Internetexplorer sorgt für Werbe-Popups selbst wenn er nicht läuft

vanDamme65 · 27.06.2010, 13:20

Hi, leider habe ich seit gestern das Problem, das sich ab und zu via IE Werbung und Anzeigen öffnen. Zudem lagt ein Spiel, das dies bisher noch nie getan hat...
hier meine HiJack Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:17:22, on 27.06.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir Desktop\sched.exe
C:\Programme\Avira\AntiVir Desktop\avguard.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\Programme2\Kodak\printer\center\KodakSvc.exe
C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\system32\Prismsta.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
C:\Programme\Avira\AntiVir Desktop\avgnt.exe
C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Programme\REALTEK RTL8185 Wireless LAN Driver and Utility\RtWLan.exe
C:\Programme2\Logitech Touch Mouse Server\iTouch-Server-Win.exe
C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\WINDOWS\Tvacaa.exe
C:\Programme\Windows Live\Messenger\msnmsgr.exe
C:\Programme\Windows Live\Contacts\wlcomm.exe
C:\Programme\Windows Media Player\wmplayer.exe
C:\WINDOWS\system32\rundll32.exe
C:\DOKUME~1\*****\LOKALE~1\Temp\Td1.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme2\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.medion.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.aldi.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Prism_Utility] Prismsta.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PRISMSTA.EXE] PRISMSTA.EXE START
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Logitech Touch Mouse Server.lnk = C:\Programme2\Logitech Touch Mouse Server\iTouch-Server-Win.exe
O4 - Global Startup: McAfee Security Scan Plus.lnk = ?
O4 - Global Startup: REALTEK RTL8185 Wireless LAN Utility.lnk = ?
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra button: MedionShop - {07E3F115-C445-480D-94CB-ECA914A353CE} - hxxp://www.medionshop.de/ (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=hxxp://www.aldi.com
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - hxxp://software-dl.real.com/04a30f04300bfbf27206/netzip/RdxIE601_de.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{109FBCD2-2EEF-4225-8CD1-73263321EE10}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{F1D17B61-9097-4B08-8A46-E43E61F637DE}: NameServer = 213.191.74.18,213.191.74.19
O17 - HKLM\System\CS1\Services\Tcpip\..\{109FBCD2-2EEF-4225-8CD1-73263321EE10}: NameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{109FBCD2-2EEF-4225-8CD1-73263321EE10}: NameServer = 192.168.1.1
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe
O23 - Service: CA-Lizenz-Client (CA_LIC_CLNT) - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: CA-Lizenzserver (CA_LIC_SRVR) - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Programme2\Common\Database\bin\fbserver.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Kodak AiO Device Service (KodakSvc) - Eastman Kodak Company - C:\Programme2\Kodak\printer\center\KodakSvc.exe
O23 - Service: Ereignisprotokoll-Überwachung (LogWatch) - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Programme\McAfee Security Scan\2.0.181\McCHSvc.exe
O23 - Service: UPnPService - Magix AG - C:\Programme\Gemeinsame Dateien\MAGIX Shared\UPnPService\UPnPService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--
End of file - 8689 bytes

Ich hoffe jemand kann mir helfen, grüße!

Larusso · 27.06.2010, 13:25

Eine Bereinigung ist mitunter mit viel Arbeit für Dich verbunden.

Bitte arbeite alle Schritte der Reihe nach ab.
Lese die Anleitungen sorgfältig. Sollte es Probleme geben, bitte stoppen und hier so gut es geht beschreiben.
Nur Scanns durchführen zu denen Du von einem Helfer aufgefordert wirst.
Bitte kein Crossposting ( posten in mehreren Foren).
Poste die Logfiles direkt in deinen Thread. Nicht anhängen ausser ich fordere Dich dazu auf. Erschwert mir nämlich das auswerten.

Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der Schnellere und immer der sicherste Weg.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist.

Vista und Win7 User
Alle Tools mit Rechtsklick "als Administrator ausführen" starten.

Schritt 1

Bitte lasse die Dateien aus der Code-Box bei Virustotal überprüfen

Code:

ATTFilter

C:\WINDOWS\Tvacaa.exe

Also gehe wie hier beschrieben vor:

Öffne diese Webseite: virustotal
Klicke auf "Durchsuchen"
Suche die Datei auf deinem Rechner--> Doppelklick auf die zu prüfende Datei (oder kopiere den Inhalt ab aus der Codebox)
"Senden der Datei"
Warte, bis der Scandurchlauf aller Virenscanner beendet ist
Auf "Filter" klicken
dann auf "Ergebnisse"
das Ergebnis (wie Du es bekommst )
komplett markieren und hier rein kopieren

Sollte die Datei als schädlich erkannt werden bitte noch nicht entfernen

Schritt 2

Downloade Dir bitte Load.exe

Das Tool benötigt eine aktive Internetverbindung, aber keinen offenen Browser
Sollte deine Firewall meckern, die Anwendung bitte zulassen.

Speichere die Datei am Desktop.
Doppelklick auf die load.exe
Belasse die Häckchen wie sie sind.
Schließe nun alle offenen Programme.
Klicke auf Download
Bitte während dem Download nicht in das Fenster klicken.
Folge den Anweisungen auf dem Bildschirm.
Wenn das Fenster Status aufpoppt klicke Start.

Nach dem Neustart findest Du einen Ordner MFTools auf dem Desktop. Darin befindet sich eine Anleitung.pdf.
Diese bitte öffnen und die darin beschriebenen Schritte abarbeiten.

vanDamme65 · 28.06.2010, 11:21

so das sind die ergebnisse von virustotal:

Antivirus Version letzte aktualisierung Ergebnis
a-squared 5.0.0.30 2010.06.27 -
AhnLab-V3 2010.06.27.01 2010.06.27 -
AntiVir 8.2.4.2 2010.06.25 -
Antiy-AVL 2.0.3.7 2010.06.25 -
Authentium 5.2.0.5 2010.06.26 -
Avast 4.8.1351.0 2010.06.27 Win32:MalOb-BL
Avast5 5.0.332.0 2010.06.27 Win32:MalOb-BL
AVG 9.0.0.836 2010.06.27 FakeAV.CCQ
BitDefender 7.2 2010.06.27 -
CAT-QuickHeal 10.00 2010.06.26 -
ClamAV 0.96.0.3-git 2010.06.26 -
Comodo 5233 2010.06.27 -
DrWeb 5.0.2.03300 2010.06.27 -
eSafe 7.0.17.0 2010.06.24 -
eTrust-Vet 36.1.7668 2010.06.25 Win32/Renos.D!generic
F-Prot 4.6.1.107 2010.06.26 -
F-Secure 9.0.15370.0 2010.06.26 Suspicious:W32/Malware!Gemini
Fortinet 4.1.133.0 2010.06.27 -
GData 21 2010.06.27 Win32:MalOb-BL
Ikarus T3.1.1.84.0 2010.06.27 -
Jiangmin 13.0.900 2010.06.27 -
Kaspersky 7.0.0.125 2010.06.27 -
McAfee 5.400.0.1158 2010.06.27 Downloader-CEW.b
McAfee-GW-Edition 2010.1 2010.06.25 -
Microsoft 1.5902 2010.06.27 -
NOD32 5232 2010.06.27 -
Norman 6.05.10 2010.06.27 -
nProtect 2010-06-27.02 2010.06.27 -
Panda 10.0.2.7 2010.06.27 -
PCTools 7.0.3.5 2010.06.27 -
Prevx 3.0 2010.06.27 High Risk Cloaked Malware
Rising 22.53.04.05 2010.06.25 -
Sophos 4.54.0 2010.06.27 Mal/FakeAV-CX
Sunbelt 6513 2010.06.27 VirTool.Win32.Obfuscator.hg!b (v)
Symantec 20101.1.0.89 2010.06.27 -
TheHacker 6.5.2.0.303 2010.06.25 -
TrendMicro 9.120.0.1004 2010.06.27 -
TrendMicro-HouseCall 9.120.0.1004 2010.06.27 -
VBA32 3.12.12.5 2010.06.25 -
ViRobot 2010.6.26.3907 2010.06.26 -
VirusBuster 5.0.27.0 2010.06.26 -
weitere Informationen
File size: 162816 bytes
MD5 : bbdf0667d1c692adedc1e978426e6cc8
SHA1 : d5af45b1449c753204b1571b146231d9f9f72a6c
SHA256: 5c5294f8abf57dd00f3456aba7606c014b23c9200b3a14cde690dbd2086916c7
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x44B0
timedatestamp.....: 0x4B2AC6F6 (Fri Dec 18 01:04:06 2009)
machinetype.......: 0x14C (Intel I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
CODE 0x1000 0x7097 0x7200 3.53 864c58e55fedc656092e8c339416864e
.data 0x9000 0x274 0x400 2.73 d28b173591273c1a0126ec27bba3864f
.tls 0xA000 0x1F879 0x1FA00 7.57 fa2bdde931e6e949d105e51417f5e849
.idata 0x2A000 0x1D36B 0x400 0.00 0f343b0931126a20f133d67c2b018a3b
DATA 0x48000 0x3FF 0x400 0.87 0df194e8a95a0f1157a508d583592796

( 12 imports )

> advapi32.dll: RegQueryValueExA, RegQueryValueA, RegEnumKeyA, RegCreateKeyA
> comctl32.dll: ImageList_Add, ImageList_Write, ImageList_DragShowNolock
> comdlg32.dll: GetSaveFileNameA, ChooseColorA, FindTextA, GetFileTitleA, GetOpenFileNameA
> gdi32.dll: GetCurrentPositionEx, SaveDC, BitBlt, CopyEnhMetaFileA, LineTo, CreateCompatibleDC, SetTextColor
> kernel32.dll: CreateFileA, CloseHandle, GetStringTypeA, SetEndOfFile, GetProcAddress, VirtualQuery, LoadResource, lstrcmpiA, ExitThread, GetModuleHandleA, LoadLibraryA, ReadFile, EnterCriticalSection, VirtualAlloc
> msvcrt.dll: malloc, strncmp, log, memcpy
> ole32.dll: CLSIDFromProgID, GetHGlobalFromStream, CoRevokeClassObject, CoTaskMemFree, OleRegGetUserType, CoGetContextToken, CoCreateFreeThreadedMarshaler
> oleaut32.dll: RegisterTypeLib
> shell32.dll: DragQueryFileA, SHGetFileInfoA
> shlwapi.dll: SHQueryInfoKeyA, SHGetValueA
> user32.dll: EnumThreadWindows, IsChild, GetWindowThreadProcessId, GetKeyboardType, GetFocus, GetTopWindow, SetMenu, CreateWindowExA, AdjustWindowRectEx, EnableScrollBar, IsDialogMessageA, IsWindowEnabled, GetDlgItem, GetWindowRect, GetDCEx, MessageBoxA, SetWindowPlacement, CharToOemA, SetScrollPos, SetClassLongA, SetMenuItemInfoA, KillTimer, DrawAnimatedRects, SetFocus, ActivateKeyboardLayout, GetMessagePos, GetKeyboardLayout, CallNextHookEx, GetMenuItemInfoA, EndPaint, DrawMenuBar, MsgWaitForMultipleObjects, GetMenuStringA, GetKeyboardLayoutList, SetParent, UpdateWindow, SetWindowLongA, EnumWindows, DestroyMenu, GetScrollPos, SendMessageA, FrameRect, GetActiveWindow, PtInRect, ScrollWindow, CloseClipboard, TrackPopupMenu, OemToCharA, InvalidateRect, RemoveMenu, InsertMenuA, SetClipboardData, RegisterWindowMessageA, GetKeyNameTextA, ScreenToClient, GetCapture, GetClassNameA, OffsetRect, ReleaseCapture, WaitMessage, RemovePropA, EnableWindow, LoadBitmapA, ShowOwnedPopups, IsDialogMessageW, SetWindowPos, SetScrollRange, GetClientRect, IsWindowVisible, DispatchMessageA, DrawTextA, EnableMenuItem, CharLowerBuffA, DestroyWindow, CharUpperBuffA, SendMessageW, LoadStringA, DefFrameProcA, IntersectRect, GetDesktopWindow, GetMenuItemID, GetScrollInfo, SetWindowTextA, DefMDIChildProcA, MapVirtualKeyA, SystemParametersInfoA, IsIconic, UnhookWindowsHookEx, UnregisterClassA, CreateIcon, InflateRect, ShowScrollBar, CreatePopupMenu, PostQuitMessage, EmptyClipboard, GetSubMenu, GetClassInfoA, SetForegroundWindow, BeginPaint, PeekMessageW, CallWindowProcA, CheckMenuItem, RedrawWindow, IsRectEmpty, ClientToScreen, GetSysColorBrush, TranslateMDISysAccel, PeekMessageA, SetWindowsHookExA, CreateMenu, IsWindow, DestroyCursor, GetClassLongA, SetCursor, SetActiveWindow, MessageBeep, OpenClipboard
> version.dll: VerQueryValueA

( 0 exports )
TrID : File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
Symantec reputation: Suspicious.Insight Suspicious.Insight | Symantec
ssdeep: 3072:FGXuq+tcCrVDq8azwbYSMMXF09dVPP6LkKtH+NuvJQT30:FMgigazIYS8xPC9teNwJM0
sigcheck: publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
Prevx Info: Prevx
PEiD : -
RDS : NSRL Reference Data Set

soll ich schritt 2 mit load.exe jetzt durchführen`?

Larusso · 28.06.2010, 11:30

Wäre nicht schlecht ja

vanDamme65 · 28.06.2010, 13:41

erledigt... von einer pdf mit aleitung war aber nichts da, lediglich der temp cleaner ist durchgelaufen ?!?! und zusätzlich hab ich ne zip aufm desktop "Gmer" enthält nur "Gmer.exe", was soll ich damit machen?

ansonsten hier noch mal die HiJack wenns was bringt:

HiJackthis Logfile:

Code:

ATTFilter

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:38:49, on 28.06.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir Desktop\sched.exe
C:\Programme\Avira\AntiVir Desktop\avguard.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\Programme2\Kodak\printer\center\KodakSvc.exe
C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\system32\Prismsta.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
C:\Programme\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Programme\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Programme\REALTEK RTL8185 Wireless LAN Driver and Utility\RtWLan.exe
C:\Programme2\Logitech Touch Mouse Server\iTouch-Server-Win.exe
C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme2\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.medion.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Welcome to ALDI
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Welcome to ALDI
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Prism_Utility] Prismsta.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PRISMSTA.EXE] PRISMSTA.EXE START
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [QNB2EB90WX] C:\DOKUME~1\Henri\LOKALE~1\Temp\Td1.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Logitech Touch Mouse Server.lnk = C:\Programme2\Logitech Touch Mouse Server\iTouch-Server-Win.exe
O4 - Global Startup: McAfee Security Scan Plus.lnk = ?
O4 - Global Startup: REALTEK RTL8185 Wireless LAN Utility.lnk = ?
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra button: MedionShop - {07E3F115-C445-480D-94CB-ECA914A353CE} - MEDIONshop Deutschland (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=hxxp://www.aldi.com
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - hxxp://software-dl.real.com/04a30f04300bfbf27206/netzip/RdxIE601_de.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{109FBCD2-2EEF-4225-8CD1-73263321EE10}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{F1D17B61-9097-4B08-8A46-E43E61F637DE}: NameServer = 213.191.74.18,213.191.74.19
O17 - HKLM\System\CS1\Services\Tcpip\..\{109FBCD2-2EEF-4225-8CD1-73263321EE10}: NameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{109FBCD2-2EEF-4225-8CD1-73263321EE10}: NameServer = 192.168.1.1
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe
O23 - Service: CA-Lizenz-Client (CA_LIC_CLNT) - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: CA-Lizenzserver (CA_LIC_SRVR) - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Programme2\Common\Database\bin\fbserver.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Kodak AiO Device Service (KodakSvc) - Eastman Kodak Company - C:\Programme2\Kodak\printer\center\KodakSvc.exe
O23 - Service: Ereignisprotokoll-Überwachung (LogWatch) - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Programme\McAfee Security Scan\2.0.181\McCHSvc.exe
O23 - Service: UPnPService - Magix AG - C:\Programme\Gemeinsame Dateien\MAGIX Shared\UPnPService\UPnPService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--
End of file - 8520 bytes

--- --- ---

Danke für die schnellen antworten, liebe Grüße, DAMME!!

Larusso · 28.06.2010, 13:46

Und kein Ordner MFTools auf dem Desktop ?

vanDamme65 · 01.07.2010, 00:05

doch, sry... wenn ich die aleitung jetzt aber befolge, dann habe ich probleme gmer.exe zu öffnen. die exe is auf dem desktop und kurz nachdem ich es öffne, kommt die fehlermeldung: "gmer.exe hat ein problem festgestellt und musste beendet werden... problem bericht senden/nicht senden."
bei senden spuct er den aber nicht aus.
bitte um hilfe, mittlerweile meckert avira noch mehr rum und teilweise kann ich nicht mal mehr den Firefox öffen, was soll ich tun, schritte 1 bis 3 aus pdf sind ausgeführt!

danke,

damme

vanDamme65 · 01.07.2010, 00:32

der neue kram vor dem mich antivir warnt heist glaub ich (name geht komischerweise weg nach paar sekunden: "sshnhs21.exe"
damme

vanDamme65 · 01.07.2010, 00:46

er sagt dahinter verbirgt sich das trojanische pferd "TR/codepack.kuw"

Larusso · 01.07.2010, 07:38

Steht da nicht, wenn Du Probleme bei einem Schritt hast, überspringen ?

vanDamme65 · 01.07.2010, 10:54

OTL.exe ist keine zulässige win32-anwendung... also funktionieren die beiden letzten schriotte leider nicht wie gehts weiter?

Larusso · 01.07.2010, 11:08

Sieht nach nem unfertigen Download aus.

CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer erneut herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die Textbox.

Code:

ATTFilter

netsvcs
%SYSTEMDRIVE%\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\drivers\*.sys /90
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
%systemroot%\system32\ws2help.dll /md5
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf .
Kopiere nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

vanDamme65 · 01.07.2010, 12:31

ÿþO T L E x t r a s l o g f i l e c r e a t e d o n : 0 1 . 0 7 . 2 0 1 0 1 3 : 1 1 : 0 3 - R u n 1

O T L b y O l d T i m e r - V e r s i o n 3 . 2 . 7 . 0 F o l d e r = C : \ D o k u m e n t e u n d E i n s t e l l u n g e n \ H e n r i \ D e s k t o p

W i n d o w s X P H o m e E d i t i o n S e r v i c e P a c k 3 ( V e r s i o n = 5 . 1 . 2 6 0 0 ) - T y p e = N T W o r k s t a t i o n

I n t e r n e t E x p l o r e r ( V e r s i o n = 6 . 0 . 2 9 0 0 . 5 5 1 2 )

L o c a l e : 0 0 0 0 0 4 0 7 | C o u n t r y : D e u t s c h l a n d | L a n g u a g e : D E U | D a t e F o r m a t : d d . M M . y y y y

1 , 0 0 G b T o t a l P h y s i c a l M e m o r y | 1 , 0 0 G b A v a i l a b l e P h y s i c a l M e m o r y | 6 5 , 0 0 % M e m o r y f r e e

2 , 0 0 G b P a g i n g F i l e | 1 , 0 0 G b A v a i l a b l e i n P a g i n g F i l e | 7 9 , 0 0 % P a g i n g F i l e f r e e

P a g i n g f i l e l o c a t i o n ( s ) : C : \ p a g e f i l e . s y s 7 6 8 1 5 3 6 [ b i n a r y d a t a ]

% S y s t e m D r i v e % = C : | % S y s t e m R o o t % = C : \ W I N D O W S | % P r o g r a m F i l e s % = C : \ P r o g r a m m e

D r i v e C : | 9 3 , 1 6 G b T o t a l S p a c e | 1 1 , 6 0 G b F r e e S p a c e | 1 2 , 4 6 % S p a c e F r e e | P a r t i t i o n T y p e : N T F S

D r i v e D : | 8 3 , 3 8 G b T o t a l S p a c e | 4 9 , 5 1 G b F r e e S p a c e | 5 9 , 3 8 % S p a c e F r e e | P a r t i t i o n T y p e : N T F S

D r i v e E : | 9 , 7 6 G b T o t a l S p a c e | 5 , 6 3 G b F r e e S p a c e | 5 7 , 7 4 % S p a c e F r e e | P a r t i t i o n T y p e : F A T 3 2

F : D r i v e n o t p r e s e n t o r m e d i a n o t l o a d e d

G : D r i v e n o t p r e s e n t o r m e d i a n o t l o a d e d

H : D r i v e n o t p r e s e n t o r m e d i a n o t l o a d e d

I : D r i v e n o t p r e s e n t o r m e d i a n o t l o a d e d

D r i v e P : | 6 , 6 7 M b T o t a l S p a c e | 0 , 0 0 M b F r e e S p a c e | 0 , 0 0 % S p a c e F r e e | P a r t i t i o n T y p e : C D F S

D r i v e Q : | 7 , 4 7 G b T o t a l S p a c e | 3 , 4 9 G b F r e e S p a c e | 4 6 , 6 6 % S p a c e F r e e | P a r t i t i o n T y p e : F A T 3 2

C o m p u t e r N a m e : H E N R I S P C

C u r r e n t U s e r N a m e : H e n r i

L o g g e d i n a s A d m i n i s t r a t o r .

C u r r e n t B o o t M o d e : N o r m a l

S c a n M o d e : C u r r e n t u s e r

C o m p a n y N a m e W h i t e l i s t : O n

S k i p M i c r o s o f t F i l e s : O n

F i l e A g e = 9 0 D a y s

O u t p u t = S t a n d a r d

Q u i c k S c a n

[ c o l o r = # E 5 6 7 1 7 ] = = = = = = = = = = E x t r a R e g i s t r y ( S a f e L i s t ) = = = = = = = = = = [ / c o l o r ]

[ c o l o r = # E 5 6 7 1 7 ] = = = = = = = = = = F i l e A s s o c i a t i o n s = = = = = = = = = = [ / c o l o r ]

[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ C l a s s e s \ < e x t e n s i o n > ]

[ H K E Y _ C U R R E N T _ U S E R \ S O F T W A R E \ C l a s s e s \ < e x t e n s i o n > ]

. h t m l [ @ = F i r e f o x H T M L ] - - C : \ P r o g r a m m e \ M o z i l l a F i r e f o x \ f i r e f o x . e x e ( M o z i l l a C o r p o r a t i o n )

[ c o l o r = # E 5 6 7 1 7 ] = = = = = = = = = = S h e l l S p a w n i n g = = = = = = = = = = [ / c o l o r ]

[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ C l a s s e s \ < k e y > \ s h e l l \ [ c o m m a n d ] \ c o m m a n d ]

b a t f i l e [ o p e n ] - - " % 1 " % *

c m d f i l e [ o p e n ] - - " % 1 " % *

c o m f i l e [ o p e n ] - - " % 1 " % *

e x e f i l e [ o p e n ] - - " % 1 " % *

h t m l f i l e [ e d i t ] - - " C : \ P r o g r a m m e \ M i c r o s o f t O f f i c e \ O f f i c e 1 2 \ m s o h t m e d . e x e " % 1 ( M i c r o s o f t C o r p o r a t i o n )

h t m l f i l e [ p r i n t ] - - " C : \ P r o g r a m m e \ M i c r o s o f t O f f i c e \ O f f i c e 1 2 \ m s o h t m e d . e x e " / p % 1 ( M i c r o s o f t C o r p o r a t i o n )

p i f f i l e [ o p e n ] - - " % 1 " % *

r e g f i l e [ m e r g e ] - - R e g E r r o r : K e y e r r o r .

s c r f i l e [ c o n f i g ] - - " % 1 "

s c r f i l e [ i n s t a l l ] - - r u n d l l 3 2 . e x e d e s k . c p l , I n s t a l l S c r e e n S a v e r % l ( M i c r o s o f t C o r p o r a t i o n )

s c r f i l e [ o p e n ] - - " % 1 " / S

t x t f i l e [ e d i t ] - - R e g E r r o r : K e y e r r o r .

U n k n o w n [ o p e n a s ] - - % S y s t e m R o o t % \ s y s t e m 3 2 \ r u n d l l 3 2 . e x e % S y s t e m R o o t % \ s y s t e m 3 2 \ s h e l l 3 2 . d l l , O p e n A s _ R u n D L L % 1

D i r e c t o r y [ f i n d ] - - % S y s t e m R o o t % \ E x p l o r e r . e x e ( M i c r o s o f t C o r p o r a t i o n )

D i r e c t o r y [ O n e N o t e . O p e n ] - - C : \ P R O G R A ~ 1 \ M I C R O S ~ 4 \ O f f i c e 1 2 \ O N E N O T E . E X E " % L " ( M i c r o s o f t C o r p o r a t i o n )

D i r e c t o r y [ W i n a m p . B o o k m a r k ] - - " C : \ P r o g r a m m e 2 \ W i n a m p \ w i n a m p . e x e " / B O O K M A R K " % 1 " ( N u l l s o f t , I n c . )

D i r e c t o r y [ W i n a m p . E n q u e u e ] - - " C : \ P r o g r a m m e 2 \ W i n a m p \ w i n a m p . e x e " / A D D " % 1 " ( N u l l s o f t , I n c . )

D i r e c t o r y [ W i n a m p . P l a y ] - - " C : \ P r o g r a m m e 2 \ W i n a m p \ w i n a m p . e x e " " % 1 " ( N u l l s o f t , I n c . )

F o l d e r [ o p e n ] - - % S y s t e m R o o t % \ E x p l o r e r . e x e / i d l i s t , % I , % L ( M i c r o s o f t C o r p o r a t i o n )

F o l d e r [ e x p l o r e ] - - % S y s t e m R o o t % \ E x p l o r e r . e x e / e , / i d l i s t , % I , % L ( M i c r o s o f t C o r p o r a t i o n )

D r i v e [ f i n d ] - - % S y s t e m R o o t % \ E x p l o r e r . e x e ( M i c r o s o f t C o r p o r a t i o n )

[ c o l o r = # E 5 6 7 1 7 ] = = = = = = = = = = S e c u r i t y C e n t e r S e t t i n g s = = = = = = = = = = [ / c o l o r ]

[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r ]

" A n t i V i r u s D i s a b l e N o t i f y " = 0

" F i r e w a l l D i s a b l e N o t i f y " = 0

" U p d a t e s D i s a b l e N o t i f y " = 0

" A n t i V i r u s O v e r r i d e " = 0

" F i r e w a l l O v e r r i d e " = 0

[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g ]

[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ A h n l a b A n t i V i r u s ]

[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ C o m p u t e r A s s o c i a t e s A n t i V i r u s ]

[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ K a s p e r s k y A n t i V i r u s ]

[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ M c A f e e A n t i V i r u s ]

[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ M c A f e e F i r e w a l l ]

[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ P a n d a A n t i V i r u s ]

[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ P a n d a F i r e w a l l ]

[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ S o p h o s A n t i V i r u s ]

[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ S y m a n t e c A n t i V i r u s ]

[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ S y m a n t e c F i r e w a l l ]

[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ T i n y F i r e w a l l ]

[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ T r e n d A n t i V i r u s ]

[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ T r e n d F i r e w a l l ]

[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ Z o n e L a b s F i r e w a l l ]

[ H K E Y _ L O C A L _ M A C H I N E \ S Y S T E M \ C u r r e n t C o n t r o l S e t \ S e r v i c e s \ S h a r e d A c c e s s \ P a r a m e t e r s \ F i r e w a l l P o l i c y \ D o m a i n P r o f i l e ]

[ H K E Y _ L O C A L _ M A C H I N E \ S Y S T E M \ C u r r e n t C o n t r o l S e t \ S e r v i c e s \ S h a r e d A c c e s s \ P a r a m e t e r s \ F i r e w a l l P o l i c y \ D o m a i n P r o f i l e \ G l o b a l l y O p e n P o r t s \ L i s t ]

" 1 3 9 : T C P " = 1 3 9 : T C P : * : E n a b l e d : @ x p s p 2 r e s . d l l , - 2 2 0 0 4

" 4 4 5 : T C P " = 4 4 5 : T C P : * : E n a b l e d : @ x p s p 2 r e s . d l l , - 2 2 0 0 5

" 1 3 7 : U D P " = 1 3 7 : U D P : * : E n a b l e d : @ x p s p 2 r e s . d l l , - 2 2 0 0 1

" 1 3 8 : U D P " = 1 3 8 : U D P : * : E n a b l e d : @ x p s p 2 r e s . d l l , - 2 2 0 0 2

[ H K E Y _ L O C A L _ M A C H I N E \ S Y S T E M \ C u r r e n t C o n t r o l S e t \ S e r v i c e s \ S h a r e d A c c e s s \ P a r a m e t e r s \ F i r e w a l l P o l i c y \ S t a n d a r d P r o f i l e ]

" E n a b l e F i r e w a l l " = 1

" D o N o t A l l o w E x c e p t i o n s " = 0

" D i s a b l e N o t i f i c a t i o n s " = 0

[ H K E Y _ L O C A L _ M A C H I N E \ S Y S T E M \ C u r r e n t C o n t r o l S e t \ S e r v i c e s \ S h a r e d A c c e s s \ P a r a m e t e r s \ F i r e w a l l P o l i c y \ S t a n d a r d P r o f i l e \ G l o b a l l y O p e n P o r t s \ L i s t ]

" 1 9 0 0 : U D P " = 1 9 0 0 : U D P : L o c a l S u b N e t : E n a b l e d : @ x p s p 2 r e s . d l l , - 2 2 0 0 7

" 2 8 6 9 : T C P " = 2 8 6 9 : T C P : L o c a l S u b N e t : E n a b l e d : @ x p s p 2 r e s . d l l , - 2 2 0 0 8

" 1 3 9 : T C P " = 1 3 9 : T C P : L o c a l S u b N e t : E n a b l e d : @ x p s p 2 r e s . d l l , - 2 2 0 0 4

" 4 4 5 : T C P " = 4 4 5 : T C P : L o c a l S u b N e t : E n a b l e d : @ x p s p 2 r e s . d l l , - 2 2 0 0 5

" 1 3 7 : U D P " = 1 3 7 : U D P : L o c a l S u b N e t : E n a b l e d : @ x p s p 2 r e s . d l l , - 2 2 0 0 1

" 1 3 8 : U D P " = 1 3 8 : U D P : L o c a l S u b N e t : E n a b l e d : @ x p s p 2 r e s . d l l , - 2 2 0 0 2

[ c o l o r = # E 5 6 7 1 7 ] = = = = = = = = = = A u t h o r i z e d A p p l i c a t i o n s L i s t = = = = = = = = = = [ / c o l o r ]

[ H K E Y _ L O C A L _ M A C H I N E \ S Y S T E M \ C u r r e n t C o n t r o l S e t \ S e r v i c e s \ S h a r e d A c c e s s \ P a r a m e t e r s \ F i r e w a l l P o l i c y \ D o m a i n P r o f i l e \ A u t h o r i z e d A p p l i c a t i o n s \ L i s t ]

" C : \ P r o g r a m m e \ W i n d o w s L i v e \ M e s s e n g e r \ w l c s d k . e x e " = C : \ P r o g r a m m e \ W i n d o w s L i v e \ M e s s e n g e r \ w l c s d k . e x e : * : E n a b l e d : W i n d o w s L i v e C a l l - - ( M i c r o s o f t C o r p o r a t i o n )

[ H K E Y _ L O C A L _ M A C H I N E \ S Y S T E M \ C u r r e n t C o n t r o l S e t \ S e r v i c e s \ S h a r e d A c c e s s \ P a r a m e t e r s \ F i r e w a l l P o l i c y \ S t a n d a r d P r o f i l e \ A u t h o r i z e d A p p l i c a t i o n s \ L i s t ]

" C : \ G a m e s \ p e s 2 0 0 8 \ P E S 2 0 0 8 . e x e " = C : \ G a m e s \ p e s 2 0 0 8 \ P E S 2 0 0 8 . e x e : * : E n a b l e d : P r o E v o l u t i o n S o c c e r 2 0 0 8 - - ( K O N A M I )

" C : \ P r o g r a m m e \ P i n n a c l e \ S h a r e d F i l e s \ P r o g r a m s \ S t r m S e r v e r \ S t r m S e r v e r . e x e " = C : \ P r o g r a m m e \ P i n n a c l e \ S h a r e d F i l e s \ P r o g r a m s \ S t r m S e r v e r \ S t r m S e r v e r . e x e : L o c a l S u b N e t : E n a b l e d : P i n n a c l e S t r e a m i n g S e r v e r - - ( P i n n a c l e S y s t e m s )

" C : \ G a m e s \ W a r h a m m e r 4 0 k \ W 4 0 k . e x e " = C : \ G a m e s \ W a r h a m m e r 4 0 k \ W 4 0 k . e x e : * : E n a b l e d : W 4 0 K - - ( R e l i c E n t e r t a i n m e n t I n c . )

" C : \ P r o g r a m m e \ M i c r o s o f t O f f i c e \ O f f i c e 1 2 \ O U T L O O K . E X E " = C : \ P r o g r a m m e \ M i c r o s o f t O f f i c e \ O f f i c e 1 2 \ O U T L O O K . E X E : * : E n a b l e d : M i c r o s o f t O f f i c e O u t l o o k - - ( M i c r o s o f t C o r p o r a t i o n )

" C : \ P r o g r a m m e \ M i c r o s o f t O f f i c e \ O f f i c e 1 2 \ G R O O V E . E X E " = C : \ P r o g r a m m e \ M i c r o s o f t O f f i c e \ O f f i c e 1 2 \ G R O O V E . E X E : * : E n a b l e d : M i c r o s o f t O f f i c e G r o o v e - - ( M i c r o s o f t C o r p o r a t i o n )

" C : \ P r o g r a m m e \ M i c r o s o f t O f f i c e \ O f f i c e 1 2 \ O N E N O T E . E X E " = C : \ P r o g r a m m e \ M i c r o s o f t O f f i c e \ O f f i c e 1 2 \ O N E N O T E . E X E : * : E n a b l e d : M i c r o s o f t O f f i c e O n e N o t e - - ( M i c r o s o f t C o r p o r a t i o n )

" C : \ P r o g r a m m e \ K O N A M I \ P r o E v o l u t i o n S o c c e r 2 0 0 9 \ p e s 2 0 0 9 . e x e " = C : \ P r o g r a m m e \ K O N A M I \ P r o E v o l u t i o n S o c c e r 2 0 0 9 \ p e s 2 0 0 9 . e x e : * : E n a b l e d : P r o E v o l u t i o n S o c c e r 2 0 0 9 - - ( K o n a m i D i g i t a l E n t e r t a i n m e n t C o . , L t d . )

" C : \ G a m e s \ C S S o u r c e \ h l 2 . e x e " = C : \ G a m e s \ C S S o u r c e \ h l 2 . e x e : * : E n a b l e d : h l 2 - - ( )

" C : \ G a m e s \ R a d s p o r t m a n a g e r P r o 2 0 0 5 - 2 0 0 6 \ C y m 2 0 0 5 . e x e " = C : \ G a m e s \ R a d s p o r t m a n a g e r P r o 2 0 0 5 - 2 0 0 6 \ C y m 2 0 0 5 . e x e : * : E n a b l e d : C y m 2 0 0 5 - - F i l e n o t f o u n d

" C : \ D o k u m e n t e u n d E i n s t e l l u n g e n \ H e n r i \ G a m e s \ T o m C l a n c y ' s H . A . W . X \ H A W X . e x e " = C : \ D o k u m e n t e u n d E i n s t e l l u n g e n \ H e n r i \ G a m e s \ T o m C l a n c y ' s H . A . W . X \ H A W X . e x e : * : E n a b l e d : T o m _ C l a n c y ' s _ H . A . W . X _ 1 - - F i l e n o t f o u n d

" C : \ D o k u m e n t e u n d E i n s t e l l u n g e n \ H e n r i \ G a m e s \ T o m C l a n c y ' s H . A . W . X \ H A W X _ d x 1 0 . e x e " = C : \ D o k u m e n t e u n d E i n s t e l l u n g e n \ H e n r i \ G a m e s \ T o m C l a n c y ' s H . A . W . X \ H A W X _ d x 1 0 . e x e : * : E n a b l e d : T o m _ C l a n c y ' s _ H . A . W . X _ 2 - - F i l e n o t f o u n d

" C : \ P r o g r a m m e \ E l e c t r o n i c A r t s \ E A D M \ C o r e . e x e " = C : \ P r o g r a m m e \ E l e c t r o n i c A r t s \ E A D M \ C o r e . e x e : * : E n a b l e d : E A D o w n l o a d M a n a g e r - - ( E l e c t r o n i c A r t s )

" C : \ G a m e s \ P e s 2 0 1 0 \ p e s 2 0 1 0 . e x e " = C : \ G a m e s \ P e s 2 0 1 0 \ p e s 2 0 1 0 . e x e : * : E n a b l e d : P r o E v o l u t i o n S o c c e r 2 0 1 0 - - F i l e n o t f o u n d

" C : \ P r o g r a m m e 2 \ i t u n e s \ i T u n e s . e x e " = C : \ P r o g r a m m e 2 \ i t u n e s \ i T u n e s . e x e : * : E n a b l e d : i T u n e s - - ( A p p l e I n c . )

" C : \ P r o g r a m m e \ W i n d o w s L i v e \ M e s s e n g e r \ w l c s d k . e x e " = C : \ P r o g r a m m e \ W i n d o w s L i v e \ M e s s e n g e r \ w l c s d k . e x e : * : E n a b l e d : W i n d o w s L i v e C a l l - - ( M i c r o s o f t C o r p o r a t i o n )

" C : \ P r o g r a m m e 2 \ L o g i t e c h T o u c h M o u s e S e r v e r \ i T o u c h - S e r v e r - W i n . e x e " = C : \ P r o g r a m m e 2 \ L o g i t e c h T o u c h M o u s e S e r v e r \ i T o u c h - S e r v e r - W i n . e x e : * : E n a b l e d : L o g i t e c h - - ( L o g i t e c h , I n c . )

" C : \ P r o g r a m m e \ R a y V \ R a y V \ R a y V . e x e " = C : \ P r o g r a m m e \ R a y V \ R a y V \ R a y V . e x e : * : E n a b l e d : R a y V - - F i l e n o t f o u n d

" C : \ P r o g r a m m e \ R a y V \ R a y V \ R a y V . d l l " = C : \ P r o g r a m m e \ R a y V \ R a y V \ R a y V . d l l : * : E n a b l e d : R a y V - - F i l e n o t f o u n d

[ c o l o r = # E 5 6 7 1 7 ] = = = = = = = = = = H K E Y _ L O C A L _ M A C H I N E U n i n s t a l l L i s t = = = = = = = = = = [ / c o l o r ]

[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ U n i n s t a l l ]

" { 0 0 2 D 9 D 5 E - 2 9 B A - 3 E 6 D - 9 B C 4 - 3 D 7 D 6 D B C 7 3 5 C } " = M i c r o s o f t V i s u a l C + + 2 0 0 8 A T L U p d a t e k b 9 7 3 9 2 4 - x 8 6 9 . 0 . 3 0 7 2 9 . 4 1 4 8

" { 0 0 4 F 0 4 0 7 - 7 8 E 1 - 1 1 D 2 - B 6 0 F - 0 0 6 0 9 7 C 9 9 8 E 7 } " = M i c r o s o f t A c c e s s 2 0 0 0 S R - 1 R u n t i m e

" { 0 2 E B D B B 9 - 4 6 0 0 - 4 1 D 3 - B 5 6 6 - 4 0 C B 8 6 1 5 1 1 D 2 } " = W o r l d o f W a r c r a f t F R E E T r i a l

" { 0 4 4 4 0 0 4 4 - 9 1 4 9 - 4 5 C 6 - A 8 0 6 - F 2 B F 9 C F C E 7 6 2 } " = M i c r o s o f t E n c a r t a E n z y k l o p ä d i e 2 0 0 4

" { 0 5 5 E E 5 9 D - 2 1 7 B - 4 3 A 7 - A B F F - 5 0 7 B 9 6 6 4 0 5 D 8 } " = A T I C a t a l y s t C o n t r o l C e n t e r

" { 0 6 F 8 0 0 1 7 - 8 F 9 8 - 4 C 9 4 - B 8 6 8 - 5 2 3 5 8 5 6 9 F C 3 2 } " = C o m m a n d & C o n q u e r G e n e r a l s

" { 0 7 2 8 7 1 2 3 - B 8 A C - 4 1 C E - 8 3 4 6 - 3 D 7 7 7 2 4 5 C 3 5 B } " = B o n j o u r

" { 0 9 9 6 C 3 3 1 - 6 D C B - 4 E 3 8 - A 3 E C - 0 A 7 7 A B A E 1 3 6 1 } " = H e l p _ C T R

" { 0 B E D B D 4 E - 2 D 3 4 - 4 7 B 5 - 9 9 7 3 - 5 7 E 6 2 B 2 9 3 0 7 C } " = A T I C o n t r o l P a n e l

" { 1 C E 5 9 6 5 6 - 4 1 0 4 - 4 4 A A - 0 0 B F - D 2 5 4 6 C 7 E A 4 9 7 } " = T i g e r W o o d s P G A T O U R 0 6

" { 1 E 0 2 4 0 3 C - C 4 6 9 - 4 9 3 7 - 9 B 9 4 - 7 D F 9 F 7 8 8 8 8 F A } " = S m a r t M a n a g e r

" { 2 0 5 C 6 B D D - 7 B 7 3 - 4 2 D E - 8 5 0 5 - 9 A 0 9 3 F 3 5 A 2 3 8 } " = W i n d o w s L i v e - U p l o a d t o o l

" { 2 1 D 3 9 3 D 7 - 6 7 1 1 - 4 6 7 0 - A 7 B A - 3 B 4 C 7 2 D 1 6 8 2 0 } " = T r e k S t o r i . B e a t c e b r a x

" { 2 2 B 7 7 5 E 7 - 6 C 4 2 - 4 F C 5 - 8 E 1 0 - 9 A 5 E 3 2 5 7 B D 9 4 } " = M S V C R T

" { 2 6 3 7 C 3 4 7 - 9 D A D - 1 1 D 6 - 9 E A 2 - 0 0 0 5 5 D 0 C A 7 6 1 } " = P o w e r C i n e m a 2 . 5

" { 2 8 3 F F B 2 3 - 8 7 5 1 - 4 B 0 8 - A C B 8 - 5 E 0 F 8 B C F 7 7 2 7 } " = P r o E v o l u t i o n S o c c e r 2 0 1 0

" { 2 A 9 7 D 5 B 3 - A 9 8 9 - 4 7 E 1 - B 2 0 7 - 1 C A 9 E 3 6 3 5 6 5 5 } " = a i o p r n t

" { 2 F D F D 6 0 0 - 7 3 3 8 - 4 7 3 8 - 9 0 D 5 - F C 4 A C A 0 8 D C 3 6 } " = P r o E v o l u t i o n S o c c e r 2 0 0 8

" { 3 0 C 1 0 E E 3 - E F B 3 - 4 B 7 A - 9 C D C - 5 0 7 9 0 C 2 B 5 2 0 0 } " = C A L i c e n s i n g

" { 3 1 D A B A 2 0 - 1 0 A 1 - 4 7 4 6 - 9 D 9 F - 5 7 9 5 5 B 8 D F F 6 6 } " = F r e e G a m e s O f f e r , D e s k t o p S h o r t c u t

" { 3 5 0 C 9 7 B 3 - 3 D 7 C - 4 E E 8 - B A A 9 - 0 0 B C B 3 D 5 4 2 2 7 } " = W e b F l d r s X P

" { 3 6 2 D 5 1 6 7 - 9 7 1 6 - 4 4 B E - 8 9 F D - B F 9 E B 6 E F 8 1 4 B } " = D a w n O f W a r

" { 3 B E D 0 2 3 8 - 3 A 2 5 - 4 1 A E - B C 2 3 - 3 1 6 9 1 4 B 5 B 0 4 8 } " = a i o o c r

" { 3 D 1 A 6 B 7 0 - 3 E 0 2 - 4 9 B C - 8 8 B 0 - 9 1 6 C 8 0 2 7 4 6 3 2 } " = I n f o r m a t i o n e n ü b e r I h r e n P C

" { 3 D E D 3 A 7 2 - 6 1 A 8 - 4 B 8 7 - 9 8 A 5 - E F 0 B C 8 0 3 8 A A 0 } " = D A E M O N T o o l s

" { 4 1 E 6 5 4 A 9 - 2 6 D 0 - 4 E A C - 8 5 4 B - 0 F A 8 2 4 F F F A B B } " = W i n d o w s L i v e M e s s e n g e r

" { 4 3 2 4 B C 9 3 - C 8 2 F - E D 1 6 - B A 8 6 - 5 E 3 4 B 9 E 0 5 3 0 3 } " = c c c - c o r e - s t a t i c

" { 4 3 D C F 7 6 6 - 6 8 3 8 - 4 F 9 A - 8 C 9 1 - D 9 2 D A 5 8 6 D F A 7 } " = M i c r o s o f t W i n d o w s - J o u r n a l - V i e w e r

" { 4 5 3 7 E A 4 B - F 6 0 3 - 4 1 8 1 - 8 9 F B - 2 9 5 3 F C 6 9 5 A B 1 } " = n e t b r d g

" { 4 5 E B D A 5 9 - D 3 3 B - 4 3 3 A - 9 5 6 E - B 2 F 2 3 6 4 6 8 B 5 6 } " = M U S I C M A T C H ( R ) J u k e b o x

" { 4 E A D 2 E 2 1 - 1 D 4 A - 4 E 2 B - A 0 8 2 - 8 D 0 8 9 6 1 5 3 9 C 9 } " = M i c r o s o f t W o r k s S u i t e - A d d - I n s f ü r M i c r o s o f t W o r d

" { 4 E D 1 1 8 E E - 7 8 5 C - C C 1 8 - 5 D 2 E - D 5 C A 4 B A A 0 3 F 0 } " = C a t a l y s t C o n t r o l C e n t e r G r a p h i c s F u l l N e w

" { 5 1 5 E 1 B 0 0 - E 2 B 4 - 4 9 7 5 - 9 9 0 0 - 9 5 F 6 6 0 7 7 C 3 A E } " = e T r u s t A n t i v i r u s R e g i s t r a t i o n

" { 5 2 B 9 7 2 1 8 - 9 8 C B - 4 B 8 B - 9 2 8 3 - D 2 1 3 C 8 5 E 1 A A 4 } " = W i n d o w s L i v e A n m e l d e - A s s i s t e n t

" { 5 3 9 4 7 5 B 7 - 4 4 B 7 - 8 B 0 A - 1 3 4 C - F 0 1 B 9 C 8 B 7 5 6 9 } " = c c c - c o r e - p r e i n s t a l l

" { 5 A C 7 A E 5 4 - 5 5 D F - 1 1 2 6 - 0 7 6 C - 6 2 3 F 0 0 8 D 4 0 B 6 } " = C a t a l y s t C o n t r o l C e n t e r G r a p h i c s F u l l E x i s t i n g

" { 5 B 6 8 0 7 5 0 - 7 6 0 B - 4 9 E 4 - 8 1 E 7 - 2 1 B 2 B 3 3 7 F 9 F 7 } " = M i c r o s o f t W o r k s

" { 5 F C 6 8 7 7 2 - 6 D 5 6 - 4 1 C 6 - 9 D F 1 - 2 4 E 8 6 8 1 9 8 A E 6 } " = W i n d o w s L i v e C a l l

" { 6 3 5 1 D 2 1 7 - 3 E E 3 - 1 9 6 7 - 2 9 B E - 6 A 7 7 6 3 5 F E 4 8 5 } " = S k i n s

" { 6 8 1 1 C A A 0 - B F 1 2 - 1 1 D 4 - 9 E A 1 - 0 0 5 0 B A E 3 1 7 E 1 } " = P o w e r D V D

" { 6 9 5 6 8 5 6 F - B 6 B 3 - 4 B E 0 - B A 0 B - 8 F 4 9 5 B E 3 2 0 3 3 } " = A p p l e S o f t w a r e U p d a t e

" { 6 A B 9 C D 3 A - F 9 1 F - 2 3 3 B - 9 2 3 B - 6 C 5 9 B A 6 3 5 2 4 D } " = C a t a l y s t C o n t r o l C e n t e r H y d r a V i s i o n F u l l

" { 7 1 6 E 0 3 0 6 - 8 3 1 8 - 4 3 6 4 - 8 B 8 F - 0 C C 4 E 9 3 7 6 B A C } " = M S X M L 4 . 0 S P 2 P a r s e r a n d S D K

" { 7 2 9 9 0 5 2 b - 0 2 a 4 - 4 6 2 7 - 8 1 f 2 - 1 8 1 8 d a 5 d 5 5 0 d } " = M i c r o s o f t V i s u a l C + + 2 0 0 5 R e d i s t r i b u t a b l e

" { 7 3 F 1 6 8 1 F - A D E 1 - 4 6 1 F - 9 F 1 8 - B 7 6 4 0 5 0 7 D 3 9 5 } " = k s d i p

" { 7 6 E F F C 7 C - 1 7 A 6 - 4 7 9 D - 9 E 4 7 - 8 E 6 5 8 C 1 6 9 5 A E } " = W i n d o w s - S i c h e r u n g s p r o g r a m m

" { 7 7 0 6 5 7 D 0 - A 1 2 3 - 3 C 0 7 - 8 E 4 4 - 1 C 8 3 E C 8 9 5 1 1 8 } " = M i c r o s o f t V i s u a l C + + 2 0 0 5 A T L U p d a t e k b 9 7 3 9 2 3 - x 8 6 8 . 0 . 5 0 7 2 7 . 4 0 5 3

" { 7 9 1 E 3 D 4 4 - 3 3 D 3 - 4 4 4 6 - 8 2 A D - 5 C D 4 B 0 1 6 9 0 8 3 } " = a i o f w

" { 7 9 E 4 1 D 9 1 - B A 1 C - 4 4 B 9 - 9 3 5 8 - 4 8 E 5 9 8 2 6 3 E C F } " = c e n t e r

" { 7 B 3 F 0 1 1 3 - E 6 3 C - 4 D 6 D - A F 1 9 - 1 1 1 A 3 1 6 5 C C A 2 } " = T e x t - T o - S p e e c h - R u n t i m e

" { 7 B 6 3 B 2 9 2 2 B 1 7 4 1 3 5 A F C 0 E 1 3 7 7 D D 8 1 E C 2 } " = D i v X C o d e c

" { 7 C 7 A C 2 D 4 - 1 0 7 7 - 4 5 C 8 - 8 2 6 A - 1 6 4 4 5 B 5 E 0 D B 7 } " = P i n n a c l e D i s t a n T V S e r v e r

" { 8 4 3 0 8 1 B D - 3 5 1 F - 4 6 F C - 8 A 1 7 - 5 1 7 A 0 D 9 1 1 7 A 3 } " = h e l p t u t

" { 8 5 A 9 1 C 2 2 - C 3 6 9 - F C F B - 5 F 1 F - D 5 9 E B 2 1 A D 0 E 1 } " = C C C H e l p E n g l i s h

" { 8 6 D 4 B 8 2 A - A B E D - 4 4 2 A - B E 8 6 - 9 6 3 5 7 B 7 0 F 4 F E } " = A s k T o o l b a r

" { 8 7 9 5 C B E D - 5 5 E 2 - 4 6 9 3 - 9 F 1 4 - 8 4 E C 4 4 6 9 3 5 B E } " = S p e e c h R e d i s t

" { 9 0 1 2 0 0 0 0 - 0 0 1 0 - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t S o f t w a r e U p d a t e f o r W e b F o l d e r s ( G e r m a n ) 1 2

" { 9 0 1 2 0 0 0 0 - 0 0 1 5 - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t O f f i c e A c c e s s M U I ( G e r m a n ) 2 0 0 7

" { 9 0 1 2 0 0 0 0 - 0 0 1 5 - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } _ E N T E R P R I S E _ { 9 B D 4 0 1 6 3 - B 9 5 D - 4 B 0 7 - 8 9 9 1 - 0 A B 7 7 5 B 6 D 8 8 B } " = M i c r o s o f t O f f i c e 2 0 0 7 S e r v i c e P a c k 2 ( S P 2 )

" { 9 0 1 2 0 0 0 0 - 0 0 1 6 - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t O f f i c e E x c e l M U I ( G e r m a n ) 2 0 0 7

" { 9 0 1 2 0 0 0 0 - 0 0 1 6 - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } _ E N T E R P R I S E _ { 9 B D 4 0 1 6 3 - B 9 5 D - 4 B 0 7 - 8 9 9 1 - 0 A B 7 7 5 B 6 D 8 8 B } " = M i c r o s o f t O f f i c e 2 0 0 7 S e r v i c e P a c k 2 ( S P 2 )

" { 9 0 1 2 0 0 0 0 - 0 0 1 8 - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t O f f i c e P o w e r P o i n t M U I ( G e r m a n ) 2 0 0 7

" { 9 0 1 2 0 0 0 0 - 0 0 1 8 - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } _ E N T E R P R I S E _ { 9 B D 4 0 1 6 3 - B 9 5 D - 4 B 0 7 - 8 9 9 1 - 0 A B 7 7 5 B 6 D 8 8 B } " = M i c r o s o f t O f f i c e 2 0 0 7 S e r v i c e P a c k 2 ( S P 2 )

" { 9 0 1 2 0 0 0 0 - 0 0 1 9 - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t O f f i c e P u b l i s h e r M U I ( G e r m a n ) 2 0 0 7

" { 9 0 1 2 0 0 0 0 - 0 0 1 9 - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } _ E N T E R P R I S E _ { 9 B D 4 0 1 6 3 - B 9 5 D - 4 B 0 7 - 8 9 9 1 - 0 A B 7 7 5 B 6 D 8 8 B } " = M i c r o s o f t O f f i c e 2 0 0 7 S e r v i c e P a c k 2 ( S P 2 )

" { 9 0 1 2 0 0 0 0 - 0 0 1 A - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t O f f i c e O u t l o o k M U I ( G e r m a n ) 2 0 0 7

" { 9 0 1 2 0 0 0 0 - 0 0 1 A - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } _ E N T E R P R I S E _ { 9 B D 4 0 1 6 3 - B 9 5 D - 4 B 0 7 - 8 9 9 1 - 0 A B 7 7 5 B 6 D 8 8 B } " = M i c r o s o f t O f f i c e 2 0 0 7 S e r v i c e P a c k 2 ( S P 2 )

" { 9 0 1 2 0 0 0 0 - 0 0 1 B - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t O f f i c e W o r d M U I ( G e r m a n ) 2 0 0 7

" { 9 0 1 2 0 0 0 0 - 0 0 1 B - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } _ E N T E R P R I S E _ { 9 B D 4 0 1 6 3 - B 9 5 D - 4 B 0 7 - 8 9 9 1 - 0 A B 7 7 5 B 6 D 8 8 B } " = M i c r o s o f t O f f i c e 2 0 0 7 S e r v i c e P a c k 2 ( S P 2 )

" { 9 0 1 2 0 0 0 0 - 0 0 1 F - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t O f f i c e P r o o f ( G e r m a n ) 2 0 0 7

" { 9 0 1 2 0 0 0 0 - 0 0 1 F - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } _ E N T E R P R I S E _ { A 0 5 1 6 4 1 5 - E D 6 1 - 4 1 9 A - 9 8 1 D - 9 3 5 9 6 D A 7 4 1 6 5 } " = M i c r o s o f t O f f i c e P r o o f i n g T o o l s 2 0 0 7 S e r v i c e P a c k 2 ( S P 2 )

" { 9 0 1 2 0 0 0 0 - 0 0 1 F - 0 4 0 9 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t O f f i c e P r o o f ( E n g l i s h ) 2 0 0 7

" { 9 0 1 2 0 0 0 0 - 0 0 1 F - 0 4 0 9 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } _ E N T E R P R I S E _ { A B D D E 9 7 2 - 3 5 5 B - 4 A F 1 - 8 9 A 8 - D A 5 0 B 7 B 5 C 0 4 5 } " = M i c r o s o f t O f f i c e P r o o f i n g T o o l s 2 0 0 7 S e r v i c e P a c k 2 ( S P 2 )

" { 9 0 1 2 0 0 0 0 - 0 0 1 F - 0 4 0 C - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t O f f i c e P r o o f ( F r e n c h ) 2 0 0 7

" { 9 0 1 2 0 0 0 0 - 0 0 1 F - 0 4 0 C - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } _ E N T E R P R I S E _ { F 5 8 0 D D D 5 - 8 D 3 7 - 4 9 9 8 - 9 6 8 E - E B B 7 6 B B 8 6 7 8 7 } " = M i c r o s o f t O f f i c e P r o o f i n g T o o l s 2 0 0 7 S e r v i c e P a c k 2 ( S P 2 )

" { 9 0 1 2 0 0 0 0 - 0 0 1 F - 0 4 1 0 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t O f f i c e P r o o f ( I t a l i a n ) 2 0 0 7

" { 9 0 1 2 0 0 0 0 - 0 0 1 F - 0 4 1 0 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } _ E N T E R P R I S E _ { 3 2 2 2 9 6 D 4 - 1 E A E - 4 0 3 0 - 9 F B C - D 2 7 8 7 E B 2 5 F A 2 } " = M i c r o s o f t O f f i c e P r o o f i n g T o o l s 2 0 0 7 S e r v i c e P a c k 2 ( S P 2 )

" { 9 0 1 2 0 0 0 0 - 0 0 2 C - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t O f f i c e P r o o f i n g ( G e r m a n ) 2 0 0 7

" { 9 0 1 2 0 0 0 0 - 0 0 3 0 - 0 0 0 0 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t O f f i c e E n t e r p r i s e 2 0 0 7

" { 9 0 1 2 0 0 0 0 - 0 0 3 0 - 0 0 0 0 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } _ E N T E R P R I S E _ { 0 B 3 6 C 6 D 6 - F 5 D 8 - 4 E A F - B F 9 4 - 4 3 7 6 A 2 3 0 A D 5 B } " = M i c r o s o f t O f f i c e 2 0 0 7 S e r v i c e P a c k 2 ( S P 2 )

" { 9 0 1 2 0 0 0 0 - 0 0 3 0 - 0 0 0 0 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } _ E N T E R P R I S E _ { 3 D 0 1 9 5 9 8 - 7 B 5 9 - 4 4 7 A - 8 0 A E - 8 1 5 B 7 0 3 B 8 4 F F } " = S e c u r i t y U p d a t e f o r M i c r o s o f t O f f i c e s y s t e m 2 0 0 7 ( 9 7 2 5 8 1 )

" { 9 0 1 2 0 0 0 0 - 0 0 4 4 - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t O f f i c e I n f o P a t h M U I ( G e r m a n ) 2 0 0 7

" { 9 0 1 2 0 0 0 0 - 0 0 4 4 - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } _ E N T E R P R I S E _ { 9 B D 4 0 1 6 3 - B 9 5 D - 4 B 0 7 - 8 9 9 1 - 0 A B 7 7 5 B 6 D 8 8 B } " = M i c r o s o f t O f f i c e 2 0 0 7 S e r v i c e P a c k 2 ( S P 2 )

" { 9 0 1 2 0 0 0 0 - 0 0 6 E - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t O f f i c e S h a r e d M U I ( G e r m a n ) 2 0 0 7

" { 9 0 1 2 0 0 0 0 - 0 0 6 E - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } _ E N T E R P R I S E _ { 2 6 4 5 4 C 2 6 - D 2 5 9 - 4 5 4 3 - A A 6 0 - 3 1 8 9 E 0 9 C 5 F 7 6 } " = M i c r o s o f t O f f i c e 2 0 0 7 S e r v i c e P a c k 2 ( S P 2 )

" { 9 0 1 2 0 0 0 0 - 0 0 A 1 - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t O f f i c e O n e N o t e M U I ( G e r m a n ) 2 0 0 7

" { 9 0 1 2 0 0 0 0 - 0 0 A 1 - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } _ E N T E R P R I S E _ { 9 B D 4 0 1 6 3 - B 9 5 D - 4 B 0 7 - 8 9 9 1 - 0 A B 7 7 5 B 6 D 8 8 B } " = M i c r o s o f t O f f i c e 2 0 0 7 S e r v i c e P a c k 2 ( S P 2 )

" { 9 0 1 2 0 0 0 0 - 0 0 B A - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t O f f i c e G r o o v e M U I ( G e r m a n ) 2 0 0 7

" { 9 0 1 2 0 0 0 0 - 0 0 B A - 0 4 0 7 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } _ E N T E R P R I S E _ { 9 B D 4 0 1 6 3 - B 9 5 D - 4 B 0 7 - 8 9 9 1 - 0 A B 7 7 5 B 6 D 8 8 B } " = M i c r o s o f t O f f i c e 2 0 0 7 S e r v i c e P a c k 2 ( S P 2 )

" { 9 5 1 2 0 0 0 0 - 0 0 B 9 - 0 4 0 9 - 0 0 0 0 - 0 0 0 0 0 0 0 F F 1 C E } " = M i c r o s o f t A p p l i c a t i o n E r r o r R e p o r t i n g

" { 9 6 6 5 B 3 2 5 - 3 F 9 6 - 1 1 D 6 - A 1 F A - 0 0 0 3 7 4 8 9 0 9 3 2 } " = T u n e U p U t i l i t i e s 2 0 0 3

" { 9 9 E C F 4 1 F - 5 C C A - 4 2 B D - B 8 B 8 - A 8 3 3 3 E 2 E 2 9 4 4 } " = i T u n e s

" { 9 A 2 5 3 0 2 D - 3 0 C 0 - 3 9 D 9 - B D 6 F - 2 1 E 6 E C 1 6 0 4 7 5 } " = M i c r o s o f t V i s u a l C + + 2 0 0 8 R e d i s t r i b u t a b l e - x 8 6 9 . 0 . 3 0 7 2 9 . 1 7

" { A 1 F 6 6 F C 9 - 1 1 E E - 4 F 2 F - 9 8 C 9 - 1 6 F 8 D 1 E 6 9 F B 7 } " = S e g o e U I

" { A 3 0 5 1 C D 0 - 2 F 6 4 - 3 8 1 3 - A 8 8 D - B 8 D C C D E 8 F 8 C 7 } " = M i c r o s o f t . N E T F r a m e w o r k 3 . 0 S e r v i c e P a c k 2

" { A 4 9 F 2 4 9 F - 0 C 9 1 - 4 9 7 F - 8 6 D F - B 2 5 8 5 E 8 E 7 6 B 7 } " = M i c r o s o f t V i s u a l C + + 2 0 0 5 R e d i s t r i b u t a b l e

" { A 6 D 0 1 4 0 F - E 6 2 F - 9 D 1 E - 2 4 0 8 - 9 C F F 9 1 F F 6 F C 8 } " = c c c - u t i l i t y

" { A 8 D B 6 1 1 A - D 8 0 E - 4 5 0 D - 8 5 F 6 - 3 A C D D 1 6 4 B E 3 1 } " = P r o E v o l u t i o n S o c c e r 2 0 0 9

" { A C 7 6 B A 8 6 - 7 A D 7 - 1 0 3 1 - 7 6 4 6 - 0 0 0 0 0 0 0 0 0 0 0 1 } " = A d o b e R e a d e r 6 . 0 - D e u t s c h

" { B 4 1 F 5 E D 6 - 4 D 6 7 - 4 F A A - B 7 8 7 - D 5 D F 1 D D 0 E C 8 0 } " = R E A L T E K R T L 8 1 8 5 W i r e l e s s L A N D r i v e r a n d U t i l i t y

" { B 7 A 0 C E 0 6 - 0 6 8 E - 1 1 D 6 - 9 7 F D - 0 0 5 0 B A C B F 8 6 1 } " = P o w e r P r o d u c e r

" { C 0 2 5 1 5 8 5 - 1 B E 8 - 4 2 7 8 - B 3 C B - 9 6 4 B 6 E 0 1 C 5 9 D } " = a i o s c n n r

" { C 0 9 F B 3 C D - 3 D 0 C - 3 F 2 D - 8 9 9 A - 6 A 1 D 6 7 F 2 0 7 3 F } " = M i c r o s o f t . N E T F r a m e w o r k 2 . 0 S e r v i c e P a c k 2

" { C 3 3 7 B D A F - C B 4 E - 4 7 E 2 - B E 1 A - C B 3 1 B B 7 D D 0 E 3 } " = A p p l e M o b i l e D e v i c e S u p p o r t

" { C 3 9 E 6 5 F 4 - 2 4 E F - 4 D C 5 - 9 F F 4 - F 9 1 F E 3 3 2 C 3 7 E } " = v i d e o n

" { C 4 4 A 7 4 2 2 - E 3 8 0 - 4 4 B E - 7 9 F E - 1 C 0 3 2 D 8 A 0 3 A 7 } " = C a t a l y s t C o n t r o l C e n t e r C o r e I m p l e m e n t a t i o n

" { C 7 3 4 0 5 7 1 - 7 7 7 3 - 4 A 8 C - 9 E B C - 4 E 4 2 4 3 B 3 8 C 7 6 } " = M i c r o s o f t X M L P a r s e r

" { C 7 8 E A C 6 F - 7 A 7 3 - 4 5 2 E - 8 1 3 4 - D B B 2 1 6 5 C 5 A 6 8 } " = Q u i c k T i m e

" { C B 0 9 9 8 9 0 - 1 D 5 F - 1 1 D 5 - 9 E A 9 - 0 0 5 0 B A E 3 1 7 E 1 } " = P o w e r D i r e c t o r

" { C B 2 F 7 E D D - 9 D 1 F - 4 3 C 1 - 9 0 F C - 4 F 5 2 E A E 1 7 2 A 1 } " = M i c r o s o f t . N E T F r a m e w o r k 1 . 1

" { C D 8 1 5 6 0 3 - A B 7 1 - 4 C F B - B 3 A C - 5 2 2 2 9 8 0 3 7 A C C } " = W 8 3 L 5 1 8 D

" { C E 2 C D D 6 2 - 0 1 2 4 - 3 6 C A - 8 4 D 3 - 9 F 4 D C F 5 C 5 B D 9 } " = M i c r o s o f t . N E T F r a m e w o r k 3 . 5 S P 1

" { C E B B 6 B F B - D 7 0 8 - 4 F 9 9 - A 6 3 3 - B C 2 6 0 0 E 0 1 E F 6 } " = B l u e t o o t h S t a c k f o r W i n d o w s b y S i t e c o m E u r o p e

" { D 1 9 5 5 A 3 A - E A 2 4 - 4 6 8 2 - 8 6 4 1 - 4 3 B 5 B 6 8 8 B 0 9 A } " = U S B W i r e l e s s K e y b o a r d D r i v e r

" { D 3 2 4 7 0 A 1 - B 1 0 C - 4 0 5 9 - B A 5 3 - C F 0 4 8 6 F 6 8 E B C } " = K O D A K A l l - i n - O n e - D r u c k e r s o f t w a r e

" { D 3 B 1 C 7 9 9 - C B 7 3 - 4 2 D E - B A 0 F - 2 3 4 4 7 9 3 A 0 9 5 C } " = C a t a l y s t C o n t r o l C e n t e r - B r a n d i n g

" { D B 0 2 F 7 1 6 - 6 2 7 5 - 4 2 E 9 - B 8 D 2 - 8 3 B A 2 B F 5 1 0 0 B } " = S F R

" { D B A 8 B 9 E 1 - C 6 F F - 4 6 2 4 - 9 5 9 8 - 7 3 D 3 B 4 1 A 0 9 0 3 } " = M i c r o s o f t P i c t u r e I t ! F o t o P r e m i u m 9

" { D C 6 2 6 A 2 1 - E D F 1 - 4 0 C 7 - 8 F 2 F - D 2 B A 7 5 3 5 5 2 9 F } " = h e l p u g

" { E 2 6 D E D C 7 - 1 A 9 9 - 4 F 8 C - 9 6 1 5 - 6 D B 1 1 2 E 6 4 9 5 B } _ i s 1 " = T e x a s H o l d ' e m P o k e r 3 D - D e l u x e E d i t i o n 1 . 0

" { E 2 A 0 7 5 3 4 - B 6 6 D - 4 F F 6 - B A 5 9 - E F 0 C B 9 C 4 2 1 1 1 } " = 8 0 2 . 1 1 G U t i l i t y

" { E 5 D 2 4 9 2 9 - 9 1 A 4 - B 0 A 1 - D E 0 0 - A F C 4 5 3 9 2 1 E F 7 } " = C a t a l y s t C o n t r o l C e n t e r G r a p h i c s L i g h t

" { E 6 C 0 9 B F B - B A 7 5 - 1 5 C 7 - 5 B 1 8 - A 2 C E 3 1 C 4 F 4 2 B } " = C a t a l y s t C o n t r o l C e n t e r G r a p h i c s P r e v i e w s C o m m o n

" { E 7 8 B F A 6 0 - 5 3 9 3 - 4 C 3 8 - 8 2 A B - E 8 0 1 9 E 4 6 4 E B 4 } " = M i c r o s o f t . N E T F r a m e w o r k 1 . 1 G e r m a n L a n g u a g e P a c k

" { E A 1 C B 7 A C - E 2 2 1 - 4 8 2 2 - A 7 8 9 - 0 A D B 0 5 1 D C 4 9 8 } " = M e d i o n F l a s h X L 2 . 0

" { E B B 7 9 4 E D - D 2 8 2 - 4 3 3 4 - 9 2 F B - 2 5 4 4 8 1 E F F 5 1 4 } " = P r o E v o l u t i o n S o c c e r 6

" { E D 0 0 D 0 8 A - 3 C 5 F - 4 8 8 D - 9 3 A 0 - A 0 4 F 2 1 F 2 3 9 5 6 } " = W i n d o w s L i v e C o m m u n i c a t i o n s P l a t f o r m

" { E F 7 E 9 3 1 D - D C 8 4 - 4 7 1 B - 8 D B 6 - A 8 3 3 5 8 0 9 5 4 7 4 } " = E A D o w n l o a d M a n a g e r

" { E F B 2 1 D E 7 - 8 C 1 9 - 4 A 8 8 - B B 2 8 - A 7 6 6 E 1 6 4 9 3 B C } " = A d o b e P h o t o s h o p C S

" { F 0 E 1 2 B B A - A D 6 6 - 4 0 2 2 - A 4 5 3 - A 1 C 8 A 0 C 4 D 5 7 0 } " = M i c r o s o f t C h o i c e G u a r d

" { F 3 8 A D C A 4 - A F 7 C - 4 C 7 3 - 9 0 2 1 - 6 F 1 E A 1 5 D 1 5 E A } " = P i n n a c l e T V C e n t e r P r o

" { F 6 5 6 D C 7 9 - 0 1 3 A - 4 6 8 3 - 8 6 9 2 - B 9 3 8 F C 0 0 B 9 4 1 } " = D k Z S t u d i o

" { F 8 F F 1 8 E E - 2 6 4 A - 4 3 F D - B 2 F 6 - 5 E A D 4 0 7 9 8 C 2 F } " = W i n d o w s L i v e E s s e n t i a l s

" { F C E 6 5 C 4 E - B 0 E 8 - 4 F B D - A D 1 6 - E D C B E 6 C D 5 9 1 F } " = H i g h M A T - E r w e i t e r u n g f ü r d e n M i c r o s o f t W i n d o w s X P - A s s i s t e n t e n z u m S c h r e i b e n v o n C D s

" 3 D R o u l e t t e " = 3 D R o u l e t t e 1 . 0

" 7 - Z i p " = 7 - Z i p 4 . 6 5

" A d o b e A c r o b a t 5 . 0 " = A d o b e A c r o b a t 5 . 0

" A d o b e F l a s h P l a y e r A c t i v e X " = A d o b e F l a s h P l a y e r 1 0 A c t i v e X

" A d o b e F l a s h P l a y e r P l u g i n " = A d o b e F l a s h P l a y e r 1 0 P l u g i n

" A d o b e S h o c k w a v e P l a y e r " = A d o b e S h o c k w a v e P l a y e r

" A l l A T I S o f t w a r e " = A T I - S o f t w a r e U n i n s t a l l U t i l i t y

" A m e r i c a O n l i n e d e " = A O L D e u t s c h l a n d

" A n t i - B l a x x _ i s 1 " = A n t i - B l a x x 1 . 1 7

" A n y V i d e o C o n v e r t e r _ i s 1 " = A n y V i d e o C o n v e r t e r 2 . 7 . 5

" A S A P I U p d a t e " = A S A P I U p d a t e

" A T I D i s p l a y D r i v e r " = A T I D i s p l a y D r i v e r

" A v i r a A n t i V i r D e s k t o p " = A v i r a A n t i V i r P e r s o n a l - F r e e A n t i v i r u s

" C - M e d i a A u d i o " = C - M e d i a 3 D A u d i o

" C o o l E d i t P r o 2 . 0 " = C o o l E d i t P r o 2 . 0

" D e r i v e 5 " = D e r i v e 5

" D L B P r o g _ i s 1 " = D L B P r o g 2 0 0 8 . 3 a

" D u n g e o n S i e g e 1 . 0 " = D u n g e o n S i e g e

" E N T E R P R I S E " = M i c r o s o f t O f f i c e E n t e r p r i s e 2 0 0 7

" E R U N T _ i s 1 " = E R U N T 1 . 1 j

" F i r e b i r d S Q L S e r v e r D " = F i r e b i r d S Q L S e r v e r - M A G I X E d i t i o n 2 . 0 . 0 . 1 ( D )

" F r e e A u d i o C D B u r n e r _ i s 1 " = F r e e A u d i o C D B u r n e r v e r s i o n 1 . 2

" F r e e V i d e o D u b _ i s 1 " = F r e e V i d e o D u b v e r s i o n 1 . 5

" F r e e Y o u T u b e t o M P 3 C o n v e r t e r _ i s 1 " = F r e e Y o u T u b e t o M P 3 C o n v e r t e r v e r s i o n 3 . 2

" F S X _ S c r e e n s a v e r " = F S X _ S c r e e n s a v e r

" G a a M o a ' s P l u g i n s f o r C o o l E d i t P r o " = G a a M o a ' s P l u g i n s f o r C o o l E d i t P r o

" G a m e C e n t e r " = G a m e C e n t e r

" G E L B E S E I T E N _ H A M B U R G _ 2 0 0 8 " = G e l b e S e i t e n f ü r H a m b u r g u n d U m g e b u n g 2 0 0 8

" G o l d W a v e v 5 . 2 0 " = G o l d W a v e v 5 . 2 0

" H i j a c k T h i s " = H i j a c k T h i s 2 . 0 . 2

" H i t m a n 2 : S i l e n t A s s a s s i n " = H i t m a n 2 : S i l e n t A s s a s s i n

" I n d e o ® s o f t w a r e " = I n d e o ® s o f t w a r e

" I n s t a l l S h i e l d _ { 0 6 F 8 0 0 1 7 - 8 F 9 8 - 4 C 9 4 - B 8 6 8 - 5 2 3 5 8 5 6 9 F C 3 2 } " = C o m m a n d & C o n q u e r G e n e r a l s

" I n s t a l l S h i e l d _ { 2 F D F D 6 0 0 - 7 3 3 8 - 4 7 3 8 - 9 0 D 5 - F C 4 A C A 0 8 D C 3 6 } " = P r o E v o l u t i o n S o c c e r 2 0 0 8

" I n s t a l l S h i e l d _ { 3 6 2 D 5 1 6 7 - 9 7 1 6 - 4 4 B E - 8 9 F D - B F 9 E B 6 E F 8 1 4 B } " = D a w n O f W a r

" I n s t a l l S h i e l d _ { E B B 7 9 4 E D - D 2 8 2 - 4 3 3 4 - 9 2 F B - 2 5 4 4 8 1 E F F 5 1 4 } " = P r o E v o l u t i o n S o c c e r 6

" I n s t a l l S h i e l d _ { E F 7 E 9 3 1 D - D C 8 4 - 4 7 1 B - 8 D B 6 - A 8 3 3 5 8 0 9 5 4 7 4 } " = E A D o w n l o a d M a n a g e r

" L o g i t e c h T o u c h M o u s e S e r v e r " = L o g i t e c h T o u c h M o u s e S e r v e r 1 . 0

" M A G I X M u s i c M a k e r T e c h n o E d i t i o n 2 D " = M A G I X M u s i c M a k e r T e c h n o E d i t i o n 2 4 . 0 . 0 . 1 0 ( D )

" M a l w a r e b y t e s ' A n t i - M a l w a r e _ i s 1 " = M a l w a r e b y t e s ' A n t i - M a l w a r e

" M c A f e e S e c u r i t y S c a n " = M c A f e e S e c u r i t y S c a n P l u s

" M e d i a S h o w " = M e d i @ S h o w

" M i c r o s o f t . N E T F r a m e w o r k 1 . 1 ( 1 0 3 3 ) " = M i c r o s o f t . N E T F r a m e w o r k 1 . 1

" M i c r o s o f t . N E T F r a m e w o r k 3 . 5 S P 1 " = M i c r o s o f t . N E T F r a m e w o r k 3 . 5 S P 1

" M o z i l l a F i r e f o x ( 3 . 6 . 3 ) " = M o z i l l a F i r e f o x ( 3 . 6 . 3 )

" M o z i l l a T h u n d e r b i r d ( 3 . 0 . 5 ) " = M o z i l l a T h u n d e r b i r d ( 3 . 0 . 5 )

" M S C o m p P a c k V 1 " = M i c r o s o f t C o m p r e s s i o n C l i e n t P a c k 1 . 0 f o r W i n d o w s X P

" N e r o - B u r n i n g R o m ! U n i n s t a l l K e y " = N e r o O E M

" N e r o V i s i o n ! U n i n s t a l l K e y " = N e r o V i s i o n E x p r e s s 2

" N M P U n i n s t a l l K e y " = N e r o M e d i a P l a y e r

" P i c t u r e I t _ v 9 " = M i c r o s o f t P i c t u r e I t ! F o t o P r e m i u m 9

" P S P M a x M e d i a M a n a g e r _ i s 1 " = P S P M a x M e d i a M a n a g e r

" P S P V i d e o C o n v e r t e r 3 " = P S P V i d e o C o n v e r t e r 3

" R e a l P l a y e r 6 . 0 " = R e a l O n e P l a y e r

" R e a s o n 4 _ i s 1 " = R e a s o n 4 . 0

" R i g h t d o w n S o f t w a r e R i g h t d o w n S o f t w a r e S e a r c h B a r " = R i g h t d o w n S o f t w a r e - T o o l b a r

" R o l l e r C o a s t e r T y c o o n S e t u p " = R o l l

" S a m s u n g M o b i l e U S B M o d e m " = S a m s u n g M o b i l e U S B M o d e m S o f t w a r e

" S h o c k w a v e " = S h o c k w a v e

" S t e i n b e r g W a v e L a b 5 . 0 0 a " = S t e i n b e r g W a v e L a b 5 . 0 0 a

" T B a s s 4 . e x e " = F i e l d & S t r e a m ® T r o p h y B a s s 4

" T o t a l A n n i h i l a t i o n : K i n g d o m s " = T o t a l A n n i h i l a t i o n : K i n g d o m s

" U n i n s t a l l _ i s 1 " = U n i n s t a l l 1 . 0 . 0 . 1

" U n r e a l T o u r n a m e n t " = U n r e a l T o u r n a m e n t

" V i e w p o i n t M e d i a P l a y e r " = V i e w p o i n t M e d i a P l a y e r

" W I C " = W i n d o w s I m a g i n g C o m p o n e n t

" W i n a m p " = W i n a m p

" W i n d o w s M e d i a F o r m a t R u n t i m e " = W i n d o w s M e d i a F o r m a t 1 1 r u n t i m e

" W i n d o w s M e d i a P l a y e r " = W i n d o w s M e d i a P l a y e r 1 1

" W i n d o w s X P S e r v i c e P a c k " = W i n d o w s X P S e r v i c e P a c k 3

" W i n L i v e S u i t e _ W a v e 3 " = W i n d o w s L i v e E s s e n t i a l s

" W i n R A R a r c h i v e r " = W i n R A R A r c h i v i e r e r

" W M F D i s t 1 1 " = W i n d o w s M e d i a F o r m a t 1 1 r u n t i m e

" w m p 1 1 " = W i n d o w s M e d i a P l a y e r 1 1

" W u d f 0 1 0 0 0 " = M i c r o s o f t U s e r - M o d e D r i v e r F r a m e w o r k F e a t u r e P a c k 1 . 0

" X 1 0 H a r d w a r e " = X 1 0 H a r d w a r e ( T M )

" X b o x _ 3 6 0 _ C C _ D r i v e r " = X b o x 3 6 0 C o n t r o l l e r f o r W i n d o w s

[ c o l o r = # E 5 6 7 1 7 ] = = = = = = = = = = H K E Y _ C U R R E N T _ U S E R U n i n s t a l l L i s t = = = = = = = = = = [ / c o l o r ]

[ H K E Y _ C U R R E N T _ U S E R \ S O F T W A R E \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ U n i n s t a l l ]

" W i n a m p D e t e c t " = W i n a m p D e t e c t o r P l u g - i n

[ c o l o r = # E 5 6 7 1 7 ] = = = = = = = = = = L a s t 1 0 E v e n t L o g E r r o r s = = = = = = = = = = [ / c o l o r ]

[ A p p l i c a t i o n E v e n t s ]

E r r o r - 2 8 . 0 6 . 2 0 1 0 1 4 : 4 3 : 1 0 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = A p p l i c a t i o n H a n g | I D = 1 0 0 2

D e s c r i p t i o n = S t i l l s t e h e n d e A n w e n d u n g w m p l a y e r . e x e , V e r s i o n 1 1 . 0 . 5 7 2 1 . 5 1 4 5 , S t i l l s t a n d m o d u l

h u n g a p p , V e r s i o n 0 . 0 . 0 . 0 , S t i l l s t a n d a d r e s s e 0 x 0 0 0 0 0 0 0 0 .

E r r o r - 2 8 . 0 6 . 2 0 1 0 1 4 : 4 3 : 2 0 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = A p p l i c a t i o n H a n g | I D = 1 0 0 2

D e s c r i p t i o n = S t i l l s t e h e n d e A n w e n d u n g w m p l a y e r . e x e , V e r s i o n 1 1 . 0 . 5 7 2 1 . 5 1 4 5 , S t i l l s t a n d m o d u l

h u n g a p p , V e r s i o n 0 . 0 . 0 . 0 , S t i l l s t a n d a d r e s s e 0 x 0 0 0 0 0 0 0 0 .

E r r o r - 2 8 . 0 6 . 2 0 1 0 1 4 : 4 6 : 0 8 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = A p p l i c a t i o n H a n g | I D = 1 0 0 2

D e s c r i p t i o n = S t i l l s t e h e n d e A n w e n d u n g w m p l a y e r . e x e , V e r s i o n 1 1 . 0 . 5 7 2 1 . 5 1 4 5 , S t i l l s t a n d m o d u l

h u n g a p p , V e r s i o n 0 . 0 . 0 . 0 , S t i l l s t a n d a d r e s s e 0 x 0 0 0 0 0 0 0 0 .

E r r o r - 3 0 . 0 6 . 2 0 1 0 1 8 : 3 4 : 3 7 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = A p p l i c a t i o n E r r o r | I D = 1 0 0 0

D e s c r i p t i o n = F e h l g e s c h l a g e n e A n w e n d u n g g m e r . e x e , V e r s i o n 1 . 0 . 1 5 . 1 5 2 8 1 , f e h l g e s c h l a g e n e s

M o d u l g m e r . e x e , V e r s i o n 1 . 0 . 1 5 . 1 5 2 8 1 , F e h l e r a d r e s s e 0 x 0 0 0 5 c 8 8 7 .

E r r o r - 3 0 . 0 6 . 2 0 1 0 1 8 : 3 5 : 1 0 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = A p p l i c a t i o n E r r o r | I D = 1 0 0 0

D e s c r i p t i o n = F e h l g e s c h l a g e n e A n w e n d u n g g m e r . e x e , V e r s i o n 1 . 0 . 1 5 . 1 5 2 8 1 , f e h l g e s c h l a g e n e s

M o d u l g m e r . e x e , V e r s i o n 1 . 0 . 1 5 . 1 5 2 8 1 , F e h l e r a d r e s s e 0 x 0 0 0 5 c 8 8 7 .

E r r o r - 3 0 . 0 6 . 2 0 1 0 1 8 : 3 6 : 0 1 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = A p p l i c a t i o n E r r o r | I D = 1 0 0 0

D e s c r i p t i o n = F e h l g e s c h l a g e n e A n w e n d u n g g m e r . e x e , V e r s i o n 1 . 0 . 1 5 . 1 5 2 8 1 , f e h l g e s c h l a g e n e s

M o d u l g m e r . e x e , V e r s i o n 1 . 0 . 1 5 . 1 5 2 8 1 , F e h l e r a d r e s s e 0 x 0 0 0 5 c 8 8 7 .

E r r o r - 3 0 . 0 6 . 2 0 1 0 1 8 : 4 4 : 1 7 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = A p p l i c a t i o n E r r o r | I D = 1 0 0 0

D e s c r i p t i o n = F e h l g e s c h l a g e n e A n w e n d u n g g m e r . e x e , V e r s i o n 1 . 0 . 1 5 . 1 5 2 8 1 , f e h l g e s c h l a g e n e s

M o d u l g m e r . e x e , V e r s i o n 1 . 0 . 1 5 . 1 5 2 8 1 , F e h l e r a d r e s s e 0 x 0 0 0 5 c 8 8 7 .

E r r o r - 3 0 . 0 6 . 2 0 1 0 1 8 : 4 7 : 5 4 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = A p p l i c a t i o n E r r o r | I D = 1 0 0 0

D e s c r i p t i o n = F e h l g e s c h l a g e n e A n w e n d u n g g m e r . e x e , V e r s i o n 1 . 0 . 1 5 . 1 5 2 8 1 , f e h l g e s c h l a g e n e s

M o d u l g m e r . e x e , V e r s i o n 1 . 0 . 1 5 . 1 5 2 8 1 , F e h l e r a d r e s s e 0 x 0 0 0 5 c 8 8 7 .

E r r o r - 3 0 . 0 6 . 2 0 1 0 1 9 : 0 1 : 4 0 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = A p p l i c a t i o n E r r o r | I D = 1 0 0 0

D e s c r i p t i o n = F e h l g e s c h l a g e n e A n w e n d u n g g m e r . e x e , V e r s i o n 1 . 0 . 1 5 . 1 5 2 8 1 , f e h l g e s c h l a g e n e s

M o d u l g m e r . e x e , V e r s i o n 1 . 0 . 1 5 . 1 5 2 8 1 , F e h l e r a d r e s s e 0 x 0 0 0 5 c 8 8 7 .

E r r o r - 3 0 . 0 6 . 2 0 1 0 1 9 : 0 1 : 4 4 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = A p p l i c a t i o n E r r o r | I D = 1 0 0 1

D e s c r i p t i o n = F e h l e r h a f t e r S p e i c h e r b e r e i c h 1 6 0 8 4 4 5 8 1 3 .

[ S y s t e m E v e n t s ]

E r r o r - 3 0 . 0 6 . 2 0 1 0 1 8 : 1 4 : 2 5 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = S e r v i c e C o n t r o l M a n a g e r | I D = 7 0 3 4

D e s c r i p t i o n = D i e n s t " W A N M i n i p o r t ( A T W ) S e r v i c e " w u r d e u n e r w a r t e t b e e n d e t . D i e s

i s t b e r e i t s 1 M a l p a s s i e r t .

E r r o r - 3 0 . 0 6 . 2 0 1 0 1 8 : 1 4 : 2 5 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = S e r v i c e C o n t r o l M a n a g e r | I D = 7 0 3 4

D e s c r i p t i o n = D i e n s t " M c A f e e S e c u r i t y S c a n C o m p o n e n t H o s t S e r v i c e " w u r d e u n e r w a r t e t

b e e n d e t . D i e s i s t b e r e i t s 1 M a l p a s s i e r t .

E r r o r - 3 0 . 0 6 . 2 0 1 0 1 8 : 5 7 : 4 8 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = W i n d o w s U p d a t e A g e n t | I D = 2 0

D e s c r i p t i o n = I n s t a l l a t i o n s f e h l e r : D i e I n s t a l l a t i o n d e s f o l g e n d e n U p d a t e s i s t m i t

F e h l e r 0 x 8 0 0 7 0 6 4 3 f e h l g e s c h l a g e n : W i n d o w s I n t e r n e t E x p l o r e r 7 f ü r W i n d o w s X P

E r r o r - 0 1 . 0 7 . 2 0 1 0 0 6 : 3 7 : 1 2 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = S e r v i c e C o n t r o l M a n a g e r | I D = 7 0 3 4

D e s c r i p t i o n = D i e n s t " A t i H o t K e y P o l l e r " w u r d e u n e r w a r t e t b e e n d e t . D i e s i s t b e r e i t s

1 M a l p a s s i e r t .

E r r o r - 0 1 . 0 7 . 2 0 1 0 0 6 : 3 7 : 1 2 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = S e r v i c e C o n t r o l M a n a g e r | I D = 7 0 3 1

D e s c r i p t i o n = D e r D i e n s t " A p p l e M o b i l e D e v i c e " w u r d e u n e r w a r t e t b e e n d e t . D i e s i s t

b e r e i t s 1 M a l v o r g e k o m m e n . F o l g e n d e K o r r e k t u r m a ß n a h m e n w e r d e n i n 6 0 0 0 0 M i l l i s e k u n d e n

d u r c h g e f ü h r t : S t a r t e n S i e d e n D i e n s t n e u . .

E r r o r - 0 1 . 0 7 . 2 0 1 0 0 6 : 3 7 : 1 2 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = S e r v i c e C o n t r o l M a n a g e r | I D = 7 0 3 4

D e s c r i p t i o n = D i e n s t " B o n j o u r - D i e n s t " w u r d e u n e r w a r t e t b e e n d e t . D i e s i s t b e r e i t s

1 M a l p a s s i e r t .

E r r o r - 0 1 . 0 7 . 2 0 1 0 0 6 : 3 7 : 1 2 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = S e r v i c e C o n t r o l M a n a g e r | I D = 7 0 3 4

D e s c r i p t i o n = D i e n s t " M a c h i n e D e b u g M a n a g e r " w u r d e u n e r w a r t e t b e e n d e t . D i e s i s t

b e r e i t s 1 M a l p a s s i e r t .

E r r o r - 0 1 . 0 7 . 2 0 1 0 0 6 : 3 7 : 1 2 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = S e r v i c e C o n t r o l M a n a g e r | I D = 7 0 3 4

D e s c r i p t i o n = D i e n s t " K o d a k A i O D e v i c e S e r v i c e " w u r d e u n e r w a r t e t b e e n d e t . D i e s i s t

b e r e i t s 1 M a l p a s s i e r t .

E r r o r - 0 1 . 0 7 . 2 0 1 0 0 6 : 3 7 : 1 2 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = S e r v i c e C o n t r o l M a n a g e r | I D = 7 0 3 4

D e s c r i p t i o n = D i e n s t " E r e i g n i s p r o t o k o l l - Ü b e r w a c h u n g " w u r d e u n e r w a r t e t b e e n d e t . D i e s

i s t b e r e i t s 1 M a l p a s s i e r t .

E r r o r - 0 1 . 0 7 . 2 0 1 0 0 6 : 3 7 : 1 3 | C o m p u t e r N a m e = H E N R I S P C | S o u r c e = S e r v i c e C o n t r o l M a n a g e r | I D = 7 0 3 4

D e s c r i p t i o n = D i e n s t " W A N M i n i p o r t ( A T W ) S e r v i c e " w u r d e u n e r w a r t e t b e e n d e t . D i e s

i s t b e r e i t s 1 M a l p a s s i e r t .

< E n d o f r e p o r t >

bitte um schnelle lösung, mittlerweile untersagt mir sshnas21.dll jegliches öffnen von firefox oder IE, ich bin an einem anderen pc jetzt zum schreiben,
vielen dank!

vanDamme65 · 01.07.2010, 12:32

OTL.txt:
OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 01.07.2010 13:11:03 - Run 1
OTL by OldTimer - Version 3.2.7.0     Folder = C:\Dokumente und Einstellungen\Henri\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 65,00% Memory free
2,00 Gb Paging File | 1,00 Gb Available in Paging File | 79,00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 93,16 Gb Total Space | 11,60 Gb Free Space | 12,46% Space Free | Partition Type: NTFS
Drive D: | 83,38 Gb Total Space | 49,51 Gb Free Space | 59,38% Space Free | Partition Type: NTFS
Drive E: | 9,76 Gb Total Space | 5,63 Gb Free Space | 57,74% Space Free | Partition Type: FAT32
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive P: | 6,67 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive Q: | 7,47 Gb Total Space | 3,49 Gb Free Space | 46,66% Space Free | Partition Type: FAT32
 
Computer Name: HENRISPC
Current User Name: Henri
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan
 
========== Processes (SafeList) ==========
 
PRC - [2010.07.01 12:45:42 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Henri\Desktop\OTL.exe
PRC - [2010.01.15 14:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee Security Scan\2.0.181\SSScheduler.exe
PRC - [2009.10.23 23:59:56 | 000,228,352 | ---- | M] (Logitech, Inc.) -- C:\Programme2\Logitech Touch Mouse Server\iTouch-Server-Win.exe
PRC - [2009.07.21 14:34:28 | 000,185,089 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2009.07.09 13:22:18 | 000,144,712 | ---- | M] (Apple Inc.) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
PRC - [2009.05.13 16:48:18 | 000,108,289 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2009.03.02 13:08:43 | 000,209,153 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2008.07.25 14:34:50 | 000,018,944 | ---- | M] (Eastman Kodak Company) -- C:\Programme2\Kodak\Printer\Center\KodakSvc.exe
PRC - [2008.07.18 14:08:34 | 001,306,624 | ---- | M] (Eastman Kodak Company) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\EKIJ5000MUI.exe
PRC - [2008.05.04 16:02:26 | 004,603,904 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\U3\0774100ED89203BB\LaunchPad.exe
PRC - [2008.04.14 08:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006.10.26 13:45:04 | 000,293,376 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\WISPTIS.EXE
PRC - [2006.05.22 18:24:02 | 000,675,840 | ---- | M] (Realtek Semiconductor Corp.) -- C:\Programme\REALTEK RTL8185 Wireless LAN Driver and Utility\RtWLan.exe
PRC - [2004.02.04 09:40:44 | 000,151,597 | ---- | M] (RealNetworks, Inc.) -- C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
PRC - [2004.01.14 17:09:56 | 000,215,552 | ---- | M] (Intersil Americas Inc.) -- C:\WINDOWS\system32\PRISMSTA.exe
PRC - [2003.12.30 00:33:16 | 000,094,208 | ---- | M] (ICSI Technology Ltd.) -- C:\WINDOWS\Dit.exe
PRC - [2003.12.05 09:49:28 | 000,065,536 | ---- | M] (America Online, Inc.) -- C:\WINDOWS\wanmpsvc.exe
PRC - [2002.09.20 17:29:30 | 000,053,248 | ---- | M] (Computer Associates) -- C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe
PRC - [2001.02.23 11:07:30 | 000,270,336 | ---- | M] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2010.07.01 12:45:42 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Henri\Desktop\OTL.exe
MOD - [2008.04.14 08:51:08 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2010.06.26 19:45:27 | 000,205,824 | ---- | M] () [Auto | Running] -- C:\WINDOWS\system32\sshnas21.dll -- (SSHNAS)
SRV - [2010.01.15 14:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Programme\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2009.07.21 14:34:28 | 000,185,089 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2009.07.09 13:22:18 | 000,144,712 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2009.05.13 16:48:18 | 000,108,289 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2008.11.04 02:06:28 | 000,441,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2008.07.25 14:34:50 | 000,018,944 | ---- | M] (Eastman Kodak Company) [Auto | Running] -- C:\Programme2\Kodak\printer\center\KodakSvc.exe -- (KodakSvc)
SRV - [2007.11.13 23:22:51 | 000,068,096 | ---- | M] () [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe -- (Adobe LM Service)
SRV - [2006.12.14 18:00:00 | 000,544,768 | ---- | M] (Magix AG) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\MAGIX Shared\UPnPService\UPnPService.exe -- (UPnPService)
SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2005.11.17 16:18:52 | 001,527,900 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Programme2\Common\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance)
SRV - [2005.04.04 01:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2003.12.05 09:49:28 | 000,065,536 | ---- | M] (America Online, Inc.) [Auto | Running] -- C:\WINDOWS\wanmpsvc.exe -- (WANMiniportService) WAN Miniport (ATW)
SRV - [2002.09.20 17:41:02 | 000,077,824 | ---- | M] (Computer Associates) [On_Demand | Stopped] -- C:\Programme\CA\SharedComponents\CA_LIC\lic98rmtd.exe -- (CA_LIC_SRVR)
SRV - [2002.09.20 17:29:30 | 000,053,248 | ---- | M] (Computer Associates) [Auto | Running] -- C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe -- (LogWatch)
SRV - [2002.09.20 17:27:06 | 000,077,824 | ---- | M] (Computer Associates) [On_Demand | Stopped] -- C:\Programme\CA\SharedComponents\CA_LIC\lic98rmt.exe -- (CA_LIC_CLNT)
SRV - [2001.11.12 14:31:48 | 000,020,480 | ---- | M] (X10) [On_Demand | Stopped] -- C:\Programme\Common Files\X10\Common\X10nets.exe -- (x10nets)
SRV - [2001.02.23 11:07:30 | 000,270,336 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe -- (MDM)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2010.07.01 12:41:03 | 000,013,440 | ---- | M] (ICSI Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\USBCRFT.SYS -- (CardReaderFilter)
DRV - [2009.11.25 12:19:02 | 000,056,816 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009.05.11 10:12:20 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.03.30 10:33:03 | 000,096,104 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2009.02.26 00:58:57 | 003,565,568 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2009.02.13 12:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2008.04.14 01:16:24 | 000,015,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mpe.sys -- (MPE)
DRV - [2007.06.14 15:41:00 | 000,466,048 | ---- | M] (LITEON) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Ltn_stk7070P.sys -- (Ltn_stk7070P)
DRV - [2007.06.13 20:30:20 | 000,013,440 | ---- | M] (LITEON) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Ltn_stkrc.sys -- (Ltn_stkrc)
DRV - [2007.05.03 14:37:08 | 000,022,152 | ---- | M] (Maxtor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mxopswd.sys -- (MXOPSWD)
DRV - [2005.09.13 18:32:00 | 000,034,816 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tosrfusb.sys -- (Tosrfusb)
DRV - [2005.08.26 23:10:20 | 000,108,672 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\TosRfbd.sys -- (Tosrfbd)
DRV - [2005.06.27 19:48:08 | 000,053,504 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\TosRfhid.sys -- (Tosrfhid)
DRV - [2005.06.27 09:14:35 | 000,066,560 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfvfs02.sys -- (sfvfs02) StarForce Protection VFS Driver (version 2.x)
DRV - [2005.05.17 14:48:21 | 000,050,176 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfdrv01.sys -- (sfdrv01) StarForce Protection Environment Driver (version 1.x)
DRV - [2005.05.16 15:23:38 | 000,019,968 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfsync02.sys -- (sfsync02) StarForce Protection Synchronization Driver (version 2.x)
DRV - [2005.05.16 15:20:39 | 000,006,656 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfhlp02.sys -- (sfhlp02) StarForce Protection Helper Driver (version 2.x)
DRV - [2005.04.06 10:54:44 | 000,050,048 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\TosRfSnd.sys -- (TosRfSnd) Bluetooth Audio Device (WDM)
DRV - [2005.03.30 13:42:54 | 000,047,230 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Tosporte.sys -- (tosporte)
DRV - [2005.01.06 14:42:42 | 000,018,612 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tosrfnds.sys -- (tosrfnds)
DRV - [2004.10.04 11:33:02 | 000,062,799 | ---- | M] (TOSHIBA Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tosrfcom.sys -- (Tosrfcom)
DRV - [2004.08.22 17:31:48 | 000,005,248 | ---- | M] ( ) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\d347prt.sys -- (d347prt)
DRV - [2004.08.22 17:31:10 | 000,155,136 | ---- | M] ( ) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\d347bus.sys -- (d347bus)
DRV - [2004.07.08 18:07:34 | 000,036,531 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tosrfbnp.sys -- (Tosrfbnp)
DRV - [2004.02.07 17:03:08 | 000,028,276 | ---- | M] (MusicMatch, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\MxlW2k.sys -- (MxlW2k)
DRV - [2004.01.16 14:02:58 | 000,017,408 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\x10ufx2.sys -- (XUIF)
DRV - [2004.01.16 10:31:56 | 000,380,736 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\PRISMA00.sys -- (PRISM_A00)
DRV - [2003.12.19 18:13:30 | 000,011,672 | ---- | M] (Chicony) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\UKBFLT.sys -- (UKBFLT)
DRV - [2003.12.05 19:46:36 | 000,010,368 | ---- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\pfc.sys -- (pfc)
DRV - [2003.12.05 09:34:20 | 000,033,588 | ---- | M] (America Online, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wanatw4.sys -- (wanatw) WAN Miniport (ATW)
DRV - [2003.06.12 11:47:42 | 000,024,704 | ---- | M] (Philips Semiconductors) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\PhTVTune.sys -- (PhTVTune)
DRV - [2003.06.05 11:04:22 | 000,350,752 | ---- | M] (Philips Semiconductors) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Cap7134.sys -- (Cap7134) MEDION (7134)
DRV - [2003.05.22 20:44:44 | 000,670,203 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctxs51.sys -- (Intels51)
DRV - [2002.10.16 14:55:48 | 000,002,851 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Toshidpt.sys -- (toshidpt)
DRV - [2002.10.02 10:57:12 | 000,013,532 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SjyPkt.sys -- (SjyPkt)
DRV - [2002.04.24 13:07:56 | 000,019,928 | ---- | M] (Winbond Electronics Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wbscr.sys -- (wbscr)
DRV - [2002.04.17 21:27:02 | 000,011,264 | ---- | M] (VOB Computersysteme GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\asapi.sys -- (Asapi)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = Welcome to ALDI
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Welcome to ALDI
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledItems: langpack-de@firefox.mozilla.org:3.6.818
FF - prefs.js..extensions.enabledItems: {25A1388B-6B18-46c3-BEBA-A81915D0DE8F}:1.7.0.1
FF - prefs.js..extensions.enabledItems: {c666c018-6409-4479-afa3-68e4129e7eff}:0.2.4
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.04.06 11:41:09 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.06.26 22:44:48 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.5\extensions\\Components: C:\Programme\Mozilla Thunderbird\components [2010.06.28 18:58:01 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.5\extensions\\Plugins: C:\Programme\Mozilla Thunderbird\plugins
 
[2010.03.04 22:38:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Mozilla\Extensions
[2010.03.04 22:38:56 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2010.07.01 01:07:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Mozilla\Firefox\Profiles\0nlzcu3e.default\extensions
[2010.03.21 13:47:53 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Mozilla\Firefox\Profiles\0nlzcu3e.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.03.04 21:40:34 | 000,000,000 | ---D | M] (Quick Locale Switcher) -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Mozilla\Firefox\Profiles\0nlzcu3e.default\extensions\{25A1388B-6B18-46c3-BEBA-A81915D0DE8F}
[2010.03.24 14:25:56 | 000,000,000 | ---D | M] (Leo Search) -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Mozilla\Firefox\Profiles\0nlzcu3e.default\extensions\{c666c018-6409-4479-afa3-68e4129e7eff}
[2010.03.04 21:35:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Mozilla\Firefox\Profiles\0nlzcu3e.default\extensions\langpack-de@firefox.mozilla.org
[2010.03.24 14:34:11 | 000,002,321 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Mozilla\Firefox\Profiles\0nlzcu3e.default\searchplugins\dictcc.xml
[2010.03.24 15:37:01 | 000,001,175 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Mozilla\Firefox\Profiles\0nlzcu3e.default\searchplugins\ebay-deutschland.xml
[2010.03.24 14:32:50 | 000,001,748 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Mozilla\Firefox\Profiles\0nlzcu3e.default\searchplugins\leo-deu-fra.xml
[2010.03.24 15:25:08 | 000,001,030 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Mozilla\Firefox\Profiles\0nlzcu3e.default\searchplugins\wikipedia-de-1.xml
[2010.03.24 15:25:09 | 000,001,030 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Mozilla\Firefox\Profiles\0nlzcu3e.default\searchplugins\wikipedia-de-2.xml
[2010.03.24 15:25:05 | 000,001,030 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Mozilla\Firefox\Profiles\0nlzcu3e.default\searchplugins\wikipedia-de.xml
[2010.03.24 14:21:08 | 000,002,057 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Mozilla\Firefox\Profiles\0nlzcu3e.default\searchplugins\youtube-videosuche.xml
[2010.03.04 20:38:35 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.05.25 18:09:48 | 000,063,488 | ---- | M] (Nullsoft, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npwachk.dll
[2010.04.06 11:41:03 | 000,001,538 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010.04.06 11:41:03 | 000,000,947 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010.04.06 11:41:03 | 000,000,769 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010.04.06 11:41:03 | 000,001,135 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-en-GB.xml
 
O1 HOSTS File: ([2002.08.29 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx ()
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [Cmaudio] C:\WINDOWS\CMICNFG.CPL (C-Media Corporation)
O4 - HKLM..\Run: [Dit] C:\WINDOWS\Dit.exe (ICSI Technology Ltd.)
O4 - HKLM..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\system32\spool\drivers\w32x86\3\EKIJ5000MUI.exe (Eastman Kodak Company)
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [Prism_Utility] C:\WINDOWS\System32\PRISMSTA.exe (Intersil Americas Inc.)
O4 - HKLM..\Run: [PRISMSTA.EXE] C:\WINDOWS\System32\PRISMSTA.exe (Intersil Americas Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\RunOnceEx: []  File not found
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\McAfee Security Scan Plus.lnk = C:\Programme\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\REALTEK RTL8185 Wireless LAN Utility.lnk = C:\Programme\REALTEK RTL8185 Wireless LAN Driver and Utility\RtWLan.exe (Realtek Semiconductor Corp.)
O4 - Startup: C:\Dokumente und Einstellungen\Henri\Startmenü\Programme\Autostart\Logitech Touch Mouse Server.lnk = C:\Programme2\Logitech Touch Mouse Server\iTouch-Server-Win.exe (Logitech, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab (Shockwave ActiveX Control)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} hxxp://office.microsoft.com/officeupdate/content/opuc.cab (Office Update Installation Engine)
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} hxxp://software-dl.real.com/04a30f04300bfbf27206/netzip/RdxIE601_de.cab (RdxIE Class)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38020.7125 (Reg Error: Key error.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Henri\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Henri\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004.02.03 20:34:08 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2008.05.06 14:26:23 | 000,000,309 | R--- | M] () - P:\autorun.inf -- [ CDFS ]
O33 - MountPoints2\{1b19811c-8821-11dd-a3c0-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{1b19811c-8821-11dd-a3c0-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{1b19811c-8821-11dd-a3c0-00038a000015}\Shell\AutoRun\command - "" = N:\LaunchU3.exe -- File not found
O33 - MountPoints2\{652309fe-1d80-11df-96ad-00038a000015}\Shell\AutoRun\command - "" = I:\SamsungSoftware\APPInst.exe -- File not found
O33 - MountPoints2\{91a8325e-a136-11de-9564-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{91a8325e-a136-11de-9564-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{91a8325e-a136-11de-9564-00038a000015}\Shell\AutoRun\command - "" = P:\LaunchU3.exe -- [2007.10.23 09:45:39 | 001,336,632 | R--- | M] ()
O33 - MountPoints2\{c1c86512-bd88-11de-95ad-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{c1c86512-bd88-11de-95ad-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{c1c86512-bd88-11de-95ad-00038a000015}\Shell\AutoRun\command - "" = I:\LaunchU3.exe -- File not found
O33 - MountPoints2\N\Shell\AutoRun\command - "" = N:\Toshiba\more4you.exe -- File not found
O33 - MountPoints2\P\Shell - "" = AutoRun
O33 - MountPoints2\P\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\P\Shell\AutoRun\command - "" = P:\LaunchU3.exe -- [2007.10.23 09:45:39 | 001,336,632 | R--- | M] ()
O34 - HKLM BootExecute: (autocheck autochk /r \??\M:) -  File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: 6to4 -  File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2004.02.03 20:33:47 | 000,000,000 | ---D | M]
NetSvcs: Iprip -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: Wmi - C:\WINDOWS\system32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp -  File not found
NetSvcs: SSHNAS - C:\WINDOWS\system32\sshnas21.dll ()
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)
 
========== Files/Folders - Created Within 90 Days ==========
 
[2010.07.01 12:45:29 | 000,574,464 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Henri\Desktop\OTL.exe
[2010.07.01 00:21:23 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010.06.28 14:29:56 | 000,000,000 | ---D | C] -- C:\Avenger
[2010.06.28 14:21:25 | 000,000,000 | ---D | C] -- C:\Programme\7-Zip
[2010.06.28 12:26:17 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Henri\Desktop\MFTools
[2010.06.27 03:00:23 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\TuneUp Software
[2010.06.26 22:44:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Winamp
[2010.06.26 19:26:04 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Henri\Eigene Dateien\Meine empfangenen Dateien
[2010.06.25 15:36:34 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Henri\Eigene Dateien\eigentümerversammlung
[2010.06.03 15:36:17 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Henri\Desktop\Anzeige
[2010.05.06 20:57:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Henri\Desktop\kopierte musik
[2010.05.05 23:41:13 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Malwarebytes
[2010.05.05 23:41:08 | 000,038,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.05.05 23:41:06 | 000,019,096 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.05.05 23:41:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2010.05.05 17:28:50 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Henri\Desktop\contentgmbh
[2010.05.03 14:35:48 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Henri\Desktop\Henri Studium
[2010.04.22 02:19:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\RayV
[2010.04.18 19:35:08 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Henri\Desktop\iphone
[2010.04.02 18:02:37 | 000,000,000 | ---D | C] -- C:\Programme\DVDVideoSoft
[2007.02.08 18:51:01 | 000,155,136 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\d347bus.sys
[2007.02.08 18:51:01 | 000,005,248 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\d347prt.sys
 
========== Files - Modified Within 90 Days ==========
 
[2010.07.01 12:45:42 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Henri\Desktop\OTL.exe
[2010.07.01 12:44:56 | 001,058,878 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010.07.01 12:44:56 | 000,454,160 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2010.07.01 12:44:56 | 000,436,790 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010.07.01 12:44:56 | 000,083,324 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2010.07.01 12:44:56 | 000,070,110 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010.07.01 12:41:03 | 000,013,440 | ---- | M] (ICSI Technology Ltd.) -- C:\WINDOWS\System32\drivers\USBCRFT.SYS
[2010.07.01 12:40:53 | 000,000,282 | -H-- | M] () -- C:\WINDOWS\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
[2010.07.01 12:40:53 | 000,000,282 | -H-- | M] () -- C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010.07.01 12:40:53 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.07.01 12:40:41 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.07.01 12:40:38 | 1341,706,240 | -HS- | M] () -- C:\hiberfil.sys
[2010.07.01 12:37:22 | 011,796,480 | -H-- | M] () -- C:\Dokumente und Einstellungen\Henri\NTUSER.DAT
[2010.07.01 12:37:22 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\Henri\ntuser.ini
[2010.07.01 00:20:22 | 000,000,584 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Desktop\NTREGOPT.lnk
[2010.07.01 00:20:22 | 000,000,565 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Desktop\ERUNT.lnk
[2010.07.01 00:00:19 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.06.28 20:43:03 | 000,026,692 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\wklnhst.dat
[2010.06.28 17:33:04 | 000,000,349 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\PCLECHAL.INI
[2010.06.28 12:28:23 | 000,284,915 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Desktop\Gmer.zip
[2010.06.27 02:58:23 | 000,062,464 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.06.27 02:34:59 | 003,707,130 | -H-- | M] () -- C:\Dokumente und Einstellungen\Henri\Lokale Einstellungen\Anwendungsdaten\IconCache.db
[2010.06.26 19:45:27 | 000,205,824 | ---- | M] () -- C:\WINDOWS\System32\sshnas21.dll
[2010.06.26 02:01:58 | 000,000,135 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010.06.19 11:22:19 | 000,034,889 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Eigene Dateien\kubb_bauplan.pdf
[2010.06.16 02:53:02 | 000,009,810 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Desktop\Zahlung Kicker.xlsx
[2010.06.09 23:12:19 | 000,348,200 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010.06.09 20:57:13 | 000,001,355 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010.06.02 22:17:05 | 050,783,831 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Desktop\doping_ndr_compl.mp3
[2010.05.26 12:48:28 | 000,602,990 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Desktop\B_000003.jpg
[2010.05.26 12:47:59 | 000,956,223 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Desktop\B_000002.jpg
[2010.04.15 02:52:49 | 000,000,190 | ---- | M] () -- C:\Dokumente und Einstellungen\Henri\Desktop\Verknüpfung mit Toshiba USB-HDD (N).lnk
 
========== Files Created - No Company Name ==========
 
[2010.07.01 00:32:11 | 000,293,376 | ---- | C] () -- C:\Dokumente und Einstellungen\Henri\Desktop\gmer.exe
[2010.07.01 00:20:22 | 000,000,584 | ---- | C] () -- C:\Dokumente und Einstellungen\Henri\Desktop\NTREGOPT.lnk
[2010.07.01 00:20:22 | 000,000,565 | ---- | C] () -- C:\Dokumente und Einstellungen\Henri\Desktop\ERUNT.lnk
[2010.06.28 12:28:15 | 000,284,915 | ---- | C] () -- C:\Dokumente und Einstellungen\Henri\Desktop\Gmer.zip
[2010.06.26 19:45:42 | 000,000,282 | -H-- | C] () -- C:\WINDOWS\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
[2010.06.26 19:45:35 | 000,000,282 | -H-- | C] () -- C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010.06.26 19:45:27 | 000,205,824 | ---- | C] () -- C:\WINDOWS\System32\sshnas21.dll
[2010.06.19 11:22:18 | 000,034,889 | ---- | C] () -- C:\Dokumente und Einstellungen\Henri\Eigene Dateien\kubb_bauplan.pdf
[2010.06.14 01:49:17 | 307,237,987 | ---- | C] () -- C:\Dokumente und Einstellungen\Henri\Desktop\5 Joanne K. Rowling - H. P. Und der Orden des Phönix (3. Teil).m4b
[2010.06.14 01:49:02 | 321,256,699 | ---- | C] () -- C:\Dokumente und Einstellungen\Henri\Desktop\5 Joanne K. Rowling - H. P. Und der Orden des Phönix (2. Teil).m4b
[2010.06.14 01:48:44 | 326,647,555 | ---- | C] () -- C:\Dokumente und Einstellungen\Henri\Desktop\5 Joanne K. Rowling - H. P. Und der Orden des Phönix (1. Teil).m4b
[2010.06.07 18:35:23 | 000,009,810 | ---- | C] () -- C:\Dokumente und Einstellungen\Henri\Desktop\Zahlung Kicker.xlsx
[2010.06.02 22:09:59 | 050,783,831 | ---- | C] () -- C:\Dokumente und Einstellungen\Henri\Desktop\doping_ndr_compl.mp3
[2010.05.27 18:27:46 | 000,956,223 | ---- | C] () -- C:\Dokumente und Einstellungen\Henri\Desktop\B_000002.jpg
[2010.05.27 18:27:46 | 000,602,990 | ---- | C] () -- C:\Dokumente und Einstellungen\Henri\Desktop\B_000003.jpg
[2010.04.04 13:00:09 | 001,285,847 | ---- | C] () -- C:\Dokumente und Einstellungen\Henri\Desktop\P1310052.JPG
[2010.04.04 12:59:29 | 001,260,439 | ---- | C] () -- C:\Dokumente und Einstellungen\Henri\Desktop\P1300050.JPG
[2010.04.04 12:59:29 | 001,232,414 | ---- | C] () -- C:\Dokumente und Einstellungen\Henri\Desktop\P1300051.JPG
[2010.04.04 12:59:29 | 001,205,695 | ---- | C] () -- C:\Dokumente und Einstellungen\Henri\Desktop\P1300047.JPG
[2010.04.04 12:59:29 | 001,088,432 | ---- | C] () -- C:\Dokumente und Einstellungen\Henri\Desktop\P1300049.JPG
[2009.09.28 19:27:57 | 000,000,387 | ---- | C] () -- C:\WINDOWS\retrieve.ini
[2009.08.18 17:47:31 | 000,000,042 | ---- | C] () -- C:\WINDOWS\IniFile1.ini
[2009.08.11 12:10:06 | 000,000,311 | ---- | C] () -- C:\WINDOWS\game.ini
[2009.01.10 14:41:15 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\Iyvu9_32.dll
[2009.01.10 12:54:32 | 000,012,800 | ---- | C] () -- C:\WINDOWS\System32\EKDeviceServices.dll
[2009.01.05 18:44:20 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\mgxasio2.dll
[2009.01.05 18:41:57 | 000,120,200 | ---- | C] () -- C:\WINDOWS\System32\DLLDEV32i.dll
[2008.05.20 13:26:11 | 000,000,032 | ---- | C] () -- C:\WINDOWS\CD_Start.INI
[2008.01.30 22:42:24 | 000,000,083 | ---- | C] () -- C:\WINDOWS\wwp.INI
[2008.01.26 16:17:56 | 000,000,327 | ---- | C] () -- C:\WINDOWS\SIERRA.INI
[2008.01.24 12:19:34 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL
[2008.01.12 21:40:08 | 000,000,098 | ---- | C] () -- C:\WINDOWS\WirelessFTP.INI
[2008.01.12 21:26:35 | 000,000,000 | ---- | C] () -- C:\WINDOWS\tosOBEX.INI
[2007.12.25 15:24:15 | 000,196,096 | ---- | C] () -- C:\WINDOWS\System32\MACD32.DLL
[2007.12.25 15:24:15 | 000,138,752 | ---- | C] () -- C:\WINDOWS\System32\MASE32.DLL
[2007.12.25 15:24:15 | 000,136,192 | ---- | C] () -- C:\WINDOWS\System32\MAMC32.DLL
[2007.12.25 15:24:15 | 000,057,856 | ---- | C] () -- C:\WINDOWS\System32\MASD32.DLL
[2007.12.25 15:24:15 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\MA32.DLL
[2007.09.20 12:33:52 | 003,190,784 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll
[2007.09.20 12:33:52 | 000,741,376 | ---- | C] () -- C:\WINDOWS\System32\audxlib.dll
[2007.09.20 12:33:52 | 000,511,488 | ---- | C] () -- C:\WINDOWS\System32\ff_x264.dll
[2007.09.20 12:33:52 | 000,405,504 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll
[2007.09.20 12:33:52 | 000,245,760 | ---- | C] () -- C:\WINDOWS\System32\ff_libfaad2.dll
[2007.09.20 12:33:52 | 000,221,184 | ---- | C] () -- C:\WINDOWS\System32\ff_kernelDeint.dll
[2007.09.20 12:33:52 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\TomsMoComp_ff.dll
[2007.09.20 12:33:52 | 000,155,648 | ---- | C] () -- C:\WINDOWS\System32\ff_libdts.dll
[2007.09.20 12:33:52 | 000,143,360 | ---- | C] () -- C:\WINDOWS\System32\ff_theora.dll
[2007.09.20 12:33:52 | 000,122,880 | ---- | C] () -- C:\WINDOWS\System32\ff_samplerate.dll
[2007.09.20 12:33:52 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\ff_libmad.dll
[2007.09.20 12:33:52 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\libmpeg2_ff.dll
[2007.09.20 12:33:52 | 000,097,280 | ---- | C] () -- C:\WINDOWS\System32\ff_realaac.dll
[2007.09.20 12:33:52 | 000,079,872 | ---- | C] () -- C:\WINDOWS\System32\ff_tremor.dll
[2007.09.20 12:33:52 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\ff_liba52.dll
[2007.09.20 12:33:52 | 000,038,400 | ---- | C] () -- C:\WINDOWS\System32\ff_unrar.dll
[2007.09.20 12:33:52 | 000,026,624 | ---- | C] () -- C:\WINDOWS\System32\ff_wmv9.dll
[2007.09.20 12:33:52 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2007.09.20 12:33:52 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2007.07.25 15:24:30 | 001,559,040 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2007.05.07 17:25:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\musicmaker.INI
[2007.05.07 17:08:10 | 000,000,334 | ---- | C] () -- C:\WINDOWS\BeatBox.INI
[2007.05.07 17:02:56 | 000,038,912 | ---- | C] () -- C:\WINDOWS\System32\mgxasio.dll
[2007.05.07 17:01:40 | 000,006,768 | ---- | C] () -- C:\WINDOWS\mgxoschk.ini
[2007.03.31 18:11:02 | 000,000,023 | ---- | C] () -- C:\WINDOWS\BlendSettings.ini
[2007.02.09 19:51:19 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2007.02.08 18:43:25 | 000,000,023 | ---- | C] () -- C:\WINDOWS\AOLMIcon.ini
[2006.12.07 02:00:50 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll
[2006.12.07 01:57:19 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2006.02.26 16:08:28 | 000,585,728 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2004.12.02 16:20:18 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\TosBtAcc.dll
[2004.09.22 11:09:06 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\TosCommAPI.dll
[2004.08.22 18:04:56 | 000,069,120 | ---- | C] () -- C:\WINDOWS\daemon.dll
[2004.07.20 18:04:02 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\TosBtHcrpAPI.dll
[2004.02.17 15:22:00 | 000,000,037 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2004.02.12 15:08:03 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\GetOSVer.dll
[2004.02.06 11:34:12 | 000,000,135 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2004.02.06 11:23:04 | 000,532,544 | ---- | C] () -- C:\WINDOWS\PIC.dll
[2004.02.06 11:23:04 | 000,049,152 | ---- | C] () -- C:\WINDOWS\CNYUSB.dll
[2004.02.06 11:23:04 | 000,024,576 | ---- | C] () -- C:\WINDOWS\HKCYDLL.dll
[2004.02.06 11:23:04 | 000,011,776 | ---- | C] () -- C:\WINDOWS\HIDMNT.dll
[2004.02.06 11:23:04 | 000,000,360 | ---- | C] () -- C:\WINDOWS\CNYHKey.ini
[2004.02.04 20:27:57 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2004.02.04 12:02:43 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2004.02.04 04:26:29 | 000,001,050 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2004.02.04 02:35:11 | 000,000,047 | ---- | C] () -- C:\WINDOWS\InoSetup.ini
[2004.02.04 02:30:46 | 000,003,776 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004.02.04 02:26:04 | 000,000,282 | ---- | C] () -- C:\WINDOWS\Dit.INI
[2004.02.04 02:14:06 | 000,028,672 | ---- | C] () -- C:\WINDOWS\CMIRMDRV.DLL
[2004.02.04 02:14:05 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\cmirmdrv.dll
[2004.02.04 02:14:05 | 000,003,424 | ---- | C] () -- C:\WINDOWS\cmiainfo.sys
[2004.02.04 02:14:05 | 000,000,092 | ---- | C] () -- C:\WINDOWS\CMISETUP.INI
[2004.02.04 02:14:05 | 000,000,026 | ---- | C] () -- C:\WINDOWS\CMCDPLAY.INI
[2004.02.04 02:14:02 | 000,028,672 | ---- | C] () -- C:\WINDOWS\CMIRmDriver.dll
[2004.02.03 20:36:59 | 000,000,863 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004.02.03 08:28:01 | 000,380,736 | ---- | C] () -- C:\WINDOWS\System32\drivers\PRISMA00.sys
[2004.01.15 15:43:28 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\TBTMonUI.dll
[2003.07.29 16:33:26 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\TosHidAPI.dll
[1998.03.25 20:12:00 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\vbzlib.dll
 
========== LOP Check ==========
 
[2010.04.30 10:07:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Eastman Kodak Company
[2009.01.10 13:02:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\kds_kodak
[2009.11.06 20:11:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\KONAMI
[2009.01.05 18:52:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MAGIX
[2007.12.26 22:23:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Maxtor
[2004.02.04 19:30:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\muvee Technologies
[2007.12.25 15:41:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Pinnacle
[2009.11.08 13:37:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Propellerhead Software
[2008.06.09 17:30:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Tandem
[2010.02.19 20:33:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2010.03.06 16:17:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\2K Sports
[2009.08.18 15:52:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Any Video Converter
[2008.08.28 12:45:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Atari
[2008.06.09 17:28:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\InterTrust
[2009.01.05 18:52:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\MAGIX
[2010.03.04 20:36:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\OfferBox
[2009.11.08 13:45:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Propellerhead Software
[2010.05.03 14:39:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\RayV
[2010.03.04 22:38:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Thunderbird
[2008.03.01 16:08:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\Toshiba
[2010.06.27 03:00:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Henri\Anwendungsdaten\TuneUp Software
[2010.07.01 12:40:53 | 000,000,282 | -H-- | M] () -- C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010.07.01 12:40:53 | 000,000,282 | -H-- | M] () -- C:\WINDOWS\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*.* >
[2010.01.12 14:10:26 | 000,444,156 | ---- | M] () -- C:\AnalysisLog.sr0
[2004.02.03 20:34:08 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2010.06.28 14:29:56 | 000,000,798 | ---- | M] () -- C:\avenger.txt
[2008.02.16 01:52:43 | 000,000,211 | RHS- | M] () -- C:\boot.ini
[2002.08.29 14:00:00 | 000,004,952 | RHS- | M] () -- C:\bootfont.bin
[2004.02.03 20:34:08 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2008.12.31 19:07:45 | 000,000,319 | ---- | M] () -- C:\drmHeader.bin
[2010.07.01 12:40:38 | 1341,706,240 | -HS- | M] () -- C:\hiberfil.sys
[2004.02.03 20:34:08 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2004.02.04 09:22:10 | 000,000,496 | -H-- | M] () -- C:\IPH.PH
[2004.02.03 20:34:08 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2007.02.26 12:35:22 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2009.11.06 19:36:11 | 000,251,712 | RHS- | M] () -- C:\ntldr
[2010.07.01 12:40:35 | 805,306,368 | -HS- | M] () -- C:\pagefile.sys
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2009.02.25 23:42:32 | 000,442,368 | ---- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 -- C:\WINDOWS\system32\ATIDEMGX.dll
[2010.06.26 19:45:27 | 000,205,824 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\sshnas21.dll
 
< %systemroot%\Tasks\*.job /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2004.02.03 21:28:53 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2004.02.03 21:28:53 | 000,606,208 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2004.02.03 21:28:53 | 000,421,888 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav
 
< %systemroot%\system32\drivers\*.sys /90 >
[2010.07.01 12:41:03 | 000,013,440 | ---- | M] (ICSI Technology Ltd.) -- C:\WINDOWS\system32\drivers\USBCRFT.SYS
 
< %systemroot%\system32\user32.dll /md5 >
[2008.04.14 08:52:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
 
< %systemroot%\system32\ws2_32.dll /md5 >
[2008.04.14 08:52:34 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=6A35E2D6F5F052C84EC2CEB296389439 -- C:\WINDOWS\system32\ws2_32.dll
 
< %systemroot%\system32\ws2help.dll /md5 >
[2008.04.14 08:52:34 | 000,019,968 | ---- | M] (Microsoft Corporation) MD5=C7D8A0517CBF16B84F657DE87EBE9D4B -- C:\WINDOWS\system32\ws2help.dll
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-06-30 22:57:44
< End of report >

--- --- ---

vanDamme65 · 01.07.2010, 12:34

Malwarebytes' Anti-Malware 1.39
Datenbank Version: 2421
Windows 5.1.2600 Service Pack 3

01.07.2010 00:31:20
mbam-log-2010-07-01 (00-31-20).txt

Scan-Methode: Quick-Scan
Durchsuchte Objekte: 88341
Laufzeit: 8 minute(s), 11 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 1
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

28.06.2010, 11:30	#4
Larusso /// Selecta Jahrusso	Internetexplorer sorgt für Werbe-Popups selbst wenn er nicht läuft Wäre nicht schlecht ja __________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie

28.06.2010, 13:46	#6
Larusso /// Selecta Jahrusso	Internetexplorer sorgt für Werbe-Popups selbst wenn er nicht läuft Und kein Ordner MFTools auf dem Desktop ? __________________ --> Internetexplorer sorgt für Werbe-Popups selbst wenn er nicht läuft

01.07.2010, 07:38	#10
Larusso /// Selecta Jahrusso	Internetexplorer sorgt für Werbe-Popups selbst wenn er nicht läuft Steht da nicht, wenn Du Probleme bei einem Schritt hast, überspringen ? __________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie

Internetexplorer sorgt für Werbe-Popups selbst wenn er nicht läuft

Log-Analyse und Auswertung: Internetexplorer sorgt für Werbe-Popups selbst wenn er nicht läuft