ADFDBB228C7E1ADB56463F5732FF7F6F" = Windows-Treiberpaket - Nokia pccsmcfd LegacyDriver (05/31/2012 7.1.2.0)
"AVG" = AVG 2013
"CanonMyPrinter" = Canon My Printer
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"PremElem100" = Adobe Premiere Elements 10
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{007F778D-F15C-4EAB-AE92-071D21FAF632}" = Adobe Photoshop Elements 9
"{01386D1F-ADE7-43B4-A4E9-312FC5BC726F}_is1" = SWF Opener
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{0481A2EA-DA1D-4D10-A7C3-F8237948F6B5}" = Messenger Companion
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0DD140D3-9563-481E-AA75-BA457CBDAEF2}" = PC Inspector File Recovery
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{10ABE49D-343A-463E-9753-C4C5A05ECEF9}" = Sibelius Scorch (Firefox, Opera, Netscape only)
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1D273D91-D7D5-4036-8B84-EB4615FF5F81}" = SmartSound Sonicfire Pro 5
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20B1B020-DEAE-48D1-9960-D4C3185D758B}" = Phase 5 HTML-Editor
"{22D3A614-482C-444A-932C-9DA1B8ECDFD2}" = Elements 10 Organizer
"{26A24AE4-039D-4CA4-87B4-2F83216025FF}" = Java(TM) 6 Update 25
"{2934DCB0-F8EE-11E0-A4A5-B8AC6F97B88E}" = Google Earth Plug-in
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3B69A712-4CBC-40B1-AE55-0203075FD093}" = Nokia Suite
"{433EACD8-4747-4A6A-826A-FFA9F39B0D40}" = Elements 9 Organizer
"{47FA2C44-D148-4DBC-AF60-B91934AA4842}" = Adobe AIR
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E98F23B-1328-4322-A6EC-2EDC8FC3A4FE}" = FontNav
"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync
"{5C1F18D2-F6B7-4242-B803-B5A78648185D}" = Corel WinDVD 2010
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{63B9224A-89C9-44E6-8252-5F2F73A71C54}" = StarMoney
"{66B4C110-8BEB-49B5-824E-C70AEEB20ECD}" = ScanSoft OmniPage SE 4
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6BABB0C8-90D8-4622-A073-18C710458031}" = capella 7
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7390478C-8581-415E-92E9-2997D9306B81}" = PC Connectivity Solution
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{7C5123A9-30A8-4C44-89CA-A8C87A1FCC91}" = CorelDRAW Graphics Suite X3
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{879C52A2-FF9A-4CB5-BB74-B0DA994ABB2A}" = StarMoney
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0407-1000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{90C67C7D-E918-402C-9856-7B13999E1786}" = StarMoney
"{90FF23FE-0E1B-40DF-A22E-B4C0372E5936}" = Iomega Product Registration
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{92633C0F-C9BE-41E3-B439-0B508F859DB5}" = StarMoney
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9F06F464-479A-403E-AF92-70CBB8D674A1}" = PRE10STI64Installer
"{A127C3C0-055E-38CF-B38F-1E85F8BBBFFE}" = Adobe Community Help
"{A47AFECA-7F0F-471A-82A3-68DEB673A311}" = AVM FRITZ!Box-Kindersicherung
"{A57025CC-5F2E-4D01-B387-06DB10500D43}" = Nokia Connectivity Cable Driver
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.01) - Deutsch
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh
"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B388231D-672A-4169-A3DF-BD80266252AB}" = StarMoney
"{B4F3A360-E1E2-479D-ADE7-9BE3B07F4539}" = NVIDIA PhysX
"{B742E8E3-F63F-48C0-991E-D05849F16A3B}" = StarMoney 7.0
"{B8A2869E-30CA-40C5-9CF8-BD7354E57EF8}" = SmartSound Common Data
"{BCC57687-98A2-4C4C-B0F8-BC6B6F52D4E3}" = Retrospect Express HD 2.5
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{C94E45B0-6AA6-4FB9-9AAE-22085F631880}" = VBA
"{C9FB6FFC-B3D2-4AA0-AC05-73DB7796B638}" = DE
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240C1}" = WinZip 15.0
"{CE52F670-9E10-4C0A-B0CB-D78BAB0A7923}" = NimoFilm
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CFF8B8E8-E086-4DE0-935F-FE22CAB54F80}" = Microsoft Search Enhancement Pack
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}" = Microsoft Primary Interoperability Assemblies 2005
"{D2D6B9EB-C6DC-4DAA-B4DE-BB7D9735E7DA}" = Presto! PageManager 7.15.20
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{DFFC0648-BC4B-47D1-93D2-6CA6B9457641}" = OpenOffice.org 3.2
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E1845F1C-068C-F8F4-D31D-D3540D47C453}" = Adobe Download Assistant
"{E2AE009D-37E5-4724-A6B8-0ED6A6BA4F68}" = Elements STI Installer
"{E3B64CC5-C011-40C0-92BC-7316CD5E5688}" = Microsoft_VC100_CRT_SP1_x86
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F428D0FB-765D-40EB-BDD8-A1E7F5C597FA}" = Update Manager
"{F5266D28-E0B2-4130-BFC5-EE155AD514DC}" = Apple Application Support
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FC338210-F594-11D3-BA24-00001C3AB4DF}" = cyberJack Base Components
"{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}" = Visual Studio 2008 x64 Redistributables
"7-Zip" = 7-Zip 9.20
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Photoshop Elements 9" = Adobe Photoshop Elements 9
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Akamai" = Akamai NetSession Interface Service
"AVMFBox" = AVM FRITZ!Box Dokumentation
"AVMFBoxPrinter" = AVM FRITZ!Box Druckeranschluss
"Canon MX7600 series Benutzerregistrierung" = Canon MX7600 series Benutzerregistrierung
"Canon RAW Codec" = Canon RAW Codec
"Canon_IJ_Network_Scan_UTILITY" = Canon IJ Network Scan Utility
"Canon_IJ_Network_UTILITY" = Canon IJ Network Tool
"CanonSolutionMenu" = Canon Utilities Solution Menu
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"com.adobe.downloadassistant.AdobeDownloadAssistant" = Adobe Download Assistant
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"FarmingSimulator2013DE_is1" = Landwirtschafts Simulator 2013
"Free Video Converter_is1" = Free Video Converter V 3.1
"Free WebM Video Converter_is1" = Free WebM Video Converter version 5.0.4.1228
"Free YouTube Download_is1" = Free YouTube Download version 3.1.39.1015
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"InstallShield_{1D273D91-D7D5-4036-8B84-EB4615FF5F81}" = SmartSound Sonicfire Pro 5
"InstallShield_{B8A2869E-30CA-40C5-9CF8-BD7354E57EF8}" = SmartSound Common Data
"Iomega StorCenter" = Iomega StorCenter
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"Mozilla Thunderbird 17.0.2 (x86 de)" = Mozilla Thunderbird 17.0.2 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MP Navigator EX 1.1" = Canon MP Navigator EX 1.1
"Nokia Suite" = Nokia Suite
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"phase-6" = phase-6 2.3.2
"Security Task Manager" = Security Task Manager 1.8d
"TeamViewer 8" = TeamViewer 8
"TIPP10_is1" = TIPP10 Version 2.0.3
"Uninstall_is1" = Uninstall 1.0.0.1
"WinLiveSuite" = Windows Live Essentials
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-383967239-2986141260-540713063-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Akamai" = Akamai NetSession Interface
"GeoGebra 4" = GeoGebra 4
"GeoGebra 4.2" = GeoGebra 4.2
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 08.02.2013 07:26:23 | Computer Name = PC-2010 | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: wmiprvse.exe, Version: 6.1.7601.17514,
Zeitstempel: 0x4ce79d42 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725,
Zeitstempel: 0x4ec4aa8e Ausnahmecode: 0xc0000005 Fehleroffset: 0x000000000009970a
ID
des fehlerhaften Prozesses: 0xf74 Startzeit der fehlerhaften Anwendung: 0x01ce05ef200dd4f4
Pfad
der fehlerhaften Anwendung: C:\Windows\system32\wbem\wmiprvse.exe Pfad des fehlerhaften
Moduls: C:\Windows\SYSTEM32\ntdll.dll Berichtskennung: 5dc3e555-71e2-11e2-8d26-002511c6faf2
Error - 08.02.2013 07:26:45 | Computer Name = PC-2010 | Source = simpleServer | ID = 3299
Description =
Error - 08.02.2013 11:51:34 | Computer Name = PC-2010 | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: nvxdsync.exe, Version: 8.17.13.697,
Zeitstempel: 0x506b3333 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725,
Zeitstempel: 0x4ec4aa8e Ausnahmecode: 0xc0000005 Fehleroffset: 0x000000000009970a
ID
des fehlerhaften Prozesses: 0xd84 Startzeit der fehlerhaften Anwendung: 0x01ce06142ba980b6
Pfad
der fehlerhaften Anwendung: C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
Pfad
des fehlerhaften Moduls: C:\Windows\SYSTEM32\ntdll.dll Berichtskennung: 698a69dd-7207-11e2-8d26-002511c6faf2
Error - 08.02.2013 13:37:46 | Computer Name = PC-2010 | Source = simpleServer | ID = 3299
Description =
Error - 08.02.2013 15:00:42 | Computer Name = PC-2010 | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: BrowserProtect.exe, Version: 2.6.1070.41,
Zeitstempel: 0x50e70af3 Name des fehlerhaften Moduls: BrowserProtect.exe, Version:
2.6.1070.41, Zeitstempel: 0x50e70af3 Ausnahmecode: 0xc0000417 Fehleroffset: 0x000ede04
ID
des fehlerhaften Prozesses: 0x1b98 Startzeit der fehlerhaften Anwendung: 0x01ce062e96e6d59b
Pfad
der fehlerhaften Anwendung: C:\ProgramData\BrowserProtect\2.6.1070.41\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe
Pfad
des fehlerhaften Moduls: C:\ProgramData\BrowserProtect\2.6.1070.41\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe
Berichtskennung:
d598aef7-7221-11e2-8d26-002511c6faf2
Error - 08.02.2013 15:03:39 | Computer Name = PC-2010 | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: CF5825.3XE, Version: 6.1.7601.17514,
Zeitstempel: 0x4ce798e5 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725,
Zeitstempel: 0x4ec4aa8e Ausnahmecode: 0xc0000005 Fehleroffset: 0x000000000009970a
ID
des fehlerhaften Prozesses: 0x300 Startzeit der fehlerhaften Anwendung: 0x01ce062f001ff3d7
Pfad
der fehlerhaften Anwendung: C:\ComboFix\CF5825.3XE Pfad des fehlerhaften Moduls:
C:\Windows\SYSTEM32\ntdll.dll Berichtskennung: 3eebbe35-7222-11e2-8d26-002511c6faf2
Error - 10.02.2013 14:00:01 | Computer Name = PC-2010 | Source = Windows Backup | ID = 4103
Description =
Error - 11.02.2013 03:57:42 | Computer Name = PC-2010 | Source = simpleServer | ID = 3299
Description =
Error - 11.02.2013 04:04:10 | Computer Name = PC-2010 | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: CF2605.3XE, Version: 6.1.7601.17514,
Zeitstempel: 0x4ce798e5 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725,
Zeitstempel: 0x4ec4aa8e Ausnahmecode: 0xc0000005 Fehleroffset: 0x000000000009970a
ID
des fehlerhaften Prozesses: 0x604 Startzeit der fehlerhaften Anwendung: 0x01ce082e5e6a2650
Pfad
der fehlerhaften Anwendung: C:\ComboFix\CF2605.3XE Pfad des fehlerhaften Moduls:
C:\Windows\SYSTEM32\ntdll.dll Berichtskennung: 9d5c3ded-7421-11e2-bf8a-002511c6faf2
Error - 11.02.2013 04:17:24 | Computer Name = PC-2010 | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: CF2605.3XE, Version: 6.1.7601.17514,
Zeitstempel: 0x4ce798e5 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725,
Zeitstempel: 0x4ec4aa8e Ausnahmecode: 0xc0000005 Fehleroffset: 0x000000000009970a
ID
des fehlerhaften Prozesses: 0xfc0 Startzeit der fehlerhaften Anwendung: 0x01ce083038099fc9
Pfad
der fehlerhaften Anwendung: C:\ComboFix\CF2605.3XE Pfad des fehlerhaften Moduls:
C:\Windows\SYSTEM32\ntdll.dll Berichtskennung: 7643af55-7423-11e2-bf8a-002511c6faf2
Error - 11.02.2013 08:08:30 | Computer Name = PC-2010 | Source = simpleServer | ID = 3299
Description =
Error - 11.02.2013 13:07:38 | Computer Name = PC-2010 | Source = simpleServer | ID = 3299
Description =
[ Media Center Events ]
Error - 30.07.2011 04:53:19 | Computer Name = PC-2010 | Source = MCUpdate | ID = 0
Description = 10:53:19 - Fehler beim Herstellen der Internetverbindung. 10:53:19
- Serververbindung konnte nicht hergestellt werden..
Error - 30.07.2011 04:53:43 | Computer Name = PC-2010 | Source = MCUpdate | ID = 0
Description = 10:53:32 - Fehler beim Herstellen der Internetverbindung. 10:53:32
- Serververbindung konnte nicht hergestellt werden..
Error - 30.07.2011 05:54:07 | Computer Name = PC-2010 | Source = MCUpdate | ID = 0
Description = 11:54:07 - Fehler beim Herstellen der Internetverbindung. 11:54:07
- Serververbindung konnte nicht hergestellt werden..
Error - 30.07.2011 05:54:19 | Computer Name = PC-2010 | Source = MCUpdate | ID = 0
Description = 11:54:18 - Fehler beim Herstellen der Internetverbindung. 11:54:18
- Serververbindung konnte nicht hergestellt werden..
Error - 30.07.2011 06:54:33 | Computer Name = PC-2010 | Source = MCUpdate | ID = 0
Description = 12:54:33 - Fehler beim Herstellen der Internetverbindung. 12:54:33
- Serververbindung konnte nicht hergestellt werden..
Error - 30.07.2011 06:54:45 | Computer Name = PC-2010 | Source = MCUpdate | ID = 0
Description = 12:54:44 - Fehler beim Herstellen der Internetverbindung. 12:54:44
- Serververbindung konnte nicht hergestellt werden..
Error - 30.07.2011 07:54:59 | Computer Name = PC-2010 | Source = MCUpdate | ID = 0
Description = 13:54:59 - Fehler beim Herstellen der Internetverbindung. 13:54:59
- Serververbindung konnte nicht hergestellt werden..
Error - 30.07.2011 07:55:11 | Computer Name = PC-2010 | Source = MCUpdate | ID = 0
Description = 13:55:10 - Fehler beim Herstellen der Internetverbindung. 13:55:10
- Serververbindung konnte nicht hergestellt werden..
Error - 30.07.2011 23:08:21 | Computer Name = PC-2010 | Source = MCUpdate | ID = 0
Description = 05:08:21 - Fehler beim Herstellen der Internetverbindung. 05:08:21
- Serververbindung konnte nicht hergestellt werden..
Error - 30.07.2011 23:08:33 | Computer Name = PC-2010 | Source = MCUpdate | ID = 0
Description = 05:08:32 - Fehler beim Herstellen der Internetverbindung. 05:08:32
- Serververbindung konnte nicht hergestellt werden..
[ System Events ]
Error - 11.02.2013 04:03:09 | Computer Name = PC-2010 | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Akamai NetSession Interface" wurde unerwartet beendet.
Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 1000
Millisekunden durchgeführt: Neustart des Diensts.
Error - 11.02.2013 04:13:19 | Computer Name = PC-2010 | Source = Service Control Manager | ID = 7030
Description = Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet.
Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich
sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error - 11.02.2013 04:16:31 | Computer Name = PC-2010 | Source = Application Popup | ID = 1060
Description = Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\ComboFix\catchme.sys
nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version
des Treibers zu erhalten.
Error - 11.02.2013 04:31:14 | Computer Name = PC-2010 | Source = Service Control Manager | ID = 7030
Description = Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet.
Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich
sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error - 11.02.2013 08:05:11 | Computer Name = PC-2010 | Source = Service Control Manager | ID = 7006
Description = Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden
Fehlers fehlgeschlagen: %%5
Error - 11.02.2013 08:06:46 | Computer Name = PC-2010 | Source = Service Control Manager | ID = 7006
Description = Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden
Fehlers fehlgeschlagen: %%5
Error - 11.02.2013 08:07:03 | Computer Name = PC-2010 | Source = Service Control Manager | ID = 7006
Description = Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden
Fehlers fehlgeschlagen: %%5
Error - 11.02.2013 08:38:13 | Computer Name = PC-2010 | Source = Service Control Manager | ID = 7006
Description = Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden
Fehlers fehlgeschlagen: %%5
Error - 11.02.2013 13:07:02 | Computer Name = PC-2010 | Source = Service Control Manager | ID = 7006
Description = Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden
Fehlers fehlgeschlagen: %%5
Error - 11.02.2013 13:07:13 | Computer Name = PC-2010 | Source = Service Control Manager | ID = 7006
Description = Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden
Fehlers fehlgeschlagen: %%5
< End of report >
[/CODE] [/CODE] Geändert von cschenkel (11.02.2013 um 18:35 Uhr) |
|
11.02.2013, 23:30
| #18 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | PUP.Datamngr nicht entfernbarZitat:
__________________ |
|
12.02.2013, 09:11
| #19 |
| | PUP.Datamngr nicht entfernbar Ich verstehe die Frage nicht. Was ist weiter zu tun? |
|
12.02.2013, 12:53
| #20 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | PUP.Datamngr nicht entfernbar Was ist an der Frage nicht zu verstehen?! Ich will wissen was für eine Datei das ist, die ich zitiert habe!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
12.02.2013, 14:14
| #21 |
| | PUP.Datamngr nicht entfernbar Ich gehe davon aus, dass das der Download einer Photoshop-Vollversion ist, die ich 2010 bei Adobe zu Testzwecken heruntergeladen habe. Hat heute keine Funktion mehr. Geändert von cschenkel (12.02.2013 um 14:21 Uhr) |
|
12.02.2013, 14:35
| #22 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | PUP.Datamngr nicht entfernbar Ok, Trialversion könnte hinkommen Fixen mit OTL
Code:
ATTFilter :OTL
IE - HKU\S-1-5-21-383967239-2986141260-540713063-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1:9421;<local>
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-383967239-2986141260-540713063-1001\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O20 - AppInit_DLLs: (c:\progra~3\browse~1\261070~1.41\{c16c1~1\browse~1.dll) - File not found
[2013.01.13 17:26:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Wincert
[2013.01.23 18:05:45 | 000,000,328 | ---- | C] () -- C:\Windows\tasks\ROC_JAN2013_TB_Kinder.job
[2013.01.21 13:39:06 | 000,000,354 | ---- | C] () -- C:\Windows\tasks\ROC_JAN2013_TB_rmv.job
[2010.07.15 14:31:43 | 000,000,008 | RHS- | C] () -- C:\ProgramData\3E504D73F4.sys
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:C3AE45C9
:Files
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[resethosts]
__________________ Logfiles bitte immer in CODE-Tags posten |
|
12.02.2013, 15:23
| #23 |
| | PUP.Datamngr nicht entfernbar OTL sagt: Code:
ATTFilter All processes killed
========== OTL ==========
HKU\S-1-5-21-383967239-2986141260-540713063-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_USERS\S-1-5-21-383967239-2986141260-540713063-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:c:\progra~3\browse~1\261070~1.41\{c16c1~1\browse~1.dll deleted successfully.
C:\ProgramData\Wincert folder moved successfully.
C:\Windows\Tasks\ROC_JAN2013_TB_Kinder.job moved successfully.
C:\Windows\Tasks\ROC_JAN2013_TB_rmv.job moved successfully.
C:\ProgramData\3E504D73F4.sys moved successfully.
ADS C:\ProgramData\TEMP:C3AE45C9 deleted successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\Schenkel\Desktop\cmd.bat deleted successfully.
C:\Users\Schenkel\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 56466 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Kinder
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 6810555 bytes
->Java cache emptied: 257 bytes
->FireFox cache emptied: 1152015107 bytes
->Flash cache emptied: 66634 bytes
User: Public
->Temp folder emptied: 0 bytes
User: Schenkel
->Temp folder emptied: 230922 bytes
->Temporary Internet Files folder emptied: 737841968 bytes
->Java cache emptied: 28751238 bytes
->Flash cache emptied: 219976 bytes
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 56466 bytes
User: Vogelhäuschen
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 31717162 bytes
->Java cache emptied: 6646 bytes
->FireFox cache emptied: 116668841 bytes
->Flash cache emptied: 71126 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 38303 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67899 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 1.979,00 mb
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
OTL by OldTimer - Version 3.2.69.0 log created on 02122013_151226
Files\Folders moved on Reboot...
C:\Users\Schenkel\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
PendingFileRenameOperations files...
Registry entries deleted on Reboot...
|
|
12.02.2013, 15:37
| #24 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | PUP.Datamngr nicht entfernbar Eine neue Kontrolle mit OTL bitte:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
12.02.2013, 16:09
| #25 |
| | PUP.Datamngr nicht entfernbar OTL: OTL Logfile: Code:
ATTFilter OTL logfile created on: 12.02.2013 15:56:21 - Run 4 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Schenkel\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 8.0.7601.17514) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 2,32 Gb Available Physical Memory | 58,08% Memory free 8,00 Gb Paging File | 5,88 Gb Available in Paging File | 73,48% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 931,51 Gb Total Space | 684,47 Gb Free Space | 73,48% Space Free | Partition Type: NTFS Drive D: | 392,05 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: UDF Computer Name: PC-2010 | User Name: Schenkel | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - File not found PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_5_502_149_ActiveX.exe (Adobe Systems Incorporated) PRC - C:\Users\Schenkel\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\14.0.1\ToolbarUpdater.exe () PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) PRC - C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe (TeamViewer GmbH) PRC - C:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe () PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation) PRC - C:\Users\Schenkel\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.) PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) PRC - C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe (Nokia) PRC - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe (Nokia) PRC - C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe (Nokia) PRC - C:\Program Files (x86)\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe (Star Finanz - Software Entwicklung und Vertriebs GmbH) PRC - C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated) PRC - C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated) PRC - C:\Windows\SysWOW64\cjpcsc.exe (REINER SCT) PRC - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) PRC - C:\Program Files (x86)\Iomega StorCenter\sohoclient.exe (EMC) PRC - C:\Program Files (x86)\Retrospect\Retrospect Express HD 2.5\retrorun.exe (EMC Corporation) PRC - C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.) PRC - C:\Program Files (x86)\ScanSoft\OmniPageSE4\OpWareSE4.exe (Nuance Communications, Inc.) PRC - C:\Program Files (x86)\FRITZ!Box-Kindersicherung\avmident.exe (AVM Berlin) ========== Modules (No Company Name) ========== MOD - C:\Program Files (x86)\Nokia\Nokia Suite\phonon4.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\QtXmlPatterns4.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\QtXml4.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\QtWebKit4.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\QtSql4.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\QtScript4.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\QtOpenGL4.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\QtGui4.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\QtNetwork4.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\QtMultimediaKit1.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\QtDeclarative4.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\QtCore4.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\sqldrivers\qsqlite4.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\imageformats\qjpeg4.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\imageformats\qico4.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\imageformats\qgif4.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\NService.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\CommonUpdateChecker.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\ssoengine.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\securestorage.dll () MOD - C:\Program Files (x86)\Nokia\Nokia Suite\mediaservice\dsengine.dll () MOD - C:\Program Files (x86)\Iomega StorCenter\wxmsw28u_vc_custom.dll () ========== Services (SafeList) ========== SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (vToolbarUpdater14.0.1) -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\14.0.1\ToolbarUpdater.exe () SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (TeamViewer8) -- C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe (TeamViewer GmbH) SRV - (AVGIDSAgent) -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.) SRV - (Akamai) -- c:\program files (x86)\common files\akamai/netsession_win_ce5ba24.dll () SRV - (avgwd) -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.) SRV - (vToolbarUpdater13.2.0) -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe () SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation) SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) SRV - (ServiceLayer) -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe (Nokia) SRV - (StarMoney 7.0 OnlineUpdate) -- C:\Program Files (x86)\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe (Star Finanz - Software Entwicklung und Vertriebs GmbH) SRV - (AdobeActiveFileMonitor10.0) -- C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated) SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) SRV - (AdobeActiveFileMonitor9.0) -- C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated) SRV - (wlcrasvc) -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation) SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.) SRV - (cjpcsc) -- C:\Windows\SysWOW64\cjpcsc.exe (REINER SCT) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (RetroExp Helper) -- C:\Program Files (x86)\Retrospect\Retrospect Express HD 2.5\rthlpsvc.exe (EMC Corporation) SRV - (RetroExpLauncher) -- C:\Program Files (x86)\Retrospect\Retrospect Express HD 2.5\retrorun.exe (EMC Corporation) SRV - (PSI_SVC_2) -- C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.) SRV - (avmidentd) -- C:\Program Files (x86)\FRITZ!Box-Kindersicherung\avmident.exe (AVM Berlin) ========== Driver Services (SafeList) ========== DRV:64bit: - (avgtp) -- C:\Windows\SysNative\drivers\avgtpx64.sys (AVG Technologies) DRV:64bit: - (Avgmfx64) -- C:\Windows\SysNative\drivers\avgmfx64.sys (AVG Technologies CZ, s.r.o.) DRV:64bit: - (AVGIDSDriver) -- C:\Windows\SysNative\drivers\avgidsdrivera.sys (AVG Technologies CZ, s.r.o. ) DRV:64bit: - (AVGIDSHA) -- C:\Windows\SysNative\drivers\avgidsha.sys (AVG Technologies CZ, s.r.o. ) DRV:64bit: - (Avgldx64) -- C:\Windows\SysNative\drivers\avgldx64.sys (AVG Technologies CZ, s.r.o.) DRV:64bit: - (Avgtdia) -- C:\Windows\SysNative\drivers\avgtdia.sys (AVG Technologies CZ, s.r.o.) DRV:64bit: - (Avgloga) -- C:\Windows\SysNative\drivers\avgloga.sys (AVG Technologies CZ, s.r.o.) DRV:64bit: - (Avgrkx64) -- C:\Windows\SysNative\drivers\avgrkx64.sys (AVG Technologies CZ, s.r.o.) DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation) DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV:64bit: - (pccsmcfd) -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys (Nokia) DRV:64bit: - (fssfltr) -- C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (nmwcdnsux64) -- C:\Windows\SysNative\drivers\nmwcdnsux64.sys (Nokia) DRV:64bit: - (nmwcd) -- C:\Windows\SysNative\drivers\ccdcmbx64.sys (Nokia) DRV:64bit: - (nmwcdnsucx64) -- C:\Windows\SysNative\drivers\nmwcdnsucx64.sys (Nokia) DRV:64bit: - (UsbserFilt) -- C:\Windows\SysNative\drivers\usbser_lowerfltjx64.sys (Nokia) DRV:64bit: - (upperdev) -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys (Nokia) DRV:64bit: - (nmwcdc) -- C:\Windows\SysNative\drivers\ccdcmbox64.sys (Nokia) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (usbser) -- C:\Windows\SysNative\drivers\usbser.sys (Microsoft Corporation) DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions) DRV:64bit: - (cjusb) -- C:\Windows\SysNative\drivers\cjusb.sys (REINER SCT) DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (WSDPrintDevice) -- C:\Windows\SysNative\drivers\WSDPrint.sys (Microsoft Corporation) DRV:64bit: - (TPM) -- C:\Windows\SysNative\drivers\tpm.sys (Microsoft Corporation) DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation) DRV:64bit: - (e1express) -- C:\Windows\SysNative\drivers\e1e6032e.sys (Intel Corporation) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (Atc002) -- C:\Windows\SysNative\drivers\l260x64.sys (Atheros Communications, Inc.) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (regi) -- C:\Windows\SysNative\drivers\regi.sys (InterVideo) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = IE:64bit: - HKLM\..\SearchScopes\{C9CEDD57-223D-484F-BF8A-DDBD5672BAA3}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=MNMTDF&pc=MANM&src=IE-SearchBox; IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{2FC6DA2B-6916-43C3-9D70-59CFD1B2063D}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=MNMTDF&pc=MANM&src=IE-SearchBox; IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-383967239-2986141260-540713063-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://nmd.msn.com/ IE - HKU\S-1-5-21-383967239-2986141260-540713063-1001\..\SearchScopes,DefaultScope = {2FC6DA2B-6916-43C3-9D70-59CFD1B2063D} IE - HKU\S-1-5-21-383967239-2986141260-540713063-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-383967239-2986141260-540713063-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local> IE - HKU\S-1-5-21-383967239-2986141260-540713063-1006\..\SearchScopes,DefaultScope = ========== FireFox ========== FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_149.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\system32\npDeployJava1.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_149.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nokia.com/EnablerPlugin: C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( ) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2013.01.08 21:28:39 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 17.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2013.01.08 21:28:39 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 17.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2013.01.25 21:05:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Schenkel\AppData\Roaming\mozilla\Extensions [2010.07.09 18:29:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Schenkel\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2013.01.25 21:06:00 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2011.05.17 22:44:56 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2010.03.31 10:09:22 | 010,437,264 | ---- | M] (PDFTron Systems Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\PDFNetC.dll [2010.04.08 12:36:02 | 000,107,760 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\plugins\ScorchPDFWrapper.dll O1 HOSTS File: ([2013.02.12 15:16:05 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll File not found O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation) O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll File not found O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated) O4:64bit: - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.) O4:64bit: - HKLM..\Run: [CanonSolutionMenu] C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.) O4:64bit: - HKLM..\Run: [WrtMon.exe] C:\Windows\SysNative\spool\drivers\x64\3\WrtMon.exe () O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [AVG_UI] C:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [OpwareSE4] C:\Program Files (x86)\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.) O4 - HKLM..\Run: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe" File not found O4 - HKU\S-1-5-21-383967239-2986141260-540713063-1001..\Run: [Akamai NetSession Interface] C:\Users\Schenkel\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.) O4 - HKU\S-1-5-21-383967239-2986141260-540713063-1001..\Run: [CAHeadless] C:\Program Files (x86)\Adobe\Elements 10 Organizer\CAHeadless\ElementsAutoAnalyzer.exe (Adobe Systems Incorporated) O4 - HKU\S-1-5-21-383967239-2986141260-540713063-1001..\Run: [NokiaSuite.exe] C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe (Nokia) O4 - HKU\S-1-5-21-383967239-2986141260-540713063-1006..\Run: [ROC_JAN2013_TB] "C:\Program Files (x86)\AVG Secure Search\ROC_JAN2013_TB.exe" /PROMPT /CMPID=JAN2013_TB File not found O4 - HKU\S-1-5-21-383967239-2986141260-540713063-1006..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-383967239-2986141260-540713063-1006..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - Startup: C:\Users\Kinder\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () O4 - Startup: C:\Users\Vogelhäuschen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-383967239-2986141260-540713063-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-383967239-2986141260-540713063-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-383967239-2986141260-540713063-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKU\S-1-5-21-383967239-2986141260-540713063-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2 O7 - HKU\S-1-5-21-383967239-2986141260-540713063-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1 O7 - HKU\S-1-5-21-383967239-2986141260-540713063-1006\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\Schenkel\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm () O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Free YouTube Download - C:\Users\Schenkel\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm () O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 File not found O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O13 - gopher Prefix: missing O15 - HKU\S-1-5-21-383967239-2986141260-540713063-1001\..Trusted Domains: fritz.box ([]* in Lokales Intranet) O15 - HKU\S-1-5-21-383967239-2986141260-540713063-1001\..Trusted Ranges: Range1 ([*] in Lokales Intranet) O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.7.cab (DLM Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25) O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25) O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} https://secure.logmein.com//activex/ractrl.cab?lmi=972 (Performance Viewer Activex Control) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2669C220-BB99-429D-97D2-C470043BC6CD}: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgppa.dll File not found O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll File not found O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.02.12 15:12:26 | 000,000,000 | ---D | C] -- C:\_OTL [2013.02.12 09:05:40 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{B3E21D59-045D-4FE8-BCBC-81AEEAE312FB} [2013.02.11 20:24:40 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\Desktop\mbar [2013.02.11 18:07:48 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{0DEE2914-01D9-4650-9448-197CA24D573E} [2013.02.11 13:08:39 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{FB882446-A7E4-4E9C-A147-11A6560EDB3B} [2013.02.11 13:08:15 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN [2013.02.11 09:36:18 | 000,000,000 | ---D | C] -- C:\Windows\temp [2013.02.11 09:01:27 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{07BCFBD6-0259-469B-8207-D0F7ABAC11BB} [2013.02.11 09:01:25 | 005,030,592 | R--- | C] (Swearware) -- C:\Users\Schenkel\Desktop\ComboFix.exe [2013.02.11 08:57:54 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{59DA3CB9-3374-407F-8B7B-F430406594E3} [2013.02.08 20:12:30 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{7842D2F0-1B5A-401C-BE03-6BD326E0FC34} [2013.02.08 20:00:45 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe [2013.02.08 20:00:45 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe [2013.02.08 20:00:45 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe [2013.02.08 20:00:34 | 000,000,000 | ---D | C] -- C:\Qoobox [2013.02.08 20:00:00 | 000,000,000 | ---D | C] -- C:\Windows\erdnt [2013.02.08 08:11:54 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{915BA8C1-54B9-462C-BF4E-6A3E9A866F5F} [2013.02.07 20:05:55 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{F60D843A-10DE-4889-87AB-EA1F8B8A4A96} [2013.02.07 16:11:58 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{EB3F6BD3-A1E3-4F96-B866-72226212C5F9} [2013.02.06 23:26:54 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\Desktop\mbar-1.01.0.1017 [2013.02.06 17:25:15 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GeoGebra 4.2 [2013.02.06 13:27:35 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Schenkel\Desktop\OTL.exe [2013.02.06 13:18:42 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{C5F145B9-BDB2-4929-992A-42F8256355A4} [2013.02.05 20:37:02 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{47519D04-F33D-4386-826A-F88149368530} [2013.02.05 02:07:18 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{19F8254E-453A-4EEC-98F4-0017FFA2B8B6} [2013.02.04 14:06:44 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{30FEEF74-5BEB-4225-B739-FCB590A53CD3} [2013.02.02 10:16:01 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{982692AB-35AA-4939-B54C-2849CAA09076} [2013.02.01 09:35:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG [2013.02.01 08:33:30 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{018403E4-670A-46C3-A3BB-BDA59F522173} [2013.01.31 15:03:04 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{F1BF9CDD-A5FE-4858-829D-C1236EB4AD4D} [2013.01.31 15:02:52 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{82FFA2D1-ED22-40A4-A1E8-EB2D1D5FFC5C} [2013.01.30 22:02:50 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{D47B6F6C-9ECF-4BE6-8F6C-99DB3DA514B1} [2013.01.30 21:59:20 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{19308E01-1A57-4F90-A336-64E87271773F} [2013.01.30 08:22:26 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{6DD607ED-E650-4829-8B3E-52C5168E372F} [2013.01.29 21:21:02 | 000,000,000 | ---D | C] -- C:\ProgramData\SecTaskMan [2013.01.29 21:20:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security Task Manager [2013.01.29 21:20:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Security Task Manager [2013.01.29 20:31:11 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\Desktop\Biologie [2013.01.29 20:21:59 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{818F3531-3E17-424B-B7E1-D560AFCF4EB1} [2013.01.28 14:44:17 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{437FAF35-2948-446E-BBDD-70AD485E0923} [2013.01.27 22:44:03 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{F3FF40F4-82B0-41A5-B65B-715997467179} [2013.01.27 10:43:39 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{FB409ADC-6ED8-49D1-9A1E-5F04F0E8F7FD} [2013.01.26 14:24:58 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{C22F4D45-7C32-4E49-B14C-E66C98D1861E} [2013.01.26 02:24:22 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{AE6BBB3C-342E-47A5-9F59-946B96379171} [2013.01.25 14:23:58 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{EFC3E380-5968-4EB6-98D7-8056B1EAB2C3} [2013.01.24 14:23:23 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{A20CA695-12A9-492C-B021-146CA61252D5} [2013.01.23 23:59:27 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{2B93B16D-56BE-4E33-B3AB-7E2F588E57B0} [2013.01.22 23:58:25 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{D4F5282F-5EDF-482D-AC97-41897FE16E77} [2013.01.21 23:57:41 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{658086ED-C8AE-408A-9AE9-E9854B4E05A6} [2013.01.20 23:56:53 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{0B2ED45F-F322-4F87-AB67-005A66C6967E} [2013.01.20 12:48:52 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\Desktop\Fotobuch 2. Wahl [2013.01.20 11:56:25 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{AEA48709-C095-4D87-A910-C3A18289086B} [2013.01.19 10:52:41 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{001D7526-1D6E-45EB-86C5-E2B05457E298} [2013.01.18 15:13:09 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{3CD56E0B-38E2-4D4D-9887-A577BD85D6F2} [2013.01.18 03:12:34 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{D1430FDC-D6BF-42AE-8177-534946FD0C6E} [2013.01.17 15:11:56 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{DA3EF255-6F50-4B15-AB78-4A5AAB1FAACC} [2013.01.16 15:21:58 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{793A7E63-8748-400A-B35F-7C8E279A496E} [2013.01.15 14:31:29 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{76F26267-5908-4A72-B895-9A50F1495CE5} [2013.01.15 02:31:18 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{7804998A-A028-4501-9B47-3F83390EC59B} [2013.01.14 22:51:25 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\Desktop\Fotokunst Indien [2013.01.14 14:30:41 | 000,000,000 | ---D | C] -- C:\Users\Schenkel\AppData\Local\{42FB7ED4-D9AB-4B16-931D-881E49372DEE} [2010.09.07 20:46:39 | 000,089,680 | ---- | C] (Microsoft Corporation) -- C:\Users\Schenkel\MSSSerif120.fon [2010.07.18 20:09:45 | 001,228,400 | ---- | C] (Adobe Systems Incorporated) -- C:\Users\Schenkel\Photoshop_12_LS1.exe ========== Files - Modified Within 30 Days ========== [2013.02.12 15:58:04 | 000,000,680 | RHS- | M] () -- C:\Users\Schenkel\ntuser.pol [2013.02.12 15:43:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2013.02.12 15:36:00 | 000,001,114 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2013.02.12 15:25:41 | 000,013,232 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.02.12 15:25:41 | 000,013,232 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.02.12 15:18:21 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2013.02.12 15:17:49 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.02.12 15:17:43 | 3220,627,456 | -HS- | M] () -- C:\hiberfil.sys [2013.02.12 15:16:05 | 000,000,098 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\Hosts [2013.02.11 13:04:11 | 000,000,166 | ---- | M] () -- C:\Windows\DeleteOnReboot.bat [2013.02.11 12:48:08 | 000,587,659 | ---- | M] () -- C:\Users\Schenkel\Desktop\adwcleaner.exe [2013.02.11 09:41:53 | 000,008,487 | ---- | M] () -- C:\Users\Schenkel\Desktop\combofix log.zip [2013.02.11 09:02:20 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2013.02.11 09:02:20 | 000,654,478 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2013.02.11 09:02:20 | 000,616,342 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2013.02.11 09:02:20 | 000,130,536 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2013.02.11 09:02:20 | 000,106,722 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2013.02.11 08:57:14 | 005,030,592 | R--- | M] (Swearware) -- C:\Users\Schenkel\Desktop\ComboFix.exe [2013.02.08 09:43:18 | 000,697,712 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2013.02.08 09:43:18 | 000,074,096 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2013.02.07 20:32:12 | 000,014,808 | ---- | M] () -- C:\Users\Schenkel\Desktop\GMER-Logdatei.7z [2013.02.07 20:28:22 | 000,009,276 | ---- | M] () -- C:\Users\Schenkel\Desktop\GMER-Logdatei.zip [2013.02.07 17:30:26 | 000,000,512 | ---- | M] () -- C:\Users\Schenkel\Desktop\MBR.dat [2013.02.06 23:26:49 | 013,562,257 | ---- | M] () -- C:\Users\Schenkel\Desktop\mbar-1.01.0.1017.zip [2013.02.06 17:25:15 | 000,002,096 | ---- | M] () -- C:\Users\Schenkel\Desktop\GeoGebra 4.2.lnk [2013.02.06 13:27:49 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Schenkel\Desktop\OTL.exe [2013.02.03 23:19:22 | 004,966,784 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2013.02.01 09:35:04 | 000,001,020 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2013.lnk [2013.01.27 18:57:19 | 000,604,658 | ---- | M] () -- C:\Users\Schenkel\Desktop\IMG.jpg [2013.01.26 14:47:10 | 000,000,146 | ---- | M] () -- C:\Users\Schenkel\Desktop\Windows Defender - Verknüpfung.lnk [2013.01.25 21:13:51 | 000,001,129 | ---- | M] () -- C:\Users\Public\Desktop\TeamViewer 8.lnk [2013.01.21 21:51:54 | 000,000,571 | ---- | M] () -- C:\Windows\SysNative\MyDefrag.debuglog [2013.01.21 13:38:23 | 000,037,720 | ---- | M] (AVG Technologies) -- C:\Windows\SysNative\drivers\avgtpx64.sys [2013.01.15 00:00:16 | 000,002,076 | ---- | M] () -- C:\Users\Schenkel\Desktop\Entfernen des Avira DE-Cleaners.lnk [2013.01.15 00:00:16 | 000,002,005 | ---- | M] () -- C:\Users\Schenkel\Desktop\Avira DE-Cleaner.lnk [2013.01.14 21:19:10 | 000,041,085 | ---- | M] () -- C:\Users\Schenkel\Desktop\dreamweaver-ornamente9.jpg ========== Files Created - No Company Name ========== [2013.02.11 13:03:57 | 000,000,166 | ---- | C] () -- C:\Windows\DeleteOnReboot.bat [2013.02.11 13:02:45 | 000,587,659 | ---- | C] () -- C:\Users\Schenkel\Desktop\adwcleaner.exe [2013.02.11 09:41:53 | 000,008,487 | ---- | C] () -- C:\Users\Schenkel\Desktop\combofix log.zip [2013.02.08 20:00:45 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe [2013.02.08 20:00:45 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe [2013.02.08 20:00:45 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe [2013.02.08 20:00:45 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe [2013.02.08 20:00:45 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe [2013.02.07 20:29:39 | 000,014,808 | ---- | C] () -- C:\Users\Schenkel\Desktop\GMER-Logdatei.7z [2013.02.07 20:28:22 | 000,009,276 | ---- | C] () -- C:\Users\Schenkel\Desktop\GMER-Logdatei.zip [2013.02.07 17:30:26 | 000,000,512 | ---- | C] () -- C:\Users\Schenkel\Desktop\MBR.dat [2013.02.06 23:26:21 | 013,562,257 | ---- | C] () -- C:\Users\Schenkel\Desktop\mbar-1.01.0.1017.zip [2013.02.06 17:25:15 | 000,002,096 | ---- | C] () -- C:\Users\Schenkel\Desktop\GeoGebra 4.2.lnk [2013.01.27 18:57:19 | 000,604,658 | ---- | C] () -- C:\Users\Schenkel\Desktop\IMG.jpg [2013.01.26 14:47:10 | 000,000,146 | ---- | C] () -- C:\Users\Schenkel\Desktop\Windows Defender - Verknüpfung.lnk [2013.01.25 21:13:51 | 000,001,141 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 8.lnk [2013.01.25 21:13:51 | 000,001,129 | ---- | C] () -- C:\Users\Public\Desktop\TeamViewer 8.lnk [2013.01.21 21:51:54 | 000,000,571 | ---- | C] () -- C:\Windows\SysNative\MyDefrag.debuglog [2013.01.14 21:19:08 | 000,041,085 | ---- | C] () -- C:\Users\Schenkel\Desktop\dreamweaver-ornamente9.jpg [2012.07.20 15:09:42 | 000,000,021 | ---- | C] () -- C:\Windows\preview.ini [2011.07.14 20:42:08 | 000,947,408 | ---- | C] () -- C:\Windows\Diercke Globus Online Uninstaller.exe.bak [2011.07.12 19:32:45 | 000,000,000 | ---- | C] () -- C:\Users\Schenkel\AppData\Local\{EBADA874-5CEF-4BAD-989A-62FA3244C962} [2011.04.10 11:27:53 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll [2010.12.02 19:58:07 | 000,000,680 | RHS- | C] () -- C:\Users\Schenkel\ntuser.pol [2010.10.24 19:54:22 | 000,021,504 | ---- | C] () -- C:\Users\Schenkel\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.07.18 20:42:26 | 000,007,601 | ---- | C] () -- C:\Users\Schenkel\AppData\Local\Resmon.ResmonCfg [2010.07.18 20:09:45 | 1026,293,791 | ---- | C] () -- C:\Users\Schenkel\Photoshop_12_LS1.7z [2010.07.15 14:31:42 | 000,002,516 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys ========== ZeroAccess Check ========== [2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== Alternate Data Streams ========== @Alternate Data Stream - 60 bytes -> C:\Users\Public\Documents\.DS_Store:AFP_AfpInfo < End of report > [/CODE] 2. OTL-Datei: OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 12.02.2013 15:56:21 - Run 4
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Schenkel\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
4,00 Gb Total Physical Memory | 2,32 Gb Available Physical Memory | 58,08% Memory free
8,00 Gb Paging File | 5,88 Gb Available in Paging File | 73,48% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 931,51 Gb Total Space | 684,47 Gb Free Space | 73,48% Space Free | Partition Type: NTFS
Drive D: | 392,05 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: UDF
Computer Name: PC-2010 | User Name: Schenkel | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- Reg Error: Value error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~2\Office12\ONENOTE.EXE "%L"
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- Reg Error: Value error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~2\Office12\ONENOTE.EXE "%L"
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
========== Firewall Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1A4C2864-9C24-4EDB-ACC8-773E329A0092}" = lport=90 | protocol=6 | dir=out | app=c:\program files (x86)\nch swift sound\axon\axon.exe |
"{1BAE9C4D-1348-4CB2-99C5-7FACB27F0212}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{2AF35438-DAA3-4B0F-BA89-BAFC66CFA13E}" = lport=139 | protocol=6 | dir=in | app=system |
"{2E12A0F0-6496-41DD-9C7A-4CB69B8774D8}" = lport=8001 | protocol=17 | dir=out | app=c:\program files (x86)\nch swift sound\axon\axon.exe |
"{2E4C4BC3-5278-4BBA-996D-E7580187BCC7}" = lport=49164 | protocol=6 | dir=in | name=akamai netsession interface |
"{4354E357-616A-4519-8327-3AFC5A8EFFE6}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{4B78255E-32EE-41DC-9424-5334B59A32BD}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{5384EC1D-B36C-42F4-B91D-98F748AD803F}" = lport=5060 | protocol=17 | dir=out | app=c:\program files (x86)\nch swift sound\axon\axon.exe |
"{586EE2A0-546A-4DDC-A10B-6A16181D0081}" = rport=10243 | protocol=6 | dir=out | app=system |
"{58D79ACA-1E83-419F-B939-767D4138C336}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{5B84CBD1-1718-4D23-B28F-262BDCB5B87C}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{69288171-0E4F-428E-8D9A-CD8544E6097E}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{70C781FF-5512-47F2-BB81-2D8F0A391202}" = lport=8009 | protocol=17 | dir=out | app=c:\program files (x86)\nch swift sound\axon\axon.exe |
"{71ADE422-8BB2-4800-BA35-61870253FFAC}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{75D9F355-742D-4426-9E54-ACD2E93CB5A2}" = lport=8005 | protocol=17 | dir=out | app=c:\program files (x86)\nch swift sound\axon\axon.exe |
"{7973CA64-EA13-4CDA-A69B-42D5B5DEE738}" = lport=2869 | protocol=6 | dir=in | app=system |
"{807AC634-E744-4970-9A14-675CA852F453}" = lport=8007 | protocol=17 | dir=out | app=c:\program files (x86)\nch swift sound\axon\axon.exe |
"{82CB5605-19FF-4728-A5E0-2E34EB7412E4}" = lport=8003 | protocol=17 | dir=out | app=c:\program files (x86)\nch swift sound\axon\axon.exe |
"{84833571-0D0A-45B0-8ACE-1D2E3E44A89D}" = lport=445 | protocol=6 | dir=in | app=system |
"{87A73A38-5975-44D0-BE06-DDFDDF8CC781}" = lport=2869 | protocol=6 | dir=in | app=system |
"{8CA5A914-8553-4FA7-8862-E75925ADAAF1}" = lport=5700 | protocol=17 | dir=out | app=c:\program files (x86)\nch swift sound\axon\axon.exe |
"{8CAE880F-839D-424B-ADAE-EF418EFA7AB7}" = lport=5701 | protocol=17 | dir=out | app=c:\program files (x86)\nch swift sound\axon\axon.exe |
"{913A4245-D630-49DF-BB16-287AEF755E1F}" = lport=137 | protocol=17 | dir=in | app=system |
"{963D1DC4-59F7-48BA-A03A-21D52D7D60C4}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{9CE84869-FDA5-40C7-8A7E-44A17D50E79F}" = rport=138 | protocol=17 | dir=out | app=system |
"{A0F18B00-E5EE-4815-9988-A04F6D5E12F7}" = lport=8008 | protocol=17 | dir=out | app=c:\program files (x86)\nch swift sound\axon\axon.exe |
"{A892E647-4398-4CCC-9652-ADC248D9FAB6}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{AA617257-F9C0-4833-BA91-3903FED28017}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{AF32CC5F-B762-4165-9A22-278EDB4E2550}" = lport=49174 | protocol=6 | dir=in | name=akamai netsession interface |
"{B0218086-E661-48BD-8602-820F4D56EB29}" = lport=138 | protocol=17 | dir=in | app=system |
"{B402DA86-F6A0-4172-AC83-A72729EBB2B0}" = rport=139 | protocol=6 | dir=out | app=system |
"{BB551F3B-C67A-4FFD-ABE1-4E55B31F4423}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{C4FA0C16-F516-4AD5-9D74-FE1F9E98BEC9}" = rport=445 | protocol=6 | dir=out | app=system |
"{D076BB77-ACCF-4DD6-A2AA-0C97A918A8B9}" = lport=8006 | protocol=17 | dir=out | app=c:\program files (x86)\nch swift sound\axon\axon.exe |
"{D5C0092D-3B33-4950-8D57-BA3F030D5A84}" = lport=81 | protocol=6 | dir=out | app=c:\program files (x86)\nch swift sound\axon\axon.exe |
"{D8244568-E85A-40B4-A7A1-E2CBAB166E44}" = lport=8004 | protocol=17 | dir=out | app=c:\program files (x86)\nch swift sound\axon\axon.exe |
"{DAD5B1E9-7B4D-4F06-9D27-2DD57C2E82D2}" = lport=8000 | protocol=17 | dir=out | app=c:\program files (x86)\nch swift sound\axon\axon.exe |
"{DC7F2519-A9E7-40BA-8885-1FA3D599AAC0}" = lport=8002 | protocol=17 | dir=out | app=c:\program files (x86)\nch swift sound\axon\axon.exe |
"{DCEE2704-6A76-4097-B23E-17EB016633E7}" = rport=137 | protocol=17 | dir=out | app=system |
"{E1C31ECC-2B42-485E-AF04-22073D0F1A90}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface |
"{E7633334-4F3D-425A-87D1-C8566643AACF}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{E775D87C-5607-43DC-94BC-84816B833453}" = lport=10243 | protocol=6 | dir=in | app=system |
"{F4916B74-98E3-4FB1-8779-AF7C034370EE}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F85DC256-42A9-4565-A447-8FD2D7FC5C40}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface |
"{F9398EA5-B92F-4517-A4B9-931524BCA4BA}" = lport=4100 | protocol=17 | dir=out | app=c:\program files (x86)\nch swift sound\axon\axon.exe |
"{FBC605A6-0D3B-47AB-8AED-5FAEC08D1D7A}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{FC6D464C-F44A-4C37-8F95-9AA1789ED138}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04A70BC1-211E-41A8-AAC2-D64F9FE2FE10}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgemca.exe |
"{064AE009-11EA-434F-8247-BC5D10F9D8FE}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgdiagex.exe |
"{0760A5A3-7318-48BE-B266-CE1E232152E5}" = protocol=17 | dir=in | app=c:\users\schenkel\appdata\local\akamai\netsession_win.exe |
"{0AD57D2F-582D-45B6-B14C-ADD857E09FA2}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{0BD3B5BF-A137-4D8D-B685-E1BAE9C33E03}" = dir=in | app=c:\program files (x86)\nokia\nokia ovi suite\nokiaovisuite.exe |
"{0F05C151-97DE-444E-986E-552C4999AA79}" = dir=in | app=c:\program files (x86)\nokia\nokia suite\nokiasuite.exe |
"{123AF159-56A9-4BCA-8102-C780B7442109}" = protocol=6 | dir=out | app=system |
"{136AE384-4E2C-48CF-9C59-B9F455B7611A}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{14C7AEC1-66BE-45D1-B999-8DB4AD138DA6}" = protocol=6 | dir=in | app=c:\program files (x86)\landwirtschafts simulator 2013\farmingsimulator2013.exe |
"{1FFBEE92-B460-4365-ADDB-70AD211F199B}" = protocol=6 | dir=in | app=c:\program files (x86)\starmoney 7.0\ouservice\starmoneyonlineupdate.exe |
"{2058ED56-0086-4FBA-B188-637425D3C21A}" = dir=in | app=c:\program files (x86)\windows live\sync\windowslivesync.exe |
"{22386482-0096-47FC-8968-8D4EE9D2E80E}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{28B5E37C-7130-44B1-9A6E-31675F808D8B}" = protocol=6 | dir=in | app=c:\program files (x86)\fritz!box-kindersicherung\avmident.exe |
"{2AC56292-9F1C-4DD7-8C70-FB0D055B1889}" = dir=in | app=c:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe |
"{315D5CC4-6213-4AD7-A8A3-ED98388A336A}" = dir=in | app=c:\program files (x86)\nokia\nokia suite\nokiasuite.exe |
"{31C19C2A-EEBB-4B3D-BA35-B71B5AFE0822}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{362ED14F-F031-4618-9531-9F1C84DAB7A2}" = protocol=17 | dir=in | app=c:\program files (x86)\retrospect\retrospect express hd 2.5\retrospect.exe |
"{433B8C5E-10FD-44CF-A3EC-8B63163483EB}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2012\avgmfapx.exe |
"{4463A591-B7E7-471D-8B52-AF749DD2494D}" = dir=in | app=c:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe |
"{452AB12F-D3D8-40D4-8BC9-0ED4C6D31A95}" = protocol=17 | dir=in | app=c:\program files (x86)\landwirtschafts simulator 2013\farmingsimulator2013game.exe |
"{46921EA8-759B-412D-9F4E-83EA1D7719DB}" = protocol=6 | dir=in | app=c:\program files (x86)\retrospect\retrospect express hd 2.5\retrospect.exe |
"{4D06B143-AF1A-440D-BFCD-CD965FDFEC6B}" = dir=in | app=c:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe |
"{4F9EBFC6-FD56-46B8-AD2E-F6E4EDF2314F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{52119E8B-B389-4B93-805B-BC09339CE05A}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{6EBEB905-CBA2-4742-B853-09CD9E50C242}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgmfapx.exe |
"{749A3F38-019C-4308-8D0B-0CCAC23D41F8}" = protocol=6 | dir=in | app=c:\program files (x86)\starmoney 7.0\app\starmoney.exe |
"{774AB72B-A746-457F-B70D-13F25318FD26}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgemca.exe |
"{78245546-1DAF-4D5D-914F-D3A684C54AD7}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgnsa.exe |
"{78B7AAFB-6BE9-49DA-A264-BE021D32C5E9}" = dir=in | app=c:\program files (x86)\nokia\nokia ovi suite\nokiaovisuite.exe |
"{78BF8A33-8BD0-481F-A95E-18606DC67EDC}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgmfapx.exe |
"{7A37DE53-1CE3-4A22-8309-97B3A22AF015}" = dir=in | app=c:\program files (x86)\nokia\nokia suite\nokiasuite.exe |
"{7BF68B6D-D7CF-4990-9BF6-1FF052C7B8BC}" = protocol=6 | dir=in | app=c:\program files (x86)\retrospect\retrospect express hd 2.5\retrorun.exe |
"{7E3EE99C-31B8-4CE7-8B3A-728BFF727972}" = protocol=17 | dir=in | app=c:\program files (x86)\starmoney 7.0\ouservice\starmoneyonlineupdate.exe |
"{82AC653B-10CB-46E5-AF54-81F969D7288A}" = protocol=6 | dir=in | app=c:\users\schenkel\appdata\local\akamai\netsession_win.exe |
"{8442F9E2-6E5D-4906-BA60-DF3283036EFC}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer.exe |
"{8632FBBD-4676-427E-819F-7DFF7A04B182}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{87C9C7A4-C0C4-46D1-99D5-EE9A1FA7D154}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{891D6D81-ADDD-4DD5-A145-1CCB98A5C0C0}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8F0B2805-DEB5-4485-9578-665D8A35FA08}" = protocol=17 | dir=in | app=c:\program files (x86)\fritz!box-kindersicherung\avmident.exe |
"{9159C465-9355-4C9A-BE8F-3603AF5C104E}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgdiagex.exe |
"{937BE8E6-2B67-4A49-BD06-8ACCADB597D9}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{95E3796B-87F7-453F-8EFD-CF1374C31DF8}" = protocol=17 | dir=in | app=c:\program files (x86)\windows searchqu toolbar\datamngr\toolbar\dtuser.exe |
"{96C868DF-A4C1-44A0-BEB7-DE899DC6E937}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{97092E14-BC90-4D4B-B038-A8F5795FDB42}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer_service.exe |
"{A0D4F026-7B8A-4710-9175-6DE824D1457C}" = dir=in | app=c:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe |
"{A1DAD40D-23F0-4247-A70F-A9AE7376C604}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{A3C178A8-FED7-4CD3-A692-17BCEB76C626}" = protocol=6 | dir=in | app=c:\program files (x86)\landwirtschafts simulator 2013\farmingsimulator2013game.exe |
"{A81AA9A1-54B6-451A-BEF8-773622D0439A}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer.exe |
"{A99A7AD5-D445-4077-A72E-7D8EA90103ED}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{AAC50861-287D-4E5E-8FCA-AD90E9E20547}" = dir=in | app=c:\program files (x86)\nokia\nokia ovi suite\nokiaovisuite.exe |
"{AE62C652-DBFA-423E-8FBE-4E549C41CC4C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{B8AAD8B9-FA50-4ADE-A703-77B3C58DAA27}" = protocol=17 | dir=in | app=c:\program files (x86)\retrospect\retrospect express hd 2.5\retrorun.exe |
"{C142764E-A8FC-47CA-9A03-E26A91A9BA90}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe |
"{C2CF07DE-A1B3-43C8-BAD5-FB6B1C8B9106}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{C3D70162-D888-483D-9E9A-08E5BCCB5FB8}" = protocol=17 | dir=in | app=c:\program files (x86)\search results toolbar\datamngr\srtool~1\dtuser.exe |
"{C410CBA3-3CB6-44F2-A563-0650443BF937}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{C650D05A-F4E0-470B-A090-AB9C04358317}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{C73087A2-B473-421E-963F-0F5EC6F2435D}" = protocol=17 | dir=in | app=c:\program files (x86)\starmoney 7.0\app\starmoney.exe |
"{C8297549-C2E1-404A-AB78-1EAAFE886224}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2012\avgmfapx.exe |
"{C890D422-54E6-45BD-B76A-D4D1DE01FA94}" = dir=in | app=c:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe |
"{CDC8B04D-ACAF-4864-8A85-27F03FB29F2A}" = dir=in | app=c:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe |
"{D3F32183-D006-4CF9-842F-E6219D9DC908}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{DAF68664-4200-4925-8E4A-4C89217B120C}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgnsa.exe |
"{E3B14026-18FA-4240-A1CB-83F7E714F21C}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{E4515328-BA3D-4E3A-9570-DB7BE88D1835}" = protocol=17 | dir=in | app=c:\program files (x86)\landwirtschafts simulator 2013\farmingsimulator2013.exe |
"{E7B8E6F2-60F7-4467-B61C-997BBEBC63A6}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{EBEA4D8A-E579-43F7-9C91-4023286DB79C}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{EF582B93-3FEB-44A2-BB0F-16CEE9A6DEAB}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{F2B9D674-8648-4AC7-90C3-3A8EAA421050}" = protocol=6 | dir=in | app=c:\program files (x86)\search results toolbar\datamngr\srtool~1\dtuser.exe |
"{F4226EB5-EE14-4B87-8AC0-645E5BD85AC8}" = protocol=6 | dir=in | app=c:\program files (x86)\windows searchqu toolbar\datamngr\toolbar\dtuser.exe |
"{F5262082-7E27-4D39-A3AF-B325C725A779}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer_service.exe |
"{FF5A1BB9-9F43-47CB-ADAA-BAE6612CEA75}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"TCP Query User{3B748D98-1971-4538-9108-5F657522619D}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |
"TCP Query User{8C03311C-741A-4AAB-8DC7-527971B045A4}C:\users\schenkel\appdata\local\akamai\netsession_win.exe" = protocol=6 | dir=in | app=c:\users\schenkel\appdata\local\akamai\netsession_win.exe |
"TCP Query User{9412F77C-1DC3-4C2E-BB39-42DA44B6DEC2}C:\program files (x86)\iomega storcenter\sohoclient.exe" = protocol=6 | dir=in | app=c:\program files (x86)\iomega storcenter\sohoclient.exe |
"TCP Query User{A03E0F06-8EBF-4C33-A926-160862BCF724}C:\program files (x86)\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe |
"TCP Query User{B42362ED-3B3C-4482-A6E1-A383E360A0CB}C:\program files (x86)\iomega storcenter\sohoclient.exe" = protocol=6 | dir=in | app=c:\program files (x86)\iomega storcenter\sohoclient.exe |
"TCP Query User{CA0B0AB4-3467-445C-8BDE-0B4B8D76DCA9}C:\program files (x86)\tmnationsforever\tmforever.exe" = protocol=6 | dir=in | app=c:\program files (x86)\tmnationsforever\tmforever.exe |
"TCP Query User{D03B5BFD-A7EE-4243-B26D-5259FCC2C80F}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe |
"TCP Query User{FD780EC3-D825-4CE5-BF0C-B3E2931CE90B}C:\users\schenkel\appdata\local\mozilla firefox\plugin-container.exe" = protocol=6 | dir=in | app=c:\users\schenkel\appdata\local\mozilla firefox\plugin-container.exe |
"TCP Query User{FF9FC55D-849F-4665-B0C2-B181D7F8489D}C:\program files (x86)\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files (x86)\google\google earth\plugin\geplugin.exe |
"UDP Query User{15FC5F5E-2FB1-4BAB-87C9-099D29B8A84F}C:\program files (x86)\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe |
"UDP Query User{1F638718-F558-4D76-B30E-0603656400FB}C:\program files (x86)\iomega storcenter\sohoclient.exe" = protocol=17 | dir=in | app=c:\program files (x86)\iomega storcenter\sohoclient.exe |
"UDP Query User{2E6868FF-B7C5-4265-BDC7-FCDF9E4C202D}C:\program files (x86)\tmnationsforever\tmforever.exe" = protocol=17 | dir=in | app=c:\program files (x86)\tmnationsforever\tmforever.exe |
"UDP Query User{457CC601-297B-4F90-BF3B-46E2D20BCE41}C:\users\schenkel\appdata\local\akamai\netsession_win.exe" = protocol=17 | dir=in | app=c:\users\schenkel\appdata\local\akamai\netsession_win.exe |
"UDP Query User{6C331B50-B762-4DA0-9D0C-80A859E5C354}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe |
"UDP Query User{BD79705A-677E-4125-9E05-641B7ED7470B}C:\program files (x86)\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files (x86)\google\google earth\plugin\geplugin.exe |
"UDP Query User{BEAA26D1-9842-4D1A-B0F5-3DBE7132B455}C:\users\schenkel\appdata\local\mozilla firefox\plugin-container.exe" = protocol=17 | dir=in | app=c:\users\schenkel\appdata\local\mozilla firefox\plugin-container.exe |
"UDP Query User{C488CDF6-AF68-414E-98F2-69519CD3C0C7}C:\program files (x86)\iomega storcenter\sohoclient.exe" = protocol=17 | dir=in | app=c:\program files (x86)\iomega storcenter\sohoclient.exe |
"UDP Query User{CEEAC6C7-7CB9-4C36-9055-93935F21A58E}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{058EB68D-8F07-4E07-BD3B-B97D18E092F0}" = AVG 2013
"{0D87AE67-14EB-4C10-88A5-DA6C3181EB18}" = Windows Live Family Safety
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX7600_series" = Canon MX7600 series
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{2128559D-BBCD-4744-87F0-7C0CD5CFB464}" = Windows Live Family Safety
"{21B133D6-5979-47F0-BE1C-F6A6B304693F}" = Visual Studio 2010 x64 Redistributables
"{26A24AE4-039D-4CA4-87B4-2F86417009FF}" = Java 7 Update 9 (64-bit)
"{26F481C6-8DBE-4F8B-9D8D-715081C23ADE}" = Adobe Premiere Elements 10
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{3DAE9A67-DD8D-4EDB-91F7-7B5132B1864D}" = SmartSound Premiere Elements 10 x64 Plugin
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{4D668D4F-FAA2-4726-834C-31F4614F312E}" = MSVC80_x64_v2
"{502275B0-3DA3-44D8-8702-066525CAAE98}" = AVG 2013
"{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}" = Paint.NET v3.5.10
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{680EDA59-9266-44B4-949E-0C24F65DFF82}" = Microsoft_VC100_CRT_SP1_x64
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{AB071C8B-873C-459F-ACA9-9EBE03C3E89B}" = MSVC90_x64
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{D5876F0A-B2E9-4376-B9F5-CD47B7B8D820}" = Windows Live Remote Client Resources
"{D930AF5C-5193-4616-887D-B974CEFC4970}" = Windows Live Remote Service Resources
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"62BBD193ADFDBB228C7E1ADB56463F5732FF7F6F" = Windows-Treiberpaket - Nokia pccsmcfd LegacyDriver (05/31/2012 7.1.2.0)
"AVG" = AVG 2013
"CanonMyPrinter" = Canon My Printer
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"PremElem100" = Adobe Premiere Elements 10
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{007F778D-F15C-4EAB-AE92-071D21FAF632}" = Adobe Photoshop Elements 9
"{01386D1F-ADE7-43B4-A4E9-312FC5BC726F}_is1" = SWF Opener
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{0481A2EA-DA1D-4D10-A7C3-F8237948F6B5}" = Messenger Companion
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0DD140D3-9563-481E-AA75-BA457CBDAEF2}" = PC Inspector File Recovery
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{10ABE49D-343A-463E-9753-C4C5A05ECEF9}" = Sibelius Scorch (Firefox, Opera, Netscape only)
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1D273D91-D7D5-4036-8B84-EB4615FF5F81}" = SmartSound Sonicfire Pro 5
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20B1B020-DEAE-48D1-9960-D4C3185D758B}" = Phase 5 HTML-Editor
"{22D3A614-482C-444A-932C-9DA1B8ECDFD2}" = Elements 10 Organizer
"{26A24AE4-039D-4CA4-87B4-2F83216025FF}" = Java(TM) 6 Update 25
"{2934DCB0-F8EE-11E0-A4A5-B8AC6F97B88E}" = Google Earth Plug-in
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3B69A712-4CBC-40B1-AE55-0203075FD093}" = Nokia Suite
"{433EACD8-4747-4A6A-826A-FFA9F39B0D40}" = Elements 9 Organizer
"{47FA2C44-D148-4DBC-AF60-B91934AA4842}" = Adobe AIR
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E98F23B-1328-4322-A6EC-2EDC8FC3A4FE}" = FontNav
"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync
"{5C1F18D2-F6B7-4242-B803-B5A78648185D}" = Corel WinDVD 2010
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{63B9224A-89C9-44E6-8252-5F2F73A71C54}" = StarMoney
"{66B4C110-8BEB-49B5-824E-C70AEEB20ECD}" = ScanSoft OmniPage SE 4
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6BABB0C8-90D8-4622-A073-18C710458031}" = capella 7
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7390478C-8581-415E-92E9-2997D9306B81}" = PC Connectivity Solution
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{7C5123A9-30A8-4C44-89CA-A8C87A1FCC91}" = CorelDRAW Graphics Suite X3
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{879C52A2-FF9A-4CB5-BB74-B0DA994ABB2A}" = StarMoney
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0407-1000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{90C67C7D-E918-402C-9856-7B13999E1786}" = StarMoney
"{90FF23FE-0E1B-40DF-A22E-B4C0372E5936}" = Iomega Product Registration
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{92633C0F-C9BE-41E3-B439-0B508F859DB5}" = StarMoney
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9F06F464-479A-403E-AF92-70CBB8D674A1}" = PRE10STI64Installer
"{A127C3C0-055E-38CF-B38F-1E85F8BBBFFE}" = Adobe Community Help
"{A47AFECA-7F0F-471A-82A3-68DEB673A311}" = AVM FRITZ!Box-Kindersicherung
"{A57025CC-5F2E-4D01-B387-06DB10500D43}" = Nokia Connectivity Cable Driver
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.01) - Deutsch
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh
"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B388231D-672A-4169-A3DF-BD80266252AB}" = StarMoney
"{B4F3A360-E1E2-479D-ADE7-9BE3B07F4539}" = NVIDIA PhysX
"{B742E8E3-F63F-48C0-991E-D05849F16A3B}" = StarMoney 7.0
"{B8A2869E-30CA-40C5-9CF8-BD7354E57EF8}" = SmartSound Common Data
"{BCC57687-98A2-4C4C-B0F8-BC6B6F52D4E3}" = Retrospect Express HD 2.5
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{C94E45B0-6AA6-4FB9-9AAE-22085F631880}" = VBA
"{C9FB6FFC-B3D2-4AA0-AC05-73DB7796B638}" = DE
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240C1}" = WinZip 15.0
"{CE52F670-9E10-4C0A-B0CB-D78BAB0A7923}" = NimoFilm
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CFF8B8E8-E086-4DE0-935F-FE22CAB54F80}" = Microsoft Search Enhancement Pack
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}" = Microsoft Primary Interoperability Assemblies 2005
"{D2D6B9EB-C6DC-4DAA-B4DE-BB7D9735E7DA}" = Presto! PageManager 7.15.20
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{DFFC0648-BC4B-47D1-93D2-6CA6B9457641}" = OpenOffice.org 3.2
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E1845F1C-068C-F8F4-D31D-D3540D47C453}" = Adobe Download Assistant
"{E2AE009D-37E5-4724-A6B8-0ED6A6BA4F68}" = Elements STI Installer
"{E3B64CC5-C011-40C0-92BC-7316CD5E5688}" = Microsoft_VC100_CRT_SP1_x86
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F428D0FB-765D-40EB-BDD8-A1E7F5C597FA}" = Update Manager
"{F5266D28-E0B2-4130-BFC5-EE155AD514DC}" = Apple Application Support
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FC338210-F594-11D3-BA24-00001C3AB4DF}" = cyberJack Base Components
"{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}" = Visual Studio 2008 x64 Redistributables
"7-Zip" = 7-Zip 9.20
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Photoshop Elements 9" = Adobe Photoshop Elements 9
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Akamai" = Akamai NetSession Interface Service
"AVMFBox" = AVM FRITZ!Box Dokumentation
"AVMFBoxPrinter" = AVM FRITZ!Box Druckeranschluss
"Canon MX7600 series Benutzerregistrierung" = Canon MX7600 series Benutzerregistrierung
"Canon RAW Codec" = Canon RAW Codec
"Canon_IJ_Network_Scan_UTILITY" = Canon IJ Network Scan Utility
"Canon_IJ_Network_UTILITY" = Canon IJ Network Tool
"CanonSolutionMenu" = Canon Utilities Solution Menu
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"com.adobe.downloadassistant.AdobeDownloadAssistant" = Adobe Download Assistant
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"FarmingSimulator2013DE_is1" = Landwirtschafts Simulator 2013
"Free Video Converter_is1" = Free Video Converter V 3.1
"Free WebM Video Converter_is1" = Free WebM Video Converter version 5.0.4.1228
"Free YouTube Download_is1" = Free YouTube Download version 3.1.39.1015
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"InstallShield_{1D273D91-D7D5-4036-8B84-EB4615FF5F81}" = SmartSound Sonicfire Pro 5
"InstallShield_{B8A2869E-30CA-40C5-9CF8-BD7354E57EF8}" = SmartSound Common Data
"Iomega StorCenter" = Iomega StorCenter
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"Mozilla Thunderbird 17.0.2 (x86 de)" = Mozilla Thunderbird 17.0.2 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MP Navigator EX 1.1" = Canon MP Navigator EX 1.1
"Nokia Suite" = Nokia Suite
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"phase-6" = phase-6 2.3.2
"Security Task Manager" = Security Task Manager 1.8d
"TeamViewer 8" = TeamViewer 8
"TIPP10_is1" = TIPP10 Version 2.0.3
"Uninstall_is1" = Uninstall 1.0.0.1
"WinLiveSuite" = Windows Live Essentials
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-383967239-2986141260-540713063-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Akamai" = Akamai NetSession Interface
"GeoGebra 4" = GeoGebra 4
"GeoGebra 4.2" = GeoGebra 4.2
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 08.02.2013 15:00:42 | Computer Name = PC-2010 | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: BrowserProtect.exe, Version: 2.6.1070.41,
Zeitstempel: 0x50e70af3 Name des fehlerhaften Moduls: BrowserProtect.exe, Version:
2.6.1070.41, Zeitstempel: 0x50e70af3 Ausnahmecode: 0xc0000417 Fehleroffset: 0x000ede04
ID
des fehlerhaften Prozesses: 0x1b98 Startzeit der fehlerhaften Anwendung: 0x01ce062e96e6d59b
Pfad
der fehlerhaften Anwendung: C:\ProgramData\BrowserProtect\2.6.1070.41\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe
Pfad
des fehlerhaften Moduls: C:\ProgramData\BrowserProtect\2.6.1070.41\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe
Berichtskennung:
d598aef7-7221-11e2-8d26-002511c6faf2
Error - 08.02.2013 15:03:39 | Computer Name = PC-2010 | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: CF5825.3XE, Version: 6.1.7601.17514,
Zeitstempel: 0x4ce798e5 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725,
Zeitstempel: 0x4ec4aa8e Ausnahmecode: 0xc0000005 Fehleroffset: 0x000000000009970a
ID
des fehlerhaften Prozesses: 0x300 Startzeit der fehlerhaften Anwendung: 0x01ce062f001ff3d7
Pfad
der fehlerhaften Anwendung: C:\ComboFix\CF5825.3XE Pfad des fehlerhaften Moduls:
C:\Windows\SYSTEM32\ntdll.dll Berichtskennung: 3eebbe35-7222-11e2-8d26-002511c6faf2
Error - 10.02.2013 14:00:01 | Computer Name = PC-2010 | Source = Windows Backup | ID = 4103
Description =
Error - 11.02.2013 03:57:42 | Computer Name = PC-2010 | Source = simpleServer | ID = 3299
Description =
Error - 11.02.2013 04:04:10 | Computer Name = PC-2010 | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: CF2605.3XE, Version: 6.1.7601.17514,
Zeitstempel: 0x4ce798e5 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725,
Zeitstempel: 0x4ec4aa8e Ausnahmecode: 0xc0000005 Fehleroffset: 0x000000000009970a
ID
des fehlerhaften Prozesses: 0x604 Startzeit der fehlerhaften Anwendung: 0x01ce082e5e6a2650
Pfad
der fehlerhaften Anwendung: C:\ComboFix\CF2605.3XE Pfad des fehlerhaften Moduls:
C:\Windows\SYSTEM32\ntdll.dll Berichtskennung: 9d5c3ded-7421-11e2-bf8a-002511c6faf2
Error - 11.02.2013 04:17:24 | Computer Name = PC-2010 | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: CF2605.3XE, Version: 6.1.7601.17514,
Zeitstempel: 0x4ce798e5 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725,
Zeitstempel: 0x4ec4aa8e Ausnahmecode: 0xc0000005 Fehleroffset: 0x000000000009970a
ID
des fehlerhaften Prozesses: 0xfc0 Startzeit der fehlerhaften Anwendung: 0x01ce083038099fc9
Pfad
der fehlerhaften Anwendung: C:\ComboFix\CF2605.3XE Pfad des fehlerhaften Moduls:
C:\Windows\SYSTEM32\ntdll.dll Berichtskennung: 7643af55-7423-11e2-bf8a-002511c6faf2
Error - 11.02.2013 08:08:30 | Computer Name = PC-2010 | Source = simpleServer | ID = 3299
Description =
Error - 11.02.2013 13:07:38 | Computer Name = PC-2010 | Source = simpleServer | ID = 3299
Description =
Error - 12.02.2013 04:05:25 | Computer Name = PC-2010 | Source = simpleServer | ID = 3299
Description =
Error - 12.02.2013 05:44:58 | Computer Name = PC-2010 | Source = simpleServer | ID = 3299
Description =
Error - 12.02.2013 08:59:37 | Computer Name = PC-2010 | Source = simpleServer | ID = 3299
Description =
Error - 12.02.2013 10:19:18 | Computer Name = PC-2010 | Source = simpleServer | ID = 3299
Description =
[ Media Center Events ]
Error - 30.07.2011 04:53:19 | Computer Name = PC-2010 | Source = MCUpdate | ID = 0
Description = 10:53:19 - Fehler beim Herstellen der Internetverbindung. 10:53:19
- Serververbindung konnte nicht hergestellt werden..
Error - 30.07.2011 04:53:43 | Computer Name = PC-2010 | Source = MCUpdate | ID = 0
Description = 10:53:32 - Fehler beim Herstellen der Internetverbindung. 10:53:32
- Serververbindung konnte nicht hergestellt werden..
Error - 30.07.2011 05:54:07 | Computer Name = PC-2010 | Source = MCUpdate | ID = 0
Description = 11:54:07 - Fehler beim Herstellen der Internetverbindung. 11:54:07
- Serververbindung konnte nicht hergestellt werden..
Error - 30.07.2011 05:54:19 | Computer Name = PC-2010 | Source = MCUpdate | ID = 0
Description = 11:54:18 - Fehler beim Herstellen der Internetverbindung. 11:54:18
- Serververbindung konnte nicht hergestellt werden..
Error - 30.07.2011 06:54:33 | Computer Name = PC-2010 | Source = MCUpdate | ID = 0
Description = 12:54:33 - Fehler beim Herstellen der Internetverbindung. 12:54:33
- Serververbindung konnte nicht hergestellt werden..
Error - 30.07.2011 06:54:45 | Computer Name = PC-2010 | Source = MCUpdate | ID = 0
Description = 12:54:44 - Fehler beim Herstellen der Internetverbindung. 12:54:44
- Serververbindung konnte nicht hergestellt werden..
Error - 30.07.2011 07:54:59 | Computer Name = PC-2010 | Source = MCUpdate | ID = 0
Description = 13:54:59 - Fehler beim Herstellen der Internetverbindung. 13:54:59
- Serververbindung konnte nicht hergestellt werden..
Error - 30.07.2011 07:55:11 | Computer Name = PC-2010 | Source = MCUpdate | ID = 0
Description = 13:55:10 - Fehler beim Herstellen der Internetverbindung. 13:55:10
- Serververbindung konnte nicht hergestellt werden..
Error - 30.07.2011 23:08:21 | Computer Name = PC-2010 | Source = MCUpdate | ID = 0
Description = 05:08:21 - Fehler beim Herstellen der Internetverbindung. 05:08:21
- Serververbindung konnte nicht hergestellt werden..
Error - 30.07.2011 23:08:33 | Computer Name = PC-2010 | Source = MCUpdate | ID = 0
Description = 05:08:32 - Fehler beim Herstellen der Internetverbindung. 05:08:32
- Serververbindung konnte nicht hergestellt werden..
[ System Events ]
Error - 12.02.2013 04:04:51 | Computer Name = PC-2010 | Source = Service Control Manager | ID = 7006
Description = Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden
Fehlers fehlgeschlagen: %%5
Error - 12.02.2013 04:05:04 | Computer Name = PC-2010 | Source = Service Control Manager | ID = 7006
Description = Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden
Fehlers fehlgeschlagen: %%5
Error - 12.02.2013 04:19:34 | Computer Name = PC-2010 | Source = Service Control Manager | ID = 7006
Description = Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden
Fehlers fehlgeschlagen: %%5
Error - 12.02.2013 05:44:05 | Computer Name = PC-2010 | Source = Service Control Manager | ID = 7006
Description = Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden
Fehlers fehlgeschlagen: %%5
Error - 12.02.2013 05:44:16 | Computer Name = PC-2010 | Source = Service Control Manager | ID = 7006
Description = Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden
Fehlers fehlgeschlagen: %%5
Error - 12.02.2013 08:59:17 | Computer Name = PC-2010 | Source = SCardSvr | ID = 610
Description =
Error - 12.02.2013 10:12:26 | Computer Name = PC-2010 | Source = Service Control Manager | ID = 7034
Description = Dienst "NVIDIA Stereoscopic 3D Driver Service" wurde unerwartet beendet.
Dies ist bereits 1 Mal passiert.
Error - 12.02.2013 10:16:26 | Computer Name = PC-2010 | Source = Service Control Manager | ID = 7006
Description = Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden
Fehlers fehlgeschlagen: %%5
Error - 12.02.2013 10:17:51 | Computer Name = PC-2010 | Source = Service Control Manager | ID = 7006
Description = Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden
Fehlers fehlgeschlagen: %%5
Error - 12.02.2013 10:18:03 | Computer Name = PC-2010 | Source = Service Control Manager | ID = 7006
Description = Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden
Fehlers fehlgeschlagen: %%5
< End of report >
[/CODE] |
|
12.02.2013, 16:26
| #26 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | PUP.Datamngr nicht entfernbar Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle einen Quickscan mit Malwarebytes - denk bitte vorher daran, Malwarebytes über den Updatebutton zu aktualisieren Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt: ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten |
|
13.02.2013, 14:32
| #27 |
| | PUP.Datamngr nicht entfernbar Weder Malwarebytes noch ESET hat eine infizierte Datei gefunden: Code:
ATTFilter Malwarebytes Anti-Malware 1.70.0.1100 www.malwarebytes.org Datenbank Version: v2013.02.12.07 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 8.0.7601.17514 Schenkel :: PC-2010 [Administrator] 12.02.2013 16:34:23 mbam-log-2013-02-12 (16-34-23).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 287616 Laufzeit: 2 Minute(n), 26 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=b9c3e2aee11837409211b55ed965eb3f
# engine=13135
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-02-12 09:40:03
# local_time=2013-02-12 10:40:03 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1043 16777213 100 94 30910 47839187 0 0
# compatibility_mode=5893 16776574 100 94 439411 112335053 0 0
# scanned=321598
# found=0
# cleaned=0
# scan_time=21355
|
|
13.02.2013, 14:46
| #28 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | PUP.Datamngr nicht entfernbar Sieht soweit ok aus Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat. Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie ) Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird. Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
13.02.2013, 17:38
| #29 |
| | PUP.Datamngr nicht entfernbar Es läuft derzeit alles perfekt. Bedanke mich sehr herzlich! Sollte ich vor dir im Himmel sein, werde ich darauf hinweisen, dass du wegen wiederholter guter Werke freien Zugang, einen bequemen Sitzplatz und freie Getränke verdient hast! Christoph |
|
14.02.2013, 10:34
| #30 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | PUP.Datamngr nicht entfernbarZitat:
  Dann wären wir durch!  Die Programme, die hier zum Einsatz kamen, können alle wieder runter. Combofix entfernen (nur relevant wenn es hier benutzt wurde!) : Start/Ausführen (Tastenkombination WIN+R), dort den Befehl combofix /uninstall eintippen und ausführen Mit Hilfe von OTL kannst du auch viele andere Tools entfernen: Starte dazu einfach OTL und klicke auf Bereinigung. Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen. Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken. Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden. Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern. Microsoftupdate Windows XP:Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren. Windows Vista/7: Start, Systemsteuerung, Windows-Update PDF-Reader aktualisieren Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast) Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader. Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers: Prüfen => Adobe - Flash Player Downloadlinks findest du hier => Browsers and Plugins - FilePony.de Alle Plugins im Firefox-Browser kannst du auch ganz einfach hier auf Aktualität prüfen => https://www.mozilla.org/de/plugincheck Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind. Java-Update Veraltete Java-Installationen sind ein großes Sicherheitsrisiko, daher solltest Du die alten Versionen deinstallieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software (bzw. Programme und Funktionen) und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu PUP.Datamngr nicht entfernbar |
| administrator, anti-malware, autostart, dateien, erfolgreich, explorer, gelöscht, gen, ide, infizierte, logdatei, löscht, malwarebytes, microsoft, neustart, pup.datamngr, quarantäne, rechner, registrierung, registry, service, software, speicher, taskmanager, trojaner, version |
Textbox. 
Linear-Darstellung
