Sparkasssentrojaner

OTL logfile created on: 06.11.2010 15:55:45 - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Users\*\Desktop
64bit-Windows Vista Ultimate Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 61,00% Memory free
10,00 Gb Paging File | 8,00 Gb Available in Paging File | 82,00% Paging File free
Paging file location(s): c:\pagefile.sys 6138 6139 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 117,19 Gb Total Space | 13,34 Gb Free Space | 11,39% Space Free | Partition Type: NTFS
Drive D: | 117,19 Gb Total Space | 88,19 Gb Free Space | 75,26% Space Free | Partition Type: NTFS
Drive E: | 231,38 Gb Total Space | 208,67 Gb Free Space | 90,18% Space Free | Partition Type: NTFS
 
Computer Name: *** | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\*\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Users\DESTIN~1\AppData\Local\Temp\tmpe96f0f7d\criticalupdate8.exe ()
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Users\*\AppData\Roaming\Neti\qyiz.exe (Online Solutions)
PRC - C:\Program Files (x86)\BOINC\boincmgr.exe (Space Sciences Laboratory)
PRC - C:\Program Files (x86)\BOINC\boinctray.exe (Space Sciences Laboratory)
PRC - C:\Program Files (x86)\BOINC\boinc.exe (Space Sciences Laboratory)
PRC - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)
PRC - C:\Program Files (x86)\BUFFALO\SLManagerEasy\Inputps.exe (BUFFALO INC.)
PRC - C:\Program Files (x86)\BUFFALO\SLManagerEasy\Bufssvr.exe (BUFFALO INC.)
PRC - C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
PRC - C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe ()
PRC - C:\Program Files (x86)\RALINK\Common\RaUI.exe (Ralink Technology, Corp.)
PRC - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
PRC - C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe ()
PRC - c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)
PRC - C:\Windows\SysWOW64\PSIService.exe ()
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\*\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (Akamai) -- C:/Program Files (x86)/Common Files/Akamai/netsession_win_062a651.dll ()
SRV - (AntiVirWebService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira GmbH)
SRV - (AntiVirMailService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe (Avira GmbH)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (ServiceLayer) -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (Fabs) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)
SRV - (Bufssvr) -- C:\Program Files (x86)\BUFFALO\SLManagerEasy\Bufssvr.exe (BUFFALO INC.)
SRV - (Nero BackItUp Scheduler 4.0) -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (Creative Media Toolbox 6 Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\MT6Licensing.exe (Creative Labs)
SRV - (Creative ALchemy AL1 Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL1Licensing.exe (Creative Labs)
SRV - (Creative HOAL Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTHOALLicensing.exe (Creative Labs)
SRV - (Creative Audio Engine Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs)
SRV - (FirebirdServerMAGIXInstance) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe (MAGIX®)
SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (CTAudSvcService) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
SRV - (IJPLMSVC) -- C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe ()
SRV - (GEST Service) -- C:\Program Files (x86)\GIGABYTE\GEST\GSvr.exe ()
SRV - (PSI_SVC_2) -- c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)
SRV - (ProtexisLicensing) -- C:\Windows\SysWOW64\PSIService.exe ()
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (NwlnkFwd) -- C:\Windows\SysNative\DRIVERS\nwlnkfwd.sys File not found
DRV:64bit: - (NwlnkFlt) -- C:\Windows\SysNative\DRIVERS\nwlnkflt.sys File not found
DRV:64bit: - (netr7364) -- C:\Windows\SysNative\DRIVERS\netr7364.sys File not found
DRV:64bit: - (IpInIp) -- C:\Windows\SysNative\DRIVERS\ipinip.sys File not found
DRV:64bit: - (ASPI) -- C:\Windows\SysNative\DRIVERS\ASPI32.sys File not found
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\DRIVERS\avgntflt.sys (Avira GmbH)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\DRIVERS\avipbb.sys (Avira GmbH)
DRV:64bit: - (UsbserFilt) -- C:\Windows\SysNative\DRIVERS\usbser_lowerfltx64j.sys (Nokia)
DRV:64bit: - (upperdev) -- C:\Windows\SysNative\DRIVERS\usbser_lowerfltx64.sys (Nokia)
DRV:64bit: - (nmwcdcx64) -- C:\Windows\SysNative\drivers\ccdcmbox64.sys (Nokia)
DRV:64bit: - (nmwcdx64) -- C:\Windows\SysNative\drivers\ccdcmbx64.sys (Nokia)
DRV:64bit: - (nmwcdnsux64) -- C:\Windows\SysNative\drivers\nmwcdnsux64.sys (Nokia)
DRV:64bit: - (nmwcdnsucx64) -- C:\Windows\SysNative\drivers\nmwcdnsucx64.sys (Nokia)
DRV:64bit: - (WpdUsb) -- C:\Windows\SysNative\DRIVERS\wpdusb.sys (Microsoft Corporation)
DRV:64bit: - (btusb64h) -- C:\Windows\SysNative\drivers\btusb64h.sys (BUFFALO INC.)
DRV:64bit: - (usbser) -- C:\Windows\SysNative\DRIVERS\usbser.sys (Microsoft Corporation)
DRV:64bit: - (pccsmcfd) -- C:\Windows\SysNative\DRIVERS\pccsmcfdx64.sys (Nokia)
DRV:64bit: - (acedrv11) -- C:\Windows\SysNative\drivers\acedrv11.sys (Protect Software GmbH)
DRV:64bit: - (atksgt) -- C:\Windows\SysNative\DRIVERS\atksgt.sys ()
DRV:64bit: - (lirsgt) -- C:\Windows\SysNative\DRIVERS\lirsgt.sys ()
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\Drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (skfiltv) -- C:\Windows\SysNative\drivers\skfiltv.sys (Creative Technology Ltd.)
DRV:64bit: - (acedrv10) -- C:\Windows\SysNative\drivers\acedrv10.sys (Protect Software GmbH)
DRV:64bit: - (acehlp10) -- C:\Windows\SysNative\drivers\acehlp10.sys (Protect Software GmbH)
DRV:64bit: - (StillCam) -- C:\Windows\SysNative\DRIVERS\serscan.sys (Microsoft Corporation)
DRV:64bit: - (RTL8169) -- C:\Windows\SysNative\DRIVERS\Rtlh64.sys (Realtek Corporation )
DRV:64bit: - (TEAM) Realtek Virtual Miniport Driver for Teaming (NDIS 6.0) -- C:\Windows\SysNative\DRIVERS\RtTeam60.sys (Realtek Corporation)
DRV:64bit: - (RTTEAMPT) Realtek Teaming Protocol Driver (NDIS 6.0) -- C:\Windows\SysNative\DRIVERS\RtTeam60.sys (Realtek Corporation)
DRV:64bit: - (RTVLANPT) Realtek Vlan Protocol Driver (NDIS 6.0) -- C:\Windows\SysNative\DRIVERS\RtVlan60.sys (Windows (R) Codename Longhorn DDK provider)
DRV:64bit: - (JRAID) -- C:\Windows\SysNative\DRIVERS\jraid.sys (JMicron Technology Corp.)
DRV:64bit: - (Ntfs) -- C:\Windows\SysNative\Wbem\ntfs.mof ()
DRV:64bit: - (rt61x64) -- C:\Windows\SysNative\DRIVERS\netr6164.sys (Ralink Technology Inc.)
DRV:64bit: - (RT61) -- C:\Windows\SysNative\DRIVERS\RT61.sys (Ralink Technology Inc.)
DRV - (GVTDrv64) -- C:\Windows\GVTDrv64.sys ()
DRV - (gdrv) -- C:\Windows\gdrv.sys (Windows (R) Server 2003 DDK provider)
DRV - (ET5Drv) -- C:\Windows\ET5Drv.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (RT61) -- C:\Windows\SysWOW64\drivers\rt61.sys (Ralink Technology Inc.)
DRV - (ASPI) -- C:\Windows\SysWOW64\drivers\ASPI32.SYS (Adaptec)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\e, = hxxp://www.preispiraten.de/e/tr_ebdeblitz.pl?%s
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\e,# = %23
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\e,& = %26
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\e,? = %3F
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\e,+ = %2B
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\e,= = %3D
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\e,MenuText = eBay.de
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eb, = hxxp://www.preispiraten.de/e/tr_ebdeblitz.pl?%s
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eb,# = %23
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eb,& = %26
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eb,? = %3F
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eb,+ = %2B
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eb,= = %3D
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eb,MenuText = eBay.de
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eba, = hxxp://www.preispiraten.de/e/tr_ebdeblitz.pl?%s
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eba,# = %23
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eba,& = %26
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eba,? = %3F
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eba,+ = %2B
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eba,= = %3D
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\eba,MenuText = eBay.de
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\ebay, = hxxp://www.preispiraten.de/e/tr_ebdeblitz.pl?%s
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\ebay,# = %23
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\ebay,& = %26
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\ebay,? = %3F
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\ebay,+ = %2B
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\ebay,= = %3D
IE - HKLM\Software\Microsoft\Internet Explorer\SearchURL\ebay,MenuText = eBay.de
IE - HKLM\..\URLSearchHook: {c2db4fe6-8409-45ce-8010-189a7b5cce86} - C:\Program Files (x86)\NCH\tbNCH.dll (Conduit Ltd.)
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {c2db4fe6-8409-45ce-8010-189a7b5cce86} - C:\Program Files (x86)\NCH\tbNCH.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Ask"
FF - prefs.js..browser.search.order.1: "Ask"
FF - prefs.js..browser.search.selectedEngine: "Ask"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {097d3191-e6fa-4728-9826-b533d755359d}:0.7.6
FF - prefs.js..extensions.enabledItems: {EC1B67CA-A2CD-4931-915A-63D5341D1285}:1.0.0.5
FF - prefs.js..extensions.enabledItems: {144D1513-0819-4538-AD26-D515AF443AE7}:1.1.0.1
FF - prefs.js..extensions.enabledItems: piclens@cooliris.com:1.9.1
FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:1.0.4
FF - prefs.js..extensions.enabledItems: {B1FC0AB8-EEDC-451A-9185-A0D5E308BBDD}:1.0.0.8
FF - prefs.js..extensions.enabledItems: {4B4D630E-AAE2-4EA9-A0CB-5F045AAF2EC2}:1.0.0.5
FF - prefs.js..extensions.enabledItems: {7A7EF87E-95DB-4A84-83E8-E0FE7B20017F}:1.0.0.5
FF - prefs.js..extensions.enabledItems: {89506680-e3f4-484c-a2c0-ed711d481eda}:0.9.5
FF - prefs.js..extensions.enabledItems: {1018e4d6-728f-4b20-ad56-37578a4de76b}:3.3.7
FF - prefs.js..extensions.enabledItems: {3F4D6A2C-841D-403C-8CD8-48E54192DDEB}:1.0.0.5
FF - prefs.js..extensions.enabledItems: {C8D3D3BE-7ADC-4109-BF8C-6330A9F58B0C}:1.0.0.5
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0
FF - prefs.js..extensions.enabledItems: {5c8bfb7c-9a54-11dc-8314-0800200c9a66}:3.0.1
FF - prefs.js..extensions.enabledItems: {da7f40f0-8675-11db-b606-0800200c9a66}:3.01
FF - prefs.js..extensions.enabledItems: nasanightlaunch@example.com:0.6.20090117
FF - prefs.js..keyword.URL: "hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13165&gct=&gc=1&q="
 
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010.10.31 20:36:03 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010.10.31 20:36:03 | 000,000,000 | ---D | M]
 
[2008.08.28 06:54:15 | 000,000,000 | ---D | M] -- C:\Users\Destination\AppData\Roaming\mozilla\Extensions
[2010.10.02 11:56:08 | 000,000,000 | ---D | M] -- C:\Users\Destination\AppData\Roaming\mozilla\Firefox\Profiles\r69bxof8.default\extensions
[2008.08.28 07:16:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Destination\AppData\Roaming\mozilla\Firefox\Profiles\r69bxof8.default\extensions\{097d3191-e6fa-4728-9826-b533d755359d}
[2009.01.05 23:12:20 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\Destination\AppData\Roaming\mozilla\Firefox\Profiles\r69bxof8.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
[2008.08.28 06:54:46 | 000,000,000 | ---D | M] (Aero Fox) -- C:\Users\Destination\AppData\Roaming\mozilla\Firefox\Profiles\r69bxof8.default\extensions\{5c8bfb7c-9a54-11dc-8314-0800200c9a66}
[2008.12.11 16:24:37 | 000,000,000 | ---D | M] (Firefox Showcase) -- C:\Users\Destination\AppData\Roaming\mozilla\Firefox\Profiles\r69bxof8.default\extensions\{89506680-e3f4-484c-a2c0-ed711d481eda}
[2010.10.02 11:56:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Destination\AppData\Roaming\mozilla\Firefox\Profiles\r69bxof8.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2008.09.17 02:47:37 | 000,000,000 | ---D | M] (FOXSCAPE) -- C:\Users\Destination\AppData\Roaming\mozilla\Firefox\Profiles\r69bxof8.default\extensions\{da7f40f0-8675-11db-b606-0800200c9a66}
[2008.12.10 19:03:06 | 000,000,000 | ---D | M] (DownThemAll!) -- C:\Users\Destination\AppData\Roaming\mozilla\Firefox\Profiles\r69bxof8.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
[2009.01.21 18:48:20 | 000,000,000 | ---D | M] -- C:\Users\Destination\AppData\Roaming\mozilla\Firefox\Profiles\r69bxof8.default\extensions\nasanightlaunch@example.com
[2008.12.24 22:27:14 | 000,000,000 | ---D | M] -- C:\Users\Destination\AppData\Roaming\mozilla\Firefox\Profiles\r69bxof8.default\extensions\piclens@cooliris.com
[2008.12.24 22:27:14 | 000,000,000 | ---D | M] -- C:\Users\Destination\AppData\Roaming\mozilla\Firefox\Profiles\r69bxof8.default\extensions\piclens@cooliris.com-trash
[2010.03.30 23:07:01 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2008.09.20 16:52:23 | 000,000,000 | ---D | M] (Amazon Startcenter) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{144D1513-0819-4538-AD26-D515AF443AE7}
[2008.09.20 16:52:24 | 000,000,000 | ---D | M] (Google Kontextmenü) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{3F4D6A2C-841D-403C-8CD8-48E54192DDEB}
[2008.09.20 16:52:23 | 000,000,000 | ---D | M] (eBay-Kontextmenü) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{4B4D630E-AAE2-4EA9-A0CB-5F045AAF2EC2}
[2008.09.20 16:52:22 | 000,000,000 | ---D | M] (eBay-Startcenter) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{7A7EF87E-95DB-4A84-83E8-E0FE7B20017F}
[2008.09.20 16:52:20 | 000,000,000 | ---D | M] (eBay Statusbar Button) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{B1FC0AB8-EEDC-451A-9185-A0D5E308BBDD}
[2008.09.20 16:52:25 | 000,000,000 | ---D | M] (Preispiraten) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{C8D3D3BE-7ADC-4109-BF8C-6330A9F58B0C}
[2008.09.20 16:52:24 | 000,000,000 | ---D | M] (Amazon Kontextmenü) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{EC1B67CA-A2CD-4931-915A-63D5341D1285}
[2009.09.04 17:12:06 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Mozilla Firefox\extensions\ashopffx@a-shop.com
[2010.10.31 20:36:01 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.10.31 20:36:01 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.10.31 20:36:01 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.10.31 20:36:01 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.10.31 20:36:01 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 22:37:24 | 000,000,761 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll (Ask.com)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (no name) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - No CLSID value found.
O2 - BHO: (amazon) - {84B94901-3645-4D80-A6B7-4D0050B19455} - C:\Program Files (x86)\Preispiraten\IEButtonAmazonInterface.dll ()
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll (Google Inc.)
O2 - BHO: (NCH Toolbar) - {c2db4fe6-8409-45ce-8010-189a7b5cce86} - C:\Program Files (x86)\NCH\tbNCH.dll (Conduit Ltd.)
O2 - BHO: (eBay) - {CD9B7762-DFBC-42B1-BB30-02A78287B456} - C:\Program Files (x86)\Preispiraten\IEButtonEbayInterface.dll ()
O2 - BHO: (Preispiraten) - {E9E027BF-C3F3-4022-8F6B-8F6D39A59684} - C:\Program Files (x86)\Preispiraten\IEButtonPPInterface.dll ()
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (NCH Toolbar) - {c2db4fe6-8409-45ce-8010-189a7b5cce86} - C:\Program Files (x86)\NCH\tbNCH.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKCU\..\Toolbar\WebBrowser: (NCH Toolbar) - {C2DB4FE6-8409-45CE-8010-189A7B5CCE86} - C:\Program Files (x86)\NCH\tbNCH.dll (Conduit Ltd.)
O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.DLL (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [NvMediaCenter] C:\Windows\SysNative\NvMcTray.DLL (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [NvSvc] C:\Windows\SysNative\nvsvc64.DLL (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Windows\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [Skytel] C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.)
O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [boincmgr] C:\Program Files (x86)\BOINC\boincmgr.exe (Space Sciences Laboratory)
O4 - HKLM..\Run: [boinctray] C:\Program Files (x86)\BOINC\boinctray.exe (Space Sciences Laboratory)
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe ()
O4 - HKCU..\Run: [{E7E6456B-F161-1299-E5E2-9E9A5B5CF4C2}] C:\Users\Destination\AppData\Roaming\Neti\qyiz.exe (Online Solutions)
O4 - HKCU..\Run: [Rainlendar2] C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe ()
O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10k_Plugin.exe (Adobe Systems, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0
O8:64bit: - Extra context menu item: &Preispiratensuche nach markiertem Text - C:\\Program Files (x86)\\Preispiraten\\preispiraten.html ()
O8:64bit: - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Destination\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O8 - Extra context menu item: &Preispiratensuche nach markiertem Text - C:\\Program Files (x86)\\Preispiraten\\preispiraten.html ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Destination\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O9 - Extra Button: Preispiraten - {350F4DA2-3886-4BB8-A1A8-D7F57B56DFFF} - C:\Program Files (x86)\Preispiraten\preispiraten3ie.exe ()
O9 - Extra 'Tools' menuitem : Preispiraten - {350F4DA2-3886-4BB8-A1A8-D7F57B56DFFF} - C:\Program Files (x86)\Preispiraten\preispiraten3ie.exe ()
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Amazon Startseite - {9E029088-432F-4EBF-9537-0171A4C37870} - File not found
O9 - Extra 'Tools' menuitem : Amazon Startseite - {9E029088-432F-4EBF-9537-0171A4C37870} - File not found
O9 - Extra Button: PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Programs\PartyGaming\PartyCasino\RunApp.exe ()
O9 - Extra 'Tools' menuitem : PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Programs\PartyGaming\PartyCasino\RunApp.exe ()
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe ()
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe ()
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files (x86)\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files (x86)\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: eBay - {E79005A3-0F92-434B-9F7B-51131FC7168F} - File not found
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab (Java Plug-in 1.6.0_04)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O22:64bit: - SharedTaskScheduler: {E31004D1-A431-41B8-826F-E902F9D95C81} - Windows DreamScene - C:\Windows\SysNative\DreamScene.dll (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Destination\Pictures\Hintergrund\darkness_2560x1600.jpg
O24 - Desktop BackupWallPaper: C:\Users\Destination\Pictures\Hintergrund\darkness_2560x1600.jpg
O32 - HKLM CDRom: AutoRun - 0
O33 - MountPoints2\{f4a08541-1946-11dd-8f5f-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{f4a08541-1946-11dd-8f5f-806e6f6e6963}\Shell\adobe\command - "" = F:\goodies\ar405deu.exe -- File not found
O33 - MountPoints2\{f4a08541-1946-11dd-8f5f-806e6f6e6963}\Shell\AutoRun\command - "" = F:\aocsetup.exe -- File not found
O33 - MountPoints2\{f4a08541-1946-11dd-8f5f-806e6f6e6963}\Shell\log\command - "" = F:\goodies\machine\machine.exe -- File not found
O33 - MountPoints2\{f4a08541-1946-11dd-8f5f-806e6f6e6963}\Shell\machine\command - "" = F:\goodies\machine\machine.exe -- File not found
O33 - MountPoints2\{f4a08541-1946-11dd-8f5f-806e6f6e6963}\Shell\setup\command - "" = F:\aocsetup.exe -- File not found
O33 - MountPoints2\{f4a08541-1946-11dd-8f5f-806e6f6e6963}\Shell\zone\command - "" = F:\goodies\mszone\zonea660.exe -- File not found
O33 - MountPoints2\{f70c0815-05dd-11df-a6ec-b8b9f2bcdc3f}\Shell - "" = AutoRun
O33 - MountPoints2\{f70c0815-05dd-11df-a6ec-b8b9f2bcdc3f}\Shell\AutoRun\command - "" = K:\Windows\CHECK\DriveNavigator.exe -- File not found
O33 - MountPoints2\{f820cbf8-a59f-11dd-bbc9-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{f820cbf8-a59f-11dd-bbc9-806e6f6e6963}\Shell\AutoRun\command - "" = F:\Run.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.11.06 15:54:19 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Users\*\Desktop\OTL.exe
[2010.11.06 15:50:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\alaplaya
[2010.11.06 15:33:51 | 686,257,826 | ---- | C] (Acresso Software Inc. ) -- C:\Users\*\Desktop\101022_AvalonHeroesEU.exe
[2010.11.06 15:33:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Akamai
[2010.11.03 23:49:20 | 000,000,000 | ---D | C] -- C:\ProgramData\BOINC
[2010.11.03 23:49:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\BOINC
[2010.10.31 21:20:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\GIMP-2.0
[2010.10.31 10:47:49 | 000,000,000 | ---D | C] -- C:\Users\Destination\Documents\The KMPlayer
[2010.10.31 10:47:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\The KMPlayer
[2010.10.27 14:23:17 | 004,240,384 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\GameUXLegacyGDFs.dll
[2010.10.27 14:23:17 | 001,927,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\gameux.dll
[2010.10.27 14:23:17 | 001,696,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\gameux.dll
[2010.10.27 14:23:17 | 000,032,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Apphlpdm.dll
[2010.10.27 14:23:17 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Apphlpdm.dll
[2010.10.27 14:23:16 | 004,240,384 | ---- | C] (Microsoft) -- C:\Windows\SysNative\GameUXLegacyGDFs.dll
[2010.10.15 03:08:13 | 000,000,000 | ---D | C] -- C:\Users\Destination\AppData\Roaming\Neti
[2010.10.13 13:59:52 | 000,316,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msshsq.dll
[2010.10.13 13:59:52 | 000,231,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msshsq.dll
[2010.10.13 13:59:47 | 001,915,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ole32.dll
[2010.10.13 13:59:44 | 000,954,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc40.dll
[2010.10.13 13:59:44 | 000,954,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc40u.dll
[2010.10.13 13:59:42 | 000,189,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\t2embed.dll
[2010.10.13 13:59:41 | 000,157,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\t2embed.dll
[2010.10.13 13:59:39 | 001,090,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wmpmde.dll
[2010.10.13 13:59:39 | 000,867,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wmpmde.dll
[2010.10.13 13:59:38 | 000,633,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\comctl32.dll
[2010.10.13 13:59:28 | 013,426,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wmp.dll
[2010.10.13 13:59:26 | 010,627,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wmp.dll
[2010.10.13 13:59:24 | 008,147,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wmploc.DLL
[2010.10.13 13:59:24 | 008,147,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wmploc.DLL
[2010.10.13 13:58:43 | 000,590,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2010.10.13 13:58:43 | 000,471,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeeds.dll
[2010.10.13 13:58:42 | 000,758,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2010.10.13 13:58:41 | 000,477,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2010.10.13 13:58:40 | 000,485,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec
[2010.10.13 13:58:40 | 000,422,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll
[2010.10.13 13:58:40 | 000,389,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec
[2010.10.13 13:58:40 | 000,380,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll
[2010.10.13 13:58:40 | 000,249,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll
[2010.10.13 13:58:40 | 000,193,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll
[2010.10.13 13:58:40 | 000,086,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieencode.dll
[2010.10.13 13:58:40 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieencode.dll
[2010.10.13 13:58:31 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\netevent.dll
[2010.10.13 13:58:31 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netevent.dll
[2010.10.13 13:58:31 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sscore.dll
[2010.10.13 13:58:31 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\sscore.dll
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.11.06 15:54:59 | 000,000,430 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{B1FCFC34-C21F-4BC1-96D0-40D79054FAC8}.job
[2010.11.06 15:54:19 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\Destination\Desktop\OTL.exe
[2010.11.06 15:50:34 | 000,001,977 | ---- | M] () -- C:\Users\Public\Desktop\AvalonHeroesEU.lnk
[2010.11.06 15:48:06 | 686,257,826 | ---- | M] (Acresso Software Inc. ) -- C:\Users\*\Desktop\101022_AvalonHeroesEU.exe
[2010.11.06 15:36:02 | 000,000,310 | -H-- | M] () -- C:\Windows\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2010.11.06 15:34:00 | 000,001,142 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2799286350-1403585287-1070279313-1000UA.job
[2010.11.06 15:04:02 | 000,000,304 | -H-- | M] () -- C:\Windows\tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
[2010.11.06 14:32:56 | 001,432,694 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2010.11.06 14:32:56 | 000,623,042 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2010.11.06 14:32:56 | 000,591,122 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2010.11.06 14:32:56 | 000,124,978 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2010.11.06 14:32:56 | 000,102,996 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2010.11.06 14:26:37 | 000,004,048 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.11.06 14:26:37 | 000,004,048 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.11.06 14:26:33 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.11.06 01:34:00 | 000,001,090 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2799286350-1403585287-1070279313-1000Core.job
[2010.11.05 22:34:41 | 000,002,117 | ---- | M] () -- C:\Users\*\Desktop\Google Chrome.lnk
[2010.11.03 00:17:24 | 000,081,584 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2010.10.31 21:49:05 | 000,002,025 | ---- | M] () -- C:\Users\*\.recently-used.xbel
[2010.10.31 21:21:07 | 000,000,896 | ---- | M] () -- C:\Users\Public\Desktop\GIMP 2.lnk
[2010.10.31 10:47:20 | 000,000,840 | ---- | M] () -- C:\Users\*\Desktop\KMPlayer.lnk
[2010.10.31 10:43:22 | 000,000,130 | ---- | M] () -- C:\Users\*\AppData\Roaming\default.rss
[2010.10.31 10:40:39 | 000,097,280 | ---- | M] () -- C:\Users\*\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.10.28 15:26:21 | 428,622,387 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2010.10.14 14:20:43 | 002,249,024 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.11.06 15:50:34 | 000,001,977 | ---- | C] () -- C:\Users\Public\Desktop\AvalonHeroesEU.lnk
[2010.11.06 15:34:44 | 000,360,044 | ---- | C] () -- C:\Users\*\AppData\Local\dd_vcredistMSI7FB1.txt
[2010.11.06 15:34:44 | 000,011,202 | ---- | C] () -- C:\Users\*\AppData\Local\dd_vcredistUI7FB1.txt
[2010.10.31 21:49:05 | 000,002,025 | ---- | C] () -- C:\Users\*\.recently-used.xbel
[2010.10.31 21:21:07 | 000,000,896 | ---- | C] () -- C:\Users\Public\Desktop\GIMP 2.lnk
[2010.10.31 10:47:20 | 000,000,840 | ---- | C] () -- C:\Users\*\Desktop\KMPlayer.lnk
[2010.10.31 10:43:22 | 000,000,130 | ---- | C] () -- C:\Users\*\AppData\Roaming\default.rss
[2010.07.26 13:58:55 | 000,007,103 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2010.07.23 23:29:19 | 000,120,200 | ---- | C] () -- C:\Windows\SysWow64\DLLDEV32i.dll
[2010.05.27 16:59:45 | 001,448,214 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010.01.21 12:23:38 | 000,009,506 | -H-- | C] () -- C:\Windows\UN070618.INI
[2010.01.21 12:22:53 | 000,009,305 | -H-- | C] () -- C:\Windows\UN090430.INI
[2009.12.13 11:17:19 | 000,000,000 | ---- | C] () -- C:\Windows\cdplayer.ini
[2009.09.22 14:57:07 | 000,001,056 | -HS- | C] () -- C:\Windows\SysWow64\KGyGaAvL.sys
[2009.09.13 15:13:47 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll
[2009.08.18 19:08:40 | 000,117,248 | ---- | C] () -- C:\Windows\SysWow64\EhStorAuthn.dll
[2009.08.18 19:08:05 | 000,368,640 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.06.22 15:50:42 | 000,000,058 | ---- | C] () -- C:\Users\*\AppData\Local\DonationCoder_ScreenshotCaptor_InstallInfo.dat
[2009.05.15 13:58:13 | 000,419,812 | ---- | C] () -- C:\Users\*\AppData\Local\dd_vcredistMSI65FE.txt
[2009.05.15 13:58:12 | 000,145,758 | ---- | C] () -- C:\Users\*\AppData\Local\dd_vcredistUI65FE.txt
[2009.04.12 19:53:48 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009.03.27 16:17:20 | 000,000,532 | -H-- | C] () -- C:\Users\*n\AppData\Roaming\vispa.ini
[2009.03.16 16:21:42 | 000,114,688 | ---- | C] () -- C:\Windows\SysWow64\RagTimeSearch.dll
[2009.02.28 19:17:00 | 000,127,488 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2009.02.28 19:17:00 | 000,069,120 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2009.02.09 19:56:22 | 000,067,584 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2008.12.07 13:08:06 | 000,795,648 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2008.12.07 13:08:04 | 000,130,048 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2008.09.07 23:57:55 | 000,002,620 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys
[2008.09.07 23:57:55 | 000,000,088 | RHS- | C] () -- C:\ProgramData\A211ADDE53.sys
[2008.08.20 21:04:45 | 000,000,075 | ---- | C] () -- C:\Users\*\AppData\Roaming\default.pls
[2008.08.16 18:50:51 | 000,000,026 | ---- | C] () -- C:\Windows\Irremote.ini
[2008.08.12 20:18:11 | 000,019,684 | ---- | C] () -- C:\Users\*n\AppData\Local\internal.grp
[2008.07.13 00:56:36 | 000,000,388 | ---- | C] () -- C:\Windows\ULEAD32.INI
[2008.04.28 16:52:43 | 000,000,486 | ---- | C] () -- C:\ProgramData\GRFolder.ini
[2008.04.28 16:52:43 | 000,000,028 | ---- | C] () -- C:\ProgramData\GRGames.ini
[2008.04.11 20:40:44 | 001,868,944 | ---- | C] () -- C:\Windows\SysWow64\RSA32_16.DLL
[2008.04.11 20:39:08 | 000,060,124 | ---- | C] () -- C:\Windows\SysWow64\tcpmon.ini
[2008.04.06 19:36:23 | 000,097,280 | ---- | C] () -- C:\Users\*\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.03.29 07:09:48 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html
[2008.03.29 06:52:17 | 000,016,098 | ---- | C] () -- C:\Windows\German2.ini
[2008.03.29 05:22:09 | 000,295,028 | ---- | C] () -- C:\Windows\SysWow64\Install6x.dll
[2008.03.29 05:03:39 | 000,030,528 | ---- | C] () -- C:\Windows\GVTDrv64.sys
[2008.03.29 04:28:08 | 000,000,010 | ---- | C] () -- C:\Windows\GSetup.ini
[2008.03.29 04:15:22 | 000,000,732 | ---- | C] () -- C:\Users\*\AppData\Local\d3d9caps64.dat
[2007.12.06 08:53:48 | 000,001,209 | R--- | C] () -- C:\Windows\xfiskcfg.ini
[2007.09.04 11:56:10 | 000,164,352 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2007.02.05 20:05:26 | 000,000,038 | ---- | C] () -- C:\Windows\AviSplitter.INI
[2006.04.21 10:08:22 | 000,253,952 | ---- | C] () -- C:\Windows\SysWow64\HtmlHelp.dll
[1997.06.14 12:56:08 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\iyvu9_32.dll
 
[U]< End of report >
         

OTL Extras logfile created on: 06.11.2010 15:55:45 - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Users\*\Desktop
64bit-Windows Vista Ultimate Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 61,00% Memory free
10,00 Gb Paging File | 8,00 Gb Available in Paging File | 82,00% Paging File free
Paging file location(s): c:\pagefile.sys 6138 6139 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 117,19 Gb Total Space | 13,34 Gb Free Space | 11,39% Space Free | Partition Type: NTFS
Drive D: | 117,19 Gb Total Space | 88,19 Gb Free Space | 75,26% Space Free | Partition Type: NTFS
Drive E: | 231,38 Gb Total Space | 208,67 Gb Free Space | 90,18% Space Free | Partition Type: NTFS
 
Computer Name: *** | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" File not found
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"AntiVirusDisableNotify" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = 0F A7 DD 32 A2 D3 C8 01 [binary data]
"VistaSp2" = 07 2A 6C 45 32 20 CA 01 [binary data]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"oobe_av" = 1
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{5D518AF4-DAEC-459D-B3B5-8248C9547B82}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface | 
"{9AB882CF-12F2-4AE6-A271-D5995A549379}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{E74BACFF-8443-4F52-8B55-D262AFCFD89A}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{EBE0B715-A207-4CCA-AB8C-226D730D7D27}" = lport=51761 | protocol=6 | dir=in | name=akamai netsession interface | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{19C5BA7C-7C9D-48F1-BDF6-88039B2BABB2}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{58B42055-E167-4CEB-A47B-8E7B044CE5F0}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | 
"{73F15264-B524-4FD2-B476-B4651EA0E61C}" = dir=in | app=c:\program files (x86)\windows live\messenger\livecall.exe | 
"{9096F57F-3689-4830-A3EA-B9EF1BC6272A}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\die siedler - aufstieg eines königreichs\base\bin\settlers6.exe | 
"{A024A855-56E5-4A9F-BC34-6612C54966AD}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{C2CBF6D3-100F-4793-B02A-1D3DBA368DEA}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\die siedler - aufstieg eines königreichs\base\bin\settlers6.exe | 
"{D01ADD1C-B3EF-4838-8C5A-0A4C9C9B0774}" = protocol=17 | dir=in | app=c:\program files (x86)\itunes\itunes.exe | 
"{F1C50BD4-82AC-449C-961B-16257E801CC0}" = protocol=6 | dir=in | app=c:\program files (x86)\itunes\itunes.exe | 
"{F39A293B-AF1C-45CB-857A-347575CA1F13}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"TCP Query User{0AAC4F41-CD44-46BC-8A39-E6241B05975D}C:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe" = protocol=6 | dir=in | app=c:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe | 
"TCP Query User{0DA5ABE1-7006-45D2-970E-329ED20CDDB9}C:\users\destination\appdata\roaming\neti\qyiz.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\neti\qyiz.exe | 
"TCP Query User{133E6721-8BE0-4ADC-9C67-E68087ED39A2}D:\ageofempires\empires2.icd" = protocol=6 | dir=in | app=d:\ageofempires\empires2.icd | 
"TCP Query User{1393886A-4624-4ECB-AB90-E430E1BCB1A6}C:\users\destination\appdata\roaming\izando\ebvee.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\izando\ebvee.exe | 
"TCP Query User{1B1E4AF0-CC6B-4C80-BF5B-BE8A7EC4236A}C:\program files (x86)\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files (x86)\icq6.5\icq.exe | 
"TCP Query User{37CC4674-0871-466A-915D-02332D508C14}C:\users\destination\appdata\roaming\xupay\emece.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\xupay\emece.exe | 
"TCP Query User{3AC9AC8B-ED87-4729-849D-AC0A4A8DDBF8}C:\users\destination\appdata\roaming\obte\dixy.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\obte\dixy.exe | 
"TCP Query User{478C1426-5F17-4623-B333-2C3448281AC1}C:\program files (x86)\nokia\nokia ovi suite\nokiaovisuite.exe" = protocol=6 | dir=in | app=c:\program files (x86)\nokia\nokia ovi suite\nokiaovisuite.exe | 
"TCP Query User{512D6662-BDE6-4657-AF4C-0E107A3AACFA}C:\users\destination\appdata\roaming\obte\dixy.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\obte\dixy.exe | 
"TCP Query User{5B20D1D3-3C6A-4055-AB43-E41FE5BB2FF4}C:\users\destination\appdata\roaming\upydew\hido.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\upydew\hido.exe | 
"TCP Query User{66731C37-61AA-478B-8E79-F22F152D12C5}C:\users\destination\appdata\roaming\egurik\qosuf.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\egurik\qosuf.exe | 
"TCP Query User{73A6E86E-59C2-4CCE-BEE3-0943B7BF6919}C:\users\destination\appdata\roaming\upydew\hido.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\upydew\hido.exe | 
"TCP Query User{82A4C78D-4B48-495C-9996-6A601B8767C0}C:\users\destination\appdata\roaming\xupay\emece.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\xupay\emece.exe | 
"TCP Query User{8A63C899-8C96-43C8-83D8-78FAFF33A741}C:\users\destination\appdata\roaming\neti\qyiz.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\neti\qyiz.exe | 
"TCP Query User{9308E9EF-4F73-42A2-A478-1FDCE0637D9E}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"TCP Query User{9946101F-A31B-4F88-8186-0B1701DB5E5F}C:\users\destination\appdata\roaming\egurik\qosuf.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\egurik\qosuf.exe | 
"TCP Query User{99E52062-3F6A-473A-A8D6-D8CB17209D83}C:\users\destination\appdata\roaming\izando\ebvee.exe" = protocol=6 | dir=in | app=c:\users\destination\appdata\roaming\izando\ebvee.exe | 
"TCP Query User{A4FA6FC8-DEE4-4549-9AFA-ED1C853AE097}D:\ageofempires\empires2.icd" = protocol=6 | dir=in | app=d:\ageofempires\empires2.icd | 
"TCP Query User{B923B75A-5181-48B3-8D0E-ADEBB22BFBD1}C:\casino\casino-club deutsch\casino.exe" = protocol=6 | dir=in | app=c:\casino\casino-club deutsch\casino.exe | 
"TCP Query User{CA7E3F50-483A-49DB-8640-41F1886F8DEA}C:\program files (x86)\nokia\nokia software updater\nsu_ui_client.exe" = protocol=6 | dir=in | app=c:\program files (x86)\nokia\nokia software updater\nsu_ui_client.exe | 
"TCP Query User{D4AE5C12-389D-4F76-8340-00596802FE02}C:\program files (x86)\rapidsolution\audials tv\bin\audialstv.exe" = protocol=6 | dir=in | app=c:\program files (x86)\rapidsolution\audials tv\bin\audialstv.exe | 
"TCP Query User{E8004BEF-99AB-407E-B06F-5D831D02C817}C:\program files (x86)\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe | 
"TCP Query User{EC6B0BF7-6800-45CE-928B-A67EB522BF0C}C:\casino\casino-club deutsch\casino.exe" = protocol=6 | dir=in | app=c:\casino\casino-club deutsch\casino.exe | 
"TCP Query User{F45D4612-76E1-448D-B42A-0CE72B45E05D}C:\program files (x86)\tv\tv.exe" = protocol=6 | dir=in | app=c:\program files (x86)\tv\tv.exe | 
"UDP Query User{14A349A0-7A23-4EF1-919B-63035A22B7AE}C:\users\destination\appdata\roaming\obte\dixy.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\obte\dixy.exe | 
"UDP Query User{158124A5-2238-4192-8CF6-A238D2DA41D5}C:\users\destination\appdata\roaming\neti\qyiz.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\neti\qyiz.exe | 
"UDP Query User{1B3A05B2-69F8-44E0-B6DD-EDE430D585F8}C:\users\destination\appdata\roaming\xupay\emece.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\xupay\emece.exe | 
"UDP Query User{251ACD28-5D28-42D3-8E03-9821AA3F5A42}C:\users\destination\appdata\roaming\obte\dixy.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\obte\dixy.exe | 
"UDP Query User{482878E5-70AE-48FD-94BE-B5C7A61D3F54}D:\ageofempires\empires2.icd" = protocol=17 | dir=in | app=d:\ageofempires\empires2.icd | 
"UDP Query User{55CB546C-AA80-486B-B482-53CFFEA484BD}C:\users\destination\appdata\roaming\xupay\emece.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\xupay\emece.exe | 
"UDP Query User{60607505-5DA6-4BF0-8824-B46AEFF16B0B}C:\users\destination\appdata\roaming\upydew\hido.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\upydew\hido.exe | 
"UDP Query User{63CD4C7C-AE04-4ACD-BCDE-435375D7B086}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"UDP Query User{6ECFF6A9-92B3-4C5A-A121-D900D078E58A}C:\program files (x86)\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files (x86)\icq6.5\icq.exe | 
"UDP Query User{6FEA2B6B-E19D-4717-A818-52D320B9CAA2}C:\users\destination\appdata\roaming\neti\qyiz.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\neti\qyiz.exe | 
"UDP Query User{74C5769B-E913-4C50-9D00-67C35DF2BA8A}C:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe" = protocol=17 | dir=in | app=c:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe | 
"UDP Query User{9C98250C-C909-4B86-A6B2-13D9BBEBD156}C:\casino\casino-club deutsch\casino.exe" = protocol=17 | dir=in | app=c:\casino\casino-club deutsch\casino.exe | 
"UDP Query User{A70DD689-49AB-4E3B-BEBA-0A7E81BF59B2}C:\users\destination\appdata\roaming\upydew\hido.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\upydew\hido.exe | 
"UDP Query User{AB56C72A-C7D4-4682-A0CB-CDFC7A987168}C:\program files (x86)\rapidsolution\audials tv\bin\audialstv.exe" = protocol=17 | dir=in | app=c:\program files (x86)\rapidsolution\audials tv\bin\audialstv.exe | 
"UDP Query User{B10B61BD-3323-4B4D-BACA-D05FDE2AAC98}D:\ageofempires\empires2.icd" = protocol=17 | dir=in | app=d:\ageofempires\empires2.icd | 
"UDP Query User{B3EABC40-9631-4CD2-9E42-F5A493AD08A6}C:\users\destination\appdata\roaming\izando\ebvee.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\izando\ebvee.exe | 
"UDP Query User{CE4395EC-D6FD-4F5E-87B8-4E2928A2748B}C:\program files (x86)\tv\tv.exe" = protocol=17 | dir=in | app=c:\program files (x86)\tv\tv.exe | 
"UDP Query User{D5E17357-B0B7-4320-BD7E-37AEDAB75329}C:\program files (x86)\nokia\nokia software updater\nsu_ui_client.exe" = protocol=17 | dir=in | app=c:\program files (x86)\nokia\nokia software updater\nsu_ui_client.exe | 
"UDP Query User{DA77EB6A-CFD9-4914-A4D1-999770487183}C:\users\destination\appdata\roaming\izando\ebvee.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\izando\ebvee.exe | 
"UDP Query User{DE1162CD-25F4-43E5-8716-EC6B8EBACB78}C:\users\destination\appdata\roaming\egurik\qosuf.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\egurik\qosuf.exe | 
"UDP Query User{DF991D98-9E8E-486F-B3CE-AAB3C507B3DF}C:\casino\casino-club deutsch\casino.exe" = protocol=17 | dir=in | app=c:\casino\casino-club deutsch\casino.exe | 
"UDP Query User{E9B59C77-D4E5-4A8F-B1C2-91DE98BFD6A7}C:\program files (x86)\nokia\nokia ovi suite\nokiaovisuite.exe" = protocol=17 | dir=in | app=c:\program files (x86)\nokia\nokia ovi suite\nokiaovisuite.exe | 
"UDP Query User{EB349035-1174-4249-93C5-0C67186516F8}C:\users\destination\appdata\roaming\egurik\qosuf.exe" = protocol=17 | dir=in | app=c:\users\destination\appdata\roaming\egurik\qosuf.exe | 
"UDP Query User{F0B78BA3-7883-4A7C-86C6-B2127940D058}C:\program files (x86)\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP620_series" = Canon MP620 series MP Drivers
"{4575935D-9457-4517-8750-2341F4286F5F}" = iTunes
"{4D668D4F-FAA2-4726-834C-31F4614F312E}" = MSVC80_x64_v2
"{52784483-7088-4A4C-81E2-808303AD98F5}" = Apple Mobile Device Support
"{53480120-0D50-4084-A168-E87F11EB3BF6}" = O&O DiskRecovery
"{7F05E704-30A6-421A-97A7-8EEB1C7FF011}" = Corel Shell Extension - 64Bit
"{AB071C8B-873C-459F-ACA9-9EBE03C3E89B}" = MSVC90_x64
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D7829DCF-B68F-4A8A-A368-992D37DFA4C1}" = Systemsteuerung "MobileMe"
"{DAE239CE-EB9D-4EB3-B0D4-528D6BAA48FD}" = Bonjour
"FCEC33AD40CEA5E0FC4CEE6E42041A0DA189652D" = Windows-Treiberpaket - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"NVIDIA Drivers" = NVIDIA Drivers
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"_{0C180787-F8C8-42FD-A9D3-689BA44BEAAF}" = Corel Painter Essentials 3
"_{7F05E704-30A6-421A-97A7-8EEB1C7FF010}" = CorelDRAW(R) Graphics Suite X4
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{00B93E18-7F40-4DA9-8156-8340936DCD2F}" = Yu-Gi-Oh! ONLINE 2
"{02627ee5-eaca-4742-a9cc-e687631773e4}" = Nero ShowTime
"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{09C468CA-2940-466A-AAE8-DCC0C6E9323C}" = Nokia Software Updater
"{0C180787-F8C8-42FD-A9D3-689BA44BEAAF}" = Corel Painter Essentials 3
"{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}" = LightScribe System Software 1.14.17.1
"{15803703-25FA-4C01-A062-3F4A59937E87}" = Ulead PhotoImpact X3
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{1A0B8239-664B-434A-99D8-C50793513249}" = Audials TV
"{1B9B5B3B-28E7-4E59-A80D-D670AA984514}" = Nokia Connectivity Cable Driver
"{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}" = Google Earth
"{20071984-5EB1-4881-8EDB-082532ACEC6D}" = Heroes of Might and Magic V
"{20400dbd-e6db-45b8-9b6b-1dd7033818ec}" = Nero InfoTool
"{212D202D-487D-49C4-8A76-4D3BB91B8471}" = BOINC
"{2348b586-c9ae-46ce-936c-a68e9426e214}" = Nero StartSmart Help
"{24D7346D-D4B4-45E8-98EA-75EC14B42DD8}" = Adobe ExtendScript Toolkit 2
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 19
"{26A24AE4-039D-4CA4-87B4-2F83216016F0}" = Java(TM) 6 Update 16
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{29F05234-DCBB-4FE0-88DC-5160C9250312}" = Adobe Photoshop CS3
"{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component
"{3248F0A8-6813-11D6-A77B-00B0D0160040}" = Java(TM) 6 Update 4
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{33cf58f5-48d8-4575-83d6-96f574e4d83a}" = Nero DriveSpeed
"{34EB6245-C8D0-4D8A-B8D8-EEBFF7A91485}" = Firebird SQL Server - MAGIX Edition
"{368ba326-73ad-4351-84ed-3c0a7a52cc53}" = Nero Rescue Agent
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}" = Gigabyte Raid Configurer
"{3C3AB164-964F-419D-A688-810E728B9D7D}" = GalleryImages
"{3EE1008C-11A1-4F4F-8DB7-27573924DE78}" = DMIView B06.1227.01
"{3FF55F91-4296-46D0-B045-1429CD46AF99}" = Adobe Setup
"{41DF6AB7-4F89-478D-8501-D81A7A975D35}" = SP2GalleryImages
"{43e39830-1826-415d-8bae-86845787b54b}" = Nero Vision
"{44A27085-0616-4181-A0C3-81C7ECA17F73}" = CorelDRAW Graphics Suite X4
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4AA5B8A5-BEEF-4AD8-B11D-4443A042EA4F}" = Adobe Dreamweaver CS3
"{4E47844E-4A18-454B-A977-EC2CCF3F1472}" = X2 - Die Bedrohung (V1.4)
"{4F2EF73A-02E9-4D10-B73A-6FF68B5F0862}" = TAXMAN 2010 Computerbild Edition
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5869CE1E-BC0B-4648-B1AE-6EF4A985590C}" = Dynamic Energy Saver 1.0 B8.0128.1
"{595a3116-40bb-4e0f-a2e8-d7951da56270}" = NeroExpress
"{59624372-3B85-47f4-9B04-4911E551DF1E}" = Lexware Info Service
"{5B3A354B-C059-4861-A85B-CA46F1089E15}" = Creative USB Headsets
"{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}" = Skype™ 3.8
"{5d9be3c1-8ba4-4e7e-82fd-9f74fa6815d1}" = Nero Vision
"{5e08ecd1-c98e-4711-bf65-8fd736b3f969}" = Nero RescueAgent Help
"{60c731fb-c951-41ce-ad41-8e54c8594609}" = Nero Disc Copy Gadget Help
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5
"{62ac81f6-bdd3-4110-9d36-3e9eaab40999}" = Nero CoverDesigner
"{64C1FA9A-FA94-4B6E-B3E4-8573738E4AD1}" = Adobe Setup
"{66FF4C48-0083-4E60-8556-B883AB200091}" = Heroes of Might & Magic V: Hammers of Fate
"{66FF4C48-0083-4E60-8556-B883AB200092}" = Heroes of Might and Magic V - Tribes of the East
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69640730-B830-4C24-BB5C-222DA1260548}" = Turbo Lister 2
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6B3CA80E-6AC0-4725-BABF-9B0FEF880CB3}" = Power Tab Editor 1.7
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF}" = Adobe Color Common Settings
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73B5D990-04EA-4751-B10F-5534770B91F2}" = Adobe Color EU Recommended Settings
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7748ac8c-18e3-43bb-959b-088faea16fb2}" = Nero StartSmart
"{7829db6f-a066-4e40-8912-cb07887c20bb}" = Nero BurnRights
"{7D386596-0E80-4808-8AAE-C1DDA8212F7F}" = Adobe Setup
"{7EB0C45E-3514-4332-BE49-784C0FEB8C58}" = AOL Download Assistent
"{7F05E704-30A6-421A-97A7-8EEB1C7FF010}" = CorelDRAW Graphics SUite X4 - ICA
"{7F05E704-30A6-421A-97A7-8EEB1C7FF012}" = CorelDRAW Graphics Suite X4 - Capture
"{7F05E704-30A6-421A-97A7-8EEB1C7FF013}" = CorelDRAW Graphics Suite X4 - Draw
"{7F05E704-30A6-421A-97A7-8EEB1C7FF014}" = CorelDRAW Graphics Suite X4 - PP
"{7F05E704-30A6-421A-97A7-8EEB1C7FF016}" = CorelDRAW Graphics Suite X4 - Content
"{7F05E704-30A6-421A-97A7-8EEB1C7FF017}" = CorelDRAW Graphics Suite X4 - Filters
"{7F05E704-30A6-421A-97A7-8EEB1C7FF019}" = CorelDRAW Graphics Suite X4 - FontNav
"{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3
"{83202942-84b3-4c50-8622-b8c0aa2d2885}" = Nero Express Help
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{869200db-287a-4dc0-b02b-2b6787fbcd4c}" = Nero DiscSpeed
"{878B631B-E0F9-41B9-83D9-BC9DFB0B9F2B}" = Ebad
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169, 8168, 8101E and 8102E Ethernet Network Card Driver for Windows Vista
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{989112B0-74DB-4A40-932F-580049CD0B97}" = Visual Basic for Applications (R) Core - German
"{99E862CC-6F69-4D39-99AA-DBF71BF3B585}" = OpenOffice.org 3.1
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{9D0798D0-AF6C-4E62-94B1-AEBF1A43E00A}" = CorelDRAW Graphics Suite X4 - IPM
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
"{A5154441-DAF4-49A6-BFEE-DE9B1928DEF0}" = Realtek Ethernet Teaming and VLAN Utility for Windows Vista
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-7AD7-1031-7B44-A90000000001}" = Adobe Reader 9 - Deutsch
"{AEFBAC58-2DDD-4CEF-BDFD-52A5A5F432ED}" = CorelDRAW Graphics Suite X4 - Lang DE
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{B2DC3F08-2EB2-49A5-AA24-15DFC8B1CB83}" = @BIOS 
"{b2ec4a38-b545-4a00-8214-13fe0e915e6d}" = Advertising Center
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B3C02EC1-A7B0-4987-9A43-8789426AAA7D}" = Adobe Setup
"{B61D21B6-469D-4423-B161-62DB20B8A70E}" = Visual Basic for Applications (R) Core - English
"{B6C2569C-E2AA-4AB9-8C26-AC2487A2BFFC}" = Sid Meier's Civilization 4
"{b78120a0-cf84-4366-a393-4d0a59bc546c}" = Menu Templates - Starter Kit
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{bd5ca0da-71ad-43da-b19e-6eee0c9adc9a}" = Nero ControlCenter
"{BE5F3842-8309-4754-92D5-83E02E6077A3}" = Adobe Extension Manager CS3
"{BEEFC4F8-2909-48B3-AFAA-55D3533FDEDD}" = Creative MediaSource 5
"{BF439B41-0252-48DE-8B8B-0430CB26A181}" = CorelDRAW Graphics Suite X4 - VBA
"{C1080852-065E-4991-9260-F3756E3CC182}" = CursorFX
"{c7e96372-fc16-4d84-aa52-80aba026d668}" = Nero 9 Essentials
"{C9D456FD-C25B-49DE-AA71-6B76D6550B23}" = Adobe Fireworks CS3
"{cc019e3f-59d2-4486-8d4b-878105b62a71}" = Nero DiscSpeed
"{ce96f5a5-584d-4f8f-aa3e-9baed413db72}" = Nero CoverDesigner Help
"{CFBCE791-2D53-4FCE-B3FB-D6E01F4112E8}" = Sid Meier's Civilization 4
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{D271DAE0-8D68-4C97-8356-A126D48A1D8C}" = Ulead Photo Explorer 8.0
"{D299837D-74C1-41A9-8783-966610A9BED7}" = Preispiraten
"{D3F80A98-05AB-4D8C-9272-766CCFA6A48D}" = DIE SIEDLER - Aufstieg eines Königreichs
"{d9dcf92e-72eb-412d-ac71-3b01276e5f8b}" = Nero ShowTime
"{DB81779E-7CC5-4630-BCFC-754004956444}" = Visual Basic for Applications (R) Core
"{dba84796-8503-4ff0-af57-1747dd9a166d}" = Nero Online Upgrade
"{DCD22647-6D31-479D-8F97-16D0AA934D9E}" = PC Connectivity Solution
"{DD3DAD13-289E-440E-A5D3-3EFB25305018}_is1" = John's Background Switcher 3.6
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{E117043B-5227-47E9-AC4C-BFB792D5820F}" = Yu-Gi-Oh! ONLINE 3
"{E285F3B1-A840-414F-9A95-47627A16E633}" = AvalonHeroesEU
"{e498385e-1c51-459a-b45f-1721e37aa1a0}" = Movie Templates - Starter Kit
"{e5c7d048-f9b4-4219-b323-8bdb01a2563d}" = Nero DriveSpeed
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{E76FCE6B-9999-4250-8C75-B2DA4AD41268}" = Face_Wizard B07.1219.01
"{e8a80433-302b-4ff1-815d-fcc8eac482ff}" = Nero Installer
"{F01F79AD-1F47-4685-AE4E-CCFA4EA9FF7C}" = Adobe Setup
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{f1861f30-3419-44db-b2a1-c274825698b3}" = Nero Disc Copy Gadget
"{F1A14CB2-A048-45A6-AFDA-3571296E1D76}" = Creative Media Toolbox 6
"{f4041dce-3fe1-4e18-8a9e-9de65231ee36}" = Nero ControlCenter
"{f6bdd7c5-89ed-4569-9318-469aa9732572}" = Nero BurnRights
"{F9FD80CE-0448-4D4F-8BCD-77FC514C3F99}" = Vista Codec Package
"{FAB1F336-1B7C-4057-A7BC-2922CD82A781}" = Ralink Wireless LAN Card
"{fbcdfd61-7dcf-4e71-9226-873ba0053139}" = Nero InfoTool
"{FF29A7E2-FF40-4D07-B7E4-2093DE59E10A}" = Adobe Color NA Extra Settings
"aborange VertippTop_is1" = aborange VertippTop - Deinstallation
"Ace DivX Player_is1" = Ace DivX Player v2.1
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe_25db75244653b42cb93dc27939d1c0e" = Adobe Dreamweaver CS3
"Adobe_3e054d2218e7aa282c2369d939e58ff" = Adobe ExtendScript Toolkit 2
"Adobe_5f143314a5d434c8511097393d17397" = Adobe Photoshop CS3
"Adobe_6c7ed6c08f4acf68bf0512885eec384" = Adobe Fireworks CS3
"Adobe_6c8e2cb4fd241c55406016127a6ab2e" = Adobe Color Common Settings
"Age of Empires 2.0" = Microsoft Age of Empires II
"Akamai" = Akamai NetSession Interface
"ALchemy X-Fi" = Creative ALchemy (X-Fi Edition)
"A-Shop" = Dailsley A-Shop
"Ask Toolbar_is1" = Ask Toolbar
"Avira AntiVir Desktop" = Avira AntiVir Premium
"Canon MP620 series Benutzerregistrierung" = Canon MP620 series Benutzerregistrierung
"Canon_IJ_Network_Scan_UTILITY" = Canon IJ Network Scan Utility
"Canon_IJ_Network_UTILITY" = Canon IJ Network Tool
"CANONIJPLM100" = Inkjet Printer/Scanner Extended Survey Program
"CanonMyPrinter" = Canon Utilities My Printer
"CanonSolutionMenu" = Canon Utilities Solution Menu
"Casino Club Poker" = Casino Club Poker
"CASINO-CLUB Deutsch" = CASINO-CLUB Deutsch
"CDCoverEasyLayout" = CDCover! - Einfach Drucken
"City Life" = City Life
"Creative Software AutoUpdate" = Creative Software AutoUpdate
"CursorFX" = CursorFX
"Direct MIDI to MP3 Converter_is1" = Direct MIDI to MP3 Converter Version 6.1.2.43
"DRI Tool 2.0_is1" = DRI Tool 2.0
"DVD Flick_is1" = DVD Flick
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"EasyTune5Pro" = EasyTune5Pro
"EVEREST Ultimate Edition_is1" = EVEREST Ultimate Edition v4.50
"Fast MP3 Cutter Joiner" = Fast MP3 Cutter Joiner 2.6 build 1198
"FileZilla Client" = FileZilla Client 3.2.4.1
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4
"Free DVD Video Burner_is1" = Free DVD Video Burner version 1.1
"Free Studio_is1" = Free Studio version 4.2
"Free Video to DVD Converter_is1" = Free Video to DVD Converter version 1.1
"Free Video to Flash Converter_is1" = Free Video to Flash Converter version 4.1
"Free YouTube Download_is1" = Free YouTube Download 2.2
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.8
"Google Updater" = Google Updater
"Inkscape" = Inkscape 0.46
"InstallShield_{15803703-25FA-4C01-A062-3F4A59937E87}" = Ulead PhotoImpact X3
"InstallShield_{69640730-B830-4C24-BB5C-222DA1260548}" = Turbo Lister 2
"KompoZer_is1" = KompoZer 0.77
"Lauge_is1" = Lauge 2.23
"Live-Player" = Live-Player
"MAGIX 3D Maker D" = MAGIX 3D Maker (embeded)
"MAGIX Fotos auf CD & DVD 9 D" = MAGIX Fotos auf CD & DVD 9 9.0.1.16 (D)
"MAGIX Online Druck Service D" = MAGIX Online Druck Service
"MAGIX Screenshare D" = MAGIX Screenshare
"MAGIX Speed burnR D" = MAGIX Speed burnR
"Mozilla Firefox (3.6.12)" = Mozilla Firefox (3.6.12)
"MP Navigator EX 2.0" = Canon MP Navigator EX 2.0
"mp3-2-wav" = mp3-2-wav converter 1.14
"NCH Toolbar" = NCH Toolbar
"PartyCasino" = PartyCasino
"PartyPoker" = PartyPoker
"PhotoClean Express" = Shortcut PhotoClean Express
"PreisHai_is1" = PreisHai 4.1
"ProtectDisc Driver 10" = ProtectDisc Helper Driver 10
"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11
"Rainlendar2" = Rainlendar2 (remove only)
"ScreenshotCaptor_is1" = Screenshot Captor 2.56.01
"Supreme Auction_is1" = Supreme Auction
"SysInfo" = Creative Systeminformationen
"The KMPlayer" = The KMPlayer (remove only)
"TrueCrypt" = TrueCrypt
"TV" = TV
"TVISTA - Tuning Vista_is1" = DATA BECKER TVISTA - Tuning Vista
"UK's Kalender_is1" = UK's Kalender 2.2.1
"UN070618" = BUFFALO TurboUSB for FLASH/HDD
"UN090430" = BUFFALO SecureLockManagerEasy for HD
"UnderCoverXP_is1" = UnderCoverXP 1.08
"Uninstall_is1" = Uninstall 1.0.0.1
"Uninstaller_B4736000_Creative Media Toolbox 6" = Creative Media Toolbox 6 (Shared Components)
"UniversalPlayer" = Universal Player
"Vista Icon Pack ST_is1" = Vista Icon Pack ST
"WavePad" = WavePad Sound Editor
"Winamp" = Winamp
"WinGimp-2.0_is1" = GIMP 2.6.11
"WinRAR archiver" = WinRAR
"XMedia Recode" = XMedia Recode 2.0.8.3
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"eBay Shortcuts" = eBay Shortcuts
"Google Chrome" = Google Chrome
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >