Habe ich einen Virus

Darkfilter · 23.05.2010, 22:34

Hi Leute,
habe mein Vierenprogramm laufen lassen und er fand folgendes:TR/Spy.Bebloh.A.55 (2 mal)
'EXP/Java.3243

Dies wurde jedoch nur verschoben in die Quarantäne. Wie kann ich diese Vieren löschen?

Hijack:
HiJackthis Logfile:

Code:

ATTFilter

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:23:24, on 23.05.2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18904)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\ATI\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
G:\Programme\Mozilla Firefox\firefox.exe
C:\Users\Nico\Downloads\jxpiinstall.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Nico\Downloads\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Windows\system32\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] "F:\Programme\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "G:\Programme\Adobe Reader\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "F:\Programme\Hamachi\hamachi-2-ui.exe" --auto-start
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [RGSC] F:\Programme\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Steam] "f:\programme\steam\steam.exe" -silent
O4 - HKCU\..\Run: [RTHDBPL] C:\Users\Nico\AppData\Roaming\SystemProc\lsass.exe
O4 - HKCU\..\Run: [iTap] C:\Program Files\HLW\iTap\iTap.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - Startup: OpenOffice.org 3.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Startup: Product Registration.lnk = C:\Users\Nico\AppData\Local\Temp\is-OANTQ.tmp\ATR1.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: HP Smart Web Printing ein- oder ausblenden - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - F:\Program Files\ICQ6.5\ICQ.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - F:\Program Files\ICQ6.5\ICQ.exe (file missing)
O13 - Gopher Prefix: 
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - Unknown owner - F:\Programme\Hamachi\hamachi-2.exe (file missing)
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

--
End of file - 6588 bytes

Danke im Voraus

cosinus · 23.05.2010, 23:10

Hallo und

Zitat:

Dies wurde jedoch nur verschoben in die Quarantäne. Wie kann ich diese Vieren löschen?

Was habt Ihr eigentlich alle nur mit der Quarantäne??
Ein schädliches Objekt in der Quarantäne ist isoliert, das kommt einem Löschen gleich mit der Ausnahme, dass man notfalls nochmal Dateien, die versehentlich gelöscht wurden (bei Fehlalarmen!!) wiederherstellen kann!

Bitte nen Vollscan mit Malwarebytes machen und Log posten. Danach OTL:

Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Doppelklick auf die OTL.exe
Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
Unter Extra Registry, wähle bitte Use SafeList
Klicke nun auf Run Scan links oben
Wenn der Scan beendet wurde werden 2 Logfiles erstellt
Poste die Logfiles hier in den Thread.

Darkfilter · 25.05.2010, 17:30

Logfile von OTL:

OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 25.05.2010 18:24:06 - Run 1
OTL by OldTimer - Version 3.2.5.0     Folder = C:\Users\Nico\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18904)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 58,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 80,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 698,63 Gb Total Space | 453,44 Gb Free Space | 64,90% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
Drive G: | 465,76 Gb Total Space | 224,37 Gb Free Space | 48,17% Space Free | Partition Type: NTFS
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: NICO-PC
Current User Name: Nico
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Nico\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Windows\System32\atieclxx.exe (AMD)
PRC - C:\Windows\System32\atiesrxx.exe (AMD)
PRC - G:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Program Files\ATI\ATI.ACE\Core-Static\MOM.exe (Advanced Micro Devices Inc.)
PRC - C:\Program Files\ATI\ATI.ACE\Core-Static\CCC.exe (ATI Technologies Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Nico\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (Hamachi2Svc) --  File not found
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AMD External Events Utility) -- C:\Windows\System32\atiesrxx.exe (AMD)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (npggsvc) -- C:\Windows\System32\GameMon.des (INCA Internet Co., Ltd.)
SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (amdkmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (amdkmdap) -- C:\Windows\System32\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV - (AtiHdmiService) -- C:\Windows\System32\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (SSHDRV61) -- C:\Windows\System32\drivers\SSHDRV61.sys ()
DRV - (hamachi) -- C:\Windows\System32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (SSHDRV76) -- C:\Windows\System32\drivers\SSHDRV76.sys ()
DRV - (SSHDRV51) -- C:\Windows\System32\drivers\SSHDRV51.sys ()
DRV - (SSHDRV52) -- C:\Windows\System32\drivers\SSHDRV52.sys ()
DRV - (StarOpen) -- C:\Windows\System32\drivers\StarOpen.sys ()
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\Windows\System32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (VClone) -- C:\Windows\System32\drivers\VClone.sys (Elaborate Bytes AG)
DRV - (ElbyCDIO) -- C:\Windows\System32\drivers\ElbyCDIO.sys (Elaborate Bytes AG)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (JRAID) -- C:\Windows\system32\DRIVERS\jraid.sys (JMicron Technology Corp.)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation                                            )
DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (NPPTNT2) -- C:\Windows\System32\npptNT2.sys (INCA Internet Co., Ltd.)
DRV - (prohlp02) -- C:\Windows\System32\drivers\prohlp02.sys (Protection Technology)
DRV - (prodrv06) -- C:\Windows\System32\drivers\prodrv06.sys (Protection Technology)
DRV - (prosync1) -- C:\Windows\System32\drivers\prosync1.sys (Protection Technology)
DRV - (TIEHDUSB) -- C:\Windows\System32\drivers\tiehdusb.sys (Texas Instruments Incorporated)
DRV - (sfhlp01) -- C:\Windows\System32\drivers\sfhlp01.sys (Protection Technology)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = DA 4E EF 96 36 0A CA 01  [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: autopager@mozilla.org:0.6.0.26
FF - prefs.js..extensions.enabledItems: smartwebprinting@hp.com:4.60
FF - prefs.js..extensions.enabledItems: NPDyyno@dyyno.com:1.0.0.24
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
 
FF - HKLM\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.02.11 21:29:20 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Components: F:\Programme\Mozilla Firefox\components
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Plugins: F:\Programme\Mozilla Firefox\plugins
 
[2009.04.29 20:00:21 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\mozilla\Extensions
[2010.05.24 15:22:19 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\mozilla\Firefox\Profiles\yv8unz8k.default\extensions
[2010.04.28 17:11:40 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Nico\AppData\Roaming\mozilla\Firefox\Profiles\yv8unz8k.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.04.28 17:11:40 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\mozilla\Firefox\Profiles\yv8unz8k.default\extensions\autopager@mozilla.org
[2009.06.14 21:37:11 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\mozilla\Firefox\Profiles\yv8unz8k.default\extensions\NPDyyno@dyyno.com
[2010.01.19 16:05:25 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions
[2010.01.19 16:05:25 | 000,000,000 | ---D | M] (Internal security) -- C:\Program Files\mozilla firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] G:\Programme\Adobe Reader\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [hpqSRMon]  File not found
O4 - HKLM..\Run: [iTunesHelper] F:\Programme\iTunes\iTunesHelper.exe File not found
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] F:\Programme\Hamachi\hamachi-2-ui.exe File not found
O4 - HKLM..\Run: [NeroFilterCheck] C:\Windows\System32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [VirtualCloneDrive] C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [iTap] C:\Program Files\HLW\iTap\iTap.exe File not found
O4 - HKCU..\Run: [RGSC] F:\Programme\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe File not found
O4 - HKCU..\Run: [RTHDBPL] C:\Users\Nico\AppData\Roaming\SystemProc\lsass.exe File not found
O4 - HKCU..\Run: [Steam] f:\programme\steam\steam.exe File not found
O4 - Startup: C:\Users\Nico\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Users\Nico\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Product Registration.lnk = C:\Users\Nico\AppData\Local\Temp\is-OANTQ.tmp\ATR1.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: AllowLegacyWebView = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: AllowUnhashedWebView = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O9 - Extra Button: HP Smart Web Printing ein- oder ausblenden - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - F:\Program Files\ICQ6.5\ICQ.exe File not found
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - F:\Program Files\ICQ6.5\ICQ.exe File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Public\Pictures\Sample Pictures\Desert Landscape.jpg
O24 - Desktop BackupWallPaper: C:\Users\Public\Pictures\Sample Pictures\Desert Landscape.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{0320e36e-7b6d-11de-9936-002185c17f27}\Shell - "" = AutoRun
O33 - MountPoints2\{0320e36e-7b6d-11de-9936-002185c17f27}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -- File not found
O33 - MountPoints2\{7daf253f-0eba-11df-beb7-002185c17f27}\Shell\AutoRun\command - "" = G:\Menu.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.05.23 23:25:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2010.05.23 23:25:01 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2010.05.23 23:24:45 | 000,411,368 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\deployJava1.dll
[2010.05.23 23:24:45 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2010.05.23 23:24:45 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2010.05.23 23:24:45 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2010.05.17 21:46:04 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\My Games
[2010.05.17 21:40:58 | 000,000,000 | ---D | C] -- C:\Program Files\2K Games
[2010.05.16 16:08:54 | 000,000,000 | ---D | C] -- C:\Die Sims 2
[2010.05.16 16:03:49 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\World in Conflict
[2010.05.16 16:03:38 | 000,000,000 | ---D | C] -- C:\Users\Nico\Documents\World in Conflict
[2010.05.16 15:48:02 | 000,000,000 | ---D | C] -- C:\Program Files\Sierra Games
[2010.05.15 20:59:25 | 000,000,000 | ---D | C] -- C:\Users\Nico\Documents\BFBC2
[2010.05.15 20:43:02 | 001,974,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_42.dll
[2010.05.15 20:43:02 | 000,515,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_5.dll
[2010.05.15 20:43:02 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_5.dll
[2010.05.15 20:43:02 | 000,000,000 | ---D | C] -- C:\Program Files\Electronic Arts
[2010.05.15 20:43:01 | 005,501,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dcsx_42.dll
[2010.05.15 20:43:01 | 001,892,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_42.dll
[2010.05.15 20:43:01 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_42.dll
[2010.05.15 20:43:01 | 000,235,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx11_42.dll
[2010.05.15 20:43:00 | 000,069,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_3.dll
[2010.05.15 20:42:59 | 000,514,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_3.dll
[2010.05.15 20:42:59 | 000,235,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_3.dll
[2010.05.15 20:42:59 | 000,070,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_2.dll
[2010.05.15 20:42:59 | 000,023,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_5.dll
[2010.05.13 13:51:01 | 000,000,000 | ---D | C] -- C:\Users\Nico\Documents\RCT3
[2010.05.13 13:51:01 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Roaming\Atari
[2010.05.13 13:50:20 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Roaming\vlc
[2010.05.13 13:41:50 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Roaming\Leadertech
[2010.05.12 22:17:39 | 000,000,000 | ---D | C] -- C:\Users\Nico\Documents\NIKITA
[2010.05.12 22:17:29 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\NIKITA
[2010.05.03 13:28:22 | 000,000,000 | ---D | C] -- C:\Phenomedia AG
[2010.04.28 22:44:54 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2010.04.28 22:04:43 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Roaming\HPAppData
[2010.04.27 16:01:52 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
 
========== Files - Modified Within 30 Days ==========
 
[2010.05.25 18:25:36 | 002,883,584 | -HS- | M] () -- C:\Users\Nico\NTUSER.DAT
[2010.05.25 18:23:00 | 000,000,420 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{8D9D19FD-3BB5-49B2-A216-4F4719AB1F71}.job
[2010.05.25 18:20:39 | 001,418,806 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010.05.25 18:20:39 | 000,618,204 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2010.05.25 18:20:39 | 000,586,980 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.05.25 18:20:39 | 000,122,636 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2010.05.25 18:20:39 | 000,101,052 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.05.25 18:14:53 | 000,005,952 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.05.25 18:14:53 | 000,005,952 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.05.25 18:14:52 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.05.25 18:14:49 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.05.24 22:43:33 | 000,524,288 | -HS- | M] () -- C:\Users\Nico\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2010.05.24 22:43:33 | 000,065,536 | -HS- | M] () -- C:\Users\Nico\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010.05.24 22:43:28 | 002,126,683 | -H-- | M] () -- C:\Users\Nico\AppData\Local\IconCache.db
[2010.05.24 15:12:02 | 000,002,379 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2010.05.23 16:27:12 | 000,000,116 | ---- | M] () -- C:\Windows\NeroDigital.ini
[2010.05.23 13:25:09 | 000,000,312 | ---- | M] () -- C:\Windows\tasks\WebReg HP Photosmart C5300 series.job
[2010.05.23 02:31:05 | 000,139,128 | ---- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2010.05.23 01:19:17 | 000,215,128 | ---- | M] () -- C:\Windows\System32\PnkBstrB.xtr
[2010.05.22 01:39:14 | 309,498,610 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2010.05.17 21:52:28 | 000,001,337 | ---- | M] () -- C:\Users\Nico\Desktop\Civilization 4 - Colonization.lnk
[2010.05.16 15:57:43 | 000,000,801 | ---- | M] () -- C:\Users\Nico\Desktop\World in Conflict.lnk
[2010.05.15 20:58:49 | 000,001,104 | ---- | M] () -- C:\Users\Nico\Desktop\Battlefield Bad Company 2.lnk
[2010.05.15 20:57:42 | 000,138,056 | ---- | M] () -- C:\Users\Nico\AppData\Roaming\PnkBstrK.sys
[2010.05.15 20:57:26 | 002,434,856 | ---- | M] () -- C:\Windows\System32\pbsvc_bc2.exe
[2010.05.13 13:42:15 | 000,000,989 | ---- | M] () -- C:\Users\Nico\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Product Registration.lnk
[2010.05.13 13:40:51 | 000,000,697 | ---- | M] () -- C:\Users\Public\Desktop\RollerCoaster Tycoon 3.lnk
[2010.05.12 21:46:53 | 000,024,576 | ---- | M] () -- C:\Users\Nico\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.05.12 11:21:16 | 000,221,568 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
[2010.05.05 22:31:56 | 000,000,009 | ---- | M] () -- C:\Windows\pbase.dat
[2010.05.05 22:31:56 | 000,000,008 | ---- | M] () -- C:\Windows\npbase.dat
[2010.05.05 22:31:56 | 000,000,003 | ---- | M] () -- C:\Windows\ver.dat
[2010.04.28 22:44:33 | 000,272,168 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010.04.28 22:24:06 | 000,000,680 | ---- | M] () -- C:\Users\Nico\AppData\Local\d3d9caps.dat
 
========== Files Created - No Company Name ==========
 
[2010.05.23 13:25:08 | 000,000,312 | ---- | C] () -- C:\Windows\tasks\WebReg HP Photosmart C5300 series.job
[2010.05.22 01:39:14 | 309,498,610 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2010.05.17 21:51:37 | 000,001,337 | ---- | C] () -- C:\Users\Nico\Desktop\Civilization 4 - Colonization.lnk
[2010.05.16 15:57:16 | 000,000,801 | ---- | C] () -- C:\Users\Nico\Desktop\World in Conflict.lnk
[2010.05.15 20:58:28 | 000,001,104 | ---- | C] () -- C:\Users\Nico\Desktop\Battlefield Bad Company 2.lnk
[2010.05.15 20:57:42 | 000,138,056 | ---- | C] () -- C:\Users\Nico\AppData\Roaming\PnkBstrK.sys
[2010.05.15 20:57:26 | 002,434,856 | ---- | C] () -- C:\Windows\System32\pbsvc_bc2.exe
[2010.05.13 13:42:15 | 000,000,989 | ---- | C] () -- C:\Users\Nico\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Product Registration.lnk
[2010.05.13 13:40:51 | 000,000,697 | ---- | C] () -- C:\Users\Public\Desktop\RollerCoaster Tycoon 3.lnk
[2010.04.07 03:22:08 | 000,023,040 | ---- | C] () -- C:\Windows\System32\atitmpxx.dll
[2010.03.05 02:11:22 | 000,041,872 | ---- | C] () -- C:\Windows\System32\xfcodec.dll
[2010.02.04 16:53:07 | 001,970,176 | ---- | C] () -- C:\Windows\System32\d3dx9.dll
[2010.01.22 23:01:19 | 000,000,083 | ---- | C] () -- C:\Windows\WA.INI
[2009.11.28 12:19:53 | 000,000,040 | ---- | C] () -- C:\Windows\WeatherSet.ini
[2009.11.27 22:42:38 | 000,036,864 | ---- | C] () -- C:\Windows\System32\drivers\SSHDRV61.sys
[2009.10.16 13:54:05 | 000,000,280 | ---- | C] () -- C:\Windows\game.ini
[2009.09.25 19:17:47 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.09.07 20:37:01 | 000,000,004 | ---- | C] () -- C:\Windows\info147.sys
[2009.09.07 20:06:19 | 000,053,760 | ---- | C] () -- C:\Windows\System32\drivers\SSHDRV76.sys
[2009.09.06 18:52:02 | 000,021,504 | ---- | C] () -- C:\Windows\System32\drivers\SSHDRV51.sys
[2009.09.06 13:42:20 | 000,029,184 | ---- | C] () -- C:\Windows\System32\drivers\SSHDRV52.sys
[2009.08.02 12:41:22 | 000,000,116 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2009.07.17 14:19:55 | 000,005,632 | ---- | C] () -- C:\Windows\System32\drivers\StarOpen.sys
[2009.07.14 02:48:04 | 000,020,480 | ---- | C] () -- C:\Windows\System32\H@tKeysH@@k.DLL
[2009.07.07 21:31:32 | 000,144,384 | ---- | C] () -- C:\Windows\System32\miccyhook.dll
[2009.06.12 18:38:11 | 000,139,128 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2009.05.17 18:15:47 | 000,000,510 | ---- | C] () -- C:\Windows\WORDPAD.INI
[2007.08.07 19:22:22 | 000,141,180 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[1997.11.17 18:13:16 | 000,010,240 | ---- | C] () -- C:\Windows\System32\vidx16.dll
[1997.06.14 10:56:08 | 000,056,832 | ---- | C] () -- C:\Windows\System32\iyvu9_32.dll
< End of report >

Darkfilter · 26.05.2010, 21:29

Jup, ich glaube ich kenne das Problem. Die Festplatte ist mal ein Platz verrutscht! Also sie war mal F und jetzt ist sie G. Musste die Pfade bei den Programmen ändern die auf F waren. Jedoch tat ich das nicht bei allen. Vielleicht wüsstest du noch eine Lösung für´s Problem.
Gruß Nico

Darkfilter · 25.05.2010, 17:30

2. Logfile:

OTL EXTRAS Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 25.05.2010 18:24:06 - Run 1
OTL by OldTimer - Version 3.2.5.0     Folder = C:\Users\Nico\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18904)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 58,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 80,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 698,63 Gb Total Space | 453,44 Gb Free Space | 64,90% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
Drive G: | 465,76 Gb Total Space | 224,37 Gb Free Space | 48,17% Space Free | Partition Type: NTFS
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: NICO-PC
Current User Name: Nico
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- G:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "G:\Programme\Microsoft Viewer\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "G:\Programme\Microsoft Viewer\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "G:\Programme\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "G:\Programme\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-442773238-3665067095-4225304131-1000]
"EnableNotifications" = 1
"EnableNotificationsRef" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02AE2E85-F4DC-40C2-8FB4-D0E6046763F1}" = lport=10244 | protocol=6 | dir=in | app=system | 
"{02E39A3D-A442-461D-BBF0-757515213DAD}" = lport=3390 | protocol=6 | dir=in | app=system | 
"{06837C40-FF4C-465D-834B-85CA8093D46F}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{07CB54D0-0201-43D1-852A-9CDF899C79E1}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{0ED49805-8EFB-40EE-BD53-E367C5E6E697}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe | 
"{115C2BA7-2233-4322-8A32-B86B647422F9}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{17C44A58-E42D-4801-AF3F-4F236C68BF2E}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{1E04E061-B32F-404A-9CB5-9A49DBD7889C}" = lport=10244 | protocol=6 | dir=in | app=system | 
"{24BC0501-E1DC-4822-9E13-8B5D054EC445}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{28CC590E-D41C-4380-8A9D-CD38429D2D9C}" = rport=138 | protocol=17 | dir=out | app=system | 
"{29732F88-429C-497C-8D61-833D3861A7EB}" = rport=139 | protocol=6 | dir=out | app=system | 
"{3433C4F7-6BB4-44F5-B37B-A2521739FC3D}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{37263DE8-9CCC-4F0D-8440-2E74D3670993}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{4063555D-277F-4977-96F7-692DC10A2545}" = rport=445 | protocol=6 | dir=out | app=system | 
"{49969AAF-D9F4-4CDA-8C17-58579A46A3E3}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{4C920637-E15D-4F41-B765-F8FCDF4CF6E7}" = lport=445 | protocol=6 | dir=in | app=system | 
"{51657973-419D-40D0-81EF-E94C6C3885F1}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=c:\windows\system32\svchost.exe | 
"{537A3742-1226-47F4-BE7F-6D8BC60F4F5C}" = lport=7777 | protocol=17 | dir=in | app=%systemroot%\ehome\ehshell.exe | 
"{53C4AAC8-6B76-4599-A065-2C8F2D0F56FB}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{5678D6BF-EA96-4DA6-A7E9-02ED1304E9F8}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{63B0B5BF-78E3-4D41-9E4C-538B5882CCDA}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=c:\windows\system32\svchost.exe | 
"{65789E52-29BD-4BA5-9F8A-58D5364F2CEA}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{6849E627-1BDD-4246-BA98-8B9018C963C2}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{68E75825-6C86-4BF5-8CF0-0788FEF60A78}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=c:\windows\system32\svchost.exe | 
"{6CBA7093-F5CA-4B35-B126-783AD5F69D9E}" = rport=10244 | protocol=6 | dir=out | app=system | 
"{6CF4D255-99A5-42A5-9158-BB65FBA25C59}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe | 
"{6D8222DB-2330-4A38-A007-DF7AA94242EA}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{747E57D4-ED60-4964-99C1-547D77BE48B2}" = lport=7777 | protocol=17 | dir=in | app=%systemroot%\ehome\ehshell.exe | 
"{7D2E965C-0C5E-43FC-BFC0-1A96513A7F56}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{899378CE-D96D-4BF4-8541-6F0CBABA4288}" = lport=554 | protocol=6 | dir=in | app=%systemroot%\ehome\ehshell.exe | 
"{93913F85-7A30-413E-9342-FC4C37D9848B}" = lport=137 | protocol=17 | dir=in | app=system | 
"{94579499-69C1-4987-B7B2-BDBFFB780024}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{95D1C9E9-D724-4F69-8B70-9C30392CEAAE}" = rport=10244 | protocol=6 | dir=out | app=system | 
"{A029C1A0-4C27-417F-9D0A-6A6963EFB7EA}" = rport=137 | protocol=17 | dir=out | app=system | 
"{A0E425D5-5485-4EA1-B455-AB9AF843ADEB}" = lport=554 | protocol=6 | dir=in | app=%systemroot%\ehome\ehshell.exe | 
"{B17EC995-1BFB-4AB4-B865-5E59C2D05B09}" = lport=139 | protocol=6 | dir=in | app=system | 
"{B4E6009D-085D-4512-93C9-D9DDA1F8CFAA}" = lport=138 | protocol=17 | dir=in | app=system | 
"{BADEF0A2-29AC-4732-A456-99656AC753D0}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{C440558E-B8ED-4760-949C-BDCFE5E7A693}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=c:\windows\system32\svchost.exe | 
"{CACEA92B-822D-4D1A-A54E-648BDD3419D8}" = lport=3390 | protocol=6 | dir=in | app=system | 
"{CCBAFFB2-1129-4B23-8B1E-77B289C95615}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{D9B24D8D-5F20-49D1-BCB9-E44A0F4255DF}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{E2E61CBE-1B8F-4D35-BA1E-C10CC0D68B9D}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=c:\windows\system32\svchost.exe | 
"{E8EA674A-F1F4-438F-8ABD-8D0595DCEA0F}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=c:\windows\system32\svchost.exe | 
"{EA31851D-F54F-45E9-8A1C-D1FF5836487E}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{EBD159E3-0639-4332-BD0C-DB0836E0762B}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{F8786D21-4A2A-48F6-AA7E-700438077CE5}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{FAD3EDED-7CA5-40E3-86F7-C9EFFE880C1F}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{FDB43EA3-0AA7-42D5-9954-4EF4D32B3C0D}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0E622DBC-ED75-4318-BDFE-ABA8582C3189}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcx2prov.exe | 
"{10CD0016-3968-4E30-8485-022828DD04FD}" = protocol=6 | dir=in | app=f:\programme\ubisoft\shaunwhite\shaunwhitesnowboardinggame.exe | 
"{1634D116-6D18-4F9A-A62D-9E2DD14C5210}" = protocol=6 | dir=in | app=c:\program files\sierra games\wic_ds.exe | 
"{184503D7-4E14-4AA4-957B-28C0FCAB061C}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqsudi.exe | 
"{1853A475-C03B-47F5-8AE4-1F5F20FBAF3B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{1B39EC54-2059-4735-80D2-9E472EE95CA0}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{20818E8C-4BD5-4DFA-8010-8BA451E3E6F8}" = protocol=17 | dir=in | app=c:\program files\sierra games\wic_ds.exe | 
"{212D0B65-8938-4698-BEF4-F8AD3A0E7AA7}" = dir=in | app=c:\program files\hp\hp software update\hpwucli.exe | 
"{21C38210-3C63-45B2-8C67-1C4E9509FFE7}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{22960918-ED57-416C-ADED-1CC39C0112C1}" = protocol=6 | dir=out | app=%systemroot%\ehome\ehshell.exe | 
"{23E44FA8-25BE-4D4D-8F5A-BC13065AFBF0}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{26528D43-E4C7-4807-A1B6-92B32AC9F4E8}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{285DC7A4-832E-4ECF-9F31-45BC6E817FE0}" = dir=in | app=c:\program files\hp\digital imaging\smart web printing\smartwebprintexe.exe | 
"{2CF1121A-DDB1-48EA-9B94-A24DD6826424}" = protocol=17 | dir=in | app=f:\programme\itunes\itunes.exe | 
"{2F36DF23-D079-4AB3-AA51-0C5D914DD9C3}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{31F73A4F-CA1F-4F22-8BA5-8796514869D7}" = protocol=17 | dir=in | app=f:\programme\thq\company of heroes\relicdownloader\relicdownloader.exe | 
"{363674AD-E4F8-4562-B265-4E6A17915D99}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe | 
"{3CCB0CDD-8105-46FA-BD43-EC5ADFCD1143}" = protocol=17 | dir=out | app=%systemroot%\ehome\ehshell.exe | 
"{421CCCA8-B77B-4F58-9016-18EFA99BEBE1}" = protocol=6 | dir=out | svc=mcx2svc | app=%systemroot%\system32\svchost.exe | 
"{4308B23E-BAD6-475C-8A38-FCF27AC09351}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgm.exe | 
"{44AE1CC7-6372-4A71-A424-96AD12884344}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcx2prov.exe | 
"{4F647465-0C2F-44E8-A1E5-40C1C0C9FB90}" = protocol=17 | dir=out | app=%systemroot%\ehome\ehshell.exe | 
"{4F6F7A46-5D51-4F5E-9EA7-C300CB812D35}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{516E691A-0D0A-4BF8-825A-EEE6E27223C2}" = protocol=6 | dir=in | app=f:\programme\itunes\itunes.exe | 
"{54BF8067-353F-4789-A579-19F74A0B8181}" = protocol=6 | dir=in | app=f:\program files\ea games\mirror's edge\binaries\mirrorsedge.exe | 
"{58CE0B16-50D2-4743-A41E-43BFD256DCC0}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqpse.exe | 
"{5ADCB0CC-C6B7-4ECC-8D7C-AEF4690A4E78}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{5B2657E6-70D9-48BF-94F4-DD21D1D7939F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{5D24E30B-2035-4A1A-9C9B-CBA06DF669E1}" = dir=in | app=c:\program files\common files\hp\digital imaging\bin\hpqphotocrm.exe | 
"{6492189D-D1B8-4FF2-9195-4F9643C2279B}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{69CA568C-67A2-4107-BEFD-86F9DD8E1CBD}" = protocol=6 | dir=out | app=system | 
"{69EA3BA1-85F4-4AD5-AC07-48ABF2BA13FE}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{6A6E8455-A074-465D-9EB1-CB9E40433405}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgpc01.exe | 
"{718BB000-440E-4DEE-BA20-17AAA085E470}" = protocol=6 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe | 
"{71B4403E-2DDD-491D-BF1B-4FA499CD55D2}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{753474C5-F1E6-4619-9083-5B644B70DCF5}" = protocol=6 | dir=in | app=c:\program files\activision\cod4\iw3mp.exe | 
"{79ACE57B-93B4-4216-869C-B6AA10AF131A}" = protocol=17 | dir=in | app=c:\program files\midway games\rise and fall\riseandfall.exe | 
"{7A437381-8981-4C12-9BDF-19D9615701CF}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpiscnapp.exe | 
"{80538A2C-1B26-46FF-9EFA-591B7961B6A0}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqpsapp.exe | 
"{875186CD-2A59-44BC-AE0F-5DE2BF3EA945}" = protocol=6 | dir=in | app=c:\program files\electronic arts\battlefield bad company 2\bfbc2updater.exe | 
"{882B0E4B-9E9D-4BB7-9954-91DB2A79E4DD}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{8B3938FB-2845-489A-AA59-45A88D12B0F0}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{8C22B901-5664-45F3-BC84-0EC309BB3CD7}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{8CA407F9-8560-4E66-A588-CE465AA9BD28}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgplgtupl.exe | 
"{9C8C870B-CC1A-4DFF-BB5F-04475C68D457}" = protocol=17 | dir=in | app=c:\users\nico\appdata\locallow\dyyno receiver\dppm.exe | 
"{9CD2B854-92EA-4324-AF25-D6DBDBF74B65}" = protocol=6 | dir=in | app=f:\programme\ubisoft\shaunwhite\shaunwhitesnowboarding.exe | 
"{9DA2B874-D77B-4A88-B137-35C91ED730FF}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{A2DACCE1-E27D-46BD-B869-3955D3B903BA}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{A48F14D5-96B1-4976-B59A-D0D615BE51E9}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{A6EC7876-7AA5-4A73-AD14-46D813118E53}" = protocol=17 | dir=in | app=c:\program files\microsoft games\gears of war\binaries\wargame-g4wlive.exe | 
"{A9C0319F-2C91-4863-8EE3-2061455881A0}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0.10192-to-3.2.0.10314-dede-downloader.exe | 
"{AC9CE1FF-3C90-446A-8229-823CA51F19D0}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe | 
"{AE4ACB50-5660-4A8E-A919-6DF4D0966081}" = protocol=17 | dir=in | app=f:\programme\ubisoft\shaunwhite\shaunwhitesnowboarding.exe | 
"{AEBD2AE3-A5B1-4129-BB4D-C0BECF348204}" = protocol=17 | dir=in | app=c:\program files\electronic arts\battlefield bad company 2\bfbc2updater.exe | 
"{AFE886E0-4B18-45B3-B455-EC108009DE72}" = protocol=6 | dir=in | app=f:\programme\thq\company of heroes\relicdownloader\relicdownloader.exe | 
"{B015F6FF-2E90-4E23-B079-12122609DCD3}" = protocol=17 | dir=in | app=f:\programme\ubisoft\shaunwhite\shaunwhitesnowboardinggame.exe | 
"{B8D5E00E-8277-4801-AEC5-604D67CFA48B}" = protocol=6 | dir=in | app=c:\program files\microsoft games\gears of war\binaries\wargame-g4wlive.exe | 
"{B9D5A4CC-32BD-4CBB-B48C-A4F822C2010F}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpoews01.exe | 
"{BBADE287-1BBA-497B-BB4E-27A7F209B482}" = protocol=17 | dir=in | app=c:\program files\sierra games\wic_online.exe | 
"{BDB715CF-C5D0-4206-AAB6-16FAB249EA0F}" = protocol=6 | dir=in | app=c:\program files\sierra games\wic.exe | 
"{BF6A4CFE-C534-4BF4-913A-14A4F802F3A0}" = protocol=6 | dir=out | svc=mcx2svc | app=%systemroot%\system32\svchost.exe | 
"{BFDFD884-43DC-4040-BD2A-C0961EC39FF4}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqkygrp.exe | 
"{C20F8C31-5F20-490D-8EA4-53F609282A9B}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe | 
"{C27ED155-9556-4E01-B45C-27B4603B95E1}" = protocol=6 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe | 
"{C60ED85D-7B20-4B39-97F1-30D3FAEE3210}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{CA3F72E1-0DDA-49C2-8E3F-2C87CE1D42CA}" = protocol=6 | dir=in | app=c:\users\nico\appdata\locallow\dyyno receiver\dppm.exe | 
"{CA8FDE01-23C9-4D67-92EA-0FBE60832146}" = protocol=17 | dir=in | app=c:\program files\sierra games\wic.exe | 
"{CADB7677-50B3-4A6D-872C-E3859DC9A66B}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{CDB770A8-363E-4C55-9AE7-0AC399EF1F31}" = protocol=6 | dir=in | app=c:\program files\midway games\rise and fall\riseandfall.exe | 
"{D0592BDA-AF6D-4782-AC54-B2462B84AECE}" = protocol=17 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe | 
"{D2FDDBFE-FC88-4B7B-AC7A-4A4AFFED81D8}" = protocol=6 | dir=in | app=c:\program files\2k games\firaxis games\sid meier's civilization iv colonization\colonization.exe | 
"{DAA6F83A-0139-4080-90C5-CFC8C1CDB12E}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqtra08.exe | 
"{DF0E44F2-6C81-453D-94C2-5B36DFE9A7C3}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe | 
"{E23BFAD7-2890-4120-BA8F-AA5997DFD262}" = protocol=17 | dir=in | app=f:\program files\ea games\mirror's edge\binaries\mirrorsedge.exe | 
"{E47D85F5-B22D-4C97-8655-3880773E8E60}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0.10192-to-3.2.0.10314-dede-downloader.exe | 
"{E5270183-632A-4CF4-80A1-AA0E0A3A63F2}" = protocol=17 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe | 
"{E71B8BB3-3D9E-4F55-A0B1-1B8F4BDDB1F8}" = dir=in | app=c:\program files\hp\digital imaging\bin\hposid01.exe | 
"{EBE354B6-51D8-4461-953C-0EF5794A7AF7}" = protocol=17 | dir=in | app=c:\program files\2k games\firaxis games\sid meier's civilization iv colonization\colonization.exe | 
"{EF8B480C-EC80-41DF-BCB5-5F272D372550}" = protocol=6 | dir=out | app=%systemroot%\ehome\ehshell.exe | 
"{F2BAE327-765A-402B-AF47-CE9E571F11D5}" = dir=in | app=f:\programme\electronic arts\command and conquer tiberium wars\retailexe\1.9\cnc3game.dat | 
"{F3E2C6F7-7FAB-472D-901B-5C8EDF8C5261}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{F48989DD-0325-43AB-B1D8-7D7A857F49AB}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 
"{F50E3981-D58A-430B-AC2F-6BCF68F93013}" = protocol=6 | dir=out | svc=upnphost | app=c:\windows\system32\svchost.exe | 
"{F527DBC3-7E15-4944-8A76-4C3D0C685449}" = protocol=17 | dir=in | app=c:\program files\activision\cod4\iw3mp.exe | 
"{F9269BAF-4DE7-4AA9-B85D-024BD616274C}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{FC5E660B-4D7C-4DF0-9EA3-97BC86A0DCDE}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgh.exe | 
"{FDA732FB-5664-4E6A-97CD-FC5476D3CAFA}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 
"{FE3AEA0E-5474-487E-B316-649E77D0EC72}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqste08.exe | 
"{FEF9E9F4-A3C3-4A35-A302-ED0A421A44C4}" = protocol=6 | dir=in | app=c:\program files\sierra games\wic_online.exe | 
"TCP Query User{03D7814F-5E6F-46F4-84FE-78048805EDA9}F:\programme\activision\call of duty 2\cod2mp_s.exe" = protocol=6 | dir=in | app=f:\programme\activision\call of duty 2\cod2mp_s.exe | 
"TCP Query User{0E2A9752-3FC5-4A7D-ABC1-DA9D5E0F0C66}C:\program files\mirc\mirc.exe" = protocol=6 | dir=in | app=c:\program files\mirc\mirc.exe | 
"TCP Query User{27D98D36-8826-4EDB-8F64-C79D54C12BCC}F:\programme\activision\call of duty 4 - modern warfare\iw3mp.exe" = protocol=6 | dir=in | app=f:\programme\activision\call of duty 4 - modern warfare\iw3mp.exe | 
"TCP Query User{28BB3054-CC82-4FA3-8425-F8C89CE01A79}C:\windows\system32\dplaysvr.exe" = protocol=6 | dir=in | app=c:\windows\system32\dplaysvr.exe | 
"TCP Query User{2A82EC34-2E5E-48FB-B505-8DD000885F6D}C:\program files\java\jre6\launch4j-tmp\jdownloader.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\launch4j-tmp\jdownloader.exe | 
"TCP Query User{2C61F42C-5320-4F4D-8195-02916E3B2EA1}F:\programme\worms armageddon\wa.exe" = protocol=6 | dir=in | app=f:\programme\worms armageddon\wa.exe | 
"TCP Query User{3349B1D8-47DB-4203-9CCB-1B5EB83F2B5A}F:\programme\activision\cod\codmp.exe" = protocol=6 | dir=in | app=f:\programme\activision\cod\codmp.exe | 
"TCP Query User{3DBB8869-B3DD-485D-AE09-BC7B3A9E8549}C:\program files\activision\cod\codmp.exe" = protocol=6 | dir=in | app=c:\program files\activision\cod\codmp.exe | 
"TCP Query User{3F699397-5447-4D89-8C8C-46EBD379E1A2}C:\program files\postal2stp\system\postal2.exe" = protocol=6 | dir=in | app=c:\program files\postal2stp\system\postal2.exe | 
"TCP Query User{3FCC6601-673B-4373-9488-5E9A1620FB69}F:\programme\microsoft games\age of empires 2 the age of kings\empires2.exe" = protocol=6 | dir=in | app=f:\programme\microsoft games\age of empires 2 the age of kings\empires2.exe | 
"TCP Query User{41E78F66-F1BE-4B6E-9933-179B5042BC9C}F:\programme\metin2\metin2.bin" = protocol=6 | dir=in | app=f:\programme\metin2\metin2.bin | 
"TCP Query User{48344DDA-927A-4172-BCB0-0DBC38391791}C:\users\nico\desktop\neuer ordner\coduomp.exe" = protocol=6 | dir=in | app=c:\users\nico\desktop\neuer ordner\coduomp.exe | 
"TCP Query User{4917B38A-8BE7-4B03-BCB8-8B5DFC26872C}F:\programme\metin2\metin2client.bin" = protocol=6 | dir=in | app=f:\programme\metin2\metin2client.bin | 
"TCP Query User{4A242EA3-0D8C-415E-8FD7-9A50E3E8E9AE}F:\programme\dead space\dead space.exe" = protocol=6 | dir=in | app=f:\programme\dead space\dead space.exe | 
"TCP Query User{5E47DFE3-9F89-4353-96DD-D52D934DA735}C:\windows\system32\dplaysvr.exe" = protocol=6 | dir=in | app=c:\windows\system32\dplaysvr.exe | 
"TCP Query User{6A78EB0E-986A-4631-A66B-DBD7F86F660C}C:\program files\wow\repair.exe" = protocol=6 | dir=in | app=c:\program files\wow\repair.exe | 
"TCP Query User{74B98BE2-0707-4254-A158-FC10493F37D9}C:\program files\left 4 dead\left4dead.exe" = protocol=6 | dir=in | app=c:\program files\left 4 dead\left4dead.exe | 
"TCP Query User{79131458-1A9B-4BD2-A678-474904C09927}F:\programme\battlefield vietnam\bfvietnam.exe" = protocol=6 | dir=in | app=f:\programme\battlefield vietnam\bfvietnam.exe | 
"TCP Query User{7E9285ED-D436-4A1E-9E0E-3A07C8B79FF3}F:\programme\electronic arts\command & conquer 3\retailexe\1.9\cnc3game.dat" = protocol=6 | dir=in | app=f:\programme\electronic arts\command & conquer 3\retailexe\1.9\cnc3game.dat | 
"TCP Query User{80B38D5E-89D2-4638-A37A-4F133DDBEC12}F:\programme\tom clancy's h.a.w.x\hawx.exe" = protocol=6 | dir=in | app=f:\programme\tom clancy's h.a.w.x\hawx.exe | 
"TCP Query User{8820DC4B-94DF-4C69-99B5-60A31DE2C44C}C:\programdata\kaspersky lab setup files\kaspersky internet security 2009\german\setup.exe" = protocol=6 | dir=in | app=c:\programdata\kaspersky lab setup files\kaspersky internet security 2009\german\setup.exe | 
"TCP Query User{993397FF-DB0A-40E9-B41F-26D711FE4420}C:\program files\activision\cod\coduomp.exe" = protocol=6 | dir=in | app=c:\program files\activision\cod\coduomp.exe | 
"TCP Query User{A85664EE-CF49-4CAB-8412-8D88AB7F80E6}C:\program files\wow\launcher.exe" = protocol=6 | dir=in | app=c:\program files\wow\launcher.exe | 
"TCP Query User{A9E53ACF-476C-4D7E-A729-3560AD3A4477}C:\users\nico\appdata\local\temp\electronicarts_patcher_000.exe" = protocol=6 | dir=in | app=c:\users\nico\appdata\local\temp\electronicarts_patcher_000.exe | 
"TCP Query User{B2BAE860-49B7-494F-999C-3F128281A40E}F:\programme\far cry 2\bin\farcry2.exe" = protocol=6 | dir=in | app=f:\programme\far cry 2\bin\farcry2.exe | 
"TCP Query User{B5A54A0A-4FD5-4C71-AED4-B795E5F5688F}C:\program files\activision\cod4\iw3mp.exe" = protocol=6 | dir=in | app=c:\program files\activision\cod4\iw3mp.exe | 
"TCP Query User{BA4063EE-9AD8-4AFB-B943-E9D2D67E92A3}F:\programme\steam\steamapps\optiolol\counter-strike source\hl2.exe" = protocol=6 | dir=in | app=f:\programme\steam\steamapps\optiolol\counter-strike source\hl2.exe | 
"TCP Query User{C1515480-ABF8-4B11-96AE-DDF1B8E865FC}C:\program files\activision\call of duty 2\cod2mp_s.exe" = protocol=6 | dir=in | app=c:\program files\activision\call of duty 2\cod2mp_s.exe | 
"TCP Query User{D6382914-4211-441C-BC7D-1E149C671738}G:\spiele\command & conquer 3\retailexe\1.9\cnc3game.dat" = protocol=6 | dir=in | app=g:\spiele\command & conquer 3\retailexe\1.9\cnc3game.dat | 
"TCP Query User{D81F15B1-47C3-4A6B-AC27-23794C912F63}F:\programme\firefly studios\stronghold crusader\stronghold crusader.exe" = protocol=6 | dir=in | app=f:\programme\firefly studios\stronghold crusader\stronghold crusader.exe | 
"TCP Query User{DD9E953A-706A-46AA-8529-C781A79C5054}C:\program files\activision\call of duty 2\cod2mp_s.exe" = protocol=6 | dir=in | app=c:\program files\activision\call of duty 2\cod2mp_s.exe | 
"TCP Query User{DE79D49F-E6E2-4E79-BD38-1A208F94FDB3}F:\programme\activision\cod\coduomp.exe" = protocol=6 | dir=in | app=f:\programme\activision\cod\coduomp.exe | 
"TCP Query User{EB976354-E18D-427B-9729-71A4FE3E5241}F:\programme\xfire\xfire.exe" = protocol=6 | dir=in | app=f:\programme\xfire\xfire.exe | 
"TCP Query User{EEBE6567-9A87-46BE-996D-93D55BB457A0}F:\programme\icq6.5\icq.exe" = protocol=6 | dir=in | app=f:\programme\icq6.5\icq.exe | 
"TCP Query User{F07A5F1D-CCEC-4DD3-AE3B-8B91A0728509}F:\programme\xfire\xfire.exe" = protocol=6 | dir=in | app=f:\programme\xfire\xfire.exe | 
"TCP Query User{F3CA7FB6-7D62-4E25-8DB6-0B08EB0BBD23}F:\programme\hlsw\hlsw.exe" = protocol=6 | dir=in | app=f:\programme\hlsw\hlsw.exe | 
"TCP Query User{FAB910C6-7385-4B29-B3E1-78EB8D1F0222}F:\programme\halo\halo.exe" = protocol=6 | dir=in | app=f:\programme\halo\halo.exe | 
"UDP Query User{095C3AB0-C7D0-4E38-B204-0B0233D8F4E6}C:\program files\left 4 dead\left4dead.exe" = protocol=17 | dir=in | app=c:\program files\left 4 dead\left4dead.exe | 
"UDP Query User{0B76F548-B64A-49F8-865E-2AAEEAA86838}C:\program files\wow\repair.exe" = protocol=17 | dir=in | app=c:\program files\wow\repair.exe | 
"UDP Query User{16C0336B-1320-4846-839C-4136F1CD327D}F:\programme\icq6.5\icq.exe" = protocol=17 | dir=in | app=f:\programme\icq6.5\icq.exe | 
"UDP Query User{18BB681D-7076-458D-8F9C-67969908CB6B}F:\programme\metin2\metin2client.bin" = protocol=17 | dir=in | app=f:\programme\metin2\metin2client.bin | 
"UDP Query User{19A89B58-9D24-4B3E-BE78-7A8BABDBE249}C:\program files\activision\cod4\iw3mp.exe" = protocol=17 | dir=in | app=c:\program files\activision\cod4\iw3mp.exe | 
"UDP Query User{35D8A1D3-F2BC-4DD0-AA17-995354BA070F}F:\programme\activision\call of duty 2\cod2mp_s.exe" = protocol=17 | dir=in | app=f:\programme\activision\call of duty 2\cod2mp_s.exe | 
"UDP Query User{3D731044-6B25-409D-A04E-86CC0C7FECF5}F:\programme\hlsw\hlsw.exe" = protocol=17 | dir=in | app=f:\programme\hlsw\hlsw.exe | 
"UDP Query User{4C999404-F378-4C22-B790-B262A1AFCE7D}C:\programdata\kaspersky lab setup files\kaspersky internet security 2009\german\setup.exe" = protocol=17 | dir=in | app=c:\programdata\kaspersky lab setup files\kaspersky internet security 2009\german\setup.exe | 
"UDP Query User{4F0EAA92-6B50-4D06-B204-2CC1055B80FD}C:\program files\java\jre6\launch4j-tmp\jdownloader.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\launch4j-tmp\jdownloader.exe | 
"UDP Query User{4F24F115-08A9-4CB0-A94F-BD4EB94052B9}F:\programme\activision\cod\coduomp.exe" = protocol=17 | dir=in | app=f:\programme\activision\cod\coduomp.exe | 
"UDP Query User{671E443F-A832-4E25-85CF-4245955C0E7D}C:\program files\activision\cod\codmp.exe" = protocol=17 | dir=in | app=c:\program files\activision\cod\codmp.exe | 
"UDP Query User{672A4D49-E844-402E-9988-FE843AAE266D}F:\programme\far cry 2\bin\farcry2.exe" = protocol=17 | dir=in | app=f:\programme\far cry 2\bin\farcry2.exe | 
"UDP Query User{79197F36-C3E7-4707-95FC-06B28F581A09}C:\program files\activision\call of duty 2\cod2mp_s.exe" = protocol=17 | dir=in | app=c:\program files\activision\call of duty 2\cod2mp_s.exe | 
"UDP Query User{7CF6C659-F6FA-4C8C-AC03-17E77D03FAE0}C:\program files\wow\launcher.exe" = protocol=17 | dir=in | app=c:\program files\wow\launcher.exe | 
"UDP Query User{7D0849E4-4895-4F15-AF19-CFB02AFEE749}C:\windows\system32\dplaysvr.exe" = protocol=17 | dir=in | app=c:\windows\system32\dplaysvr.exe | 
"UDP Query User{7E8D4DB1-5979-4FF6-851B-36D328FD92C0}C:\users\nico\appdata\local\temp\electronicarts_patcher_000.exe" = protocol=17 | dir=in | app=c:\users\nico\appdata\local\temp\electronicarts_patcher_000.exe | 
"UDP Query User{86634CE6-1170-4738-974E-B558A276F15A}F:\programme\electronic arts\command & conquer 3\retailexe\1.9\cnc3game.dat" = protocol=17 | dir=in | app=f:\programme\electronic arts\command & conquer 3\retailexe\1.9\cnc3game.dat | 
"UDP Query User{8DA1B81C-024C-420E-8D00-09818BAE6428}F:\programme\microsoft games\age of empires 2 the age of kings\empires2.exe" = protocol=17 | dir=in | app=f:\programme\microsoft games\age of empires 2 the age of kings\empires2.exe | 
"UDP Query User{8F65452A-B4E7-4987-B0B8-7E8831FF2FB9}F:\programme\dead space\dead space.exe" = protocol=17 | dir=in | app=f:\programme\dead space\dead space.exe | 
"UDP Query User{9A734DE8-1C32-49AE-915F-7775CC853CCF}F:\programme\firefly studios\stronghold crusader\stronghold crusader.exe" = protocol=17 | dir=in | app=f:\programme\firefly studios\stronghold crusader\stronghold crusader.exe | 
"UDP Query User{A566035F-83A2-4EE2-8B55-EF5937FC7463}C:\program files\mirc\mirc.exe" = protocol=17 | dir=in | app=c:\program files\mirc\mirc.exe | 
"UDP Query User{B1AFD9F4-CDC8-43AE-986D-61202C4E60A2}G:\spiele\command & conquer 3\retailexe\1.9\cnc3game.dat" = protocol=17 | dir=in | app=g:\spiele\command & conquer 3\retailexe\1.9\cnc3game.dat | 
"UDP Query User{B23C8BF4-1ECC-4BA3-BA7F-AF194FC5DE4A}F:\programme\xfire\xfire.exe" = protocol=17 | dir=in | app=f:\programme\xfire\xfire.exe | 
"UDP Query User{B60CC65B-5F7D-457D-987A-13B86ADC9428}F:\programme\halo\halo.exe" = protocol=17 | dir=in | app=f:\programme\halo\halo.exe | 
"UDP Query User{B76DC34F-35D7-4E20-A0D4-52C72AC7CA22}C:\users\nico\desktop\neuer ordner\coduomp.exe" = protocol=17 | dir=in | app=c:\users\nico\desktop\neuer ordner\coduomp.exe | 
"UDP Query User{B83AB61B-1A12-4874-8E8F-ED16322F243B}F:\programme\battlefield vietnam\bfvietnam.exe" = protocol=17 | dir=in | app=f:\programme\battlefield vietnam\bfvietnam.exe | 
"UDP Query User{BA7E8B1E-EC86-44AD-9272-E7F05A4D196C}F:\programme\activision\cod\codmp.exe" = protocol=17 | dir=in | app=f:\programme\activision\cod\codmp.exe | 
"UDP Query User{BC659AA2-13DF-43CE-9D13-93378DCEB9B6}C:\program files\postal2stp\system\postal2.exe" = protocol=17 | dir=in | app=c:\program files\postal2stp\system\postal2.exe | 
"UDP Query User{C80AD029-E05F-4CAE-AD39-A8F0302C7A19}C:\program files\activision\cod\coduomp.exe" = protocol=17 | dir=in | app=c:\program files\activision\cod\coduomp.exe | 
"UDP Query User{CD0E34D6-80ED-46C4-9232-2841F98C0F41}C:\program files\activision\call of duty 2\cod2mp_s.exe" = protocol=17 | dir=in | app=c:\program files\activision\call of duty 2\cod2mp_s.exe | 
"UDP Query User{CDBB0EFE-0E49-428F-8E8F-79C556D0116D}F:\programme\tom clancy's h.a.w.x\hawx.exe" = protocol=17 | dir=in | app=f:\programme\tom clancy's h.a.w.x\hawx.exe | 
"UDP Query User{D4876D4C-903F-4707-9AE5-6BF602B98B16}F:\programme\xfire\xfire.exe" = protocol=17 | dir=in | app=f:\programme\xfire\xfire.exe | 
"UDP Query User{E4D89834-32E8-4CCF-934C-ECCB80848907}F:\programme\metin2\metin2.bin" = protocol=17 | dir=in | app=f:\programme\metin2\metin2.bin | 
"UDP Query User{F3BA5037-B25B-4E47-A156-D2797058141A}F:\programme\activision\call of duty 4 - modern warfare\iw3mp.exe" = protocol=17 | dir=in | app=f:\programme\activision\call of duty 4 - modern warfare\iw3mp.exe | 
"UDP Query User{F573619F-4530-4ED9-ABC8-8D0BB616F105}F:\programme\steam\steamapps\optiolol\counter-strike source\hl2.exe" = protocol=17 | dir=in | app=f:\programme\steam\steamapps\optiolol\counter-strike source\hl2.exe | 
"UDP Query User{F7A5C010-16EE-4E68-BCA3-403F1F9F6416}C:\windows\system32\dplaysvr.exe" = protocol=17 | dir=in | app=c:\windows\system32\dplaysvr.exe | 
"UDP Query User{F7B7EB9D-AAA6-45C9-9DF1-D426C95F594A}F:\programme\worms armageddon\wa.exe" = protocol=17 | dir=in | app=f:\programme\worms armageddon\wa.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01521746-02A6-4A72-00BD-A285DF6B80C6}" = Die Sims 2: Wilde Campus-Jahre
"{0289B35E-DC07-4c7a-9710-BBD686EA4B7D}" = Status
"{03B0D67B-36C9-C2CD-B63B-7B526138BA52}" = ccc-utility
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{04FC2E4C-0E41-9D39-4E58-1EF29D4EF09D}" = ccc-core-static
"{04FE63AC-AC7B-4C80-83AA-CCACA48C0C19}" = PS_AIO_04_C5300_Software
"{050C1C8E-4A4D-4C2F-B9AE-67E60EE91B7F}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.3 Patch
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{086BADF8-9B1F-4E89-B207-2EDA520972D6}" = Grand Theft Auto San Andreas
"{0949C078-58B4-CAF1-9A63-A4545145806D}" = Catalyst Control Center Graphics Previews Common
"{09633A5E-3089-41A8-9FF1-382171423C5D}" = PSSWCORE
"{09725E0F-6406-4500-8296-DBF6E697E9D7}" = C5300
"{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}" = PlayStation(R)Store
"{121634B0-2F4B-11D3-ADA3-00C04F52DD52}" = Windows Installer Clean Up
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{14574B7F-75D1-4718-B7F2-EBF6E2862A35}" = Company of Heroes - FAKEMSI
"{15B8AFD9-92E9-4E86-96D9-83FAC510B82E}" = HPPhotoSmartPhotobookWebPack1
"{199E6632-EB28-4F73-AECB-3E192EB92D18}" = Company of Heroes - FAKEMSI
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20DEB77C-21D6-4D22-BB47-233E47613D57}" = Microsoft Games for Windows - LIVE Redistributable
"{22F761D1-8063-4170-ADF7-2D2F47834CA9}" = VideoToolkit01
"{25724802-CC14-4B90-9F3B-3D6955EE27B1}" = Company of Heroes - FAKEMSI
"{2614F54E-A828-49FA-93BA-45A3F756BFAA}" = 32 Bit HP CIO Components Installer
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 20
"{26BEE28E-C285-4532-82D3-7CE3C5F805D4}" = HPPhotoSmartDiscLabel_PrintOnDisc
"{2AFEAA03-2DFE-4519-A629-EDAB6541ABE9}" = HPSSupply
"{32C4A4EB-C97D-414E-99C5-38F8DFD31D5D}" = Company of Heroes - FAKEMSI
"{3700194C-C5DD-439A-BE06-A66960CA4C70}" = MSVCSetup
"{38D9575F-6228-6A54-3A92-D902739B6541}" = Catalyst Control Center InstallProxy
"{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}" = JMB36X Raid Configurer
"{3AC8457C-0385-4BEA-A959-E095F05D6D67}" = Battlefield: Bad Company™ 2
"{3AD56302-2ADE-4A1C-864A-CB9FFF040576}" = PS_AIO_04_C5300_ProductContext
"{3BD633E0-4BF8-4499-9149-88F0767D449C}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.4 Patch
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{489CA990-9FFB-495A-B5F6-027199E65405}" = PS_AIO_04_C5300_Software_Min
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A3D0CF8-60FF-4CEF-91A4-A1F001424602}" = DocProc
"{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter
"{4E7C28C7-D5DA-4E9F-A1CA-60490B54AE35}" = UnloadSupport
"{50193078-F553-4EBA-AA77-64C9FAA12F98}" = Company of Heroes - FAKEMSI
"{51D718D1-DA81-4FAD-919F-5C1CE3C33379}" = Company of Heroes - FAKEMSI
"{573F1931-08F7-9222-704E-841C391794C5}" = ATI Catalyst Install Manager
"{5D7767FA-7FE8-4627-9F09-AEF7A25F1E07}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.1 Patch
"{5E8B45A0-072C-91F7-BC80-29374194B452}" = Catalyst Control Center Graphics Previews Vista
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5
"{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{66F78C51-D108-4F0C-A93C-1CBE74CE338F}" = Company of Heroes - FAKEMSI
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69C57747-551F-4e4f-AB60-13358DC4F00A}" = HP Photosmart C5300 All-In-One Driver Software 11.0 Rel .4
"{6CC1EE94-B426-478B-AE83-F83EBB4EF66A}" = HPPhotoSmartDiscLabel_PaperLabel
"{6E7DD182-9FC6-4651-0095-2E666CC6AF35}" = Die Sims 2
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{70E1E357-E57C-4284-B04E-58196DC27BC1}" = PanoStandAlone
"{74DC0593-6BC6-4001-AD5F-D810AFB68D86}" = HP Update
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{7B3577F5-1D82-4C9B-008B-69D026FD8BCA}" = Die Sims 2: Open For Business
"{7B4A5C13-069F-4AFE-AE57-C497B4E33C7E}" = Call of Duty(R) 2 Patch 1.3
"{7BA01D2D-E25C-0C2C-5779-7A8E02A4BE7D}" = Catalyst Control Center Core Implementation
"{7ED180E1-ADE9-4C69-8845-BDF518D763B8}" = hpphotosmartdisclabelplugin
"{7F4B1592-222F-4E5F-A100-E5AFD61A0BB3}" = Company of Heroes - FAKEMSI
"{80D03817-7943-4839-8E96-B9F924C5E67D}" = Company of Heroes - FAKEMSI
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8503C901-85D7-4262-88D2-8D8B2A7B08B8}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.5 Patch
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch
"{8A74DEFD-A224-49CC-AB80-4E88BC730125}" = LogMeIn Hamachi
"{8ACC73AA-6511-7C55-B1A9-8E5D1DEAFAA3}" = The Lord of the Rings FREE Trial 
"{8D7133DE-27D2-47E5-B248-4180278D32AA}" = Catalyst Control Center - Branding
"{8FF4E834-DCAD-29E7-1EE8-9D817A3FA15B}" = CCC Help English
"{8FF6F5CA-4E30-4E3B-B951-204CAAA2716A}" = SmartWebPrinting
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90850407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Word Viewer 2003
"{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch
"{9580813D-94B1-4C28-9426-A441E2BB29A5}" = Counter-Strike: Source
"{97E5205F-EA4F-438F-B211-F1846419F1C1}" = Company of Heroes - FAKEMSI
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{99A7722D-9ACB-43F3-A222-ABC7133F159E}" = Company of Heroes - FAKEMSI
"{99E862CC-6F69-4D39-99AA-DBF71BF3B585}" = OpenOffice.org 3.1
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C2D4047-0E40-499a-AC7A-C4B9BB12FE03}" = TrayApp
"{9F4EE72A-C5C9-42ad-ABEF-427690843577}" = MarketResearch
"{A6FDF86A-F541-4E7B-AEA0-8849A2A700D5}" = iTunes
"{A8B94669-8654-4126-BD28-D0D2412CDED6}" = TI Connect 1.6
"{AA2E8A46-B45E-4aea-8A23-88AB57D04523}" = WebReg
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.2 - Deutsch
"{AEDBD563-24BB-4EE3-8366-A654DAC2D988}" = Mirror's Edge™
"{B3276CB1-20B6-4AF9-AAEC-E72C83816495}" = IKEA Home Planner
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BA801B94-C28D-46EE-B806-E1E021A3D519}" = Company of Heroes - FAKEMSI
"{BC4CA8FA-41D2-4B81-8680-E9B7573D6500}" = PlayStation(R)Network Downloader
"{BCC09E9C-3340-473D-A4FE-8580992CA77A}" = HPPhotoSmartDiscLabelContent1
"{BF08AB1C-3357-4f20-A200-8EBB8EF27C59}" = BufferChm
"{C03A56EE-2715-5F54-69C4-A1CDB7602354}" = Catalyst Control Center Graphics Full New
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = Die Sims™ 3
"{C307DD64-1C69-8C52-D2C9-02D38995A269}" = Catalyst Control Center HydraVision Full
"{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant
"{C89B5E3A-690F-4CEE-909A-BF869E198B0A}" = Scan
"{C9933E93-8653-447E-9A19-9BCF658E3AE9}" = C5300_Help
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D078226E-83F2-45FD-9CDE-5DA66E5ADB51}" = Rise and Fall
"{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D16B4BE6-8B10-422f-8034-96D1CA9483B5}" = GPBaseService
"{D4D244D1-05E0-4D24-86A2-B2433C435671}" = Company of Heroes - FAKEMSI
"{D74CFE48-087F-46E1-80E6-E2950E1A8DCE}" = HP Photosmart Essential 2.5
"{D99223D4-1F48-47BD-ADFD-D43C91CDFD00}" = S4 League
"{DDEDAF6C-488E-4CDA-8276-1CCF5F3C5C32}" = Command & Conquer 3
"{E3E1398E-8FF2-0154-6D8F-7FC26299EBED}" = Catalyst Control Center Graphics Full Existing
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E5141379-B2D9-4BBC-BB2A-5805541571DD}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.2 Patch
"{E535C94A-B87F-4182-BEA8-1E9322078D3E}" = Cards_Calendar_OrderGift_DoMorePlugout
"{E96B0085-6659-486b-A221-5042A042728D}" = Toolbox
"{EAF636A9-F664-4703-A659-85A894DA264F}" = Company of Heroes - FAKEMSI
"{ED1390DC-6910-4C77-97E2-579CAFE82F5B}" = Moorhuhn 4 Teile
"{ED3866E9-4F50-4A47-9945-58D5C97AB56F}" = Media Go
"{EF1ADA5A-0B1A-4662-8C55-7475A61D8B65}" = DeviceDiscovery
"{EF36A836-BF89-4A4F-B079-057B0C68C1E0}" = Sid Meier's Civilization IV Colonization
"{EF9E56EE-0243-4BAD-88F4-5E7508AA7D96}" = Destination Component
"{F11ADC64-C89E-47F4-A0B3-3665FF859397}" = WORLD IN CONFLICT
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F7529650-B9DB-481B-0089-A2AC3C2821C1}" = Die Sims 2: Nightlife
"{FBEF69BB-829C-8D4D-B299-497147916039}" = Catalyst Control Center Graphics Light
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CEP - Colour Enable Packages_is1" = CEP - Color Enable Package
"Cheat Engine 5.4_is1" = Cheat Engine 5.4
"Command and Conquer™ 3 Tiberium Wars™ Sprachsteuerung" = Command and Conquer™ 3 Tiberium Wars™ Sprachsteuerung 1.0.0.0 
"Company of Heroes" = Company of Heroes
"Free Video to iPod Converter_is1" = Free Video to iPod Converter version 3.2
"HijackThis" = HijackThis 2.0.2
"HP Imaging Device Functions" = HP Imaging Device Functions 11.0
"HP Photosmart Essential" = HP Photosmart Essential 3.0
"HP Smart Web Printing" = HP Smart Web Printing 4.60
"HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0
"HPExtendedCapabilities" = HP Customer Participation Program 11.0
"HPOCR" = OCR Software by I.R.I.S. 11.0
"ImgBurn" = ImgBurn
"InstallShield_{050C1C8E-4A4D-4C2F-B9AE-67E60EE91B7F}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.3 Patch
"InstallShield_{3BD633E0-4BF8-4499-9149-88F0767D449C}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.4 Patch
"InstallShield_{5D7767FA-7FE8-4627-9F09-AEF7A25F1E07}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.1 Patch
"InstallShield_{8503C901-85D7-4262-88D2-8D8B2A7B08B8}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.5 Multiplayer Patch
"InstallShield_{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch
"InstallShield_{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch
"InstallShield_{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2
"InstallShield_{E5141379-B2D9-4BBC-BB2A-5805541571DD}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.2 Patch
"Left 4 Dead" = Left 4 Dead
"LogMeIn Hamachi" = LogMeIn Hamachi
"Metin2_is1" = Metin2
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.5.9)" = Mozilla Firefox (3.5.9)
"NeroMultiInstaller!UninstallKey" = Nero Suite
"oZone3D.Net FurMark_is1" = oZone3D.Net FurMark v1.8.0
"Postal 2 Share The Pain" = Postal 2 Share The Pain
"PunkBusterSvc" = PunkBuster Services
"RollerCoaster Tycoon 3_is1" = RollerCoaster Tycoon 3
"Shop for HP Supplies" = Shop for HP Supplies
"Sims2Pack Clean Installer " = Sims2Pack Clean Installer 
"Steam App 240" = Counter-Strike: Source
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"VirtualCloneDrive" = VirtualCloneDrive
"VLC media player" = VLC media player 1.0.5
"WinRAR archiver" = WinRAR archiver
"Zygor Guides" = Zygor Guides
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"TeamSpeak 3 Client" = TeamSpeak 3 Client
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 23.05.2010 05:17:25 | Computer Name = Nico-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 23.05.2010 09:59:06 | Computer Name = Nico-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung RunDLL32.exe, Version 6.0.6000.16386, Zeitstempel
 0x4549b0e1, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000,
 Ausnahmecode 0xc0000005, Fehleroffset 0x024da8ed,  Prozess-ID 0xf6c, Anwendungsstartzeit
 01cafa801b3c29fc.
 
Error - 23.05.2010 09:59:18 | Computer Name = Nico-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung RunDLL32.exe, Version 6.0.6000.16386, Zeitstempel
 0x4549b0e1, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000,
 Ausnahmecode 0xc0000005, Fehleroffset 0x00c7a8ed,  Prozess-ID 0x12f4, Anwendungsstartzeit
 01cafa80230432ec.
 
Error - 23.05.2010 10:27:09 | Computer Name = Nico-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung RunDLL32.exe, Version 6.0.6000.16386, Zeitstempel
 0x4549b0e1, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000,
 Ausnahmecode 0xc0000005, Fehleroffset 0x01bca8ed,  Prozess-ID 0x1044, Anwendungsstartzeit
 01cafa84072de62c.
 
Error - 23.05.2010 10:27:11 | Computer Name = Nico-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung RunDLL32.exe, Version 6.0.6000.16386, Zeitstempel
 0x4549b0e1, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000,
 Ausnahmecode 0xc0000005, Fehleroffset 0x01ada8ed,  Prozess-ID 0x1720, Anwendungsstartzeit
 01cafa840833212c.
 
Error - 23.05.2010 17:53:44 | Computer Name = Nico-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 24.05.2010 09:10:07 | Computer Name = Nico-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 24.05.2010 09:10:32 | Computer Name = Nico-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung hpqpsapp.exe, Version 110.0.226.11, Zeitstempel
 0x47e22104, fehlerhaftes Modul hpqpsapp.exe, Version 110.0.226.11, Zeitstempel 
0x47e22104, Ausnahmecode 0xc0000005, Fehleroffset 0x00176e77,  Prozess-ID 0xfb8, Anwendungsstartzeit
 01cafb427743b6a0.
 
Error - 24.05.2010 14:09:05 | Computer Name = Nico-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung javaw.exe, Version 6.0.200.2, Zeitstempel 0x4bc398b3,
 fehlerhaftes Modul java.dll, Version 6.0.200.2, Zeitstempel 0x4bc3c8dc, Ausnahmecode
 0xc0000005, Fehleroffset 0x00005875,  Prozess-ID 0x1158, Anwendungsstartzeit 01cafb6c31c7f4e0.
 
Error - 25.05.2010 12:16:20 | Computer Name = Nico-PC | Source = WinMgmt | ID = 10
Description = 
 
[ Media Center Events ]
Error - 18.05.2009 08:45:55 | Computer Name = Nico-PC | Source = Media Center Guide | ID = 0
Description = Ereignisinformationen: ERROR: SqmApiWrapper.TimerRecord failed; Win32
 GetLastError returned 10000105  Prozess: DefaultDomain Objektname: Media Center Guide

 
Error - 09.08.2009 11:27:51 | Computer Name = Nico-PC | Source = Media Center Guide | ID = 0
Description = Ereignisinformationen: ERROR: SqmApiWrapper.TimerRecord failed; Win32
 GetLastError returned 10000105  Prozess: DefaultDomain Objektname: Media Center Guide

 
Error - 16.10.2009 06:39:03 | Computer Name = Nico-PC | Source = Mcx2Dvcs | ID = 401
Description = 
 
[ System Events ]
Error - 25.05.2010 12:21:22 | Computer Name = Nico-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk1\DR1.
 
Error - 25.05.2010 12:21:25 | Computer Name = Nico-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk1\DR1.
 
Error - 25.05.2010 12:22:43 | Computer Name = Nico-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk1\DR1.
 
Error - 25.05.2010 12:22:46 | Computer Name = Nico-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk1\DR1.
 
Error - 25.05.2010 12:23:49 | Computer Name = Nico-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk1\DR1.
 
Error - 25.05.2010 12:23:52 | Computer Name = Nico-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk1\DR1.
 
Error - 25.05.2010 12:24:59 | Computer Name = Nico-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk1\DR1.
 
Error - 25.05.2010 12:25:02 | Computer Name = Nico-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk1\DR1.
 
Error - 25.05.2010 12:26:07 | Computer Name = Nico-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk1\DR1.
 
Error - 25.05.2010 12:26:10 | Computer Name = Nico-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk1\DR1.
 
 
< End of report >

cosinus · 25.05.2010, 20:23

Was ist mit Malwarebytes? Das solltest Du vor OTL ausführen.

Darkfilter · 27.05.2010, 21:41

Hier, Report von OSAM

Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 22:34:37 on 27.05.2010
OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit
Default Browser: Mozilla Corporation Firefox 3.5.9

Scanner Settings
Rootkits detection (hidden registry)
Rootkits detection (hidden files)
Retrieve files information
Check Microsoft signatures

Filters
Trusted entries
Empty entries
Hidden registry entries (rootkit activity)
Exclusively opened files
Not found files
Files without detailed information
Existing files
Non-startable services
Non-startable drivers
Active entries
Disabled entries

Risk Name Publisher Full Path Status
Common
%SystemRoot%\Tasks
|||| "WebReg HP Photosmart C5300 series.job" "Hewlett-Packard Co." C:\Program Files\HP\Digital Imaging\bin\hpqwrg.exe File exists
Control Panel Objects
%SystemRoot%\system32
|||||| "TIControlPanel.cpl" "Texas Instruments Incorporated" C:\Windows\system32\TIControlPanel.cpl File exists
HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls
|||||| "Pando" "Pando Networks" C:\Program Files\Pando Networks\Media Booster\PMB.cpl File exists
|||||| "QuickTime" "Apple Inc." C:\Program Files\QuickTime\QTSystem\QuickTime.cpl File exists
Drivers
HKLM\SYSTEM\CurrentControlSet\Services
|||||| "avgntflt" (avgntflt) "Avira GmbH" C:\Windows\System32\DRIVERS\avgntflt.sys File exists
|||||| "avipbb" (avipbb) "Avira GmbH" C:\Windows\System32\DRIVERS\avipbb.sys File exists
"cdrmkaun" (cdrmkaun) C:\Users\Nico\AppData\Local\Temp\cdrmkaun.sys File not found
"DBKDRVR54" (DBKDRVR54) F:\Program Files\Cheat Engine\dbk32.sys File not found
"dump_wmimmc" (dump_wmimmc) F:\Programme\Cossfire\CrossFire\GameGuard\dump_wmimmc.sys File not found
"EagleNT" (EagleNT) C:\Windows\system32\drivers\EagleNT.sys File not found
|||||| "ElbyCDIO Driver" (ElbyCDIO) "Elaborate Bytes AG" C:\Windows\System32\Drivers\ElbyCDIO.sys File exists
"GMSIPCI" (GMSIPCI) E:\INSTALL\GMSIPCI.SYS File not found
|||||| "Hamachi Network Interface" (hamachi) "LogMeIn, Inc." C:\Windows\System32\DRIVERS\hamachi.sys File exists
"IP in IP Tunnel Driver" (IpInIp) C:\Windows\System32\DRIVERS\ipinip.sys File not found
"IPX Traffic Filter Driver" (NwlnkFlt) C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
"IPX Traffic Forwarder Driver" (NwlnkFwd) C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
|||||| "NPPTNT2" (NPPTNT2) "INCA Internet Co., Ltd." C:\Windows\system32\npptNT2.sys File exists
"PCD52X2" (PCD52X2) C:\Users\Nico\AppData\Local\Temp\PCD52X2.sys File not found
"PCD52X3" (PCD52X3) C:\Users\Nico\AppData\Local\Temp\PCD52X3.sys File not found
"PCD61X2" (PCD61X2) C:\Users\Nico\AppData\Local\Temp\PCD61X2.sys File not found
"PCD61X3" (PCD61X3) C:\Users\Nico\AppData\Local\Temp\PCD61X3.sys File not found
"SSHDRV51" (SSHDRV51) C:\Windows\system32\drivers\SSHDRV51.sys File found, but it contains no detailed information
|||||| "SSHDRV52" (SSHDRV52) C:\Windows\system32\drivers\SSHDRV52.sys File found, but it contains no detailed information
|||||| "SSHDRV61" (SSHDRV61) C:\Windows\system32\drivers\SSHDRV61.sys File found, but it contains no detailed information
|||||| "SSHDRV76" (SSHDRV76) C:\Windows\system32\drivers\SSHDRV76.sys File exists
|||||| "ssmdrv" (ssmdrv) "Avira GmbH" C:\Windows\System32\DRIVERS\ssmdrv.sys File exists
|||||| "StarForce Protection Environment Driver v6" (prodrv06) "Protection Technology" C:\Windows\System32\drivers\prodrv06.sys File exists
|||||| "StarForce Protection Helper Driver" (sfhlp01) "Protection Technology" C:\Windows\System32\drivers\sfhlp01.sys File exists
|||||| "StarForce Protection Helper Driver v2" (prohlp02) "Protection Technology" C:\Windows\System32\drivers\prohlp02.sys File exists
|||||| "StarForce Protection Synchronization Driver v1" (prosync1) "Protection Technology" C:\Windows\System32\drivers\prosync1.sys File exists
|||||| "StarOpen" (StarOpen) C:\Windows\system32\drivers\StarOpen.sys File found, but it contains no detailed information
|||||| "TIEHDUSB" (TIEHDUSB) "Texas Instruments Incorporated" C:\Windows\System32\drivers\tiehdusb.sys File exists
Explorer
HKLM\Software\Classes\Folder\shellex\ColumnHandlers
|||||| {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" "Adobe Systems, Inc." C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll File exists
|||||| {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll File exists
HKLM\Software\Classes\Protocols\Handler
|||||| {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" "Skype Technologies" C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL File exists
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" File not found | COM-object registry key not found
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" File not found | COM-object registry key not found
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" File not found | COM-object registry key not found
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" File not found | COM-object registry key not found
|||||| {872A9397-E0D6-4e28-B64D-52B8D0A7EA35} "DisplayCplExt Class" "Advanced Micro Devices, Inc." C:\Program Files\ATI\ATI.ACE\Core-Static\atiamaxx.dll File exists
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" File not found | COM-object registry key not found
|||||| {3FCEF010-09A4-11D4-8D3B-D12F9D3D8B02} "FileTimeShlExt Class" "Texas Instruments Incorporated" C:\PROGRA~2\COMMON~1\TISHAR~1\TICONN~1\TIShlExt.dll File exists
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" File not found | COM-object registry key not found
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" F:\Programme\iTunes\iTunesMiniPlayer.dll File not found
{00020d75-0000-0000-c000-000000000046} "lnkfile" File not found | COM-object registry key not found
|||||| {42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" "Microsoft Corporation" G:\PROGRA~1\MICROS~2\OFFICE11\msohev.dll File exists
|||||| {993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" "Microsoft Corporation" C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\msoshext.dll File exists
|||||| {C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" "Microsoft Corporation" C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\msoshext.dll File exists
|||||| {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll File exists
|||||| {087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll File exists
|||||| {63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll File exists
|||||| {3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll File exists
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" File not found | COM-object registry key not found
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" File not found | COM-object registry key not found
|||||| {45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" "Avira GmbH" C:\Program Files\Avira\AntiVir Desktop\shlext.dll File exists
|||||| {5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" "Advanced Micro Devices, Inc." C:\Program Files\ATI\ATI.ACE\Core-Static\atiacmxx.dll File exists
|||||| {B7056B8E-4F99-44f8-8CBD-282390FE5428} "VirtualCloneDrive Shell Extension" "Elaborate Bytes AG" C:\Program Files\Elaborate Bytes\VirtualCloneDrive\ElbyVCDShell.dll File exists
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" File not found | COM-object registry key not found
|||||| {B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" C:\Program Files\WinRAR\rarext.dll File exists
Internet Explorer
HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars
|||| {555D4D79-4BD2-4094-A395-CFC534424A05} "HP Smart Web Printing" "Hewlett-Packard Co." C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll File exists
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
"ITBar7Layout" File not found | COM-object registry key not found
HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units
|||| {8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_20"
hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab "Sun Microsystems, Inc." C:\Program Files\Java\jre6\bin\jp2iexp.dll File exists
|||| {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} "Java Plug-in 1.6.0_20"
hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab "Sun Microsystems, Inc." C:\Program Files\Java\jre6\bin\jp2iexp.dll File exists
|||| {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_20"
hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab "Sun Microsystems, Inc." C:\Program Files\Java\jre6\bin\npjpi160_20.dll File exists
HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars
|||| {555D4D79-4BD2-4094-A395-CFC534424A05} "HP Smart Web Printing" "Hewlett-Packard Co." C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll File exists
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions
|||| {DDE87865-83C5-48c4-8357-2F5B1AA84522} "HP Smart Web Printing ein- oder ausblenden" "Hewlett-Packard Co." C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll File exists
"ICQ6" F:\Program Files\ICQ6.5\ICQ.exe File not found
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
|||||| {18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" "Adobe Systems Incorporated" C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll File exists
|||| {0347C33E-8762-4905-BF09-768834316C61} "HP Print Enhancer" "Hewlett-Packard Co." C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll File exists
|||| {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} "HP Smart BHO Class" "Hewlett-Packard Co." C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll File exists
|||| {DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" "Sun Microsystems, Inc." C:\Program Files\Java\jre6\bin\jp2ssv.dll File exists
Logon
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
|||||| "desktop.ini" C:\Users\Nico\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini File exists
|||| "OpenOffice.org 3.1.lnk" C:\Program Files\OpenOffice.org 3\program\quickstart.exe Shortcut exists | File found, but it contains no detailed information | File exists
"Product Registration.lnk" C:\Users\Nico\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Product Registration.lnk Shortcut exists | File not found
%AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup
|||||| "desktop.ini" C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini File exists
|||| "HP Digital Imaging Monitor.lnk" "Hewlett-Packard Co." C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe Shortcut exists | File exists
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"iTap" C:\Program Files\HLW\iTap\iTap.exe File not found
"RGSC" F:\Programme\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent File not found
"Steam" "f:\programme\steam\steam.exe" -silent File not found
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd
"StartupPrograms" rdpclip File not found
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
|||| "Adobe ARM" "Adobe Systems Incorporated" "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" File exists
|||| "Adobe Reader Speed Launcher" "Adobe Systems Incorporated" "G:\Programme\Adobe Reader\Reader\Reader_sl.exe" File exists
|||||| "avgnt" "Avira GmbH" "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min File exists
|||| "HP Software Update" "Hewlett-Packard" C:\Program Files\HP\HP Software Update\HPWuSchd2.exe File exists
"iTunesHelper" "F:\Programme\iTunes\iTunesHelper.exe" File not found
|||||| "JMB36X IDE Setup" C:\Windows\RaidTool\xInsIDE.exe File found, but it contains no detailed information
"LogMeIn Hamachi Ui" "F:\Programme\Hamachi\hamachi-2-ui.exe" --auto-start File not found
|||| "NeroFilterCheck" "Ahead Software Gmbh" C:\Windows\system32\NeroCheck.exe File exists
|||| "StartCCC" "Advanced Micro Devices, Inc." "C:\Program Files\ATI\ATI.ACE\Core-Static\CLIStart.exe" MSRun File exists
|||| "SunJavaUpdateSched" "Sun Microsystems, Inc." "C:\Program Files\Common Files\Java\Java Update\jusched.exe" File exists
|||| "VirtualCloneDrive" "Elaborate Bytes AG" "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s File exists
Print Monitors
HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors
|||||| "PCL Language Monitor" "Hewlett-Packard Company" C:\Windows\system32\hpz3l692.dll File exists
Services
HKLM\SYSTEM\CurrentControlSet\Services
|||||| "Apple Mobile Device" (Apple Mobile Device) "Apple Inc." C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe File exists
|||||| "Avira AntiVir Guard" (AntiVirService) "Avira GmbH" C:\Program Files\Avira\AntiVir Desktop\avguard.exe File exists
|||||| "Avira AntiVir Planer" (AntiVirSchedulerService) "Avira GmbH" C:\Program Files\Avira\AntiVir Desktop\sched.exe File exists
|||||| "Bonjour-Dienst" (Bonjour Service) "Apple Inc." C:\Program Files\Bonjour\mDNSResponder.exe File exists
|||||| "HP CUE DeviceDiscovery Service" (hpqddsvc) "Hewlett-Packard Co." C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll File exists
|||||| "hpqcxs08" (hpqcxs08) "Hewlett-Packard Co." C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll File exists
|||||| "iPod-Dienst" (iPod Service) "Apple Inc." C:\Program Files\iPod\bin\iPodService.exe File exists
"LogMeIn Hamachi 2.0 Tunneling Engine" (Hamachi2Svc) F:\Programme\Hamachi\hamachi-2.exe -s File not found
|||||| "Net Driver HPZ12" (Net Driver HPZ12) "Hewlett-Packard" C:\Windows\system32\HPZinw12.dll File exists
|||| "nProtect GameGuard Service" (npggsvc) "INCA Internet Co., Ltd." C:\Windows\system32\GameMon.des File exists
|||||| "Office Source Engine" (ose) "Microsoft Corporation" C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE File exists
|||||| "Pml Driver HPZ12" (Pml Driver HPZ12) "Hewlett-Packard" C:\Windows\system32\HPZipm12.dll File exists
|||||| "PnkBstrA" (PnkBstrA) C:\Windows\system32\PnkBstrA.exe File found, but it contains no detailed information
"PnkBstrB" (PnkBstrB) C:\Windows\system32\PnkBstrB.exe File found, but it contains no detailed information
|||||| "Steam Client Service" (Steam Client Service) "Valve Corporation" C:\Program Files\Common Files\Steam\SteamService.exe File exists
Winsock Providers
HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries
|||||| "mdnsNSP" "Apple Inc." C:\Program Files\Bonjour\mdnsNSP.dll File exists

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Darkfilter · 25.05.2010, 20:29

Sry, da es länger gedauert hat, habe ich es erst jetzt ausgeführt nun hier: (Soll ich jetzt noch einmal OTL ausführen?)
Gruß Nico

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4142

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18904

25.05.2010 21:25:02
mbam-log-2010-05-25 (21-25-02).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|G:\|)
Durchsuchte Objekte: 530080
Laufzeit: 1 Stunde(n), 48 Minute(n), 43 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 1
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 6
Infizierte Dateien: 9

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\WS9E3IQBKY (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rthdbpl (Trojan.Agent) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
C:\ProgramData\MPK (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\ProgramData\MPK\1 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D} (Trojan.Swisyn) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}\chrome (Trojan.Swisyn) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}\chrome\content (Trojan.Swisyn) -> Quarantined and deleted successfully.
C:\Users\Nico\AppData\Roaming\SystemProc (Trojan.Agent) -> Quarantined and deleted successfully.

Infizierte Dateien:
C:\System Volume Information\_restore{9A487E93-5CF2-48B1-8774-5D5682EECE5E}\RP103\A0025076.dll (Keylogger.PerfectKeylogger) -> Quarantined and deleted successfully.
C:\ProgramData\MPK\M0000 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\ProgramData\MPK\S0000 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\ProgramData\MPK\1\D0000 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\ProgramData\MPK\1\S0000 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}\chrome.manifest (Trojan.Swisyn) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}\install.rdf (Trojan.Swisyn) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}\chrome\content\timer.xul (Trojan.Swisyn) -> Quarantined and deleted successfully.
C:\Windows\System32\h@tkeysh@@k.dll (Trojan.Agent) -> Quarantined and deleted successfully.

cosinus · 25.05.2010, 20:51

Ja, ein frisches OTL-Log wäre gut, da sich durch Malwarebytes ja wieder das System verändert hat.

Darkfilter · 25.05.2010, 21:55

So, ich hoffe jetzt ist alles vorhanden was Du benötigst

OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 25.05.2010 22:52:08 - Run 2
OTL by OldTimer - Version 3.2.5.0     Folder = C:\Users\Nico\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18904)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 64,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 82,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 698,63 Gb Total Space | 454,65 Gb Free Space | 65,08% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
Drive G: | 465,76 Gb Total Space | 224,36 Gb Free Space | 48,17% Space Free | Partition Type: NTFS
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: NICO-PC
Current User Name: Nico
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Nico\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Windows\System32\atieclxx.exe (AMD)
PRC - C:\Windows\System32\atiesrxx.exe (AMD)
PRC - G:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Program Files\ATI\ATI.ACE\Core-Static\MOM.exe (Advanced Micro Devices Inc.)
PRC - C:\Program Files\ATI\ATI.ACE\Core-Static\CCC.exe (ATI Technologies Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Nico\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (Hamachi2Svc) --  File not found
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AMD External Events Utility) -- C:\Windows\System32\atiesrxx.exe (AMD)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (npggsvc) -- C:\Windows\System32\GameMon.des (INCA Internet Co., Ltd.)
SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (amdkmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (amdkmdap) -- C:\Windows\System32\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV - (AtiHdmiService) -- C:\Windows\System32\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (SSHDRV61) -- C:\Windows\System32\drivers\SSHDRV61.sys ()
DRV - (hamachi) -- C:\Windows\System32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (SSHDRV76) -- C:\Windows\System32\drivers\SSHDRV76.sys ()
DRV - (SSHDRV51) -- C:\Windows\System32\drivers\SSHDRV51.sys ()
DRV - (SSHDRV52) -- C:\Windows\System32\drivers\SSHDRV52.sys ()
DRV - (StarOpen) -- C:\Windows\System32\drivers\StarOpen.sys ()
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\Windows\System32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (VClone) -- C:\Windows\System32\drivers\VClone.sys (Elaborate Bytes AG)
DRV - (ElbyCDIO) -- C:\Windows\System32\drivers\ElbyCDIO.sys (Elaborate Bytes AG)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (JRAID) -- C:\Windows\system32\DRIVERS\jraid.sys (JMicron Technology Corp.)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation                                            )
DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (NPPTNT2) -- C:\Windows\System32\npptNT2.sys (INCA Internet Co., Ltd.)
DRV - (prohlp02) -- C:\Windows\System32\drivers\prohlp02.sys (Protection Technology)
DRV - (prodrv06) -- C:\Windows\System32\drivers\prodrv06.sys (Protection Technology)
DRV - (prosync1) -- C:\Windows\System32\drivers\prosync1.sys (Protection Technology)
DRV - (TIEHDUSB) -- C:\Windows\System32\drivers\tiehdusb.sys (Texas Instruments Incorporated)
DRV - (sfhlp01) -- C:\Windows\System32\drivers\sfhlp01.sys (Protection Technology)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = DA 4E EF 96 36 0A CA 01  [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: autopager@mozilla.org:0.6.0.26
FF - prefs.js..extensions.enabledItems: smartwebprinting@hp.com:4.60
FF - prefs.js..extensions.enabledItems: NPDyyno@dyyno.com:1.0.0.24
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
 
FF - HKLM\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.02.11 21:29:20 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Components: F:\Programme\Mozilla Firefox\components
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Plugins: F:\Programme\Mozilla Firefox\plugins
 
[2009.04.29 20:00:21 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\mozilla\Extensions
[2010.05.25 18:25:54 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\mozilla\Firefox\Profiles\yv8unz8k.default\extensions
[2010.04.28 17:11:40 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Nico\AppData\Roaming\mozilla\Firefox\Profiles\yv8unz8k.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.04.28 17:11:40 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\mozilla\Firefox\Profiles\yv8unz8k.default\extensions\autopager@mozilla.org
[2009.06.14 21:37:11 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\mozilla\Firefox\Profiles\yv8unz8k.default\extensions\NPDyyno@dyyno.com
[2010.05.25 21:25:02 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] G:\Programme\Adobe Reader\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [hpqSRMon]  File not found
O4 - HKLM..\Run: [iTunesHelper] F:\Programme\iTunes\iTunesHelper.exe File not found
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] F:\Programme\Hamachi\hamachi-2-ui.exe File not found
O4 - HKLM..\Run: [NeroFilterCheck] C:\Windows\System32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [VirtualCloneDrive] C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [iTap] C:\Program Files\HLW\iTap\iTap.exe File not found
O4 - HKCU..\Run: [RGSC] F:\Programme\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe File not found
O4 - HKCU..\Run: [Steam] f:\programme\steam\steam.exe File not found
O4 - Startup: C:\Users\Nico\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Users\Nico\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Product Registration.lnk = C:\Users\Nico\AppData\Local\Temp\is-OANTQ.tmp\ATR1.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: AllowLegacyWebView = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: AllowUnhashedWebView = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O9 - Extra Button: HP Smart Web Printing ein- oder ausblenden - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - F:\Program Files\ICQ6.5\ICQ.exe File not found
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - F:\Program Files\ICQ6.5\ICQ.exe File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Public\Pictures\Sample Pictures\Desert Landscape.jpg
O24 - Desktop BackupWallPaper: C:\Users\Public\Pictures\Sample Pictures\Desert Landscape.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{0320e36e-7b6d-11de-9936-002185c17f27}\Shell - "" = AutoRun
O33 - MountPoints2\{0320e36e-7b6d-11de-9936-002185c17f27}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -- File not found
O33 - MountPoints2\{7daf253f-0eba-11df-beb7-002185c17f27}\Shell\AutoRun\command - "" = G:\Menu.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.05.25 18:33:17 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Roaming\Malwarebytes
[2010.05.25 18:33:09 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.05.25 18:33:07 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.05.25 18:33:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.05.23 23:25:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2010.05.23 23:25:01 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2010.05.23 23:24:45 | 000,411,368 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\deployJava1.dll
[2010.05.23 23:24:45 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2010.05.23 23:24:45 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2010.05.23 23:24:45 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2010.05.17 21:46:04 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\My Games
[2010.05.17 21:40:58 | 000,000,000 | ---D | C] -- C:\Program Files\2K Games
[2010.05.16 16:08:54 | 000,000,000 | ---D | C] -- C:\Die Sims 2
[2010.05.16 16:03:49 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\World in Conflict
[2010.05.16 16:03:38 | 000,000,000 | ---D | C] -- C:\Users\Nico\Documents\World in Conflict
[2010.05.16 15:48:02 | 000,000,000 | ---D | C] -- C:\Program Files\Sierra Games
[2010.05.15 20:59:25 | 000,000,000 | ---D | C] -- C:\Users\Nico\Documents\BFBC2
[2010.05.15 20:43:02 | 001,974,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_42.dll
[2010.05.15 20:43:02 | 000,515,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_5.dll
[2010.05.15 20:43:02 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_5.dll
[2010.05.15 20:43:02 | 000,000,000 | ---D | C] -- C:\Program Files\Electronic Arts
[2010.05.15 20:43:01 | 005,501,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dcsx_42.dll
[2010.05.15 20:43:01 | 001,892,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_42.dll
[2010.05.15 20:43:01 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_42.dll
[2010.05.15 20:43:01 | 000,235,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx11_42.dll
[2010.05.15 20:43:00 | 000,069,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_3.dll
[2010.05.15 20:42:59 | 000,514,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_3.dll
[2010.05.15 20:42:59 | 000,235,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_3.dll
[2010.05.15 20:42:59 | 000,070,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_2.dll
[2010.05.15 20:42:59 | 000,023,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_5.dll
[2010.05.13 13:51:01 | 000,000,000 | ---D | C] -- C:\Users\Nico\Documents\RCT3
[2010.05.13 13:51:01 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Roaming\Atari
[2010.05.13 13:50:20 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Roaming\vlc
[2010.05.13 13:41:50 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Roaming\Leadertech
[2010.05.12 22:17:39 | 000,000,000 | ---D | C] -- C:\Users\Nico\Documents\NIKITA
[2010.05.12 22:17:29 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\NIKITA
[2010.05.03 13:28:22 | 000,000,000 | ---D | C] -- C:\Phenomedia AG
[2010.04.28 22:44:54 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2010.04.28 22:04:43 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Roaming\HPAppData
[2010.04.27 16:01:52 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
 
========== Files - Modified Within 30 Days ==========
 
[2010.05.25 22:53:00 | 000,000,420 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{8D9D19FD-3BB5-49B2-A216-4F4719AB1F71}.job
[2010.05.25 22:52:18 | 002,883,584 | -HS- | M] () -- C:\Users\Nico\NTUSER.DAT
[2010.05.25 21:32:44 | 001,418,806 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010.05.25 21:32:44 | 000,618,204 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2010.05.25 21:32:44 | 000,586,980 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.05.25 21:32:44 | 000,122,636 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2010.05.25 21:32:44 | 000,101,052 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.05.25 21:26:54 | 000,005,952 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.05.25 21:26:54 | 000,005,952 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.05.25 21:26:50 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.05.25 21:26:46 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.05.25 21:25:45 | 000,065,536 | -HS- | M] () -- C:\Users\Nico\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010.05.25 21:25:44 | 002,127,119 | -H-- | M] () -- C:\Users\Nico\AppData\Local\IconCache.db
[2010.05.25 21:25:44 | 000,524,288 | -HS- | M] () -- C:\Users\Nico\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2010.05.25 18:33:11 | 000,000,621 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.05.24 15:12:02 | 000,002,379 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2010.05.23 16:27:12 | 000,000,116 | ---- | M] () -- C:\Windows\NeroDigital.ini
[2010.05.23 13:25:09 | 000,000,312 | ---- | M] () -- C:\Windows\tasks\WebReg HP Photosmart C5300 series.job
[2010.05.23 02:31:05 | 000,139,128 | ---- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2010.05.23 01:19:17 | 000,215,128 | ---- | M] () -- C:\Windows\System32\PnkBstrB.xtr
[2010.05.22 01:39:14 | 309,498,610 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2010.05.17 21:52:28 | 000,001,337 | ---- | M] () -- C:\Users\Nico\Desktop\Civilization 4 - Colonization.lnk
[2010.05.16 15:57:43 | 000,000,801 | ---- | M] () -- C:\Users\Nico\Desktop\World in Conflict.lnk
[2010.05.15 20:58:49 | 000,001,104 | ---- | M] () -- C:\Users\Nico\Desktop\Battlefield Bad Company 2.lnk
[2010.05.15 20:57:42 | 000,138,056 | ---- | M] () -- C:\Users\Nico\AppData\Roaming\PnkBstrK.sys
[2010.05.15 20:57:26 | 002,434,856 | ---- | M] () -- C:\Windows\System32\pbsvc_bc2.exe
[2010.05.13 13:42:15 | 000,000,989 | ---- | M] () -- C:\Users\Nico\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Product Registration.lnk
[2010.05.13 13:40:51 | 000,000,697 | ---- | M] () -- C:\Users\Public\Desktop\RollerCoaster Tycoon 3.lnk
[2010.05.12 21:46:53 | 000,024,576 | ---- | M] () -- C:\Users\Nico\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.05.12 11:21:16 | 000,221,568 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
[2010.05.05 22:31:56 | 000,000,009 | ---- | M] () -- C:\Windows\pbase.dat
[2010.05.05 22:31:56 | 000,000,008 | ---- | M] () -- C:\Windows\npbase.dat
[2010.05.05 22:31:56 | 000,000,003 | ---- | M] () -- C:\Windows\ver.dat
[2010.04.29 12:19:24 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.04.29 12:19:14 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.04.28 22:44:33 | 000,272,168 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010.04.28 22:24:06 | 000,000,680 | ---- | M] () -- C:\Users\Nico\AppData\Local\d3d9caps.dat
 
========== Files Created - No Company Name ==========
 
[2010.05.25 18:33:11 | 000,000,621 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.05.23 13:25:08 | 000,000,312 | ---- | C] () -- C:\Windows\tasks\WebReg HP Photosmart C5300 series.job
[2010.05.22 01:39:14 | 309,498,610 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2010.05.17 21:51:37 | 000,001,337 | ---- | C] () -- C:\Users\Nico\Desktop\Civilization 4 - Colonization.lnk
[2010.05.16 15:57:16 | 000,000,801 | ---- | C] () -- C:\Users\Nico\Desktop\World in Conflict.lnk
[2010.05.15 20:58:28 | 000,001,104 | ---- | C] () -- C:\Users\Nico\Desktop\Battlefield Bad Company 2.lnk
[2010.05.15 20:57:42 | 000,138,056 | ---- | C] () -- C:\Users\Nico\AppData\Roaming\PnkBstrK.sys
[2010.05.15 20:57:26 | 002,434,856 | ---- | C] () -- C:\Windows\System32\pbsvc_bc2.exe
[2010.05.13 13:42:15 | 000,000,989 | ---- | C] () -- C:\Users\Nico\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Product Registration.lnk
[2010.05.13 13:40:51 | 000,000,697 | ---- | C] () -- C:\Users\Public\Desktop\RollerCoaster Tycoon 3.lnk
[2010.04.07 03:22:08 | 000,023,040 | ---- | C] () -- C:\Windows\System32\atitmpxx.dll
[2010.03.05 02:11:22 | 000,041,872 | ---- | C] () -- C:\Windows\System32\xfcodec.dll
[2010.02.04 16:53:07 | 001,970,176 | ---- | C] () -- C:\Windows\System32\d3dx9.dll
[2010.01.22 23:01:19 | 000,000,083 | ---- | C] () -- C:\Windows\WA.INI
[2009.11.28 12:19:53 | 000,000,040 | ---- | C] () -- C:\Windows\WeatherSet.ini
[2009.11.27 22:42:38 | 000,036,864 | ---- | C] () -- C:\Windows\System32\drivers\SSHDRV61.sys
[2009.10.16 13:54:05 | 000,000,280 | ---- | C] () -- C:\Windows\game.ini
[2009.09.25 19:17:47 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.09.07 20:37:01 | 000,000,004 | ---- | C] () -- C:\Windows\info147.sys
[2009.09.07 20:06:19 | 000,053,760 | ---- | C] () -- C:\Windows\System32\drivers\SSHDRV76.sys
[2009.09.06 18:52:02 | 000,021,504 | ---- | C] () -- C:\Windows\System32\drivers\SSHDRV51.sys
[2009.09.06 13:42:20 | 000,029,184 | ---- | C] () -- C:\Windows\System32\drivers\SSHDRV52.sys
[2009.08.02 12:41:22 | 000,000,116 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2009.07.17 14:19:55 | 000,005,632 | ---- | C] () -- C:\Windows\System32\drivers\StarOpen.sys
[2009.07.07 21:31:32 | 000,144,384 | ---- | C] () -- C:\Windows\System32\miccyhook.dll
[2009.06.12 18:38:11 | 000,139,128 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2009.05.17 18:15:47 | 000,000,510 | ---- | C] () -- C:\Windows\WORDPAD.INI
[2007.08.07 19:22:22 | 000,141,180 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[1997.11.17 18:13:16 | 000,010,240 | ---- | C] () -- C:\Windows\System32\vidx16.dll
[1997.06.14 10:56:08 | 000,056,832 | ---- | C] () -- C:\Windows\System32\iyvu9_32.dll
< End of report >

Darkfilter · 30.05.2010, 21:52

Hier das Logfile von ComboFix

Combofix Logfile:

Code:

ATTFilter

ComboFix 10-05-29.05 - Nico 30.05.2010  22:38:12.1.4 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3070.2000 [GMT 2:00]
ausgeführt von:: c:\users\Nico\Desktop\cofi.exe.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.

G:\install.exe

.
(((((((((((((((((((((((   Dateien erstellt von 2010-04-28 bis 2010-05-30  ))))))))))))))))))))))))))))))
.

2010-05-30 20:45 . 2010-05-30 20:46	--------	d-----w-	c:\users\Nico\AppData\Local\temp
2010-05-30 20:45 . 2010-05-30 20:45	--------	d-----w-	c:\users\Mama\AppData\Local\temp
2010-05-30 20:45 . 2010-05-30 20:45	--------	d-----w-	c:\users\Default\AppData\Local\temp
2010-05-29 20:36 . 2010-05-29 20:36	--------	d-----w-	c:\users\Nico\AppData\Roaming\HPAppData
2010-05-26 10:12 . 2010-04-23 14:13	2048	----a-w-	c:\windows\system32\tzres.dll
2010-05-25 16:33 . 2010-05-25 16:33	--------	d-----w-	c:\users\Nico\AppData\Roaming\Malwarebytes
2010-05-25 16:33 . 2010-04-29 10:19	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-05-25 16:33 . 2010-05-25 16:33	--------	d-----w-	c:\programdata\Malwarebytes
2010-05-25 16:33 . 2010-04-29 10:19	20952	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-05-23 21:25 . 2010-05-23 21:25	--------	d-----w-	c:\program files\Common Files\Java
2010-05-23 21:24 . 2010-04-12 15:29	411368	----a-w-	c:\windows\system32\deployJava1.dll
2010-05-17 19:46 . 2010-05-17 19:46	--------	d-----w-	c:\users\Nico\AppData\Local\My Games
2010-05-17 19:40 . 2010-05-17 19:40	--------	d-----w-	c:\program files\2K Games
2010-05-16 14:08 . 2010-05-16 14:17	--------	d-----w-	C:\Die Sims 2
2010-05-16 14:03 . 2010-05-16 14:03	--------	d-----w-	c:\users\Nico\AppData\Local\World in Conflict
2010-05-16 13:48 . 2010-05-16 14:03	--------	d-----w-	c:\program files\Sierra Games
2010-05-15 18:57 . 2010-05-15 18:57	138056	----a-w-	c:\users\Nico\AppData\Roaming\PnkBstrK.sys
2010-05-15 18:57 . 2010-05-15 18:57	2434856	----a-w-	c:\windows\system32\pbsvc_bc2.exe
2010-05-15 18:43 . 2010-05-15 18:43	--------	d-----w-	c:\program files\Electronic Arts
2010-05-15 18:43 . 2009-09-04 15:44	515416	----a-w-	c:\windows\system32\XAudio2_5.dll
2010-05-15 18:43 . 2009-09-04 15:44	238936	----a-w-	c:\windows\system32\xactengine3_5.dll
2010-05-15 18:43 . 2009-09-04 15:29	1974616	----a-w-	c:\windows\system32\D3DCompiler_42.dll
2010-05-15 18:43 . 2009-09-04 15:29	453456	----a-w-	c:\windows\system32\d3dx10_42.dll
2010-05-15 18:43 . 2009-09-04 15:29	235344	----a-w-	c:\windows\system32\d3dx11_42.dll
2010-05-15 18:43 . 2009-09-04 15:29	5501792	----a-w-	c:\windows\system32\d3dcsx_42.dll
2010-05-15 18:43 . 2009-09-04 15:29	1892184	----a-w-	c:\windows\system32\D3DX9_42.dll
2010-05-15 18:43 . 2009-09-04 15:44	69464	----a-w-	c:\windows\system32\XAPOFX1_3.dll
2010-05-15 18:42 . 2008-10-27 08:04	514384	----a-w-	c:\windows\system32\XAudio2_3.dll
2010-05-15 18:42 . 2008-10-27 08:04	235856	----a-w-	c:\windows\system32\xactengine3_3.dll
2010-05-15 18:42 . 2008-10-27 08:04	23376	----a-w-	c:\windows\system32\X3DAudio1_5.dll
2010-05-15 18:42 . 2008-10-27 08:04	70992	----a-w-	c:\windows\system32\XAPOFX1_2.dll
2010-05-15 16:34 . 2010-05-15 16:34	--------	d-----w-	c:\users\Mama\AppData\Roaming\HPAppData
2010-05-13 11:51 . 2010-05-13 11:51	--------	d-----w-	c:\users\Nico\AppData\Roaming\Atari
2010-05-13 11:50 . 2010-05-28 20:06	--------	d-----w-	c:\users\Nico\AppData\Roaming\vlc
2010-05-13 11:41 . 2010-05-13 11:41	--------	d-----w-	c:\users\Nico\AppData\Roaming\Leadertech
2010-05-12 19:25 . 2010-01-29 15:40	738816	----a-w-	c:\windows\system32\inetcomm.dll
2010-05-11 18:37 . 2010-05-11 18:37	41872	----a-w-	c:\windows\system32\xfcodec.dll
2010-05-03 11:28 . 2010-05-03 11:28	--------	d-----w-	C:\Phenomedia AG

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-30 20:15 . 2009-05-28 19:25	1	----a-w-	c:\users\Nico\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-05-30 20:15 . 2009-04-29 18:02	--------	d-----w-	c:\users\Nico\AppData\Roaming\Xfire
2010-05-30 20:07 . 2009-11-15 16:53	--------	d-----w-	c:\users\Nico\AppData\Roaming\Skype
2010-05-30 19:21 . 2009-06-12 16:38	137464	----a-w-	c:\windows\system32\drivers\PnkBstrK.sys
2010-05-30 19:21 . 2009-06-12 16:38	214520	----a-w-	c:\windows\system32\PnkBstrB.exe
2010-05-30 16:52 . 2009-11-15 16:55	--------	d-----w-	c:\users\Nico\AppData\Roaming\skypePM
2010-05-30 15:35 . 2008-01-21 07:15	618204	----a-w-	c:\windows\system32\perfh007.dat
2010-05-30 15:35 . 2008-01-21 07:15	122636	----a-w-	c:\windows\system32\perfc007.dat
2010-05-30 15:29 . 2009-04-29 18:02	--------	d-----w-	c:\programdata\Xfire
2010-05-29 21:47 . 2009-03-01 15:56	--------	d---a-w-	c:\program files\WoW
2010-05-23 21:24 . 2009-05-09 18:29	--------	d-----w-	c:\program files\Java
2010-05-17 19:42 . 2009-04-29 17:34	--------	d--h--w-	c:\program files\InstallShield Installation Information
2010-05-16 14:22 . 2009-08-02 10:40	--------	d-----w-	c:\program files\EA GAMES
2010-05-16 13:56 . 2009-05-18 13:16	--------	d-----w-	c:\programdata\Media Center Programs
2010-05-15 18:57 . 2009-06-05 12:50	75064	----a-w-	c:\windows\system32\PnkBstrA.exe
2010-05-15 16:43 . 2009-08-25 07:32	1	----a-w-	c:\users\Mama\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-05-12 19:49 . 2006-11-02 11:18	--------	d-----w-	c:\program files\Windows Mail
2010-05-12 09:21 . 2009-10-02 16:32	221568	------w-	c:\windows\system32\MpSigStub.exe
2010-05-08 15:44 . 2009-08-28 15:36	--------	d-----w-	c:\users\Nico\AppData\Roaming\HpUpdate
2010-05-06 18:43 . 2009-04-29 17:52	--------	d-----w-	c:\users\Nico\AppData\Roaming\teamspeak2
2010-05-05 20:31 . 2009-12-24 01:13	9	----a-w-	c:\windows\pbase.dat
2010-05-05 20:31 . 2009-12-24 01:13	8	----a-w-	c:\windows\npbase.dat
2010-05-05 20:31 . 2009-12-24 01:13	3	----a-w-	c:\windows\ver.dat
2010-04-29 18:34 . 2009-04-29 17:13	--------	d-----w-	c:\program files\ATI
2010-04-28 20:44 . 2010-04-28 20:44	--------	d-----w-	c:\programdata\ATI
2010-04-28 20:24 . 2010-02-11 21:37	680	----a-w-	c:\users\Nico\AppData\Local\d3d9caps.dat
2010-04-27 14:01 . 2010-02-24 14:48	--------	d-----w-	c:\program files\MSECache
2010-04-25 11:36 . 2010-04-25 11:36	3584	----a-r-	c:\users\Nico\AppData\Roaming\Microsoft\Installer\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}\Icon386ED4E3.exe
2010-04-25 11:36 . 2010-04-25 11:36	--------	d-----w-	c:\program files\Windows Installer Clean Up
2010-04-25 10:54 . 2009-07-17 12:05	--------	d-----w-	c:\program files\Common Files\Adobe
2010-04-24 16:24 . 2010-04-24 16:20	--------	d-----w-	c:\users\Nico\AppData\Roaming\Sony
2010-04-24 16:23 . 2010-04-24 16:23	--------	d-----w-	c:\program files\Common Files\Sony Shared
2010-04-24 16:22 . 2010-04-24 16:22	10134	----a-r-	c:\users\Nico\AppData\Roaming\Microsoft\Installer\{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}\ARPPRODUCTICON.exe
2010-04-24 16:22 . 2010-04-24 16:22	--------	d-----w-	c:\program files\Sony
2010-04-24 16:22 . 2010-04-24 16:22	--------	d-----w-	c:\programdata\Sony Corporation
2010-04-23 21:14 . 2010-04-23 21:14	--------	d-----w-	c:\users\Nico\AppData\Roaming\Avira
2010-04-23 21:13 . 2010-04-23 21:13	--------	d-----w-	c:\programdata\Avira
2010-04-23 21:07 . 2009-04-29 19:44	--------	d-----w-	c:\program files\Bonjour
2010-04-23 20:58 . 2009-08-22 17:19	--------	d-----w-	c:\program files\Common Files\DVDVideoSoft
2010-04-23 20:52 . 2009-05-09 09:51	--------	d-----w-	c:\program files\Common Files\Wise Installation Wizard
2010-04-20 18:25 . 2010-04-20 18:25	--------	d-----w-	c:\program files\Common Files\Skype
2010-04-16 14:29 . 2009-05-22 16:24	196608	----a-w-	c:\users\Nico\AppData\Roaming\Acreon\WowMatrix\Libraries\wmweb.dll
2010-04-16 14:29 . 2009-05-22 16:24	258048	----a-w-	c:\users\Nico\AppData\Roaming\Acreon\WowMatrix\Libraries\wmzip.dll
2010-04-07 02:43 . 2010-04-07 02:43	5430272	----a-w-	c:\windows\system32\drivers\atikmdag.sys
2010-04-07 02:16 . 2010-04-07 02:16	143360	----a-w-	c:\windows\system32\atiapfxx.exe
2010-04-07 02:16 . 2010-04-07 02:16	489472	----a-w-	c:\windows\system32\aticfx32.dll
2010-04-07 02:13 . 2010-04-07 02:13	446464	----a-w-	c:\windows\system32\ATIDEMGX.dll
2010-04-07 02:12 . 2010-04-07 02:12	372736	----a-w-	c:\windows\system32\atieclxx.exe
2010-04-07 02:12 . 2010-04-07 02:12	14321664	----a-w-	c:\windows\system32\atioglxx.dll
2010-04-07 02:12 . 2010-04-07 02:12	172032	----a-w-	c:\windows\system32\atiesrxx.exe
2010-04-07 02:10 . 2010-04-07 02:10	159744	----a-w-	c:\windows\system32\atitmmxx.dll
2010-04-07 02:10 . 2010-04-07 02:10	356352	----a-w-	c:\windows\system32\atipdlxx.dll
2010-04-07 02:10 . 2010-04-07 02:10	278528	----a-w-	c:\windows\system32\Oemdspif.dll
2010-04-07 02:10 . 2010-04-07 02:10	11776	----a-w-	c:\windows\system32\atimuixx.dll
2010-04-07 02:10 . 2010-04-07 02:10	43520	----a-w-	c:\windows\system32\ati2edxx.dll
2010-04-07 02:06 . 2010-04-07 02:06	3164160	----a-w-	c:\windows\system32\atidxx32.dll
2010-04-07 01:46 . 2010-04-07 01:46	50176	----a-w-	c:\windows\system32\coinst.dll
2010-04-07 01:40 . 2010-04-07 01:40	3707904	----a-w-	c:\windows\system32\atiumdag.dll
2010-04-07 01:40 . 2010-04-07 01:40	53248	----a-w-	c:\windows\system32\aticalrt.dll
2010-04-07 01:40 . 2010-04-07 01:40	53248	----a-w-	c:\windows\system32\aticalcl.dll
2010-04-07 01:38 . 2010-04-07 01:38	4018176	----a-w-	c:\windows\system32\aticaldd.dll
2010-04-07 01:23 . 2010-04-07 01:23	237568	----a-w-	c:\windows\system32\atiadlxx.dll
2010-04-07 01:23 . 2010-04-07 01:23	12800	----a-w-	c:\windows\system32\atiglpxx.dll
2010-04-07 01:23 . 2010-04-07 01:23	14848	----a-w-	c:\windows\system32\atigktxx.dll
2010-04-07 01:23 . 2010-04-07 01:23	157184	----a-w-	c:\windows\system32\drivers\atikmpag.sys
2010-04-07 01:22 . 2010-04-07 01:22	28160	----a-w-	c:\windows\system32\atiuxpag.dll
2010-04-07 01:22 . 2010-04-07 01:22	20480	----a-w-	c:\windows\system32\atiu9pag.dll
2010-04-07 01:22 . 2010-04-07 01:22	23040	----a-w-	c:\windows\system32\atitmpxx.dll
2010-04-07 01:22 . 2010-04-07 01:22	53248	----a-w-	c:\windows\system32\drivers\ati2erec.dll
2010-04-07 01:21 . 2010-04-07 01:21	2983936	----a-w-	c:\windows\system32\atiumdva.dll
2010-04-07 01:08 . 2010-04-07 01:08	52224	----a-w-	c:\windows\system32\atimpc32.dll
2010-04-07 01:08 . 2010-04-07 01:08	52224	----a-w-	c:\windows\system32\amdpcom32.dll
2010-04-02 16:09 . 2010-04-02 16:09	2023	----a-w-	c:\windows\system32\atipblag.dat
2010-03-22 10:25 . 2009-05-03 17:02	61736	----a-w-	c:\users\Mama\AppData\Local\GDIPFONTCACHEV1.DAT
2010-03-17 15:06 . 2010-03-17 15:06	202234	----a-w-	c:\windows\system32\atiicdxx.dat
2010-03-09 10:20 . 2010-03-09 10:20	104464	----a-w-	c:\windows\system32\drivers\AtiHdmi.sys
2010-03-05 14:01 . 2010-04-16 13:17	420352	----a-w-	c:\windows\system32\vbscript.dll
.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"RtHDVCpl"="RtHDVCpl.exe" [2008-07-03 6266880]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-03-25 49152]
"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-01-29 52392]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Adobe Reader Speed Launcher"="g:\programme\Adobe Reader\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
"StartCCC"="c:\program files\ATI\ATI.ACE\Core-Static\CLIStart.exe" [2010-04-06 102400]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

c:\users\Mama\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-4-16 384000]

c:\users\Nico\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-4-16 384000]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 22:08	417792	----a-w-	c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):cc,27,92,6f,61,40,ca,01

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-442773238-3665067095-4225304131-1000]
"EnableNotifications"=dword:00000001
"EnableNotificationsRef"=dword:00000001

R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;f:\programme\Hamachi\hamachi-2.exe [x]
R3 cdrmkaun;cdrmkaun;c:\users\Nico\AppData\Local\Temp\cdrmkaun.sys [x]
R3 DBKDRVR54;DBKDRVR54;f:\program files\Cheat Engine\dbk32.sys [x]
R3 dump_wmimmc;dump_wmimmc;f:\programme\Cossfire\CrossFire\GameGuard\dump_wmimmc.sys [x]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2009-05-06 2785582]
R3 PCD52X2;PCD52X2;c:\users\Nico\AppData\Local\Temp\PCD52X2.sys [x]
R3 PCD52X3;PCD52X3;c:\users\Nico\AppData\Local\Temp\PCD52X3.sys [x]
R3 PCD61X2;PCD61X2;c:\users\Nico\AppData\Local\Temp\PCD61X2.sys [x]
R3 PCD61X3;PCD61X3;c:\users\Nico\AppData\Local\Temp\PCD61X3.sys [x]
S1 SSHDRV51;SSHDRV51;c:\windows\system32\drivers\SSHDRV51.sys [2009-09-06 21504]
S1 SSHDRV52;SSHDRV52;c:\windows\system32\drivers\SSHDRV52.sys [2009-09-06 29184]
S1 SSHDRV76;SSHDRV76;c:\windows\system32\drivers\SSHDRV76.sys [2009-09-07 53760]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-04-07 172032]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-02-24 135336]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-04-07 5430272]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-04-07 157184]


--- Andere Dienste/Treiber im Speicher ---

*Deregistered* - avgntflt

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
.
Inhalt des "geplante Tasks" Ordners

2010-05-30 c:\windows\Tasks\User_Feed_Synchronization-{8D9D19FD-3BB5-49B2-A216-4F4719AB1F71}.job
- c:\windows\system32\msfeedssync.exe [2010-03-30 04:54]

2010-05-26 c:\windows\Tasks\WebReg HP Photosmart C5300 series.job
- c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2008-03-25 18:42]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

HKCU-Run-RGSC - f:\programme\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe
HKCU-Run-Steam - f:\programme\steam\steam.exe
HKLM-Run-hpqSRMon - (no file)
HKLM-Run-iTunesHelper - f:\programme\iTunes\iTunesHelper.exe
HKLM-Run-LogMeIn Hamachi Ui - f:\programme\Hamachi\hamachi-2-ui.exe
MSConfigStartUp-AppleSyncNotifier - c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
MSConfigStartUp-iTunesHelper - f:\program files\iTunes\iTunesHelper.exe
MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe
AddRemove-Cheat Engine 5.4_is1 - f:\programme\Cheat Engine\unins000.exe
AddRemove-Company of Heroes - f:\programme\THQ\Company of Heroes\Uninstall_German.exe
AddRemove-Free Video to iPod Converter_is1 - f:\programme\Free Video to iPod Converter\unins000.exe
AddRemove-ImgBurn - f:\programme\ImgBurn\uninstall.exe
AddRemove-Metin2_is1 - f:\programme\Metin2\unins000.exe
AddRemove-Mozilla Firefox (3.5.9) - f:\programme\Mozilla Firefox\uninstall\helper.exe
AddRemove-Nero - Burning Rom!UninstallKey - f:\programme\Ahead\Nero\nero\uninstall\UNNERO.exe
AddRemove-Steam App 240 - f:\program files\Steam\steam.exe
AddRemove-Teamspeak 2 RC2_is1 - f:\program files\Teamspeak2_RC2\unins000.exe
AddRemove-{B7050CBDB2504B34BC2A9CA0A692CC29} - f:\programme\DivX\DivXWebPlayerUninstall.exe
AddRemove-TeamSpeak 3 Client - f:\programme\Teamspeak3\uninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-05-30 22:46
Windows 6.0.6002 Service Pack 2 NTFS

Scanne versteckte Prozesse... 

Scanne versteckte Autostarteinträge... 

Scanne versteckte Dateien... 


c:\users\Nico\AppData\Local\Temp\catchme.dll 53248 bytes executable

Scan erfolgreich abgeschlossen
versteckte Dateien: 1

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_USERS\S-1-5-21-442773238-3665067095-4225304131-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:69,70,b8,17,8f,94,fb,03,84,08,d1,71,6e,d1,51,c0,9c,7e,64,7f,cc,c7,f0,
   58,84,cd,0f,87,94,bb,a2,c7,51,98,d5,56,d7,c3,d5,68,96,95,35,88,b5,ec,bd,85,\
"??"=hex:5d,2e,bc,00,9b,07,bc,9c,34,34,87,88,c9,ab,ca,0d

[HKEY_USERS\S-1-5-21-442773238-3665067095-4225304131-1000\Software\SecuROM\License information*]
"datasecu"=hex:36,58,8f,04,77,95,da,de,48,ea,04,ee,f5,23,45,55,8b,21,d1,12,53,
   a6,3f,58,55,3a,ad,da,bc,54,5a,fb,4b,e7,bd,b1,4e,d2,5a,76,05,6a,af,72,4d,12,\
"rkeysecu"=hex:5a,b9,86,93,7b,45,50,27,2f,20,20,d5,0b,14,e6,dd
.
Zeit der Fertigstellung: 2010-05-30  22:47:56
ComboFix-quarantined-files.txt  2010-05-30 20:47

Vor Suchlauf: 12 Verzeichnis(se), 487.017.054.208 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 487.149.494.272 Bytes frei

- - End Of File - - 68BD7E59EA53BE5C6EC3CAA9B834D4FD

--- --- ---

Darkfilter · 25.05.2010, 21:56

2. logfile

OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 25.05.2010 22:52:08 - Run 2
OTL by OldTimer - Version 3.2.5.0     Folder = C:\Users\Nico\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18904)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 64,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 82,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 698,63 Gb Total Space | 454,65 Gb Free Space | 65,08% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
Drive G: | 465,76 Gb Total Space | 224,36 Gb Free Space | 48,17% Space Free | Partition Type: NTFS
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: NICO-PC
Current User Name: Nico
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Nico\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Windows\System32\atieclxx.exe (AMD)
PRC - C:\Windows\System32\atiesrxx.exe (AMD)
PRC - G:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Program Files\ATI\ATI.ACE\Core-Static\MOM.exe (Advanced Micro Devices Inc.)
PRC - C:\Program Files\ATI\ATI.ACE\Core-Static\CCC.exe (ATI Technologies Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Nico\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (Hamachi2Svc) --  File not found
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AMD External Events Utility) -- C:\Windows\System32\atiesrxx.exe (AMD)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (npggsvc) -- C:\Windows\System32\GameMon.des (INCA Internet Co., Ltd.)
SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (amdkmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (amdkmdap) -- C:\Windows\System32\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV - (AtiHdmiService) -- C:\Windows\System32\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (SSHDRV61) -- C:\Windows\System32\drivers\SSHDRV61.sys ()
DRV - (hamachi) -- C:\Windows\System32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (SSHDRV76) -- C:\Windows\System32\drivers\SSHDRV76.sys ()
DRV - (SSHDRV51) -- C:\Windows\System32\drivers\SSHDRV51.sys ()
DRV - (SSHDRV52) -- C:\Windows\System32\drivers\SSHDRV52.sys ()
DRV - (StarOpen) -- C:\Windows\System32\drivers\StarOpen.sys ()
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\Windows\System32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (VClone) -- C:\Windows\System32\drivers\VClone.sys (Elaborate Bytes AG)
DRV - (ElbyCDIO) -- C:\Windows\System32\drivers\ElbyCDIO.sys (Elaborate Bytes AG)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (JRAID) -- C:\Windows\system32\DRIVERS\jraid.sys (JMicron Technology Corp.)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation                                            )
DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (NPPTNT2) -- C:\Windows\System32\npptNT2.sys (INCA Internet Co., Ltd.)
DRV - (prohlp02) -- C:\Windows\System32\drivers\prohlp02.sys (Protection Technology)
DRV - (prodrv06) -- C:\Windows\System32\drivers\prodrv06.sys (Protection Technology)
DRV - (prosync1) -- C:\Windows\System32\drivers\prosync1.sys (Protection Technology)
DRV - (TIEHDUSB) -- C:\Windows\System32\drivers\tiehdusb.sys (Texas Instruments Incorporated)
DRV - (sfhlp01) -- C:\Windows\System32\drivers\sfhlp01.sys (Protection Technology)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = DA 4E EF 96 36 0A CA 01  [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: autopager@mozilla.org:0.6.0.26
FF - prefs.js..extensions.enabledItems: smartwebprinting@hp.com:4.60
FF - prefs.js..extensions.enabledItems: NPDyyno@dyyno.com:1.0.0.24
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
 
FF - HKLM\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.02.11 21:29:20 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Components: F:\Programme\Mozilla Firefox\components
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Plugins: F:\Programme\Mozilla Firefox\plugins
 
[2009.04.29 20:00:21 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\mozilla\Extensions
[2010.05.25 18:25:54 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\mozilla\Firefox\Profiles\yv8unz8k.default\extensions
[2010.04.28 17:11:40 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Nico\AppData\Roaming\mozilla\Firefox\Profiles\yv8unz8k.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.04.28 17:11:40 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\mozilla\Firefox\Profiles\yv8unz8k.default\extensions\autopager@mozilla.org
[2009.06.14 21:37:11 | 000,000,000 | ---D | M] -- C:\Users\Nico\AppData\Roaming\mozilla\Firefox\Profiles\yv8unz8k.default\extensions\NPDyyno@dyyno.com
[2010.05.25 21:25:02 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] G:\Programme\Adobe Reader\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [hpqSRMon]  File not found
O4 - HKLM..\Run: [iTunesHelper] F:\Programme\iTunes\iTunesHelper.exe File not found
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] F:\Programme\Hamachi\hamachi-2-ui.exe File not found
O4 - HKLM..\Run: [NeroFilterCheck] C:\Windows\System32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [VirtualCloneDrive] C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [iTap] C:\Program Files\HLW\iTap\iTap.exe File not found
O4 - HKCU..\Run: [RGSC] F:\Programme\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe File not found
O4 - HKCU..\Run: [Steam] f:\programme\steam\steam.exe File not found
O4 - Startup: C:\Users\Nico\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Users\Nico\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Product Registration.lnk = C:\Users\Nico\AppData\Local\Temp\is-OANTQ.tmp\ATR1.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: AllowLegacyWebView = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: AllowUnhashedWebView = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O9 - Extra Button: HP Smart Web Printing ein- oder ausblenden - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - F:\Program Files\ICQ6.5\ICQ.exe File not found
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - F:\Program Files\ICQ6.5\ICQ.exe File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Public\Pictures\Sample Pictures\Desert Landscape.jpg
O24 - Desktop BackupWallPaper: C:\Users\Public\Pictures\Sample Pictures\Desert Landscape.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{0320e36e-7b6d-11de-9936-002185c17f27}\Shell - "" = AutoRun
O33 - MountPoints2\{0320e36e-7b6d-11de-9936-002185c17f27}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -- File not found
O33 - MountPoints2\{7daf253f-0eba-11df-beb7-002185c17f27}\Shell\AutoRun\command - "" = G:\Menu.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.05.25 18:33:17 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Roaming\Malwarebytes
[2010.05.25 18:33:09 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.05.25 18:33:07 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.05.25 18:33:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.05.23 23:25:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2010.05.23 23:25:01 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2010.05.23 23:24:45 | 000,411,368 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\deployJava1.dll
[2010.05.23 23:24:45 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2010.05.23 23:24:45 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2010.05.23 23:24:45 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2010.05.17 21:46:04 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\My Games
[2010.05.17 21:40:58 | 000,000,000 | ---D | C] -- C:\Program Files\2K Games
[2010.05.16 16:08:54 | 000,000,000 | ---D | C] -- C:\Die Sims 2
[2010.05.16 16:03:49 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Local\World in Conflict
[2010.05.16 16:03:38 | 000,000,000 | ---D | C] -- C:\Users\Nico\Documents\World in Conflict
[2010.05.16 15:48:02 | 000,000,000 | ---D | C] -- C:\Program Files\Sierra Games
[2010.05.15 20:59:25 | 000,000,000 | ---D | C] -- C:\Users\Nico\Documents\BFBC2
[2010.05.15 20:43:02 | 001,974,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_42.dll
[2010.05.15 20:43:02 | 000,515,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_5.dll
[2010.05.15 20:43:02 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_5.dll
[2010.05.15 20:43:02 | 000,000,000 | ---D | C] -- C:\Program Files\Electronic Arts
[2010.05.15 20:43:01 | 005,501,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dcsx_42.dll
[2010.05.15 20:43:01 | 001,892,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_42.dll
[2010.05.15 20:43:01 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_42.dll
[2010.05.15 20:43:01 | 000,235,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx11_42.dll
[2010.05.15 20:43:00 | 000,069,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_3.dll
[2010.05.15 20:42:59 | 000,514,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_3.dll
[2010.05.15 20:42:59 | 000,235,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_3.dll
[2010.05.15 20:42:59 | 000,070,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_2.dll
[2010.05.15 20:42:59 | 000,023,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_5.dll
[2010.05.13 13:51:01 | 000,000,000 | ---D | C] -- C:\Users\Nico\Documents\RCT3
[2010.05.13 13:51:01 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Roaming\Atari
[2010.05.13 13:50:20 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Roaming\vlc
[2010.05.13 13:41:50 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Roaming\Leadertech
[2010.05.12 22:17:39 | 000,000,000 | ---D | C] -- C:\Users\Nico\Documents\NIKITA
[2010.05.12 22:17:29 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\NIKITA
[2010.05.03 13:28:22 | 000,000,000 | ---D | C] -- C:\Phenomedia AG
[2010.04.28 22:44:54 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2010.04.28 22:04:43 | 000,000,000 | ---D | C] -- C:\Users\Nico\AppData\Roaming\HPAppData
[2010.04.27 16:01:52 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
 
========== Files - Modified Within 30 Days ==========
 
[2010.05.25 22:53:00 | 000,000,420 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{8D9D19FD-3BB5-49B2-A216-4F4719AB1F71}.job
[2010.05.25 22:52:18 | 002,883,584 | -HS- | M] () -- C:\Users\Nico\NTUSER.DAT
[2010.05.25 21:32:44 | 001,418,806 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010.05.25 21:32:44 | 000,618,204 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2010.05.25 21:32:44 | 000,586,980 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.05.25 21:32:44 | 000,122,636 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2010.05.25 21:32:44 | 000,101,052 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.05.25 21:26:54 | 000,005,952 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.05.25 21:26:54 | 000,005,952 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.05.25 21:26:50 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.05.25 21:26:46 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.05.25 21:25:45 | 000,065,536 | -HS- | M] () -- C:\Users\Nico\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010.05.25 21:25:44 | 002,127,119 | -H-- | M] () -- C:\Users\Nico\AppData\Local\IconCache.db
[2010.05.25 21:25:44 | 000,524,288 | -HS- | M] () -- C:\Users\Nico\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2010.05.25 18:33:11 | 000,000,621 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.05.24 15:12:02 | 000,002,379 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2010.05.23 16:27:12 | 000,000,116 | ---- | M] () -- C:\Windows\NeroDigital.ini
[2010.05.23 13:25:09 | 000,000,312 | ---- | M] () -- C:\Windows\tasks\WebReg HP Photosmart C5300 series.job
[2010.05.23 02:31:05 | 000,139,128 | ---- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2010.05.23 01:19:17 | 000,215,128 | ---- | M] () -- C:\Windows\System32\PnkBstrB.xtr
[2010.05.22 01:39:14 | 309,498,610 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2010.05.17 21:52:28 | 000,001,337 | ---- | M] () -- C:\Users\Nico\Desktop\Civilization 4 - Colonization.lnk
[2010.05.16 15:57:43 | 000,000,801 | ---- | M] () -- C:\Users\Nico\Desktop\World in Conflict.lnk
[2010.05.15 20:58:49 | 000,001,104 | ---- | M] () -- C:\Users\Nico\Desktop\Battlefield Bad Company 2.lnk
[2010.05.15 20:57:42 | 000,138,056 | ---- | M] () -- C:\Users\Nico\AppData\Roaming\PnkBstrK.sys
[2010.05.15 20:57:26 | 002,434,856 | ---- | M] () -- C:\Windows\System32\pbsvc_bc2.exe
[2010.05.13 13:42:15 | 000,000,989 | ---- | M] () -- C:\Users\Nico\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Product Registration.lnk
[2010.05.13 13:40:51 | 000,000,697 | ---- | M] () -- C:\Users\Public\Desktop\RollerCoaster Tycoon 3.lnk
[2010.05.12 21:46:53 | 000,024,576 | ---- | M] () -- C:\Users\Nico\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.05.12 11:21:16 | 000,221,568 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
[2010.05.05 22:31:56 | 000,000,009 | ---- | M] () -- C:\Windows\pbase.dat
[2010.05.05 22:31:56 | 000,000,008 | ---- | M] () -- C:\Windows\npbase.dat
[2010.05.05 22:31:56 | 000,000,003 | ---- | M] () -- C:\Windows\ver.dat
[2010.04.29 12:19:24 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.04.29 12:19:14 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.04.28 22:44:33 | 000,272,168 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010.04.28 22:24:06 | 000,000,680 | ---- | M] () -- C:\Users\Nico\AppData\Local\d3d9caps.dat
 
========== Files Created - No Company Name ==========
 
[2010.05.25 18:33:11 | 000,000,621 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.05.23 13:25:08 | 000,000,312 | ---- | C] () -- C:\Windows\tasks\WebReg HP Photosmart C5300 series.job
[2010.05.22 01:39:14 | 309,498,610 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2010.05.17 21:51:37 | 000,001,337 | ---- | C] () -- C:\Users\Nico\Desktop\Civilization 4 - Colonization.lnk
[2010.05.16 15:57:16 | 000,000,801 | ---- | C] () -- C:\Users\Nico\Desktop\World in Conflict.lnk
[2010.05.15 20:58:28 | 000,001,104 | ---- | C] () -- C:\Users\Nico\Desktop\Battlefield Bad Company 2.lnk
[2010.05.15 20:57:42 | 000,138,056 | ---- | C] () -- C:\Users\Nico\AppData\Roaming\PnkBstrK.sys
[2010.05.15 20:57:26 | 002,434,856 | ---- | C] () -- C:\Windows\System32\pbsvc_bc2.exe
[2010.05.13 13:42:15 | 000,000,989 | ---- | C] () -- C:\Users\Nico\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Product Registration.lnk
[2010.05.13 13:40:51 | 000,000,697 | ---- | C] () -- C:\Users\Public\Desktop\RollerCoaster Tycoon 3.lnk
[2010.04.07 03:22:08 | 000,023,040 | ---- | C] () -- C:\Windows\System32\atitmpxx.dll
[2010.03.05 02:11:22 | 000,041,872 | ---- | C] () -- C:\Windows\System32\xfcodec.dll
[2010.02.04 16:53:07 | 001,970,176 | ---- | C] () -- C:\Windows\System32\d3dx9.dll
[2010.01.22 23:01:19 | 000,000,083 | ---- | C] () -- C:\Windows\WA.INI
[2009.11.28 12:19:53 | 000,000,040 | ---- | C] () -- C:\Windows\WeatherSet.ini
[2009.11.27 22:42:38 | 000,036,864 | ---- | C] () -- C:\Windows\System32\drivers\SSHDRV61.sys
[2009.10.16 13:54:05 | 000,000,280 | ---- | C] () -- C:\Windows\game.ini
[2009.09.25 19:17:47 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.09.07 20:37:01 | 000,000,004 | ---- | C] () -- C:\Windows\info147.sys
[2009.09.07 20:06:19 | 000,053,760 | ---- | C] () -- C:\Windows\System32\drivers\SSHDRV76.sys
[2009.09.06 18:52:02 | 000,021,504 | ---- | C] () -- C:\Windows\System32\drivers\SSHDRV51.sys
[2009.09.06 13:42:20 | 000,029,184 | ---- | C] () -- C:\Windows\System32\drivers\SSHDRV52.sys
[2009.08.02 12:41:22 | 000,000,116 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2009.07.17 14:19:55 | 000,005,632 | ---- | C] () -- C:\Windows\System32\drivers\StarOpen.sys
[2009.07.07 21:31:32 | 000,144,384 | ---- | C] () -- C:\Windows\System32\miccyhook.dll
[2009.06.12 18:38:11 | 000,139,128 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2009.05.17 18:15:47 | 000,000,510 | ---- | C] () -- C:\Windows\WORDPAD.INI
[2007.08.07 19:22:22 | 000,141,180 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[1997.11.17 18:13:16 | 000,010,240 | ---- | C] () -- C:\Windows\System32\vidx16.dll
[1997.06.14 10:56:08 | 000,056,832 | ---- | C] () -- C:\Windows\System32\iyvu9_32.dll
< End of report >

cosinus · 26.05.2010, 13:08

Das OTL-Log sieht ok aus, aber kannst Du nochmal das extras Log nachreichen? Du hast 2x das gleiche Log gepostet.

Darkfilter · 26.05.2010, 16:46

So, aber jetzt!^^

OTL EXTRAS Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 26.05.2010 17:42:58 - Run 3
OTL by OldTimer - Version 3.2.5.0     Folder = C:\Users\Nico\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18904)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 59,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 81,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 698,63 Gb Total Space | 454,63 Gb Free Space | 65,07% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
Drive G: | 465,76 Gb Total Space | 224,36 Gb Free Space | 48,17% Space Free | Partition Type: NTFS
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: NICO-PC
Current User Name: Nico
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- G:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "G:\Programme\Microsoft Viewer\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "G:\Programme\Microsoft Viewer\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "G:\Programme\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "G:\Programme\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-442773238-3665067095-4225304131-1000]
"EnableNotifications" = 1
"EnableNotificationsRef" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02AE2E85-F4DC-40C2-8FB4-D0E6046763F1}" = lport=10244 | protocol=6 | dir=in | app=system | 
"{02E39A3D-A442-461D-BBF0-757515213DAD}" = lport=3390 | protocol=6 | dir=in | app=system | 
"{06837C40-FF4C-465D-834B-85CA8093D46F}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{07CB54D0-0201-43D1-852A-9CDF899C79E1}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{0ED49805-8EFB-40EE-BD53-E367C5E6E697}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe | 
"{115C2BA7-2233-4322-8A32-B86B647422F9}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{17C44A58-E42D-4801-AF3F-4F236C68BF2E}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{1E04E061-B32F-404A-9CB5-9A49DBD7889C}" = lport=10244 | protocol=6 | dir=in | app=system | 
"{24BC0501-E1DC-4822-9E13-8B5D054EC445}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{28CC590E-D41C-4380-8A9D-CD38429D2D9C}" = rport=138 | protocol=17 | dir=out | app=system | 
"{29732F88-429C-497C-8D61-833D3861A7EB}" = rport=139 | protocol=6 | dir=out | app=system | 
"{3433C4F7-6BB4-44F5-B37B-A2521739FC3D}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{37263DE8-9CCC-4F0D-8440-2E74D3670993}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{4063555D-277F-4977-96F7-692DC10A2545}" = rport=445 | protocol=6 | dir=out | app=system | 
"{49969AAF-D9F4-4CDA-8C17-58579A46A3E3}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{4C920637-E15D-4F41-B765-F8FCDF4CF6E7}" = lport=445 | protocol=6 | dir=in | app=system | 
"{51657973-419D-40D0-81EF-E94C6C3885F1}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=c:\windows\system32\svchost.exe | 
"{537A3742-1226-47F4-BE7F-6D8BC60F4F5C}" = lport=7777 | protocol=17 | dir=in | app=%systemroot%\ehome\ehshell.exe | 
"{53C4AAC8-6B76-4599-A065-2C8F2D0F56FB}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{5678D6BF-EA96-4DA6-A7E9-02ED1304E9F8}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{63B0B5BF-78E3-4D41-9E4C-538B5882CCDA}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=c:\windows\system32\svchost.exe | 
"{65789E52-29BD-4BA5-9F8A-58D5364F2CEA}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{6849E627-1BDD-4246-BA98-8B9018C963C2}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{68E75825-6C86-4BF5-8CF0-0788FEF60A78}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=c:\windows\system32\svchost.exe | 
"{6CBA7093-F5CA-4B35-B126-783AD5F69D9E}" = rport=10244 | protocol=6 | dir=out | app=system | 
"{6CF4D255-99A5-42A5-9158-BB65FBA25C59}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe | 
"{6D8222DB-2330-4A38-A007-DF7AA94242EA}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{747E57D4-ED60-4964-99C1-547D77BE48B2}" = lport=7777 | protocol=17 | dir=in | app=%systemroot%\ehome\ehshell.exe | 
"{7D2E965C-0C5E-43FC-BFC0-1A96513A7F56}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{899378CE-D96D-4BF4-8541-6F0CBABA4288}" = lport=554 | protocol=6 | dir=in | app=%systemroot%\ehome\ehshell.exe | 
"{93913F85-7A30-413E-9342-FC4C37D9848B}" = lport=137 | protocol=17 | dir=in | app=system | 
"{94579499-69C1-4987-B7B2-BDBFFB780024}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{95D1C9E9-D724-4F69-8B70-9C30392CEAAE}" = rport=10244 | protocol=6 | dir=out | app=system | 
"{A029C1A0-4C27-417F-9D0A-6A6963EFB7EA}" = rport=137 | protocol=17 | dir=out | app=system | 
"{A0E425D5-5485-4EA1-B455-AB9AF843ADEB}" = lport=554 | protocol=6 | dir=in | app=%systemroot%\ehome\ehshell.exe | 
"{B17EC995-1BFB-4AB4-B865-5E59C2D05B09}" = lport=139 | protocol=6 | dir=in | app=system | 
"{B4E6009D-085D-4512-93C9-D9DDA1F8CFAA}" = lport=138 | protocol=17 | dir=in | app=system | 
"{BADEF0A2-29AC-4732-A456-99656AC753D0}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{C440558E-B8ED-4760-949C-BDCFE5E7A693}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=c:\windows\system32\svchost.exe | 
"{CACEA92B-822D-4D1A-A54E-648BDD3419D8}" = lport=3390 | protocol=6 | dir=in | app=system | 
"{CCBAFFB2-1129-4B23-8B1E-77B289C95615}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{D9B24D8D-5F20-49D1-BCB9-E44A0F4255DF}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{E2E61CBE-1B8F-4D35-BA1E-C10CC0D68B9D}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=c:\windows\system32\svchost.exe | 
"{E8EA674A-F1F4-438F-8ABD-8D0595DCEA0F}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=c:\windows\system32\svchost.exe | 
"{EA31851D-F54F-45E9-8A1C-D1FF5836487E}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{EBD159E3-0639-4332-BD0C-DB0836E0762B}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{F8786D21-4A2A-48F6-AA7E-700438077CE5}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{FAD3EDED-7CA5-40E3-86F7-C9EFFE880C1F}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{FDB43EA3-0AA7-42D5-9954-4EF4D32B3C0D}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0E622DBC-ED75-4318-BDFE-ABA8582C3189}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcx2prov.exe | 
"{10CD0016-3968-4E30-8485-022828DD04FD}" = protocol=6 | dir=in | app=f:\programme\ubisoft\shaunwhite\shaunwhitesnowboardinggame.exe | 
"{1634D116-6D18-4F9A-A62D-9E2DD14C5210}" = protocol=6 | dir=in | app=c:\program files\sierra games\wic_ds.exe | 
"{184503D7-4E14-4AA4-957B-28C0FCAB061C}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqsudi.exe | 
"{1853A475-C03B-47F5-8AE4-1F5F20FBAF3B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{1B39EC54-2059-4735-80D2-9E472EE95CA0}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{20818E8C-4BD5-4DFA-8010-8BA451E3E6F8}" = protocol=17 | dir=in | app=c:\program files\sierra games\wic_ds.exe | 
"{212D0B65-8938-4698-BEF4-F8AD3A0E7AA7}" = dir=in | app=c:\program files\hp\hp software update\hpwucli.exe | 
"{21C38210-3C63-45B2-8C67-1C4E9509FFE7}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{22960918-ED57-416C-ADED-1CC39C0112C1}" = protocol=6 | dir=out | app=%systemroot%\ehome\ehshell.exe | 
"{23E44FA8-25BE-4D4D-8F5A-BC13065AFBF0}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{26528D43-E4C7-4807-A1B6-92B32AC9F4E8}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{285DC7A4-832E-4ECF-9F31-45BC6E817FE0}" = dir=in | app=c:\program files\hp\digital imaging\smart web printing\smartwebprintexe.exe | 
"{2CF1121A-DDB1-48EA-9B94-A24DD6826424}" = protocol=17 | dir=in | app=f:\programme\itunes\itunes.exe | 
"{2F36DF23-D079-4AB3-AA51-0C5D914DD9C3}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{31F73A4F-CA1F-4F22-8BA5-8796514869D7}" = protocol=17 | dir=in | app=f:\programme\thq\company of heroes\relicdownloader\relicdownloader.exe | 
"{363674AD-E4F8-4562-B265-4E6A17915D99}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe | 
"{3CCB0CDD-8105-46FA-BD43-EC5ADFCD1143}" = protocol=17 | dir=out | app=%systemroot%\ehome\ehshell.exe | 
"{421CCCA8-B77B-4F58-9016-18EFA99BEBE1}" = protocol=6 | dir=out | svc=mcx2svc | app=%systemroot%\system32\svchost.exe | 
"{4308B23E-BAD6-475C-8A38-FCF27AC09351}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgm.exe | 
"{44AE1CC7-6372-4A71-A424-96AD12884344}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcx2prov.exe | 
"{4F647465-0C2F-44E8-A1E5-40C1C0C9FB90}" = protocol=17 | dir=out | app=%systemroot%\ehome\ehshell.exe | 
"{4F6F7A46-5D51-4F5E-9EA7-C300CB812D35}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{516E691A-0D0A-4BF8-825A-EEE6E27223C2}" = protocol=6 | dir=in | app=f:\programme\itunes\itunes.exe | 
"{54BF8067-353F-4789-A579-19F74A0B8181}" = protocol=6 | dir=in | app=f:\program files\ea games\mirror's edge\binaries\mirrorsedge.exe | 
"{58CE0B16-50D2-4743-A41E-43BFD256DCC0}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqpse.exe | 
"{5ADCB0CC-C6B7-4ECC-8D7C-AEF4690A4E78}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{5B2657E6-70D9-48BF-94F4-DD21D1D7939F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{5D24E30B-2035-4A1A-9C9B-CBA06DF669E1}" = dir=in | app=c:\program files\common files\hp\digital imaging\bin\hpqphotocrm.exe | 
"{6492189D-D1B8-4FF2-9195-4F9643C2279B}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{69CA568C-67A2-4107-BEFD-86F9DD8E1CBD}" = protocol=6 | dir=out | app=system | 
"{69EA3BA1-85F4-4AD5-AC07-48ABF2BA13FE}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{6A6E8455-A074-465D-9EB1-CB9E40433405}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgpc01.exe | 
"{718BB000-440E-4DEE-BA20-17AAA085E470}" = protocol=6 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe | 
"{71B4403E-2DDD-491D-BF1B-4FA499CD55D2}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{753474C5-F1E6-4619-9083-5B644B70DCF5}" = protocol=6 | dir=in | app=c:\program files\activision\cod4\iw3mp.exe | 
"{79ACE57B-93B4-4216-869C-B6AA10AF131A}" = protocol=17 | dir=in | app=c:\program files\midway games\rise and fall\riseandfall.exe | 
"{7A437381-8981-4C12-9BDF-19D9615701CF}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpiscnapp.exe | 
"{80538A2C-1B26-46FF-9EFA-591B7961B6A0}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqpsapp.exe | 
"{875186CD-2A59-44BC-AE0F-5DE2BF3EA945}" = protocol=6 | dir=in | app=c:\program files\electronic arts\battlefield bad company 2\bfbc2updater.exe | 
"{882B0E4B-9E9D-4BB7-9954-91DB2A79E4DD}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{8B3938FB-2845-489A-AA59-45A88D12B0F0}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{8C22B901-5664-45F3-BC84-0EC309BB3CD7}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{8CA407F9-8560-4E66-A588-CE465AA9BD28}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgplgtupl.exe | 
"{9C8C870B-CC1A-4DFF-BB5F-04475C68D457}" = protocol=17 | dir=in | app=c:\users\nico\appdata\locallow\dyyno receiver\dppm.exe | 
"{9CD2B854-92EA-4324-AF25-D6DBDBF74B65}" = protocol=6 | dir=in | app=f:\programme\ubisoft\shaunwhite\shaunwhitesnowboarding.exe | 
"{9DA2B874-D77B-4A88-B137-35C91ED730FF}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{A2DACCE1-E27D-46BD-B869-3955D3B903BA}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{A48F14D5-96B1-4976-B59A-D0D615BE51E9}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{A6EC7876-7AA5-4A73-AD14-46D813118E53}" = protocol=17 | dir=in | app=c:\program files\microsoft games\gears of war\binaries\wargame-g4wlive.exe | 
"{A9C0319F-2C91-4863-8EE3-2061455881A0}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0.10192-to-3.2.0.10314-dede-downloader.exe | 
"{AC9CE1FF-3C90-446A-8229-823CA51F19D0}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe | 
"{AE4ACB50-5660-4A8E-A919-6DF4D0966081}" = protocol=17 | dir=in | app=f:\programme\ubisoft\shaunwhite\shaunwhitesnowboarding.exe | 
"{AEBD2AE3-A5B1-4129-BB4D-C0BECF348204}" = protocol=17 | dir=in | app=c:\program files\electronic arts\battlefield bad company 2\bfbc2updater.exe | 
"{AFE886E0-4B18-45B3-B455-EC108009DE72}" = protocol=6 | dir=in | app=f:\programme\thq\company of heroes\relicdownloader\relicdownloader.exe | 
"{B015F6FF-2E90-4E23-B079-12122609DCD3}" = protocol=17 | dir=in | app=f:\programme\ubisoft\shaunwhite\shaunwhitesnowboardinggame.exe | 
"{B8D5E00E-8277-4801-AEC5-604D67CFA48B}" = protocol=6 | dir=in | app=c:\program files\microsoft games\gears of war\binaries\wargame-g4wlive.exe | 
"{B9D5A4CC-32BD-4CBB-B48C-A4F822C2010F}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpoews01.exe | 
"{BBADE287-1BBA-497B-BB4E-27A7F209B482}" = protocol=17 | dir=in | app=c:\program files\sierra games\wic_online.exe | 
"{BDB715CF-C5D0-4206-AAB6-16FAB249EA0F}" = protocol=6 | dir=in | app=c:\program files\sierra games\wic.exe | 
"{BF6A4CFE-C534-4BF4-913A-14A4F802F3A0}" = protocol=6 | dir=out | svc=mcx2svc | app=%systemroot%\system32\svchost.exe | 
"{BFDFD884-43DC-4040-BD2A-C0961EC39FF4}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqkygrp.exe | 
"{C20F8C31-5F20-490D-8EA4-53F609282A9B}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe | 
"{C27ED155-9556-4E01-B45C-27B4603B95E1}" = protocol=6 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe | 
"{C60ED85D-7B20-4B39-97F1-30D3FAEE3210}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{CA3F72E1-0DDA-49C2-8E3F-2C87CE1D42CA}" = protocol=6 | dir=in | app=c:\users\nico\appdata\locallow\dyyno receiver\dppm.exe | 
"{CA8FDE01-23C9-4D67-92EA-0FBE60832146}" = protocol=17 | dir=in | app=c:\program files\sierra games\wic.exe | 
"{CADB7677-50B3-4A6D-872C-E3859DC9A66B}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{CDB770A8-363E-4C55-9AE7-0AC399EF1F31}" = protocol=6 | dir=in | app=c:\program files\midway games\rise and fall\riseandfall.exe | 
"{D0592BDA-AF6D-4782-AC54-B2462B84AECE}" = protocol=17 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe | 
"{D2FDDBFE-FC88-4B7B-AC7A-4A4AFFED81D8}" = protocol=6 | dir=in | app=c:\program files\2k games\firaxis games\sid meier's civilization iv colonization\colonization.exe | 
"{DAA6F83A-0139-4080-90C5-CFC8C1CDB12E}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqtra08.exe | 
"{DF0E44F2-6C81-453D-94C2-5B36DFE9A7C3}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe | 
"{E23BFAD7-2890-4120-BA8F-AA5997DFD262}" = protocol=17 | dir=in | app=f:\program files\ea games\mirror's edge\binaries\mirrorsedge.exe | 
"{E47D85F5-B22D-4C97-8655-3880773E8E60}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0.10192-to-3.2.0.10314-dede-downloader.exe | 
"{E5270183-632A-4CF4-80A1-AA0E0A3A63F2}" = protocol=17 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe | 
"{E71B8BB3-3D9E-4F55-A0B1-1B8F4BDDB1F8}" = dir=in | app=c:\program files\hp\digital imaging\bin\hposid01.exe | 
"{EBE354B6-51D8-4461-953C-0EF5794A7AF7}" = protocol=17 | dir=in | app=c:\program files\2k games\firaxis games\sid meier's civilization iv colonization\colonization.exe | 
"{EF8B480C-EC80-41DF-BCB5-5F272D372550}" = protocol=6 | dir=out | app=%systemroot%\ehome\ehshell.exe | 
"{F2BAE327-765A-402B-AF47-CE9E571F11D5}" = dir=in | app=f:\programme\electronic arts\command and conquer tiberium wars\retailexe\1.9\cnc3game.dat | 
"{F3E2C6F7-7FAB-472D-901B-5C8EDF8C5261}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{F48989DD-0325-43AB-B1D8-7D7A857F49AB}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 
"{F50E3981-D58A-430B-AC2F-6BCF68F93013}" = protocol=6 | dir=out | svc=upnphost | app=c:\windows\system32\svchost.exe | 
"{F527DBC3-7E15-4944-8A76-4C3D0C685449}" = protocol=17 | dir=in | app=c:\program files\activision\cod4\iw3mp.exe | 
"{F9269BAF-4DE7-4AA9-B85D-024BD616274C}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{FC5E660B-4D7C-4DF0-9EA3-97BC86A0DCDE}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgh.exe | 
"{FDA732FB-5664-4E6A-97CD-FC5476D3CAFA}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 
"{FE3AEA0E-5474-487E-B316-649E77D0EC72}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqste08.exe | 
"{FEF9E9F4-A3C3-4A35-A302-ED0A421A44C4}" = protocol=6 | dir=in | app=c:\program files\sierra games\wic_online.exe | 
"TCP Query User{03D7814F-5E6F-46F4-84FE-78048805EDA9}F:\programme\activision\call of duty 2\cod2mp_s.exe" = protocol=6 | dir=in | app=f:\programme\activision\call of duty 2\cod2mp_s.exe | 
"TCP Query User{0E2A9752-3FC5-4A7D-ABC1-DA9D5E0F0C66}C:\program files\mirc\mirc.exe" = protocol=6 | dir=in | app=c:\program files\mirc\mirc.exe | 
"TCP Query User{27D98D36-8826-4EDB-8F64-C79D54C12BCC}F:\programme\activision\call of duty 4 - modern warfare\iw3mp.exe" = protocol=6 | dir=in | app=f:\programme\activision\call of duty 4 - modern warfare\iw3mp.exe | 
"TCP Query User{28BB3054-CC82-4FA3-8425-F8C89CE01A79}C:\windows\system32\dplaysvr.exe" = protocol=6 | dir=in | app=c:\windows\system32\dplaysvr.exe | 
"TCP Query User{2A82EC34-2E5E-48FB-B505-8DD000885F6D}C:\program files\java\jre6\launch4j-tmp\jdownloader.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\launch4j-tmp\jdownloader.exe | 
"TCP Query User{2C61F42C-5320-4F4D-8195-02916E3B2EA1}F:\programme\worms armageddon\wa.exe" = protocol=6 | dir=in | app=f:\programme\worms armageddon\wa.exe | 
"TCP Query User{3349B1D8-47DB-4203-9CCB-1B5EB83F2B5A}F:\programme\activision\cod\codmp.exe" = protocol=6 | dir=in | app=f:\programme\activision\cod\codmp.exe | 
"TCP Query User{3DBB8869-B3DD-485D-AE09-BC7B3A9E8549}C:\program files\activision\cod\codmp.exe" = protocol=6 | dir=in | app=c:\program files\activision\cod\codmp.exe | 
"TCP Query User{3F699397-5447-4D89-8C8C-46EBD379E1A2}C:\program files\postal2stp\system\postal2.exe" = protocol=6 | dir=in | app=c:\program files\postal2stp\system\postal2.exe | 
"TCP Query User{3FCC6601-673B-4373-9488-5E9A1620FB69}F:\programme\microsoft games\age of empires 2 the age of kings\empires2.exe" = protocol=6 | dir=in | app=f:\programme\microsoft games\age of empires 2 the age of kings\empires2.exe | 
"TCP Query User{41E78F66-F1BE-4B6E-9933-179B5042BC9C}F:\programme\metin2\metin2.bin" = protocol=6 | dir=in | app=f:\programme\metin2\metin2.bin | 
"TCP Query User{48344DDA-927A-4172-BCB0-0DBC38391791}C:\users\nico\desktop\neuer ordner\coduomp.exe" = protocol=6 | dir=in | app=c:\users\nico\desktop\neuer ordner\coduomp.exe | 
"TCP Query User{4917B38A-8BE7-4B03-BCB8-8B5DFC26872C}F:\programme\metin2\metin2client.bin" = protocol=6 | dir=in | app=f:\programme\metin2\metin2client.bin | 
"TCP Query User{4A242EA3-0D8C-415E-8FD7-9A50E3E8E9AE}F:\programme\dead space\dead space.exe" = protocol=6 | dir=in | app=f:\programme\dead space\dead space.exe | 
"TCP Query User{5E47DFE3-9F89-4353-96DD-D52D934DA735}C:\windows\system32\dplaysvr.exe" = protocol=6 | dir=in | app=c:\windows\system32\dplaysvr.exe | 
"TCP Query User{6A78EB0E-986A-4631-A66B-DBD7F86F660C}C:\program files\wow\repair.exe" = protocol=6 | dir=in | app=c:\program files\wow\repair.exe | 
"TCP Query User{74B98BE2-0707-4254-A158-FC10493F37D9}C:\program files\left 4 dead\left4dead.exe" = protocol=6 | dir=in | app=c:\program files\left 4 dead\left4dead.exe | 
"TCP Query User{79131458-1A9B-4BD2-A678-474904C09927}F:\programme\battlefield vietnam\bfvietnam.exe" = protocol=6 | dir=in | app=f:\programme\battlefield vietnam\bfvietnam.exe | 
"TCP Query User{7E9285ED-D436-4A1E-9E0E-3A07C8B79FF3}F:\programme\electronic arts\command & conquer 3\retailexe\1.9\cnc3game.dat" = protocol=6 | dir=in | app=f:\programme\electronic arts\command & conquer 3\retailexe\1.9\cnc3game.dat | 
"TCP Query User{80B38D5E-89D2-4638-A37A-4F133DDBEC12}F:\programme\tom clancy's h.a.w.x\hawx.exe" = protocol=6 | dir=in | app=f:\programme\tom clancy's h.a.w.x\hawx.exe | 
"TCP Query User{8820DC4B-94DF-4C69-99B5-60A31DE2C44C}C:\programdata\kaspersky lab setup files\kaspersky internet security 2009\german\setup.exe" = protocol=6 | dir=in | app=c:\programdata\kaspersky lab setup files\kaspersky internet security 2009\german\setup.exe | 
"TCP Query User{993397FF-DB0A-40E9-B41F-26D711FE4420}C:\program files\activision\cod\coduomp.exe" = protocol=6 | dir=in | app=c:\program files\activision\cod\coduomp.exe | 
"TCP Query User{A85664EE-CF49-4CAB-8412-8D88AB7F80E6}C:\program files\wow\launcher.exe" = protocol=6 | dir=in | app=c:\program files\wow\launcher.exe | 
"TCP Query User{A9E53ACF-476C-4D7E-A729-3560AD3A4477}C:\users\nico\appdata\local\temp\electronicarts_patcher_000.exe" = protocol=6 | dir=in | app=c:\users\nico\appdata\local\temp\electronicarts_patcher_000.exe | 
"TCP Query User{B2BAE860-49B7-494F-999C-3F128281A40E}F:\programme\far cry 2\bin\farcry2.exe" = protocol=6 | dir=in | app=f:\programme\far cry 2\bin\farcry2.exe | 
"TCP Query User{B5A54A0A-4FD5-4C71-AED4-B795E5F5688F}C:\program files\activision\cod4\iw3mp.exe" = protocol=6 | dir=in | app=c:\program files\activision\cod4\iw3mp.exe | 
"TCP Query User{BA4063EE-9AD8-4AFB-B943-E9D2D67E92A3}F:\programme\steam\steamapps\optiolol\counter-strike source\hl2.exe" = protocol=6 | dir=in | app=f:\programme\steam\steamapps\optiolol\counter-strike source\hl2.exe | 
"TCP Query User{C1515480-ABF8-4B11-96AE-DDF1B8E865FC}C:\program files\activision\call of duty 2\cod2mp_s.exe" = protocol=6 | dir=in | app=c:\program files\activision\call of duty 2\cod2mp_s.exe | 
"TCP Query User{D6382914-4211-441C-BC7D-1E149C671738}G:\spiele\command & conquer 3\retailexe\1.9\cnc3game.dat" = protocol=6 | dir=in | app=g:\spiele\command & conquer 3\retailexe\1.9\cnc3game.dat | 
"TCP Query User{D81F15B1-47C3-4A6B-AC27-23794C912F63}F:\programme\firefly studios\stronghold crusader\stronghold crusader.exe" = protocol=6 | dir=in | app=f:\programme\firefly studios\stronghold crusader\stronghold crusader.exe | 
"TCP Query User{DD9E953A-706A-46AA-8529-C781A79C5054}C:\program files\activision\call of duty 2\cod2mp_s.exe" = protocol=6 | dir=in | app=c:\program files\activision\call of duty 2\cod2mp_s.exe | 
"TCP Query User{DE79D49F-E6E2-4E79-BD38-1A208F94FDB3}F:\programme\activision\cod\coduomp.exe" = protocol=6 | dir=in | app=f:\programme\activision\cod\coduomp.exe | 
"TCP Query User{EB976354-E18D-427B-9729-71A4FE3E5241}F:\programme\xfire\xfire.exe" = protocol=6 | dir=in | app=f:\programme\xfire\xfire.exe | 
"TCP Query User{EEBE6567-9A87-46BE-996D-93D55BB457A0}F:\programme\icq6.5\icq.exe" = protocol=6 | dir=in | app=f:\programme\icq6.5\icq.exe | 
"TCP Query User{F07A5F1D-CCEC-4DD3-AE3B-8B91A0728509}F:\programme\xfire\xfire.exe" = protocol=6 | dir=in | app=f:\programme\xfire\xfire.exe | 
"TCP Query User{F3CA7FB6-7D62-4E25-8DB6-0B08EB0BBD23}F:\programme\hlsw\hlsw.exe" = protocol=6 | dir=in | app=f:\programme\hlsw\hlsw.exe | 
"TCP Query User{FAB910C6-7385-4B29-B3E1-78EB8D1F0222}F:\programme\halo\halo.exe" = protocol=6 | dir=in | app=f:\programme\halo\halo.exe | 
"UDP Query User{095C3AB0-C7D0-4E38-B204-0B0233D8F4E6}C:\program files\left 4 dead\left4dead.exe" = protocol=17 | dir=in | app=c:\program files\left 4 dead\left4dead.exe | 
"UDP Query User{0B76F548-B64A-49F8-865E-2AAEEAA86838}C:\program files\wow\repair.exe" = protocol=17 | dir=in | app=c:\program files\wow\repair.exe | 
"UDP Query User{16C0336B-1320-4846-839C-4136F1CD327D}F:\programme\icq6.5\icq.exe" = protocol=17 | dir=in | app=f:\programme\icq6.5\icq.exe | 
"UDP Query User{18BB681D-7076-458D-8F9C-67969908CB6B}F:\programme\metin2\metin2client.bin" = protocol=17 | dir=in | app=f:\programme\metin2\metin2client.bin | 
"UDP Query User{19A89B58-9D24-4B3E-BE78-7A8BABDBE249}C:\program files\activision\cod4\iw3mp.exe" = protocol=17 | dir=in | app=c:\program files\activision\cod4\iw3mp.exe | 
"UDP Query User{35D8A1D3-F2BC-4DD0-AA17-995354BA070F}F:\programme\activision\call of duty 2\cod2mp_s.exe" = protocol=17 | dir=in | app=f:\programme\activision\call of duty 2\cod2mp_s.exe | 
"UDP Query User{3D731044-6B25-409D-A04E-86CC0C7FECF5}F:\programme\hlsw\hlsw.exe" = protocol=17 | dir=in | app=f:\programme\hlsw\hlsw.exe | 
"UDP Query User{4C999404-F378-4C22-B790-B262A1AFCE7D}C:\programdata\kaspersky lab setup files\kaspersky internet security 2009\german\setup.exe" = protocol=17 | dir=in | app=c:\programdata\kaspersky lab setup files\kaspersky internet security 2009\german\setup.exe | 
"UDP Query User{4F0EAA92-6B50-4D06-B204-2CC1055B80FD}C:\program files\java\jre6\launch4j-tmp\jdownloader.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\launch4j-tmp\jdownloader.exe | 
"UDP Query User{4F24F115-08A9-4CB0-A94F-BD4EB94052B9}F:\programme\activision\cod\coduomp.exe" = protocol=17 | dir=in | app=f:\programme\activision\cod\coduomp.exe | 
"UDP Query User{671E443F-A832-4E25-85CF-4245955C0E7D}C:\program files\activision\cod\codmp.exe" = protocol=17 | dir=in | app=c:\program files\activision\cod\codmp.exe | 
"UDP Query User{672A4D49-E844-402E-9988-FE843AAE266D}F:\programme\far cry 2\bin\farcry2.exe" = protocol=17 | dir=in | app=f:\programme\far cry 2\bin\farcry2.exe | 
"UDP Query User{79197F36-C3E7-4707-95FC-06B28F581A09}C:\program files\activision\call of duty 2\cod2mp_s.exe" = protocol=17 | dir=in | app=c:\program files\activision\call of duty 2\cod2mp_s.exe | 
"UDP Query User{7CF6C659-F6FA-4C8C-AC03-17E77D03FAE0}C:\program files\wow\launcher.exe" = protocol=17 | dir=in | app=c:\program files\wow\launcher.exe | 
"UDP Query User{7D0849E4-4895-4F15-AF19-CFB02AFEE749}C:\windows\system32\dplaysvr.exe" = protocol=17 | dir=in | app=c:\windows\system32\dplaysvr.exe | 
"UDP Query User{7E8D4DB1-5979-4FF6-851B-36D328FD92C0}C:\users\nico\appdata\local\temp\electronicarts_patcher_000.exe" = protocol=17 | dir=in | app=c:\users\nico\appdata\local\temp\electronicarts_patcher_000.exe | 
"UDP Query User{86634CE6-1170-4738-974E-B558A276F15A}F:\programme\electronic arts\command & conquer 3\retailexe\1.9\cnc3game.dat" = protocol=17 | dir=in | app=f:\programme\electronic arts\command & conquer 3\retailexe\1.9\cnc3game.dat | 
"UDP Query User{8DA1B81C-024C-420E-8D00-09818BAE6428}F:\programme\microsoft games\age of empires 2 the age of kings\empires2.exe" = protocol=17 | dir=in | app=f:\programme\microsoft games\age of empires 2 the age of kings\empires2.exe | 
"UDP Query User{8F65452A-B4E7-4987-B0B8-7E8831FF2FB9}F:\programme\dead space\dead space.exe" = protocol=17 | dir=in | app=f:\programme\dead space\dead space.exe | 
"UDP Query User{9A734DE8-1C32-49AE-915F-7775CC853CCF}F:\programme\firefly studios\stronghold crusader\stronghold crusader.exe" = protocol=17 | dir=in | app=f:\programme\firefly studios\stronghold crusader\stronghold crusader.exe | 
"UDP Query User{A566035F-83A2-4EE2-8B55-EF5937FC7463}C:\program files\mirc\mirc.exe" = protocol=17 | dir=in | app=c:\program files\mirc\mirc.exe | 
"UDP Query User{B1AFD9F4-CDC8-43AE-986D-61202C4E60A2}G:\spiele\command & conquer 3\retailexe\1.9\cnc3game.dat" = protocol=17 | dir=in | app=g:\spiele\command & conquer 3\retailexe\1.9\cnc3game.dat | 
"UDP Query User{B23C8BF4-1ECC-4BA3-BA7F-AF194FC5DE4A}F:\programme\xfire\xfire.exe" = protocol=17 | dir=in | app=f:\programme\xfire\xfire.exe | 
"UDP Query User{B60CC65B-5F7D-457D-987A-13B86ADC9428}F:\programme\halo\halo.exe" = protocol=17 | dir=in | app=f:\programme\halo\halo.exe | 
"UDP Query User{B76DC34F-35D7-4E20-A0D4-52C72AC7CA22}C:\users\nico\desktop\neuer ordner\coduomp.exe" = protocol=17 | dir=in | app=c:\users\nico\desktop\neuer ordner\coduomp.exe | 
"UDP Query User{B83AB61B-1A12-4874-8E8F-ED16322F243B}F:\programme\battlefield vietnam\bfvietnam.exe" = protocol=17 | dir=in | app=f:\programme\battlefield vietnam\bfvietnam.exe | 
"UDP Query User{BA7E8B1E-EC86-44AD-9272-E7F05A4D196C}F:\programme\activision\cod\codmp.exe" = protocol=17 | dir=in | app=f:\programme\activision\cod\codmp.exe | 
"UDP Query User{BC659AA2-13DF-43CE-9D13-93378DCEB9B6}C:\program files\postal2stp\system\postal2.exe" = protocol=17 | dir=in | app=c:\program files\postal2stp\system\postal2.exe | 
"UDP Query User{C80AD029-E05F-4CAE-AD39-A8F0302C7A19}C:\program files\activision\cod\coduomp.exe" = protocol=17 | dir=in | app=c:\program files\activision\cod\coduomp.exe | 
"UDP Query User{CD0E34D6-80ED-46C4-9232-2841F98C0F41}C:\program files\activision\call of duty 2\cod2mp_s.exe" = protocol=17 | dir=in | app=c:\program files\activision\call of duty 2\cod2mp_s.exe | 
"UDP Query User{CDBB0EFE-0E49-428F-8E8F-79C556D0116D}F:\programme\tom clancy's h.a.w.x\hawx.exe" = protocol=17 | dir=in | app=f:\programme\tom clancy's h.a.w.x\hawx.exe | 
"UDP Query User{D4876D4C-903F-4707-9AE5-6BF602B98B16}F:\programme\xfire\xfire.exe" = protocol=17 | dir=in | app=f:\programme\xfire\xfire.exe | 
"UDP Query User{E4D89834-32E8-4CCF-934C-ECCB80848907}F:\programme\metin2\metin2.bin" = protocol=17 | dir=in | app=f:\programme\metin2\metin2.bin | 
"UDP Query User{F3BA5037-B25B-4E47-A156-D2797058141A}F:\programme\activision\call of duty 4 - modern warfare\iw3mp.exe" = protocol=17 | dir=in | app=f:\programme\activision\call of duty 4 - modern warfare\iw3mp.exe | 
"UDP Query User{F573619F-4530-4ED9-ABC8-8D0BB616F105}F:\programme\steam\steamapps\optiolol\counter-strike source\hl2.exe" = protocol=17 | dir=in | app=f:\programme\steam\steamapps\optiolol\counter-strike source\hl2.exe | 
"UDP Query User{F7A5C010-16EE-4E68-BCA3-403F1F9F6416}C:\windows\system32\dplaysvr.exe" = protocol=17 | dir=in | app=c:\windows\system32\dplaysvr.exe | 
"UDP Query User{F7B7EB9D-AAA6-45C9-9DF1-D426C95F594A}F:\programme\worms armageddon\wa.exe" = protocol=17 | dir=in | app=f:\programme\worms armageddon\wa.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01521746-02A6-4A72-00BD-A285DF6B80C6}" = Die Sims 2: Wilde Campus-Jahre
"{0289B35E-DC07-4c7a-9710-BBD686EA4B7D}" = Status
"{03B0D67B-36C9-C2CD-B63B-7B526138BA52}" = ccc-utility
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{04FC2E4C-0E41-9D39-4E58-1EF29D4EF09D}" = ccc-core-static
"{04FE63AC-AC7B-4C80-83AA-CCACA48C0C19}" = PS_AIO_04_C5300_Software
"{050C1C8E-4A4D-4C2F-B9AE-67E60EE91B7F}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.3 Patch
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{086BADF8-9B1F-4E89-B207-2EDA520972D6}" = Grand Theft Auto San Andreas
"{0949C078-58B4-CAF1-9A63-A4545145806D}" = Catalyst Control Center Graphics Previews Common
"{09633A5E-3089-41A8-9FF1-382171423C5D}" = PSSWCORE
"{09725E0F-6406-4500-8296-DBF6E697E9D7}" = C5300
"{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}" = PlayStation(R)Store
"{121634B0-2F4B-11D3-ADA3-00C04F52DD52}" = Windows Installer Clean Up
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{14574B7F-75D1-4718-B7F2-EBF6E2862A35}" = Company of Heroes - FAKEMSI
"{15B8AFD9-92E9-4E86-96D9-83FAC510B82E}" = HPPhotoSmartPhotobookWebPack1
"{199E6632-EB28-4F73-AECB-3E192EB92D18}" = Company of Heroes - FAKEMSI
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20DEB77C-21D6-4D22-BB47-233E47613D57}" = Microsoft Games for Windows - LIVE Redistributable
"{22F761D1-8063-4170-ADF7-2D2F47834CA9}" = VideoToolkit01
"{25724802-CC14-4B90-9F3B-3D6955EE27B1}" = Company of Heroes - FAKEMSI
"{2614F54E-A828-49FA-93BA-45A3F756BFAA}" = 32 Bit HP CIO Components Installer
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 20
"{26BEE28E-C285-4532-82D3-7CE3C5F805D4}" = HPPhotoSmartDiscLabel_PrintOnDisc
"{2AFEAA03-2DFE-4519-A629-EDAB6541ABE9}" = HPSSupply
"{32C4A4EB-C97D-414E-99C5-38F8DFD31D5D}" = Company of Heroes - FAKEMSI
"{3700194C-C5DD-439A-BE06-A66960CA4C70}" = MSVCSetup
"{38D9575F-6228-6A54-3A92-D902739B6541}" = Catalyst Control Center InstallProxy
"{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}" = JMB36X Raid Configurer
"{3AC8457C-0385-4BEA-A959-E095F05D6D67}" = Battlefield: Bad Company™ 2
"{3AD56302-2ADE-4A1C-864A-CB9FFF040576}" = PS_AIO_04_C5300_ProductContext
"{3BD633E0-4BF8-4499-9149-88F0767D449C}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.4 Patch
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{489CA990-9FFB-495A-B5F6-027199E65405}" = PS_AIO_04_C5300_Software_Min
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A3D0CF8-60FF-4CEF-91A4-A1F001424602}" = DocProc
"{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter
"{4E7C28C7-D5DA-4E9F-A1CA-60490B54AE35}" = UnloadSupport
"{50193078-F553-4EBA-AA77-64C9FAA12F98}" = Company of Heroes - FAKEMSI
"{51D718D1-DA81-4FAD-919F-5C1CE3C33379}" = Company of Heroes - FAKEMSI
"{573F1931-08F7-9222-704E-841C391794C5}" = ATI Catalyst Install Manager
"{5D7767FA-7FE8-4627-9F09-AEF7A25F1E07}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.1 Patch
"{5E8B45A0-072C-91F7-BC80-29374194B452}" = Catalyst Control Center Graphics Previews Vista
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5
"{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{66F78C51-D108-4F0C-A93C-1CBE74CE338F}" = Company of Heroes - FAKEMSI
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69C57747-551F-4e4f-AB60-13358DC4F00A}" = HP Photosmart C5300 All-In-One Driver Software 11.0 Rel .4
"{6CC1EE94-B426-478B-AE83-F83EBB4EF66A}" = HPPhotoSmartDiscLabel_PaperLabel
"{6E7DD182-9FC6-4651-0095-2E666CC6AF35}" = Die Sims 2
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{70E1E357-E57C-4284-B04E-58196DC27BC1}" = PanoStandAlone
"{74DC0593-6BC6-4001-AD5F-D810AFB68D86}" = HP Update
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{7B3577F5-1D82-4C9B-008B-69D026FD8BCA}" = Die Sims 2: Open For Business
"{7B4A5C13-069F-4AFE-AE57-C497B4E33C7E}" = Call of Duty(R) 2 Patch 1.3
"{7BA01D2D-E25C-0C2C-5779-7A8E02A4BE7D}" = Catalyst Control Center Core Implementation
"{7ED180E1-ADE9-4C69-8845-BDF518D763B8}" = hpphotosmartdisclabelplugin
"{7F4B1592-222F-4E5F-A100-E5AFD61A0BB3}" = Company of Heroes - FAKEMSI
"{80D03817-7943-4839-8E96-B9F924C5E67D}" = Company of Heroes - FAKEMSI
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8503C901-85D7-4262-88D2-8D8B2A7B08B8}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.5 Patch
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch
"{8A74DEFD-A224-49CC-AB80-4E88BC730125}" = LogMeIn Hamachi
"{8ACC73AA-6511-7C55-B1A9-8E5D1DEAFAA3}" = The Lord of the Rings FREE Trial 
"{8D7133DE-27D2-47E5-B248-4180278D32AA}" = Catalyst Control Center - Branding
"{8FF4E834-DCAD-29E7-1EE8-9D817A3FA15B}" = CCC Help English
"{8FF6F5CA-4E30-4E3B-B951-204CAAA2716A}" = SmartWebPrinting
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90850407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Word Viewer 2003
"{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch
"{9580813D-94B1-4C28-9426-A441E2BB29A5}" = Counter-Strike: Source
"{97E5205F-EA4F-438F-B211-F1846419F1C1}" = Company of Heroes - FAKEMSI
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{99A7722D-9ACB-43F3-A222-ABC7133F159E}" = Company of Heroes - FAKEMSI
"{99E862CC-6F69-4D39-99AA-DBF71BF3B585}" = OpenOffice.org 3.1
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C2D4047-0E40-499a-AC7A-C4B9BB12FE03}" = TrayApp
"{9F4EE72A-C5C9-42ad-ABEF-427690843577}" = MarketResearch
"{A6FDF86A-F541-4E7B-AEA0-8849A2A700D5}" = iTunes
"{A8B94669-8654-4126-BD28-D0D2412CDED6}" = TI Connect 1.6
"{AA2E8A46-B45E-4aea-8A23-88AB57D04523}" = WebReg
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.2 - Deutsch
"{AEDBD563-24BB-4EE3-8366-A654DAC2D988}" = Mirror's Edge™
"{B3276CB1-20B6-4AF9-AAEC-E72C83816495}" = IKEA Home Planner
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BA801B94-C28D-46EE-B806-E1E021A3D519}" = Company of Heroes - FAKEMSI
"{BC4CA8FA-41D2-4B81-8680-E9B7573D6500}" = PlayStation(R)Network Downloader
"{BCC09E9C-3340-473D-A4FE-8580992CA77A}" = HPPhotoSmartDiscLabelContent1
"{BF08AB1C-3357-4f20-A200-8EBB8EF27C59}" = BufferChm
"{C03A56EE-2715-5F54-69C4-A1CDB7602354}" = Catalyst Control Center Graphics Full New
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = Die*Sims™*3
"{C307DD64-1C69-8C52-D2C9-02D38995A269}" = Catalyst Control Center HydraVision Full
"{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant
"{C89B5E3A-690F-4CEE-909A-BF869E198B0A}" = Scan
"{C9933E93-8653-447E-9A19-9BCF658E3AE9}" = C5300_Help
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D078226E-83F2-45FD-9CDE-5DA66E5ADB51}" = Rise and Fall
"{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D16B4BE6-8B10-422f-8034-96D1CA9483B5}" = GPBaseService
"{D4D244D1-05E0-4D24-86A2-B2433C435671}" = Company of Heroes - FAKEMSI
"{D74CFE48-087F-46E1-80E6-E2950E1A8DCE}" = HP Photosmart Essential 2.5
"{D99223D4-1F48-47BD-ADFD-D43C91CDFD00}" = S4 League
"{DDEDAF6C-488E-4CDA-8276-1CCF5F3C5C32}" = Command & Conquer 3
"{E3E1398E-8FF2-0154-6D8F-7FC26299EBED}" = Catalyst Control Center Graphics Full Existing
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E5141379-B2D9-4BBC-BB2A-5805541571DD}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.2 Patch
"{E535C94A-B87F-4182-BEA8-1E9322078D3E}" = Cards_Calendar_OrderGift_DoMorePlugout
"{E96B0085-6659-486b-A221-5042A042728D}" = Toolbox
"{EAF636A9-F664-4703-A659-85A894DA264F}" = Company of Heroes - FAKEMSI
"{ED1390DC-6910-4C77-97E2-579CAFE82F5B}" = Moorhuhn 4 Teile
"{ED3866E9-4F50-4A47-9945-58D5C97AB56F}" = Media Go
"{EF1ADA5A-0B1A-4662-8C55-7475A61D8B65}" = DeviceDiscovery
"{EF36A836-BF89-4A4F-B079-057B0C68C1E0}" = Sid Meier's Civilization IV Colonization
"{EF9E56EE-0243-4BAD-88F4-5E7508AA7D96}" = Destination Component
"{F11ADC64-C89E-47F4-A0B3-3665FF859397}" = WORLD IN CONFLICT
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F7529650-B9DB-481B-0089-A2AC3C2821C1}" = Die Sims 2: Nightlife
"{FBEF69BB-829C-8D4D-B299-497147916039}" = Catalyst Control Center Graphics Light
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CEP - Colour Enable Packages_is1" = CEP - Color Enable Package
"Cheat Engine 5.4_is1" = Cheat Engine 5.4
"Command and Conquer™ 3 Tiberium Wars™ Sprachsteuerung" = Command and Conquer™ 3 Tiberium Wars™ Sprachsteuerung 1.0.0.0 
"Company of Heroes" = Company of Heroes
"Free Video to iPod Converter_is1" = Free Video to iPod Converter version 3.2
"HijackThis" = HijackThis 2.0.2
"HP Imaging Device Functions" = HP Imaging Device Functions 11.0
"HP Photosmart Essential" = HP Photosmart Essential 3.0
"HP Smart Web Printing" = HP Smart Web Printing 4.60
"HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0
"HPExtendedCapabilities" = HP Customer Participation Program 11.0
"HPOCR" = OCR Software by I.R.I.S. 11.0
"ImgBurn" = ImgBurn
"InstallShield_{050C1C8E-4A4D-4C2F-B9AE-67E60EE91B7F}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.3 Patch
"InstallShield_{3BD633E0-4BF8-4499-9149-88F0767D449C}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.4 Patch
"InstallShield_{5D7767FA-7FE8-4627-9F09-AEF7A25F1E07}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.1 Patch
"InstallShield_{8503C901-85D7-4262-88D2-8D8B2A7B08B8}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.5 Multiplayer Patch
"InstallShield_{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch
"InstallShield_{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch
"InstallShield_{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2
"InstallShield_{E5141379-B2D9-4BBC-BB2A-5805541571DD}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.2 Patch
"Left 4 Dead" = Left 4 Dead
"LogMeIn Hamachi" = LogMeIn Hamachi
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Metin2_is1" = Metin2
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.5.9)" = Mozilla Firefox (3.5.9)
"NeroMultiInstaller!UninstallKey" = Nero Suite
"oZone3D.Net FurMark_is1" = oZone3D.Net FurMark v1.8.0
"Postal 2 Share The Pain" = Postal 2 Share The Pain
"PunkBusterSvc" = PunkBuster Services
"RollerCoaster Tycoon 3_is1" = RollerCoaster Tycoon 3
"Shop for HP Supplies" = Shop for HP Supplies
"Sims2Pack Clean Installer " = Sims2Pack Clean Installer 
"Steam App 240" = Counter-Strike: Source
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"VirtualCloneDrive" = VirtualCloneDrive
"VLC media player" = VLC media player 1.0.5
"WinRAR archiver" = WinRAR archiver
"Zygor Guides" = Zygor Guides
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"TeamSpeak 3 Client" = TeamSpeak 3 Client
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 23.05.2010 10:27:11 | Computer Name = Nico-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung RunDLL32.exe, Version 6.0.6000.16386, Zeitstempel
 0x4549b0e1, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000,
 Ausnahmecode 0xc0000005, Fehleroffset 0x01ada8ed,  Prozess-ID 0x1720, Anwendungsstartzeit
 01cafa840833212c.
 
Error - 23.05.2010 17:53:44 | Computer Name = Nico-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 24.05.2010 09:10:07 | Computer Name = Nico-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 24.05.2010 09:10:32 | Computer Name = Nico-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung hpqpsapp.exe, Version 110.0.226.11, Zeitstempel
 0x47e22104, fehlerhaftes Modul hpqpsapp.exe, Version 110.0.226.11, Zeitstempel 
0x47e22104, Ausnahmecode 0xc0000005, Fehleroffset 0x00176e77,  Prozess-ID 0xfb8, Anwendungsstartzeit
 01cafb427743b6a0.
 
Error - 24.05.2010 14:09:05 | Computer Name = Nico-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung javaw.exe, Version 6.0.200.2, Zeitstempel 0x4bc398b3,
 fehlerhaftes Modul java.dll, Version 6.0.200.2, Zeitstempel 0x4bc3c8dc, Ausnahmecode
 0xc0000005, Fehleroffset 0x00005875,  Prozess-ID 0x1158, Anwendungsstartzeit 01cafb6c31c7f4e0.
 
Error - 25.05.2010 12:16:20 | Computer Name = Nico-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 25.05.2010 13:51:32 | Computer Name = Nico-PC | Source = Application Hang | ID = 1002
Description = Programm gta_sa.exe, Version 0.0.0.0 arbeitet nicht mehr mit Windows
 zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
 für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
 zu suchen.  Prozess-ID: 860  Anfangszeit: 01cafc310e6120fd  Zeitpunkt der Beendigung:
 206
 
Error - 25.05.2010 14:07:49 | Computer Name = Nico-PC | Source = Avira AntiVir | ID = 4118
Description = AUSNAHMEFEHLER beim Aufruf der Funktion <Scan> für die Datei  G:\Programme\AquaSoft\lol\a\r\Katie_Price_042[1].jpg.

 [ACCESS_VIOLATION Exception!! EIP = 0x218c258]   Bitte Avira informieren und die 
obige Datei übersenden!
 
Error - 25.05.2010 15:28:16 | Computer Name = Nico-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 26.05.2010 04:48:47 | Computer Name = Nico-PC | Source = WinMgmt | ID = 10
Description = 
 
[ Media Center Events ]
Error - 18.05.2009 08:45:55 | Computer Name = Nico-PC | Source = Media Center Guide | ID = 0
Description = Ereignisinformationen: ERROR: SqmApiWrapper.TimerRecord failed; Win32
 GetLastError returned 10000105  Prozess: DefaultDomain Objektname: Media Center Guide

 
Error - 09.08.2009 11:27:51 | Computer Name = Nico-PC | Source = Media Center Guide | ID = 0
Description = Ereignisinformationen: ERROR: SqmApiWrapper.TimerRecord failed; Win32
 GetLastError returned 10000105  Prozess: DefaultDomain Objektname: Media Center Guide

 
Error - 16.10.2009 06:39:03 | Computer Name = Nico-PC | Source = Mcx2Dvcs | ID = 401
Description = 
 
[ System Events ]
Error - 26.05.2010 11:40:33 | Computer Name = Nico-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk1\DR1.
 
Error - 26.05.2010 11:40:36 | Computer Name = Nico-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk1\DR1.
 
Error - 26.05.2010 11:41:39 | Computer Name = Nico-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk1\DR1.
 
Error - 26.05.2010 11:41:42 | Computer Name = Nico-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk1\DR1.
 
Error - 26.05.2010 11:42:48 | Computer Name = Nico-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk1\DR1.
 
Error - 26.05.2010 11:42:51 | Computer Name = Nico-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk1\DR1.
 
Error - 26.05.2010 11:43:54 | Computer Name = Nico-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk1\DR1.
 
Error - 26.05.2010 11:43:57 | Computer Name = Nico-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk1\DR1.
 
Error - 26.05.2010 11:45:00 | Computer Name = Nico-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk1\DR1.
 
Error - 26.05.2010 11:45:03 | Computer Name = Nico-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk1\DR1.
 
 
< End of report >

cosinus · 26.05.2010, 18:41

Zitat:

Error - 26.05.2010 11:43:57 | Computer Name = Nico-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk1\DR1.

Error - 26.05.2010 11:45:00 | Computer Name = Nico-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk1\DR1.

Error - 26.05.2010 11:45:03 | Computer Name = Nico-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk1\DR1.

Scheint so als hätte eine Deiner Festplatten ein Problem. Harddisk1 müsste die 2. Platte sein (Zählung fängt bei 0 an!) als diese hier:

Code:

ATTFilter

Drive G: | 465,76 Gb Total Space | 224,36 Gb Free Space | 48,17% Space Free | Partition Type: NTFS

Ist das eine externe Platte?

25.05.2010, 20:23	#6
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Habe ich einen Virus Was ist mit Malwarebytes? Das solltest Du vor OTL ausführen. __________________ --> Habe ich einen Virus

25.05.2010, 20:51	#9
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Habe ich einen Virus Ja, ein frisches OTL-Log wäre gut, da sich durch Malwarebytes ja wieder das System verändert hat. __________________ Logfiles bitte immer in CODE-Tags posten

26.05.2010, 13:08	#13
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Habe ich einen Virus Das OTL-Log sieht ok aus, aber kannst Du nochmal das extras Log nachreichen? Du hast 2x das gleiche Log gepostet. __________________ Logfiles bitte immer in CODE-Tags posten

Habe ich einen Virus

Log-Analyse und Auswertung: Habe ich einen Virus