HijackThis Log wegen Anruf von Sparkasse

Satuiro · 29.12.2010, 18:05

Hallo,

ich habe heute einen Anruf von der Sparkasse bekommen, dass auf meinem Rechner ein Trojaner sein und deswegen Online Banking gesperrt wurde.

Hier der HijackThis Log:

Code:

ATTFilter

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:54:37, on 29.12.2010
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18248)
Boot mode: Normal

Running processes:
D:\Programme\Hardcopy\hardcopy.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Users\*****\Downloads\HiJackThis204.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
F2 - REG:system.ini: UserInit=userinit.exe
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files (x86)\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - Global Startup: Hardcopy.LNK = D:\Programme\Hardcopy\hardcopy.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files (x86)\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
O9 - Extra 'Tools' menuitem: &Gears-Einstellungen - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files (x86)\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
O9 - Extra button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{94B756D0-C20D-4182-B69A-6A51D583D2D7}: NameServer = 192.168.2.1
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: AAV UpdateService - Unknown owner - D:\Programme\Steuer\Steuer 2010\AAVUpdateManager\aavus.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Dragon Age: Origins - Inhaltsupdater (DAUpdaterSvc) - BioWare - H:\Games\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate1c98ed1bd78afd0) (gupdate1c98ed1bd78afd0) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files (x86)\iPod\bin\iPodService.exe
O23 - Service: Just Flight Limited License Service - Just Flight Limited - C:\Program Files (x86)\Common Files\Just Flight Limited Shared\Service\JustFlightLimitedLicSvc.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NitroPDFReaderDriverCreatorReadSpool (NitroReaderDriverReadSpool) - Nitro PDF Software - C:\Program Files\Common Files\Nitro PDF\Reader\1.0\NitroPDFReaderDriverServicex64.exe
O23 - Service: Sony Ericsson OMSI download service (OMSI download service) - Unknown owner - D:\Programme\Sony Ericson\SupServ.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SCM_Service - Unknown owner - C:\Windows\SysWOW64\WinService.exe
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - Unknown owner - C:\Windows\System32\TuneUpDefragService.exe (file missing)
O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - Unknown owner - C:\Windows\System32\TUProgSt.exe (file missing)
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Virtual CD v9 Management Service (VC9SecS) - H+H Software GmbH - D:\Programme\Virtual CD\System\vc9secs.exe
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 10029 bytes

Ich hoffe mir kann jemand helfen.

Viele Grüße
Christian

markusg · 29.12.2010, 18:08

Systemscan mit OTL
download otl:
http://filepony.de/download-otl/

Doppelklick auf die OTL.exe
(user von Windows 7 und Vista: Rechtsklick als Administrator ausführen)
1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
2. Hake an "scan all users"
3. Unter "Extra Registry wähle:
"Use Safelist" "LOP Check" "Purity Check"
4. Kopiere in die Textbox:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
5. Klicke "Scan"
6. 2 reporte werden erstellt:
OTL.Txt
Extras.Txt
beide posten

Satuiro · 29.12.2010, 18:31

OTL.txt

Code:

ATTFilter

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

Extras.txt

Code:

ATTFilter

OTL Extras logfile created on: 29.12.2010 18:15:06 - Run 1
OTL by OldTimer - Version 3.2.18.1     Folder = C:\Users\*****\Downloads
64bit-Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 61,00% Memory free
8,00 Gb Paging File | 7,00 Gb Available in Paging File | 79,00% Paging File free
Paging file location(s): ?:\pagefile.sys
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 157,83 Gb Total Space | 56,61 Gb Free Space | 35,87% Space Free | Partition Type: NTFS
Drive D: | 140,26 Gb Total Space | 22,02 Gb Free Space | 15,70% Space Free | Partition Type: NTFS
Drive G: | 74,53 Gb Total Space | 32,80 Gb Free Space | 44,01% Space Free | Partition Type: NTFS
Drive H: | 698,63 Gb Total Space | 283,06 Gb Free Space | 40,52% Space Free | Partition Type: NTFS
 
Computer Name: UNSER-PC | User Name: ***** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-1494578580-287442235-1036857688-1001\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" File not found
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" ()
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l ()
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [ACDSee Pro 2.5.Browse] -- "D:\Programme\ACDSee\ACDSee Pro\2.5\ACDSeeQVPro25.exe" "%1" (ACD Systems)
Directory [AddToPlaylistVLC] -- "D:\Programme\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [CEWE FOTOSCHAU] -- "D:\Programme\Mein CEWE FOTOBUCH\CEWE FOTOSCHAU.exe" -d "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Mein CEWE FOTOBUCH] -- "D:\Programme\Mein CEWE FOTOBUCH\Mein CEWE FOTOBUCH.exe" "%1" ()
Directory [PlayWithVLC] -- "D:\Programme\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [ACDSee Pro 2.5.Browse] -- "D:\Programme\ACDSee\ACDSee Pro\2.5\ACDSeeQVPro25.exe" "%1" (ACD Systems)
Directory [AddToPlaylistVLC] -- "D:\Programme\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [CEWE FOTOSCHAU] -- "D:\Programme\Mein CEWE FOTOBUCH\CEWE FOTOSCHAU.exe" -d "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Mein CEWE FOTOBUCH] -- "D:\Programme\Mein CEWE FOTOBUCH\Mein CEWE FOTOBUCH.exe" "%1" ()
Directory [PlayWithVLC] -- "D:\Programme\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 1
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = 9F 9E 16 8C DC 5B C8 01  [binary data]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"oobe_av" = 1
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DisableUnicastResponsesToMulticastBroadcast" = 0
"DefaultOutboundAction" = 0
"DefaultInboundAction" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"D:\Programme\fotobuch.de\Designer 2.0\Designer.exe" = D:\Programme\fotobuch.de\Designer 2.0\Designer.exe:*:Designer.exe -- File not found
"D:\Programme\fotobuch.de\Designer 2.0\Designer.exe" = D:\Programme\fotobuch.de\Designer 2.0\Designer.exe:*:Designer.exe -- File not found
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04CCCEE4-936D-4FF6-A591-5BBF56BC63B8}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{10C83069-706D-4528-9489-CF9211B5F242}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{210A27E7-27E0-4A6F-B9FA-6C73E3BF5CAF}" = lport=5721 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{299F027F-5394-4983-B90F-2D6316CD8835}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe | 
"{3A0DC997-7BE5-4D0B-B93B-2D8C7468A517}" = rport=138 | protocol=17 | dir=out | app=system | 
"{3B6964CE-728C-4B89-85BB-65A777FF94D6}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe | 
"{3F1E7B5E-54F6-4F5E-9754-5AD2270F65FD}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdcbase.exe,-4006 | 
"{4FF61DE2-6673-4494-A4B2-395D09F14560}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{65B8F8B5-D1C5-46CD-A7E9-BCCE49FB5339}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{692DC4A6-CB39-478A-9702-8C563651607E}" = lport=3389 | protocol=6 | dir=in | name=remote | 
"{69CED20E-BF07-4DAF-A72E-2959762A56A9}" = lport=139 | protocol=6 | dir=in | app=system | 
"{6ECEFC22-05FD-4DCB-8541-530F1D47F2C9}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{719B3A04-78FF-46B7-BF3E-6D7C8B59087F}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{74E2F970-B25C-4A94-BE1C-45C395C2D96D}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{77CD8E68-C717-4FAD-B644-3ED470470DFC}" = rport=445 | protocol=6 | dir=out | app=system | 
"{7ACC0B8D-C1B2-4215-9D2A-34F050E62E26}" = lport=137 | protocol=17 | dir=in | app=system | 
"{7CFE36CF-C4A0-4EC7-9E21-B2B38B5D140D}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe | 
"{80DFFC7E-AE7F-45DC-A918-E89E45E9D603}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe | 
"{8C651BDE-25A4-4490-867B-A136269B06C9}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{8E471BD2-E568-4A7E-8776-A7C19F22EDC2}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{95D8E196-85B5-428F-953D-F270CECCA91D}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{9688CC1B-F2FB-416B-A287-14372197C7EB}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{A12DC02C-556A-49E4-AE75-77B2FDC92D12}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe | 
"{AE217B5F-0B40-4B40-BFA3-9A96CC1270C1}" = lport=5721 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{B120F189-816C-4B19-8E71-7CA01BC78077}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe | 
"{BB9319C8-DD80-48EE-9C65-89158E1749C5}" = lport=138 | protocol=17 | dir=in | app=system | 
"{BD5C22F8-19DA-47D7-81D0-E9CA7B72F75D}" = lport=445 | protocol=6 | dir=in | app=system | 
"{BEA4D525-83E0-4E6E-89BD-72A7A5BDEF6F}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{C36D8E34-7E3D-473D-8269-7250280AABF8}" = rport=137 | protocol=17 | dir=out | app=system | 
"{CB019637-54BA-4426-BE67-E467805D8F02}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{D3B62A96-4F15-44BB-BCBE-EE70BD4D48C1}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdcbase.exe,-4006 | 
"{DBE24125-CF5B-43EF-9F8F-012357E93E2B}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{DC7B2CAE-E64A-4358-AFB9-15D7EC63A84F}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{DDF8089C-6E5F-4798-8BEC-74FD42C3BED5}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{DEED7EEB-797E-46F3-B174-5BD26A8A64AC}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdcbase.exe,-4006 | 
"{EF1AEA13-5A8C-4B14-9D4D-2E64BEF4B056}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{EF9CE994-80B1-4C06-BE0C-658957A1CC14}" = rport=139 | protocol=6 | dir=out | app=system | 
"{F41B2ADB-7AEC-4C69-90A4-E2E1273C3ECC}" = lport=5721 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{FDEAE689-03A6-4BF2-863D-617954AE147A}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{043BF183-89C2-41C6-8A63-E51626FD205D}" = protocol=6 | dir=in | app=h:\games\dragon age\daoriginslauncher.exe | 
"{05D5020B-962C-4192-8712-A5EFCEC2E7A3}" = protocol=6 | dir=in | app=h:\games\silent hunter 5\sh5.exe | 
"{0ACFF412-9882-4396-9394-E4F178992CB5}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{10855DDF-F460-49A0-91B1-A45BFAB204BF}" = protocol=17 | dir=in | app=h:\games\dragon age\bin_ship\daorigins.exe | 
"{114C3F46-9000-422F-8B32-A159378C3DBB}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{12BDE141-8611-43B7-BB7D-6892C5B5B86F}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{13D1A03B-6AE8-4FD0-A08F-C99029FA6018}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{1B71D13B-3128-42CA-84FD-F6A72617BA96}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{20939590-4540-4C34-9136-EF2E43B11561}" = protocol=17 | dir=in | app=h:\games\dirt2\dirt2_game.exe | 
"{22DE58EB-32E5-4F38-9D00-0C97FDD31799}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | 
"{2ADF4F6B-FA99-47BD-AEE8-D54799D46E87}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{2DA4A0CE-3A18-497E-9AEA-F07DDEAC7199}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{30F48C2E-9929-4363-938D-2551D37638FB}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{32170AA0-14F1-4940-9D2A-816C042F0EF4}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{3540F7A0-52E8-46FF-AB4B-FBEF5FD7D38D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{3609659D-22EA-4190-B21E-BE75E799ED6F}" = protocol=6 | dir=in | app=h:\games\dirt2\dirt2_game.exe | 
"{36CDBC53-E97C-49B6-AF28-5D7FF85CB3DD}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{3AC28069-F380-43FA-A3A4-ABF38AF46A96}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{3BD515DF-C48B-475A-818D-2946E963B373}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{3F41764B-BE0D-46B8-9917-3A1DE9405B37}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{43D88FB5-91B3-4361-999C-ED6230550636}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{4804976E-049E-493F-9D6A-3C11080BA3F5}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{49B97087-3B97-4C79-AC26-0236D379AECC}" = protocol=17 | dir=in | app=c:\users\*****\appdata\roaming\dropbox\bin\dropbox.exe | 
"{4D257647-FFC7-414A-AA64-F1E3EC02BE13}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{56621CD4-844A-4514-A8B0-E3E3E7670A52}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{57702942-29A2-4A98-BBF9-3E1E415D9F84}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{58089792-5954-4990-9283-4A6559505571}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{58D39F3C-DB13-454B-8A13-E1AE2217E4AD}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{5E992289-BE9A-414C-A2F0-70F9E85766AF}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{67CA4659-0627-42E3-8D52-FE110425B693}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{6E5F538F-49E7-4182-B20D-40BAB3D91080}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{76B7B598-C709-4ED2-9E4F-7B10B178B0E2}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | 
"{794B8E95-59B5-4398-A148-8BE27E86A4EE}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{7A181083-286C-498B-A2A9-531921ADBC0E}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{7C4DC13D-6DA4-4E27-81E3-21D0CAC36D75}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{7C5DC4F4-4932-4C5A-9940-0EAF58525C5B}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{7C794CA4-6884-46B5-9E4B-690D03551A3E}" = protocol=6 | dir=in | app=h:\games\dragon age\bin_ship\daupdatersvc.service.exe | 
"{8127B0CB-09C5-4729-A64D-446180ED7451}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{870E6ED6-C5A1-4B9B-A49E-1F711FED3CF2}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{8A5554D3-2BDF-4031-9FF0-340120890219}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{8C4379D5-F504-40F2-A85A-3C169373973D}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{9119A68A-7FEA-4234-AE68-1F5D5003F1C4}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{956ED424-0C24-444E-9515-59E605BD2733}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{991DF660-1D95-43AA-AEC6-5A22DB4A3A62}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{9F059376-3F3F-48CD-B30A-CB23E3BF1195}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{A8EC139A-A426-4782-95DA-173245C546BC}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{ABBC3359-3ECB-45F0-83F6-24314F19512B}" = protocol=6 | dir=in | app=c:\users\*****\appdata\roaming\dropbox\bin\dropbox.exe | 
"{AF08BC4A-D83B-4BD6-A514-7E7EB7E40598}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{B2F3EAF3-6525-4CB1-9464-C2B5EB86EBA3}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{B3E46385-467B-49CC-9506-DA2535366668}" = protocol=6 | dir=in | app=d:\programme\itunes\itunes.exe | 
"{B4D78327-2914-4693-87C7-2D7A172A3947}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{B82DB51B-E22E-40D7-B21F-1F6DF2BA4128}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{BC3514E6-4D33-4BCD-8A1C-55D9C007B46A}" = protocol=17 | dir=in | app=h:\games\dragon age\bin_ship\daupdatersvc.service.exe | 
"{C19166EE-4E56-4A2D-8571-5174660378DD}" = protocol=17 | dir=in | app=h:\games\silent hunter 5\sh5.exe | 
"{C21C032B-3F6F-4C09-8475-07B55E95E53B}" = protocol=17 | dir=in | app=h:\games\dragon age\daoriginslauncher.exe | 
"{CFCB0755-BD48-4213-A3B3-BB05DC86DFA9}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{D1B587F6-8FB6-464D-91E7-75B3997E8684}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{D36CDC1D-55D1-41BD-A07E-DB283D15DED5}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{D5454577-5A9A-4397-87A2-9F8792148A54}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{D55AF45C-B958-4DD6-98FB-3CA1FE22FA69}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{D67E0AD0-9E15-4B29-8D6D-F0F46A4E50DA}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{D7114853-C32A-4CA5-91EA-6D85D407C591}" = protocol=17 | dir=in | app=d:\programme\itunes\itunes.exe | 
"{DB54CFE0-CD5E-43B0-9768-7D5F210569F2}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{E1BF2FDC-0127-4F52-8A38-2FB0FC328115}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{E2B5AAAA-1644-46A7-B6A7-647807EE27A4}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{E594EF97-E1B6-462F-85A3-6EA41C9FF7A3}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{E5F9AE35-F433-4773-AF3A-E9FE7BA4E236}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{E781FE53-0E46-4A70-B395-459FB4C0AEF8}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{E8903F9B-4BD2-4B79-9B65-5657D4EFFCCD}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{E8C00677-B3BD-40C3-AA0C-0E79EF2D7A1C}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{F0932D29-9125-4478-9DD7-E03B00450A0F}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{F4A9DCEE-82B0-42FC-BFA0-4C0155115A1C}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{FC130C73-A9E1-4BCD-B931-6BFAFAD506C6}" = protocol=6 | dir=in | app=h:\games\dragon age\bin_ship\daorigins.exe | 
"{FF9D9611-A7FC-4568-A20B-20298233A826}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"TCP Query User{0A87B463-A946-4AE7-BE02-3990C7D6D789}H:\games\tmunitedforever\tmforever.exe" = protocol=6 | dir=in | app=h:\games\tmunitedforever\tmforever.exe | 
"TCP Query User{14C19F57-3C22-420C-9417-4F55C2C31EED}D:\programme\musicbrainz picard\picard.exe" = protocol=6 | dir=in | app=d:\programme\musicbrainz picard\picard.exe | 
"TCP Query User{171614ED-6FAC-46AE-8839-F32AE745964E}C:\program files (x86)\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\java.exe | 
"TCP Query User{34490265-6EAE-4E78-9B53-26BD037A7E9B}D:\programme\webcam\classic link\station2.exe" = protocol=6 | dir=in | app=d:\programme\webcam\classic link\station2.exe | 
"TCP Query User{3EB341CA-DEAE-44A7-8D7C-6DA73E23859F}D:\programme\filezilla ftp client\filezilla.exe" = protocol=6 | dir=in | app=d:\programme\filezilla ftp client\filezilla.exe | 
"TCP Query User{4045A80B-BF50-405F-97BD-10FCD14ACBE8}D:\programme\proxy\proxy.exe" = protocol=6 | dir=in | app=d:\programme\proxy\proxy.exe | 
"TCP Query User{4649F0D3-F256-475E-82F0-071DF0A3BBAA}D:\programme\my mobile\mymobiler\mymobiler.exe" = protocol=6 | dir=in | app=d:\programme\my mobile\mymobiler\mymobiler.exe | 
"TCP Query User{5D99DC03-76F5-4203-934D-42B03D1031C4}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe | 
"TCP Query User{61BC2A2D-FCB2-44B4-BB08-8231495E06CD}D:\games\uo-lostland\uo-llr\client.exe" = protocol=6 | dir=in | app=d:\games\uo-lostland\uo-llr\client.exe | 
"TCP Query User{70DF1574-7D99-4F7A-9F08-D53C3673CD96}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"TCP Query User{742245C5-5ECB-4D32-B165-A6A163A73C1B}D:\games\neverwinter nights\nwmain.exe" = protocol=6 | dir=in | app=d:\games\neverwinter nights\nwmain.exe | 
"TCP Query User{8C1747FC-78D6-463C-BE82-5A2D7C6F1014}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe | 
"TCP Query User{9449508B-AE34-42A7-A430-286EF22151B1}H:\kerstin\ganz alter rechner\kerstin\spiele\blobby volley\volley.exe" = protocol=6 | dir=in | app=h:\kerstin\ganz alter rechner\kerstin\spiele\blobby volley\volley.exe | 
"TCP Query User{B24078C3-A84C-4E41-AE05-120F7BAFA20C}D:\games\electronic arts\ultima online stygian abyss classic\client.exe" = protocol=6 | dir=in | app=d:\games\electronic arts\ultima online stygian abyss classic\client.exe | 
"TCP Query User{BC4D60D5-AF6B-4D02-AC38-2C4A5ADCB79A}D:\games\uo-lostland\uo-llr\client.exe" = protocol=6 | dir=in | app=d:\games\uo-lostland\uo-llr\client.exe | 
"TCP Query User{C8692581-32A6-45AF-AEB9-BCA47C5052C5}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"TCP Query User{CFB13032-B617-49D8-9FD1-A2A11214BFC1}D:\games\uo-lostland\ultima online zubehör\automap\uoam.exe" = protocol=6 | dir=in | app=d:\games\uo-lostland\ultima online zubehör\automap\uoam.exe | 
"TCP Query User{D31D7425-1D03-4073-84D0-B022F2D39962}H:\flight simulator\fsx.exe" = protocol=6 | dir=in | app=h:\flight simulator\fsx.exe | 
"UDP Query User{0AFF001D-955C-45AD-BAB5-CA06BA0E72EE}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"UDP Query User{118C0175-89DE-471B-86A1-C435EB3D6C78}D:\programme\proxy\proxy.exe" = protocol=17 | dir=in | app=d:\programme\proxy\proxy.exe | 
"UDP Query User{11B0F68C-B067-46CE-8816-B152A268EF92}D:\programme\webcam\classic link\station2.exe" = protocol=17 | dir=in | app=d:\programme\webcam\classic link\station2.exe | 
"UDP Query User{120D357D-DDE0-4261-B5A3-183FE530B8FD}D:\games\uo-lostland\uo-llr\client.exe" = protocol=17 | dir=in | app=d:\games\uo-lostland\uo-llr\client.exe | 
"UDP Query User{34C60892-4824-4B80-9700-8803B927DC35}D:\games\uo-lostland\ultima online zubehör\automap\uoam.exe" = protocol=17 | dir=in | app=d:\games\uo-lostland\ultima online zubehör\automap\uoam.exe | 
"UDP Query User{3A7E4626-6B27-480F-B2C3-2F162DF10665}D:\programme\musicbrainz picard\picard.exe" = protocol=17 | dir=in | app=d:\programme\musicbrainz picard\picard.exe | 
"UDP Query User{549ED58A-10AC-4DAC-91D1-CB862D1BD59C}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"UDP Query User{668F107D-B032-493A-A260-0AE4A468F9F8}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe | 
"UDP Query User{71649779-A021-41D5-A5C0-DAEE4B9218E2}H:\games\tmunitedforever\tmforever.exe" = protocol=17 | dir=in | app=h:\games\tmunitedforever\tmforever.exe | 
"UDP Query User{7C9F8A5C-3265-4D2B-A2C1-29A4CF260C01}D:\games\electronic arts\ultima online stygian abyss classic\client.exe" = protocol=17 | dir=in | app=d:\games\electronic arts\ultima online stygian abyss classic\client.exe | 
"UDP Query User{82B55727-D8AE-42AE-BFDD-2334A64A28E7}H:\flight simulator\fsx.exe" = protocol=17 | dir=in | app=h:\flight simulator\fsx.exe | 
"UDP Query User{A8DD374B-FD8D-4294-812F-587B86440C81}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe | 
"UDP Query User{CDE07F59-227D-41EA-A5AA-94F1DCDBC2ED}D:\games\uo-lostland\uo-llr\client.exe" = protocol=17 | dir=in | app=d:\games\uo-lostland\uo-llr\client.exe | 
"UDP Query User{D998C00D-780D-48D0-AB00-716968C32982}C:\program files (x86)\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\java.exe | 
"UDP Query User{DB1A81C0-9494-444E-ABC0-C06000745955}D:\programme\my mobile\mymobiler\mymobiler.exe" = protocol=17 | dir=in | app=d:\programme\my mobile\mymobiler\mymobiler.exe | 
"UDP Query User{F640A9EE-EC9F-462A-8D85-3846BECC87AF}H:\kerstin\ganz alter rechner\kerstin\spiele\blobby volley\volley.exe" = protocol=17 | dir=in | app=h:\kerstin\ganz alter rechner\kerstin\spiele\blobby volley\volley.exe | 
"UDP Query User{F756C9C4-54CE-4613-A87B-FD539E5E907B}D:\games\neverwinter nights\nwmain.exe" = protocol=17 | dir=in | app=d:\games\neverwinter nights\nwmain.exe | 
"UDP Query User{FC1009F2-27E2-4617-B625-95AB1059079B}D:\programme\filezilla ftp client\filezilla.exe" = protocol=17 | dir=in | app=d:\programme\filezilla ftp client\filezilla.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{0FB94E81-C427-46D0-A1E7-A4BC42899E65}" = Nitro PDF Reader
"{23170F69-40C1-2702-0457-000001000000}" = 7-Zip 4.57 (x64 edition)
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{626672CD-BFCF-49A9-AEFE-AB0FED3BFC5B}" = Windows Mobile-Gerätecenter
"{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{84BC87D4-0480-4E10-B15D-1E7886D55180}" = iTunes
"{92DBCA36-9B41-4DD1-941A-AED149DD37F0}" = Windows Mobile-Gerätecenter: Treiberupdate
"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant
"{9EFC40E3-5F31-4F75-8445-286273F74D8E}" = Apple Mobile Device Support
"{AB3FDAEC-7702-3A47-655B-4A34714CBEFA}" = ccc-utility64
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D1EF69B7-7A97-40FC-9AF1-6D6656FF874F}" = ATI AVIVO64 Codecs
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319
"{F3FEB53B-0BD3-F481-A8F9-51BA46466A6A}" = ATI Catalyst Install Manager
"45A7283175C62FAC673F913C1F532C5361F97841" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (03/08/2007 2.2.1.0)
"KLiteCodecPack64_is1" = K-Lite Codec Pack (64-bit) v2.4.5
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"x64 Components_is1" = x64 Components v2.2.9
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00277C92-28A4-4A4F-828C-3C7C15732E9E}" = T-Online Banking Software
"{0032D29F-7E8F-40E5-AD12-8857AAB0DBFF}" = Catalyst Control Center - Branding
"{02EBDBB9-4600-41D3-B566-40CB861511D2}" = World of Warcraft FREE Trial
"{034C3647-3240-B744-D10B-637197A1E5B1}" = Catalyst Control Center InstallProxy
"{04B45310-A5FE-4425-BFCA-1A6D8920DE74}" = OpenOffice.org 3.0
"{07A8ED9E-B98E-437F-B750-241B412BE924}" = Garmin USB Drivers
"{09298F26-A95C-31E2-9D95-2C60F586F075}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{0B744987-A39E-45E5-B930-11EDBDFE3003}" = X3 Reunion
"{0D410F4D-9009-43F8-9DF1-BDADCE7FC43F}" = AAVUpdateManager
"{11083C7A-D0D6-4DA4-8C3A-74B8389EC07B}" = ATI Catalyst Registration
"{112B0ED9-57F8-4883-8E6A-5BEAABDABBC1}" = Crazy Machines II
"{11D6DF85-2731-45CA-BD80-E342CA0E033F}_is1" = RigNRoll (Nur entfernen)
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{15F4085A-BC98-4590-AFFD-03BBBE49524E}" = Garmin Communicator Plugin
"{1873789F-59D5-4002-8A2F-60A827B78F98}_is1" = GmapTool 0.5.2
"{19DDEE14-1A97-196F-B33B-5F069C929ACA}" = HydraVision
"{1C4551A6-4743-4093-91E4-1477CD655043}" = NVIDIA PhysX
"{1FDA5A37-B22D-43FF-B582-B8964050DC13}" = Microsoft Games for Windows - LIVE Redistributable
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{21E02D3D-46CD-4D65-865A-F2FB8DECE18B}" = Coffee Shop
"{2336573C-3213-48AA-A306-8309BA9BD92C}" = Aerosoft's - Airbus X
"{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}" = TuneUp Utilities 2011
"{241F2BF7-69EB-42A4-9156-96B2426C7504}" = Microsoft SQL Server Compact 3.5 for Devices ENU
"{2436F2A8-4B7E-4B6C-AE4E-604C84AA6A4F}" = Nero Core Components 10
"{25B473C3-2C62-482B-858F-94ED76880F79}" = Patrizier 4
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 18
"{2A03B9F8-BE6D-43C6-A16A-B9998A194AF0}" = Garmin Training Center
"{2AEB2EFA-477F-4F3F-9864-356AC2141F45}" = aerosoft's - Berliner S-Bahn Teil 1
"{2C0AC9A4-3FA8-4B71-848E-9BB9D492BC2E}_is1" = Mystery Tales - Insel der Träume
"{2C440596-FD75-9EA6-5472-B2EDBF5D222B}" = ccc-core-static
"{2D50613C-6903-412A-9EAC-18F3890B0C55}" = WiFiFoFum
"{2D95950E-6D76-43E7-94A5-D9DBA2FD29E4}" = ACDSee Pro 2.5
"{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component
"{2FA41EBB-3F5A-35C3-85D6-51EC72A11FBD}" = Google Gears
"{2FFE93F0-BB72-4E52-8761-354D1AAA9387}" = Sony Ericsson PC Suite 6.011.00
"{302AC480-43D2-11D5-A818-00500435FC18}" = Gothic_Patch
"{328019A7-0012-401D-96A2-4CDDD02675A8}" = Garmin POI Loader
"{32E00E5E-22B1-4D5A-9DC2-CD75E087A5E6}" = Steuer-Spar-Erklärung 2009
"{36A1E3D6-288A-4EEE-A081-30D9808B2BE3}" = Joe
"{3A8DED06-80E7-4555-AA1F-FF4A2A4D353C}" = Aerosoft's - DHC-6 Twin Otter X
"{3C2E0ED3-5EEE-4D08-B446-7E73F1E03F38}" = Formfiller
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{3FEF132F-973E-4255-A8A5-81C83FD6F858}" = Platform4 Player
"{40FE74B5-71A1-4393-A0AB-21D6E1DA5A66}" = Gothic 2 Gold
"{4102037D-E8E0-48E0-B203-E521D194FB71}" = NETGEAR WG111v2 wireless USB 2.0 adapter
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{434D0820-3AA6-493A-80B9-301000028501}" = DiRT2
"{434D0831-A4CC-401A-9E74-621000018401}" = F1 2010
"{44E1DE63-C8FA-4C70-B4AA-0C49A947ACDE}" = Sid Meier's Railroads!
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CFCC6FD-AEA2-4208-99A6-45CBF9DFFD82}" = Real Environment Xtreme
"{4D96D2F0-8FB4-45C2-9B80-2DCB88016316}_is1" = Machinarium
"{510D2239-6C2E-457B-9590-485EC552D94D}" = Garmin USB Drivers
"{523B2B1B-D8DB-4B41-90FF-C4D799E2758A}" = Nero ControlCenter 10 Help (CHM)
"{52D1D62C-FEAB-4580-849E-1DB624BADBBD}" = DiRT2
"{555868C6-49FB-484F-BB43-8980651A1B00}" = Nero BurnRights 10 Help (CHM)
"{55A29068-F2CE-456C-9148-C869879E2357}" = TuneUp Utilities 2009
"{587A2120-41D3-11DB-3D6C-00E19E4D4AE1}" = MSTS Patch 1.8.0105
"{5D4C60AA-84E6-4E1A-8A68-69970D387BE1}" = TuneUp Utilities Language Pack (de-DE)
"{5E30BDEB-9307-11D4-9AE0-006067325E47}" = Baldur's Gate(TM) II - Schatten von Amn(TM)
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{605C5258-7549-4F4C-9E40-D8327CE6C62E}" = Platform4 Player ActiveX Control
"{6060D783-86C9-436E-B321-7279B19152C0}" = Hairy Landing at PAKP
"{60DA1EC2-27C2-4A51-A77D-F482E186531E}" = Ilyushin IL-14 for FSX
"{625386A4-B6B6-4911-A6E8-23189C3F2D15}" = Microsoft .NET Compact Framework 2.0
"{641FE800-650B-4E99-A304-9D50E7235BAF}" = Topo Deutschland v2
"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update
"{68C17A81-81E1-458C-8555-3131C4D7A8DF}" = Garmin MapSource
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6DFB899F-17A2-48F0-A533-ED8D6866CF38}" = Nero Control Center 10
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser und SDK
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72CCBEA1-8D57-4981-A337-81019F28C5BA}" = Microsoft .NET Compact Framework 3.5
"{75EA97E2-BAD7-45DF-8196-82A828BF47DC}" = Royal Doppelkopf
"{7730D510-6DE2-4CD4-8F58-0B04680AEFE6}" = Mysteryville 2
"{79438F1E-DEC3-443D-9DCD-FECE2D68C605}" = IL-2 Sturmovik 1946
"{7A5D731D-B4B3-490E-B339-75685712BAAB}" = Nero Burning ROM 10
"{7ACEE78A-537D-2857-1A64-72198BC4A67D}" = Catalyst Control Center Graphics Previews Vista
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7C503E58-B2BC-11D5-978A-0050BA84F5F7}" = Neverwinter Nights
"{7CD82818-18F2-E4D5-A502-9D1F16C8DF9C}" = Catalyst Control Center Graphics Previews Common
"{7D606567-5047-451A-B49E-29FCB6012B4E}" = Microsoft Flight Simulator X: Acceleration
"{7E8944E9-4F29-4900-82C6-136EAB4D1BB8}" = Das Geheimnis des silbernen Ohrrings
"{7FC7AD70-1DF3-4B84-9AA2-4FB680F45572}_is1" = Hex-Editor MX
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{86A4C6D9-29EE-4719-AFA1-BA3341862B83}" = Microsoft Games for Windows - LIVE
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{8A261769-9640-4DB4-B877-3E00C61967F3}_is1" = concept/design onlineTV 5
"{8A76CFCA-4BEC-C88E-3A7B-7CD18E3B86EA}" = CCC Help English
"{8ACC73AA-6511-7C55-B1A9-8E5D1DEAFAA3}" = The Lord of the Rings FREE Trial 
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8B62D59A-4B38-4B93-B8F7-DF3A88A6362E}_is1" = WEM Confi 7.51
"{8F08E12A-363F-4F69-8BC8-0E0EA502A6ED}" = Holly - Ein Weihnachtsmärchen
"{943CFD7D-5336-47AF-9418-E02473A5A517}" = Nero BurnRights 10
"{9720C029-0C2C-4D1E-9DE0-E89971C4C8C7}" = Silent Hunter III
"{974C4B12-4D02-4879-85E0-61C95CC63E9E}" = Fallout 3
"{98A64C75-BFD6-4212-8746-8BADC7ABA79E}" = Virtual CD v9
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A822727-D0F1-4DE4-B01E-C2BC71677471}" = German Landmarks FSX
"{9A996B6A-846E-4A89-B9C4-17546B7BE49F}" = Burnout(TM) Paradise The Ultimate Box
"{9B6B24BE-80E7-46C4-9FA5-B167D5E0F345}" = Nero BurningROM 10 Help (CHM)
"{9C45D9D2-D429-4EA7-8E9E-BFBBD9BAA4F2}" = Garmin City Navigator Europe NT 2011.10
"{A06A6679-41D7-48C5-82F8-7D3B0B654720}" = Active Sky X
"{A2433A63-5F5D-40E5-B529-9123C2B3E734}" = Anno 1701
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A7709081-CE4E-4339-A727-F88E648F92FA}_is1" = Oblivion Improved 1.41
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC61C594-5F86-4BE9-ABAF-763C6A8E2302}" = Silent Hunter 5
"{AC76BA86-1033-F400-7760-000000000004}" = Adobe Acrobat 9 Pro - English, Français, Deutsch
"{AC76BA86-1033-F400-7760-000000000004}_940" = Adobe Acrobat 9.4.0 - CPSID_83708
"{AC76BA86-1033-F400-7760-000000000004}{AC76BA86-1033-F400-7760-000000000004}" = Adobe Acrobat 9 Pro - English, Français, Deutsch
"{AC76BA86-7AD7-1031-7B44-A90000000001}" = Adobe Reader 9 - Deutsch
"{AE0FB74F-8E5D-41DF-9EC6-061B6390189B}" = Aerosoft's - German Airfields 9 - Nordbayern
"{AE395AC2-28CB-463F-87DC-00C8059781BF}" = 7Artifacs
"{AE7DCBDC-7C07-339D-0202-A12F93A67D90}" = Catalyst Control Center InstallProxy
"{AEC81925-9C76-4707-84A9-40696C613ED3}" = Dragon Age: Origins
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B6A24D2D-1ADB-4553-87FD-38F3FAADC18E}_is1" = The Book of Unwritten Tales 1.0.0.0
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B7429839-9FAE-448E-8413-4888DCFE064F}" = Aerosoft's - Piper Cheyenne FSX
"{BD009869-6498-4CF9-9016-E9EA6E3742B2}" = The Whispered World
"{BF8921C7-59DD-486C-8D8A-B433DC4A5323}" = Search and Rescue 4
"{C3C9EB3D-24FA-4462-B784-0EC6AAFCD2DD}" = Fable - The Lost Chapters
"{CED6EAB9-9FFD-44B2-939A-D77905AD35F3}" = PMDG_MD11_FSX
"{D1AC9B0B-2727-4811-91DC-1FC3C4E47A9B}" = Microsoft Flight Simulator SimConnect Client v10.0.60905.0
"{D2FCA41E-AC01-4DCD-B3A7-DC9E32363065}}_is1" = Rapture3D 2.3.26 Game
"{D3BFE020-607E-11DC-6784-0094671E18BE}" = Flight Environment X
"{D8E1DFEE-622B-46BA-AEFF-AB7E541C0B21}" = Steuer-Spar-Erklärung 2010
"{DF6FE172-006A-4324-AF7F-ACFE4BA290FE}" = AAVUpdateManager
"{E0783143-EAE2-4047-A8D6-E155523C594C}" = Garmin WebUpdater
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E40AAC4D-152C-4C7E-BAB2-92C6539E61CA}" = Douglas DC-4 for FSX
"{E6FA148F-1E7D-4A42-A9A2-7DFABC2C6A2B}" = SportTracks 2.1
"{EA312C43-6187-11D8-AEFD-00A0CC5F5288}" = Simon Bergner´s ATC Simulator
"{EBC0E8C0-63AC-11D4-BEF2-00A0C9E0B324}" = StarTopia
"{EDA12670-56B5-4459-BA21-D010F0E3EBA1}" = Emergency 4 Deluxe
"{EE3FBD3C-782E-4A90-9507-0ECFE1FECCE4}" = Sid Meier's Railroads!
"{EEC8205A-E3DE-4C00-B60C-48E3B9B58B13}" = Garmin City Navigator Europe NT 2008
"{EF11FC33-6C4D-4AF3-8ECB-5D1917E0AEC1}" = Just Flight - Air Hauler
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F138762F-5A1F-4CF0-A5E1-1588EF6088A4}" = The Witcher
"{F535B2CF-C9BB-4162-B03A-02D6971F32CC}" = Microsoft Flight Simulator X
"{F7016342-C196-44B1-AAC5-D7BA4708473E}" = Aerosoft's - VFR Germany 4
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{F9FD80CE-0448-4D4F-8BCD-77FC514C3F99}" = Vista Codec Package
"{FB647DBE-2231-405D-AC36-C73246CBE305}" = PMDG BAe JS4100
"{FD4FE0F7-91FC-43A2-9C3A-187553991FFF}" = Hercules Classic Link Webcam
"{FE83F463-7E61-4B18-9FA0-B94B90A0B6B9}" = Nero Burning ROM 10
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"10finger" = 10Finger- Schreibtrainer
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AFPL Ghostscript 8.54" = AFPL Ghostscript 8.54
"AFPL Ghostscript Fonts" = AFPL Ghostscript Fonts
"Airline Tycoon - Deluxe" = Airline Tycoon - Deluxe
"Amazing Adventures – The Lost Tomb" = Amazing Adventures – The Lost Tomb
"Amelies Cafe" = Amelies Cafe
"AnalogX Proxy" = AnalogX Proxy
"ATR_72500" = Flight One ATR 72-500
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"AviSynth" = AviSynth 2.5
"beaTunes-2.0.19" = tagtraum industries beaTunes 2.0.19
"Bejeweled Twist" = Bejeweled Twist
"Berlin Subway" = Berlin Subway
"BlogDesk_is1" = BlogDesk 2.8
"Camouflage" = Camouflage
"Cargo Transport to Lonesome Lake Hut" = Cargo Transport to Lonesome Lake Hut
"Crayon Physics Deluxe_is1" = Crayon Physics Deluxe - release 51
"Dark Age of Camelot" = Dark Age of Camelot
"dBpowerAMP Music Converter" = dBpowerAMP Music Converter
"Diablo II" = Diablo II
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"Drakensang_is1" = Drakensang (Patch Version 1.1)
"DSGPlayer" = DEUTSCHLAND SPIELT GAME CENTER
"Dungeon Keeper II" = Dungeon Keeper 2
"EAX Unified" = EAX Unified
"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20
"FileZilla Client" = FileZilla Client 3.2.2.1
"FixTunes" = FixTunes (remove only)
"Flight Info X" = Flight Info X 1.0.5
"FlightSim_{7D606567-5047-451A-B49E-29FCB6012B4E}" = Microsoft Flight Simulator X: Acceleration
"Free M4a to MP3 Converter_is1" = Free M4a to MP3 Converter 6.1
"Free PDF to Word Doc Converter_is1" = Free PDF to Word Doc Converter v1.1
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.2
"FreePDF_XP" = FreePDF (Remove only)
"FSFDT FSCopilot" = FSFDT FSCopilot
"FSFlyingSchool 2010" = FSFlyingSchool 2010
"FSX Missions - A321 Lufthansa" = FSX Missions - A321 Lufthansa
"Gothic" = Gothic
"GPL Ghostscript 8.71" = GPL Ghostscript 8.71
"GPS2PowerTrack Plugin_is1" = GPS2PowerTrack Plugin
"GPS-Track-Analyse.NET_is1" = 5.0.1
"Gray Matter_is1" = Gray Matter
"GSAK_is1" = GSAK 7.7.3.21 (patch)
"Guitar Pro 5_is1" = Guitar Pro 5.2
"Hardcopy(D__Programme_Hardcopy)" = Hardcopy (D:\Programme\Hardcopy)
"HospitalTycoon" = Hospital Tycoon
"InstallShield_{79438F1E-DEC3-443D-9DCD-FECE2D68C605}" = IL-2 Sturmovik 1946
"InstallShield_{9720C029-0C2C-4D1E-9DE0-E89971C4C8C7}" = Silent Hunter III
"InstallShield_{BF8921C7-59DD-486C-8D8A-B433DC4A5323}" = Search and Rescue 4
"InstallShield_{C3C9EB3D-24FA-4462-B784-0EC6AAFCD2DD}" = Fable - The Lost Chapters
"InstallShield_{F535B2CF-C9BB-4162-B03A-02D6971F32CC}" = Microsoft Flight Simulator X
"JDownloader" = JDownloader
"KeePassPasswordSafe2_is1" = KeePass Password Safe 2.13
"KLiteCodecPack_is1" = K-Lite Mega Codec Pack 4.9.5
"LANGMaster eduExplorer" = LANGMaster eduExplorer
"Loksim3D" = Loksim3D
"Mahjong Escape – Ancient China" = Mahjong Escape – Ancient China
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mein CEWE FOTOBUCH" = Mein CEWE FOTOBUCH
"Mobile Partner" = Mobile Partner
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"Mozilla Thunderbird (3.0.11)" = Mozilla Thunderbird (3.0.11)
"Mp3tag" = Mp3tag v2.45a
"MyMDb_0" = MyMDb 3.6
"NiBiRu_is1" = NiBiRu 1.2
"Nvu_is1" = Nvu 1.0
"Oblivion Character Manager_is1" = Oblivion Character Manager
"Oblivion mod manager_is1" = Oblivion mod manager 1.1.12
"Oblivion User Patch v1.07 > v1.07.1 Minifix_is1" = Oblivion User Patch
"Oblivion User Patch v1.07_is1" = Oblivion User Patch
"Oblivion-Schilder-Mod_is1" = Oblivion-Schilder-Mod-v0.5
"OpenAL" = OpenAL
"OpenStreetMap Plugin V2_is1" = OpenStreetMap Plugin V2
"OpenStreetMap Plugin_is1" = OpenStreetMap Plugin
"PDF Blender" = PDF Blender
"Peggle Deluxe" = Peggle Deluxe
"Personal Video Database_is1" = Personal Video Database 0.9.9.14
"Picasa 3" = Picasa 3
"PirateVille" = PirateVille
"Populous: The Beginning" = Populous: The Beginning
"Power Analysis Plugin_is1" = Power Analysis Plugin
"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11
"ProTrain Vogelfluglinie 1.0" = ProTrain Vogelfluglinie 1.0
"Riva FLV Encoder 2.0_is1" = Riva FLV Encoder 2.0
"RTMshadow_{7D606567-5047-451A-B49E-29FCB6012B4E}" = Flight Simulator X
"SADK" = Die Siedler - Aufbruch der Kulturen
"Schnell schreiben_is1" = Schnell schreiben 2.2
"SP1shadow_{7D606567-5047-451A-B49E-29FCB6012B4E}" = Flight Simulator X Service Pack 1
"Spoiler Sync_is1" = Spoiler Sync
"STP DB ICE3 403 V1.0" = STP DB ICE3 403 V1.0
"Tales of Monkey Island" = Tales of Monkey Island
"Tipp Top 5.0" = Tipp Top 5.0
"TIPP10_is1" = TIPP10 Version 2.0.3
"TmUnitedForever_is1" = TmUnitedForever
"Total Video Converter 3.50_is1" = Total Video Converter 3.50
"Train Simulator 1.0" = Microsoft Train Simulator
"TuneUp Utilities 2011" = TuneUp Utilities 2011
"tv_enua" = Lernout & Hauspie TruVoice American English TTS Engine
"tvbrowser" = TV-Browser 2.7.5
"Uninstall_is1" = Uninstall 1.0.0.1
"Uninstaller_B72FF000_Air Hauler" = Air Hauler (Shared Components)
"VirtualDub Filter Pack_is1" = VirtualDub Filter Pack 1.1
"VLC media player" = VLC media player 1.1.5
"WinGimp-2.0_is1" = GIMP 2.6.6
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
"WinUAE" = WinUAE 2.0.1
"X3 Bonuspaket_is1" = X3 Bonuspaket 3.1.07
"Xilisoft Video Converter Ultimate" = Xilisoft Video Converter Ultimate
"Xtreme Prototypes 20 Series Business Jets SP2" = Xtreme Prototypes 20 Series Business Jets SP2
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-1494578580-287442235-1036857688-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{03748342-E2C2-4442-8D15-6A28D8A932BE}" = Aerosoft's - Seahawk & Jayhawk X
"{92B44BC9-B9A1-43F7-ABBC-A197A34A656E}" = Aerosoft's - Flight Tales I
"{BC2AB841-B2D9-400F-BF98-F2B620A2C233}" = Just Flight VLJ Business Jet (FSX)
"171a3bd25b2ddd36" = vroute.info
"AlphaSim HU-16 for FSX v1.00" = AlphaSim HU-16 for FSX v1.00
"Classic Wings Cierva C.30 For Fs9" = Classic Wings Cierva C.30 For Fs9
"DAoC Portal" = DAoC Portal
"Dropbox" = Dropbox
"Epic Victory  Build 1.0" = Epic Victory  Build 1.0
"FreeTrack v2.1.2" = FreeTrack v2.1.2
"FreeTrack v2.2.0.279" = FreeTrack v2.2.0.279
"Wilco Fleet : A400M (FSX)" = Wilco Fleet : A400M (FSX)
"Wupper Express 11 Actpack 1.0" = Wupper Express 11 Actpack 1.0
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 06.06.2010 03:40:23 | Computer Name = Unser-Pc | Source = WinMgmt | ID = 10
Description = 
 
Error - 06.06.2010 03:41:06 | Computer Name = Unser-Pc | Source = Google Update | ID = 20
Description = 
 
Error - 06.06.2010 04:53:07 | Computer Name = Unser-Pc | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung Explorer.EXE, Version 6.0.6001.18164, Zeitstempel
 0x4907e791, fehlerhaftes Modul fontext.dll, Version 6.0.6001.18000, Zeitstempel
 0x4791aceb, Ausnahmecode 0xc0000005, Fehleroffset 0x0000000000009d46,  Prozess-ID
 0x620, Anwendungsstartzeit 01cb054bd16d98bc.
 
Error - 06.06.2010 05:00:24 | Computer Name = Unser-Pc | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung Explorer.EXE, Version 6.0.6001.18164, Zeitstempel
 0x4907e791, fehlerhaftes Modul ntdll.dll, Version 6.0.6001.18000, Zeitstempel 0x4791adec,
 Ausnahmecode 0xc0150010, Fehleroffset 0x00000000000b1188,  Prozess-ID 0x620, Anwendungsstartzeit
 01cb054bd16d98bc.
 
Error - 06.06.2010 14:09:03 | Computer Name = Unser-Pc | Source = WinMgmt | ID = 10
Description = 
 
Error - 06.06.2010 14:41:05 | Computer Name = Unser-Pc | Source = Google Update | ID = 20
Description = 
 
Error - 06.06.2010 15:41:05 | Computer Name = Unser-Pc | Source = Google Update | ID = 20
Description = 
 
Error - 07.06.2010 05:32:03 | Computer Name = Unser-Pc | Source = WinMgmt | ID = 10
Description = 
 
Error - 07.06.2010 12:26:20 | Computer Name = Unser-Pc | Source = WinMgmt | ID = 10
Description = 
 
Error - 08.06.2010 04:15:03 | Computer Name = Unser-Pc | Source = WinMgmt | ID = 10
Description = 
 
[ Media Center Events ]
Error - 04.03.2010 11:06:24 | Computer Name = Unser-Pc | Source = Media Center Guide | ID = 0
Description = Ereignisinformationen: ERROR: SqmApiWrapper.TimerRecord failed; Win32
 GetLastError returned 10000105  Prozess: DefaultDomain Objektname: Media Center Guide

 
Error - 13.11.2010 13:50:51 | Computer Name = Unser-Pc | Source = Media Center Guide | ID = 0
Description = Ereignisinformationen: ERROR: SqmApiWrapper.TimerRecord failed; Win32
 GetLastError returned 10000105  Prozess: DefaultDomain Objektname: Media Center Guide

 
[ System Events ]
Error - 26.12.2010 04:53:52 | Computer Name = Unser-Pc | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 27.12.2010 14:38:06 | Computer Name = Unser-Pc | Source = Application Popup | ID = 1060
Description = Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Windows\SysWow64\drivers\SSHDRV61.sys
 nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version
 des Treibers zu erhalten.
 
Error - 27.12.2010 14:38:23 | Computer Name = Unser-Pc | Source = HTTP | ID = 15016
Description = 
 
Error - 27.12.2010 14:39:55 | Computer Name = Unser-Pc | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 28.12.2010 13:17:00 | Computer Name = Unser-Pc | Source = Application Popup | ID = 1060
Description = Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Windows\SysWow64\drivers\SSHDRV61.sys
 nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version
 des Treibers zu erhalten.
 
Error - 28.12.2010 13:17:16 | Computer Name = Unser-Pc | Source = HTTP | ID = 15016
Description = 
 
Error - 28.12.2010 13:43:19 | Computer Name = Unser-Pc | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 29.12.2010 12:43:43 | Computer Name = Unser-Pc | Source = Application Popup | ID = 1060
Description = Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Windows\SysWow64\drivers\SSHDRV61.sys
 nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version
 des Treibers zu erhalten.
 
Error - 29.12.2010 12:43:59 | Computer Name = Unser-Pc | Source = HTTP | ID = 15016
Description = 
 
Error - 29.12.2010 12:45:32 | Computer Name = Unser-Pc | Source = Service Control Manager | ID = 7001
Description = 
 
[ TuneUp Events ]
Error - 22.12.2010 12:33:18 | Computer Name = Unser-Pc | Source = TuneUp.UtilitiesSvc | ID = 300
Description = 
 
Error - 22.12.2010 15:16:14 | Computer Name = Unser-Pc | Source = TuneUp.UtilitiesSvc | ID = 300
Description = 
 
Error - 23.12.2010 12:27:49 | Computer Name = Unser-Pc | Source = TuneUp.UtilitiesSvc | ID = 300
Description = 
 
Error - 24.12.2010 05:41:23 | Computer Name = Unser-Pc | Source = TuneUp.UtilitiesSvc | ID = 300
Description = 
 
Error - 25.12.2010 12:04:16 | Computer Name = Unser-Pc | Source = TuneUp.UtilitiesSvc | ID = 300
Description = 
 
Error - 26.12.2010 04:42:37 | Computer Name = Unser-Pc | Source = TuneUp.UtilitiesSvc | ID = 300
Description = 
 
Error - 27.12.2010 14:38:46 | Computer Name = Unser-Pc | Source = TuneUp.UtilitiesSvc | ID = 300
Description = 
 
Error - 28.12.2010 13:17:32 | Computer Name = Unser-Pc | Source = TuneUp.UtilitiesSvc | ID = 300
Description = 
 
Error - 29.12.2010 12:44:15 | Computer Name = Unser-Pc | Source = TuneUp.UtilitiesSvc | ID = 300
Description = 
 
Error - 29.12.2010 13:12:41 | Computer Name = Unser-Pc | Source = TuneUp Program Statistics | ID = 131840
Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO
 ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2010-12-29 18:12:41', '\device\harddiskvolume2\programme\malwarebytes'
 anti-malware\mbam.exe','2368',0)
 
 
< End of report >

Ich hoffe das hilft.

markusg · 29.12.2010, 18:34

nö, otl.txt fehlt ja.

Satuiro · 29.12.2010, 18:38

Sorry...

OTL.txt

Code:

ATTFilter

OTL logfile created on: 29.12.2010 18:15:05 - Run 1
OTL by OldTimer - Version 3.2.18.1     Folder = C:\Users\*****\Downloads
64bit-Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 61,00% Memory free
8,00 Gb Paging File | 7,00 Gb Available in Paging File | 79,00% Paging File free
Paging file location(s): ?:\pagefile.sys
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 157,83 Gb Total Space | 56,61 Gb Free Space | 35,87% Space Free | Partition Type: NTFS
Drive D: | 140,26 Gb Total Space | 22,02 Gb Free Space | 15,70% Space Free | Partition Type: NTFS
Drive G: | 74,53 Gb Total Space | 32,80 Gb Free Space | 44,01% Space Free | Partition Type: NTFS
Drive H: | 698,63 Gb Total Space | 283,06 Gb Free Space | 40,52% Space Free | Partition Type: NTFS
 
Computer Name: UNSER-PC | User Name: ***** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\*****\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Users\CHRIST~1\AppData\Local\Temp\is-ANN6C.tmp\mbam-setup-1.50.1.1100.tmp ()
PRC - C:\Users\*****\Downloads\mbam-setup-1.50.1.1100.exe (Malwarebytes Corporation                                    )
PRC - C:\Users\*****\Downloads\HiJackThis204.exe (Trend Micro Inc.)
PRC - D:\Programme\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - D:\Programme\Hardcopy\hardcopy.exe (sw4you, Siegfried Weckmann)
PRC - C:\Program Files (x86)\Google\Update\1.2.183.39\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - D:\Programme\Sony Ericson\SupServ.exe ()
PRC - D:\Programme\Virtual CD\System\vc9secs.exe (H+H Software GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - D:\Programme\Steuer\Steuer 2010\AAVUpdateManager\aavus.exe ()
PRC - C:\Windows\SysWOW64\WinService.exe ()
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\*****\Downloads\OTL.exe (OldTimer Tools)
MOD - D:\Programme\Hardcopy\hardcopy_03.dll ()
MOD - D:\Programme\Hardcopy\HcDLL2_30_Win32.dll ()
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (UxTuneUp) -- C:\Windows\SysNative\uxtuneup.dll ()
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe ()
SRV:64bit: - (NitroReaderDriverReadSpool) -- C:\Program Files\Common Files\Nitro PDF\Reader\1.0\NitroPDFReaderDriverServicex64.exe (Nitro PDF Software)
SRV:64bit: - (TuneUp.ProgramStatisticsSvc) -- C:\Windows\SysNative\TUProgSt.exe ()
SRV:64bit: - (TuneUp.Defrag) -- C:\Windows\SysNative\TuneUpDefragService.exe ()
SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\Windows\SysWOW64\uxtuneup.dll (TuneUp Software)
SRV - (NAUpdate) -- C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG)
SRV - (Just Flight Limited License Service) -- C:\Program Files (x86)\Common Files\Just Flight Limited Shared\Service\JustFlightLimitedLicSvc.exe (Just Flight Limited)
SRV - (DAUpdaterSvc) -- H:\Games\Dragon Age\bin_ship\daupdatersvc.service.exe (BioWare)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (OMSI download service) -- D:\Programme\Sony Ericson\SupServ.exe ()
SRV - (VC9SecS) -- D:\Programme\Virtual CD\System\vc9secs.exe (H+H Software GmbH)
SRV - (AAV UpdateService) -- D:\Programme\Steuer\Steuer 2010\AAVUpdateManager\aavus.exe ()
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (SCM_Service) -- C:\Windows\SysWOW64\WinService.exe ()
SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (vhidmini) -- C:\Windows\SysNative\DRIVERS\vhidmini.sys File not found
DRV:64bit: - (SSHDRV61) -- C:\Windows\SysNative\drivers\SSHDRV61.sys File not found
DRV:64bit: - (NwlnkFwd) -- C:\Windows\SysNative\DRIVERS\nwlnkfwd.sys File not found
DRV:64bit: - (NwlnkFlt) -- C:\Windows\SysNative\DRIVERS\nwlnkflt.sys File not found
DRV:64bit: - (IpInIp) -- C:\Windows\SysNative\DRIVERS\ipinip.sys File not found
DRV:64bit: - (atksgt) -- C:\Windows\SysNative\DRIVERS\atksgt.sys ()
DRV:64bit: - (lirsgt) -- C:\Windows\SysNative\DRIVERS\lirsgt.sys ()
DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\DRIVERS\atikmdag.sys ()
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\DRIVERS\atikmdag.sys ()
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\DRIVERS\atikmpag.sys ()
DRV:64bit: - (acedrv11) -- C:\Windows\SysNative\drivers\acedrv11.sys ()
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\DRIVERS\avgntflt.sys ()
DRV:64bit: - (cmnsusbser) -- C:\Windows\SysNative\DRIVERS\cmnsusbser.sys ()
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\Drivers\usbaapl64.sys ()
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\DRIVERS\GEARAspiWDM.sys ()
DRV:64bit: - (grmnusb) -- C:\Windows\SysNative\drivers\grmnusb.sys ()
DRV:64bit: - (KMWDFILTER) -- C:\Windows\SysNative\DRIVERS\KMWDFILTER.sys ()
DRV:64bit: - (vdrv9000) -- C:\Windows\SysNative\DRIVERS\vdrv9000.sys ()
DRV:64bit: - (sptd) -- C:\Windows\SysNative\Drivers\sptd.sys ()
DRV:64bit: - (s0017unic) Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM) -- C:\Windows\SysNative\DRIVERS\s0017unic.sys ()
DRV:64bit: - (s0017obex) -- C:\Windows\SysNative\DRIVERS\s0017obex.sys ()
DRV:64bit: - (s0017nd5) Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS) -- C:\Windows\SysNative\DRIVERS\s0017nd5.sys ()
DRV:64bit: - (s0017mdm) -- C:\Windows\SysNative\DRIVERS\s0017mdm.sys ()
DRV:64bit: - (s0017mgmt) Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM) -- C:\Windows\SysNative\DRIVERS\s0017mgmt.sys ()
DRV:64bit: - (s0017mdfl) -- C:\Windows\SysNative\DRIVERS\s0017mdfl.sys ()
DRV:64bit: - (s0017bus) Sony Ericsson Device 0017 driver (WDM) -- C:\Windows\SysNative\DRIVERS\s0017bus.sys ()
DRV:64bit: - (RTHDMIAzAudService) -- C:\Windows\SysNative\drivers\RtHDMIVX.sys ()
DRV:64bit: - (RTL8169) -- C:\Windows\SysNative\DRIVERS\Rtlh64.sys ()
DRV:64bit: - (hwdatacard) -- C:\Windows\SysNative\DRIVERS\ewusbmdm.sys ()
DRV:64bit: - (RMCAST) RMCAST (Pgm) -- C:\Windows\SysNative\DRIVERS\RMCAST.sys ()
DRV:64bit: - (AtiPcie) ATI PCI Express (3GIO) -- C:\Windows\SysNative\DRIVERS\AtiPcie.sys ()
DRV:64bit: - (camfilt2) -- C:\Windows\SysNative\DRIVERS\camfilt2.sys ()
DRV:64bit: - (WpdUsb) -- C:\Windows\SysNative\DRIVERS\wpdusb.sys ()
DRV:64bit: - (usb_rndisx) -- C:\Windows\SysNative\DRIVERS\usb8023x.sys ()
DRV:64bit: - (RTL8187) -- C:\Windows\SysNative\DRIVERS\wg111v2.sys ()
DRV:64bit: - (amdide64) -- C:\Windows\SysNative\DRIVERS\amdide64.sys ()
DRV:64bit: - (PAC7302) -- C:\Windows\SysNative\DRIVERS\PAC7302.SYS ()
DRV:64bit: - (HH9Help.sys) -- C:\Windows\SysNative\drivers\HH9Help.sys ()
DRV:64bit: - (vcd9bus) -- C:\Windows\SysNative\DRIVERS\vcd9bus.sys ()
DRV:64bit: - (SCMNdisP) -- C:\Windows\SysNative\DRIVERS\scmndisp.sys ()
DRV:64bit: - (Ntfs) -- C:\Windows\SysNative\Wbem\ntfs.mof ()
DRV - (TuneUpUtilitiesDrv) -- C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys (TuneUp Software)
DRV - (SSHDRV61) -- C:\Windows\SysWOW64\drivers\SSHDRV61.sys ()
DRV - (gdrv) -- C:\Windows\gdrv.sys (Windows (R) Server 2003 DDK provider)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1494578580-287442235-1036857688-1001\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-1494578580-287442235-1036857688-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultthis.engineName: "Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.startup.homepage: "hxxp://search.conduit.com/?ctid=CT2269050&SearchSource=13"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: elemhidehelper@adblockplus.org:1.1
FF - prefs.js..extensions.enabledItems: {8b86149f-01fb-4842-9dd8-4d7eb02fd055}:0.21.1
FF - prefs.js..extensions.enabledItems: piclens@cooliris.com:1.12.0.36949
FF - prefs.js..extensions.enabledItems: feedly@devhd:4.x
FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.6.0
FF - prefs.js..extensions.enabledItems: {0538E3E3-7E9B-4d49-8831-A227C80A7AD3}:2.0.2
FF - prefs.js..extensions.enabledItems: {000a9d1c-beef-4f90-9363-039d445309b8}:0.5.36.0
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6
FF - prefs.js..extensions.enabledItems: foxmarks@kei.com:3.8.7
 
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{000a9d1c-beef-4f90-9363-039d445309b8}: C:\Program Files (x86)\Google\Google Gears\Firefox\ [2010.03.06 17:31:56 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010.12.25 19:37:00 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010.12.11 15:16:57 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.11\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2010.12.10 18:50:32 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.11\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2010.11.10 20:43:02 | 000,000,000 | ---D | M]
 
[2010.02.10 10:59:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Extensions
[2010.02.10 10:59:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2010.12.28 19:53:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\bmp853v9.default\extensions
[2010.10.08 17:29:18 | 000,000,000 | ---D | M] (Forecastfox Weather) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\bmp853v9.default\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}
[2010.04.14 18:52:05 | 000,000,000 | ---D | M] (All-in-One Gestures) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\bmp853v9.default\extensions\{8b86149f-01fb-4842-9dd8-4d7eb02fd055}
[2010.12.24 11:06:16 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\bmp853v9.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.04.14 18:52:02 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\bmp853v9.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2010.12.24 11:06:15 | 000,000,000 | ---D | M] (Element Hiding Helper for Adblock Plus) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\bmp853v9.default\extensions\elemhidehelper@adblockplus.org
[2010.12.24 11:06:21 | 000,000,000 | ---D | M] (feedly) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\bmp853v9.default\extensions\feedly@devhd
[2010.12.24 11:06:13 | 000,000,000 | ---D | M] (Firebug) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\bmp853v9.default\extensions\firebug@software.joehewitt.com
[2010.09.04 09:33:36 | 000,000,000 | ---D | M] ("Xmarks") -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\bmp853v9.default\extensions\foxmarks@kei.com
[2010.09.04 09:33:32 | 000,000,000 | ---D | M] (Cooliris) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\bmp853v9.default\extensions\piclens@cooliris.com
[2010.12.24 11:06:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\bmp853v9.default\extensions\feedly@devhd\content\app\extension
[2010.02.12 22:49:29 | 000,000,881 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Mozilla\FireFox\Profiles\bmp853v9.default\searchplugins\conduit.xml
[2010.12.28 19:53:31 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2010.03.06 17:31:56 | 000,000,000 | ---D | M] (Google Gears) -- C:\PROGRAM FILES (X86)\GOOGLE\GOOGLE GEARS\FIREFOX
[2010.11.30 23:20:02 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.11.30 23:20:02 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2010.11.30 23:20:02 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.11.30 23:20:02 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.11.30 23:20:02 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010.11.10 20:50:41 | 000,001,879 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 adobeereg.com
O1 - Hosts: 127.0.0.1 hxxp://www.adobeereg.com
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 192.150.18.108
O1 - Hosts: 127.0.0.1 activate.adobe.com:443
O1 - Hosts: 127.0.0.1 3dns-3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobeereg.com
O1 - Hosts: 127.0.0.1 www.adobeereg.com
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 192.150.18.108
O1 - Hosts: 127.0.0.1 adobeereg.com
O1 - Hosts: 127.0.0.1 www.adobeereg.com
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 15 more lines...
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Google Gears Helper) - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files (x86)\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll (Google Inc.)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKU\S-1-5-21-1494578580-287442235-1036857688-1001\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Windows\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [Skytel] C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.)
O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-1494578580-287442235-1036857688-1001..\Run: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe File not found
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] D:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O8:64bit: - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9 - Extra 'Tools' menuitem : &Gears-Einstellungen - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files (x86)\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll (Google Inc.)
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img21.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img21.jpg
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\##SPEEDPORT.IP#All#TOSHIBAExternal_HDD#USB-HDD\Shell\AutoRun\command - "" = Z:\Toshiba\more4you.exe -- File not found
O33 - MountPoints2\{21947bd5-75e6-11de-ba12-001fd09d5076}\Shell - "" = AutoRun
O33 - MountPoints2\{21947bd5-75e6-11de-ba12-001fd09d5076}\Shell\AutoRun\command - "" = J:\AutoRun.exe -- File not found
O33 - MountPoints2\{25f93b22-dfe6-11de-bf98-001fd09d5076}\Shell - "" = AutoRun
O33 - MountPoints2\{25f93b22-dfe6-11de-bf98-001fd09d5076}\Shell\AutoRun\command - "" = I:\autorun.exe -- File not found
O33 - MountPoints2\{56df8de8-8349-11de-b9ec-001b2f73a59b}\Shell - "" = AutoRun
O33 - MountPoints2\{56df8de8-8349-11de-b9ec-001b2f73a59b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- File not found
O33 - MountPoints2\{56df8e08-8349-11de-b9ec-001b2f73a59b}\Shell - "" = AutoRun
O33 - MountPoints2\{56df8e08-8349-11de-b9ec-001b2f73a59b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- File not found
O33 - MountPoints2\{5b69d790-8974-11de-a98e-001b2f73a59b}\Shell - "" = AutoRun
O33 - MountPoints2\{5b69d790-8974-11de-a98e-001b2f73a59b}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- File not found
O33 - MountPoints2\{61a035de-7556-11de-87e2-001fd09d5076}\Shell - "" = AutoRun
O33 - MountPoints2\{61a035de-7556-11de-87e2-001fd09d5076}\Shell\AutoRun\command - "" = I:\AutoRun.exe -- File not found
O33 - MountPoints2\{61a03617-7556-11de-87e2-001fd09d5076}\Shell - "" = AutoRun
O33 - MountPoints2\{61a03617-7556-11de-87e2-001fd09d5076}\Shell\AutoRun\command - "" = I:\AutoRun.exe -- File not found
O33 - MountPoints2\{61a03623-7556-11de-87e2-001fd09d5076}\Shell - "" = AutoRun
O33 - MountPoints2\{61a03623-7556-11de-87e2-001fd09d5076}\Shell\AutoRun\command - "" = J:\AutoRun.exe -- File not found
O33 - MountPoints2\{74a3143f-7926-11de-940d-001fd09d5076}\Shell - "" = AutoRun
O33 - MountPoints2\{74a3143f-7926-11de-940d-001fd09d5076}\Shell\AutoRun\command - "" = I:\AutoRun.exe -- File not found
O33 - MountPoints2\{74a31441-7926-11de-940d-001fd09d5076}\Shell - "" = AutoRun
O33 - MountPoints2\{74a31441-7926-11de-940d-001fd09d5076}\Shell\AutoRun\command - "" = I:\AutoRun.exe -- File not found
O33 - MountPoints2\{9d0b897f-87d5-11de-85a9-001fd09d5076}\Shell - "" = AutoRun
O33 - MountPoints2\{9d0b897f-87d5-11de-85a9-001fd09d5076}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- File not found
O33 - MountPoints2\{9d0b898d-87d5-11de-85a9-001fd09d5076}\Shell - "" = AutoRun
O33 - MountPoints2\{9d0b898d-87d5-11de-85a9-001fd09d5076}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- File not found
O33 - MountPoints2\{9e112158-ff70-11de-8fc0-001fd09d5076}\Shell\AutoRun\command - "" = I:\Toshiba\more4you.exe -- File not found
O33 - MountPoints2\{c789ecfa-ee53-11dd-b22c-001fd09d5076}\Shell - "" = AutoRun
O33 - MountPoints2\{c789ecfa-ee53-11dd-b22c-001fd09d5076}\Shell\AutoRun\command - "" = E:\AUTOSTARTER.EXE -- File not found
O33 - MountPoints2\{d3e2e90b-010a-11df-9667-001fd09d5076}\Shell\AutoRun\command - "" = J:\Menu.exe -- File not found
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\Toshiba\more4you.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O36 - AppCertDlls: fltMmmc - (C:\Windows\system32\nbtsntui.dll) - C:\Windows\SysWOW64\nbtsntui.dll ()
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs:64bit: UxTuneUp - C:\Windows\SysNative\uxtuneup.dll ()
 
 
SafeBootMin:64bit: AppMgmt - Service
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: AppMgmt - Service
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3EC4EC5B-D0A4-6B9F-FC9C-A9AAA79D126F} - Java (Sun)
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
Drivers32:64bit: msacm.ac3filter - ac3filter64.acm ()
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm ()
Drivers32:64bit: msacm.lameacm - LameACM.acm ()
Drivers32:64bit: VIDC.FFDS - ff_vfw.dll ()
Drivers32:64bit: vidc.XVID - xvidvfw.dll ()
Drivers32: msacm.ac3acm - C:\Windows\SysWow64\ac3acm.acm (fccHandler)
Drivers32: msacm.ac3filter - C:\Windows\SysWow64\ac3filter.acm ()
Drivers32: msacm.avis - C:\Windows\SysWow64\ff_acm.acm ()
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\Windows\SysWow64\lameACM.acm (hxxp://www.mp3dev.org/)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\Windows\SysWow64\ff_vfw.dll ()
Drivers32: VIDC.XVID - C:\Windows\SysWow64\xvidvfw.dll ()
Drivers32: vidc.yv12 - C:\Windows\SysWow64\yv12vfw.dll (www.helixcommunity.org)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.12.29 18:12:38 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\Malwarebytes
[2010.12.29 18:10:18 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2010.12.29 18:10:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.12.25 19:58:50 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\G12_V10
[2010.12.25 17:08:01 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\Kerstin
[2010.12.22 18:25:08 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\Urlaub 2004 Mallorca
[2010.12.21 20:07:59 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\System
[2010.12.21 20:07:59 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\SetupLanguages
[2010.12.21 20:07:59 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Patches
[2010.12.21 20:07:59 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Output
[2010.12.21 20:07:58 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\BuilderLanguages
[2010.12.20 21:19:34 | 000,501,760 | ---- | C] (www.sw4you.de Siegfried Weckmann) -- C:\Windows\SwSetupu.exe
[2010.12.19 15:29:41 | 000,000,000 | ---D | C] -- C:\Users\*****\Documents\Etiketten
[2010.12.17 20:49:07 | 000,000,000 | ---D | C] -- C:\Users\*****\Documents\SH5
[2010.12.17 20:48:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Ubisoft
[2010.12.08 22:47:51 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\vlc
[2010.12.06 21:12:06 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\PMDG_MD11_for_FSX_n_crack
[2010.12.02 04:35:18 | 004,280,320 | ---- | C] (Google Inc.) -- C:\Windows\SysWow64\GPhotos.scr
[2010.11.30 23:48:51 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2010.11.30 23:35:26 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\LANGMaster
[2010.11.30 23:28:38 | 000,000,000 | ---D | C] -- C:\ATI
[2010.11.30 22:40:39 | 003,485,696 | ---- | C] (Intel Corporation) -- C:\Windows\SysWow64\mkl_p4.dll
[2010.11.30 22:40:39 | 002,793,472 | ---- | C] (Intel Corporation) -- C:\Windows\SysWow64\mkl_p3.dll
[2010.11.30 22:40:39 | 002,174,976 | ---- | C] (Intel Corporation) -- C:\Windows\SysWow64\mkl_lapack32.dll
[2010.11.30 22:40:39 | 002,125,824 | ---- | C] (Intel Corporation) -- C:\Windows\SysWow64\mkl_lapack64.dll
[2010.11.30 22:40:39 | 000,839,680 | ---- | C] (Intel Corporation) -- C:\Windows\SysWow64\mkl_vml_p4.dll
[2010.11.30 22:40:39 | 000,532,480 | ---- | C] (Intel Corporation) -- C:\Windows\SysWow64\mkl_vml_p3.dll
[2010.11.30 22:40:39 | 000,512,000 | ---- | C] (Intel Corporation) -- C:\Windows\SysWow64\mkl_vml_def.dll
[2010.11.30 22:40:38 | 002,441,216 | ---- | C] (Intel Corporation) -- C:\Windows\SysWow64\mkl_def.dll
[2010.11.30 22:40:38 | 000,184,320 | ---- | C] (Intel Corporation) -- C:\Windows\SysWow64\libguide40.dll
[2010.11.30 20:14:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TuneUp Utilities 2011
[2010.11.30 20:13:38 | 000,000,000 | -HSD | C] -- C:\ProgramData\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
[2010.11.30 18:44:32 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\Abacus
[2010.11.29 20:44:00 | 000,000,000 | ---D | C] -- C:\Users\*****\Documents\My Garmin
[2010.11.29 19:56:07 | 000,000,000 | ---D | C] -- C:\ProgramData\TrackMania
[2010.11.29 19:51:16 | 000,000,000 | ---D | C] -- C:\Users\*****\Documents\TrackMania
[2010.06.02 18:13:10 | 000,148,736 | ---- | C] (Avanquest Software) -- C:\ProgramData\hpe8C6A.dll
[2008.09.17 16:54:30 | 000,151,552 | ---- | C] ( ) -- C:\Windows\SysWow64\STAPI.dll
[2 C:\Users\*****\AppData\Local\*.tmp files -> C:\Users\*****\AppData\Local\*.tmp -> ]
[10 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.12.29 18:16:00 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010.12.29 18:14:59 | 000,000,418 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{06855CFE-6E02-4ACB-8D35-28C0744153B7}.job
[2010.12.29 17:59:59 | 000,000,472 | ---- | M] () -- C:\Windows\tasks\1-Klick-Wartung.job
[2010.12.29 17:50:21 | 001,439,058 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2010.12.29 17:50:21 | 000,633,360 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2010.12.29 17:50:21 | 000,586,980 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2010.12.29 17:50:21 | 000,127,364 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2010.12.29 17:50:21 | 000,101,052 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2010.12.29 17:44:30 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010.12.29 17:44:02 | 000,003,840 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.12.29 17:44:02 | 000,003,840 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.12.29 17:43:57 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.12.28 22:50:06 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2010.12.28 20:23:19 | 000,000,426 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{84622FF5-8C33-4726-A647-C515AD759BF7}.job
[2010.12.27 19:47:33 | 005,605,771 | ---- | M] () -- C:\Users\*****\Desktop\Z137T_vFsX.zip
[2010.12.25 21:29:18 | 003,362,965 | ---- | M] () -- C:\Users\*****\Desktop\amaz37.zip
[2010.12.25 20:40:09 | 025,680,055 | ---- | M] () -- C:\Users\*****\Desktop\Xenon_071310.zip
[2010.12.25 19:50:35 | 108,292,151 | ---- | M] () -- C:\Users\*****\Desktop\Cera_Bell_212_SP2.zip
[2010.12.24 13:34:32 | 030,579,272 | ---- | M] () -- C:\Users\*****\Desktop\G12_V10.zip
[2010.12.24 13:21:08 | 006,894,792 | ---- | M] () -- C:\Users\*****\Desktop\8828ef95Cierva+C.30+Fs9.zip
[2010.12.24 13:15:51 | 032,132,979 | ---- | M] () -- C:\Users\*****\Desktop\oltomb12.zip
[2010.12.24 11:16:24 | 000,002,133 | ---- | M] () -- C:\Users\*****\.recently-used.xbel
[2010.12.21 20:52:10 | 000,048,128 | -H-- | M] () -- C:\Windows\SysWow64\nbtsntui.dll
[2010.12.21 20:51:42 | 000,048,128 | -H-- | M] () -- C:\Windows\nbtsntui.dll
[2010.12.20 22:32:23 | 048,105,074 | ---- | M] () -- C:\Users\*****\Desktop\334ATR_72-500.zip
[2010.12.20 21:20:09 | 000,001,153 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Hardcopy.LNK
[2010.12.20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2010.12.20 18:08:40 | 000,024,152 | ---- | M] () -- C:\Windows\SysNative\drivers\mbam.sys
[2010.12.19 12:07:59 | 000,314,016 | ---- | M] () -- C:\Windows\SysNative\drivers\atksgt.sys
[2010.12.19 12:07:59 | 000,043,680 | ---- | M] () -- C:\Windows\SysNative\drivers\lirsgt.sys
[2010.12.17 21:02:56 | 000,009,803 | ---- | M] () -- C:\Users\*****\Desktop\SH5.Spielstände.patchen.by.dive.master.rar
[2010.12.14 19:51:41 | 002,730,867 | ---- | M] () -- C:\Users\*****\Desktop\wuerfel.pdf
[2010.12.13 19:58:11 | 001,657,810 | ---- | M] () -- C:\Users\*****\Documents\Aktuell.pdf
[2010.12.11 18:31:03 | 001,658,198 | ---- | M] () -- C:\Users\*****\Documents\Entwurf.pdf
[2010.12.09 20:47:57 | 000,142,848 | ---- | M] () -- C:\Users\*****\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.12.08 22:47:46 | 001,094,021 | ---- | M] () -- C:\Users\*****\Desktop\dvdshrink32setup.zip
[2010.12.08 20:01:51 | 000,969,067 | ---- | M] () -- C:\Users\*****\Shippers_17669.pdf
[2010.12.07 20:31:15 | 000,001,050 | RH-- | M] () -- C:\Windows\SysWow64\ttri.dat
[2010.12.06 22:35:57 | 000,282,600 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2010.12.05 13:36:08 | 034,887,689 | ---- | M] () -- C:\Users\*****\Desktop\FSFlyingSchool_2010.rar
[2010.12.02 04:35:18 | 004,280,320 | ---- | M] (Google Inc.) -- C:\Windows\SysWow64\GPhotos.scr
[2010.12.01 21:35:41 | 000,000,608 | ---- | M] () -- C:\Windows\SysWow64\BLDSETUP.CFG
[2010.12.01 00:36:55 | 000,466,520 | ---- | M] () -- C:\Windows\SysNative\wrap_oal.dll
[2010.12.01 00:36:55 | 000,445,016 | ---- | M] (Creative Labs) -- C:\Windows\SysWow64\wrap_oal.dll
[2010.12.01 00:36:55 | 000,122,968 | ---- | M] () -- C:\Windows\SysNative\OpenAL32.dll
[2010.12.01 00:36:55 | 000,109,144 | ---- | M] (Portions (C) Creative Labs Inc. and NVIDIA Corp.) -- C:\Windows\SysWow64\OpenAL32.dll
[2010.11.30 23:36:03 | 000,001,969 | ---- | M] () -- C:\Users\Public\Desktop\Play The Lord of the Rings Online™ - FREE for 10 Days!.lnk
[2010.11.30 20:15:01 | 000,001,929 | ---- | M] () -- C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
[2010.11.30 20:15:01 | 000,001,925 | ---- | M] () -- C:\Users\Public\Desktop\TuneUp Utilities 2011.lnk
[2010.11.30 20:13:19 | 023,219,961 | ---- | M] () -- C:\Users\*****\Desktop\TU2011_10.0.2020.1_GE_Final_Wolf57.rar
[2010.11.29 19:52:54 | 001,510,254 | ---- | M] () -- C:\Users\*****\shippers.pdf
[2010.11.29 19:34:36 | 062,323,501 | ---- | M] () -- C:\Users\*****\Desktop\MapSource_6.16.1.rar
[2 C:\Users\*****\AppData\Local\*.tmp files -> C:\Users\*****\AppData\Local\*.tmp -> ]
[10 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.12.29 18:10:14 | 000,024,152 | ---- | C] () -- C:\Windows\SysNative\drivers\mbam.sys
[2010.12.27 19:47:32 | 005,605,771 | ---- | C] () -- C:\Users\*****\Desktop\Z137T_vFsX.zip
[2010.12.25 21:29:06 | 003,362,965 | ---- | C] () -- C:\Users\*****\Desktop\amaz37.zip
[2010.12.25 20:38:34 | 025,680,055 | ---- | C] () -- C:\Users\*****\Desktop\Xenon_071310.zip
[2010.12.25 19:44:45 | 108,292,151 | ---- | C] () -- C:\Users\*****\Desktop\Cera_Bell_212_SP2.zip
[2010.12.24 13:21:44 | 030,579,272 | ---- | C] () -- C:\Users\*****\Desktop\G12_V10.zip
[2010.12.24 13:20:42 | 006,894,792 | ---- | C] () -- C:\Users\*****\Desktop\8828ef95Cierva+C.30+Fs9.zip
[2010.12.24 13:02:24 | 032,132,979 | ---- | C] () -- C:\Users\*****\Desktop\oltomb12.zip
[2010.12.24 11:16:24 | 000,002,133 | ---- | C] () -- C:\Users\*****\.recently-used.xbel
[2010.12.21 20:51:42 | 000,048,128 | -H-- | C] () -- C:\Windows\SysWow64\nbtsntui.dll
[2010.12.21 20:51:42 | 000,048,128 | -H-- | C] () -- C:\Windows\nbtsntui.dll
[2010.12.21 20:07:59 | 000,212,992 | ---- | C] () -- C:\Windows\SysWow64\Setup.EXE
[2010.12.21 20:07:59 | 000,086,016 | ---- | C] () -- C:\Windows\SysWow64\ZCompress.EXE
[2010.12.21 20:07:59 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\WinSFX.bin
[2010.12.21 20:07:59 | 000,062,716 | ---- | C] () -- C:\Windows\SysWow64\Uninstall985F.DAT
[2010.12.21 20:07:59 | 000,017,759 | ---- | C] () -- C:\Windows\SysWow64\Order Form.pdf
[2010.12.21 20:07:59 | 000,013,826 | ---- | C] () -- C:\Windows\SysWow64\UILANG2.UDB
[2010.12.21 20:07:59 | 000,013,826 | ---- | C] () -- C:\Windows\SysWow64\UILANG1.UDB
[2010.12.21 20:07:59 | 000,001,846 | ---- | C] () -- C:\Windows\SysWow64\SOPFile.ico
[2010.12.21 20:07:58 | 001,536,716 | ---- | C] () -- C:\Windows\SysWow64\GkSetup.chm
[2010.12.21 20:07:58 | 000,516,096 | ---- | C] () -- C:\Windows\SysWow64\BldSetup.EXE
[2010.12.21 20:07:58 | 000,114,688 | ---- | C] () -- C:\Windows\SysWow64\BldDat.EXE
[2010.12.21 20:07:58 | 000,098,304 | ---- | C] () -- C:\Windows\SysWow64\BldOpt.EXE
[2010.12.21 20:07:58 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\GkSui20.EXE
[2010.12.21 20:07:58 | 000,069,632 | ---- | C] () -- C:\Windows\SysWow64\Dspan.bin
[2010.12.21 20:07:58 | 000,000,608 | ---- | C] () -- C:\Windows\SysWow64\BLDSETUP.CFG
[2010.12.20 21:20:09 | 000,001,153 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Hardcopy.LNK
[2010.12.17 21:02:54 | 000,009,803 | ---- | C] () -- C:\Users\*****\Desktop\SH5.Spielstände.patchen.by.dive.master.rar
[2010.12.17 20:48:24 | 000,375,942 | ---- | C] () -- C:\Users\*****\AppData\Local\dd_vcredistMSI7337.txt
[2010.12.17 20:48:24 | 000,013,438 | ---- | C] () -- C:\Users\*****\AppData\Local\dd_vcredistUI7337.txt
[2010.12.17 20:47:13 | 000,007,113 | ---- | C] () -- C:\Users\*****\AppData\Local\dd_depcheck_NETFX20_EXP_35.txt
[2010.12.17 20:47:10 | 000,026,686 | ---- | C] () -- C:\Users\*****\AppData\Local\dd_dotnetfx20install.txt
[2010.12.17 20:47:10 | 000,000,754 | ---- | C] () -- C:\Users\*****\AppData\Local\dd_dotnetfx20error.txt
[2010.12.14 19:51:41 | 002,730,867 | ---- | C] () -- C:\Users\*****\Desktop\wuerfel.pdf
[2010.12.08 22:47:46 | 001,094,021 | ---- | C] () -- C:\Users\*****\Desktop\dvdshrink32setup.zip
[2010.12.08 21:44:00 | 001,657,810 | ---- | C] () -- C:\Users\*****\Documents\Aktuell.pdf
[2010.12.08 20:11:07 | 001,658,198 | ---- | C] () -- C:\Users\*****\Documents\Entwurf.pdf
[2010.12.08 20:01:50 | 000,969,067 | ---- | C] () -- C:\Users\*****\Shippers_17669.pdf
[2010.12.06 21:20:19 | 000,552,096 | ---- | C] () -- C:\Users\*****\AppData\Local\dd_vcredistMSI3028.txt
[2010.12.06 21:20:17 | 000,014,364 | ---- | C] () -- C:\Users\*****\AppData\Local\dd_vcredistUI3028.txt
[2010.12.06 20:14:07 | 048,105,074 | ---- | C] () -- C:\Users\*****\Desktop\334ATR_72-500.zip
[2010.12.05 13:35:40 | 034,887,689 | ---- | C] () -- C:\Users\*****\Desktop\FSFlyingSchool_2010.rar
[2010.11.30 23:38:42 | 000,001,050 | RH-- | C] () -- C:\Windows\SysWow64\ttri.dat
[2010.11.30 23:36:03 | 000,001,969 | ---- | C] () -- C:\Users\Public\Desktop\Play The Lord of the Rings Online™ - FREE for 10 Days!.lnk
[2010.11.30 20:15:06 | 000,034,624 | ---- | C] () -- C:\Windows\SysNative\TURegOpt.exe
[2010.11.30 20:15:01 | 000,001,929 | ---- | C] () -- C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
[2010.11.30 20:15:01 | 000,001,925 | ---- | C] () -- C:\Users\Public\Desktop\TuneUp Utilities 2011.lnk
[2010.11.30 20:11:25 | 023,219,961 | ---- | C] () -- C:\Users\*****\Desktop\TU2011_10.0.2020.1_GE_Final_Wolf57.rar
[2010.11.29 19:33:39 | 062,323,501 | ---- | C] () -- C:\Users\*****\Desktop\MapSource_6.16.1.rar
[2010.11.28 16:13:22 | 000,429,778 | ---- | C] () -- C:\Users\*****\AppData\Local\dd_vcredistMSI5430.txt
[2010.11.28 16:13:22 | 000,011,426 | ---- | C] () -- C:\Users\*****\AppData\Local\dd_vcredistUI5430.txt
[2010.11.25 17:42:18 | 000,329,476 | ---- | C] () -- C:\Users\*****\AppData\Local\dd_vcredistMSI2DDB.txt
[2010.11.25 17:42:18 | 000,011,378 | ---- | C] () -- C:\Users\*****\AppData\Local\dd_vcredistUI2DDB.txt
[2010.11.23 20:35:36 | 002,468,694 | ---- | C] () -- C:\Users\*****\AppData\Local\dd_NET_Framework35_x64_MSI1637.txt
[2010.11.13 18:33:56 | 000,330,476 | ---- | C] () -- C:\Users\*****\AppData\Local\dd_vcredistMSI2BC7.txt
[2010.11.13 18:33:56 | 000,012,498 | ---- | C] () -- C:\Users\*****\AppData\Local\dd_vcredistUI2BC7.txt
[2010.11.13 11:24:05 | 000,000,038 | ---- | C] () -- C:\Windows\wininit.ini
[2010.11.12 19:43:59 | 000,013,896 | ---- | C] () -- C:\Users\*****\AppData\Local\dd_vcredistUI1342.txt
[2010.10.28 11:22:51 | 000,017,122 | ---- | C] () -- C:\Users\*****\AppData\Local\dd_vcredistUI7FB6.txt
[2010.10.14 01:36:44 | 000,179,263 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2010.05.05 12:15:12 | 000,000,566 | ---- | C] () -- C:\Windows\SysWow64\SP7302.INI
[2010.03.29 18:31:24 | 000,000,051 | ---- | C] () -- C:\Windows\TSetup.INI
[2010.03.28 21:03:36 | 000,382,118 | ---- | C] () -- C:\Users\*****\AppData\Local\dd_vcredistMSI6BBD.txt
[2010.03.28 21:03:36 | 000,011,604 | ---- | C] () -- C:\Users\*****\AppData\Local\dd_vcredistUI6BBD.txt
[2010.03.25 20:37:35 | 000,000,043 | ---- | C] () -- C:\Windows\gswin32.ini
[2010.02.25 15:50:23 | 000,036,864 | ---- | C] () -- C:\Windows\SysWow64\drivers\SSHDRV61.sys
[2010.02.03 21:11:31 | 000,000,552 | ---- | C] () -- C:\Users\*****\AppData\Local\d3d8caps.dat
[2010.02.03 11:38:01 | 000,620,351 | ---- | C] () -- C:\Users\*****\AppData\Local\dd_depcheck_NETFX_EXP_35.txt
[2010.02.03 11:37:58 | 000,605,990 | ---- | C] () -- C:\Users\*****\AppData\Local\dd_dotnetfx35install.txt
[2010.02.03 11:37:58 | 000,035,900 | ---- | C] () -- C:\Users\*****\AppData\Local\uxeventlog.txt
[2010.02.03 11:37:58 | 000,000,002 | ---- | C] () -- C:\Users\*****\AppData\Local\dd_dotnetfx35error.txt
[2010.02.02 20:03:19 | 000,000,082 | ---- | C] () -- C:\Windows\netdet.ini
[2010.01.13 11:32:57 | 000,881,664 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2010.01.13 11:32:56 | 000,205,824 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2010.01.13 11:23:06 | 000,131,072 | ---- | C] () -- C:\Windows\SysWow64\imgproc.dll
[2009.12.29 19:55:39 | 000,000,038 | ---- | C] () -- C:\Windows\AviSplitter.INI
[2009.12.29 17:53:21 | 000,178,176 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2009.12.18 14:51:08 | 000,000,023 | ---- | C] () -- C:\Windows\BlendSettings.ini
[2009.09.23 23:46:04 | 000,085,504 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2009.07.28 14:03:21 | 000,000,680 | ---- | C] () -- C:\Users\*****\AppData\Local\d3d9caps.dat
[2009.07.25 15:49:42 | 000,000,577 | ---- | C] () -- C:\Windows\SysWow64\gmsblist.dll
[2009.04.27 14:19:35 | 000,237,568 | ---- | C] () -- C:\Windows\SysWow64\lame_enc.dll
[2009.04.27 14:19:35 | 000,110,080 | ---- | C] () -- C:\Windows\SysWow64\advd.dll
[2009.04.27 14:19:35 | 000,023,040 | ---- | C] () -- C:\Windows\SysWow64\auth.dll
[2009.02.06 18:53:57 | 000,142,848 | ---- | C] () -- C:\Users\*****\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.02.05 21:16:35 | 000,221,184 | ---- | C] () -- C:\Windows\SysWow64\TidyATL.dll
[2009.01.28 22:08:18 | 000,000,010 | ---- | C] () -- C:\Windows\GSetup.ini
[2008.10.07 09:13:30 | 000,197,912 | ---- | C] () -- C:\Windows\SysWow64\physxcudart_20.dll
[2008.10.07 09:13:22 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelTraditionalChinese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSwedish.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSpanish.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelPortugese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelKorean.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelJapanese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelGerman.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelFrench.dll
[2008.01.21 03:50:05 | 000,060,124 | ---- | C] () -- C:\Windows\SysWow64\tcpmon.ini
[2008.01.21 03:49:49 | 000,368,640 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2004.10.28 15:38:10 | 000,315,728 | ---- | C] () -- C:\Windows\SysWow64\flt1chk3.dll
[2002.08.13 15:04:12 | 000,217,088 | R--- | C] () -- C:\Users\*****\AppData\Roaming\MafiaSetup.exe
[2000.03.01 19:49:20 | 000,028,958 | ---- | C] () -- C:\Windows\SysWow64\kart_dbl.dll
[1997.09.01 03:00:00 | 000,038,614 | ---- | C] () -- C:\Windows\SysWow64\Kart_doj.dll
[1997.08.04 11:17:56 | 001,201,206 | ---- | C] () -- C:\Windows\SysWow64\Kart24gf.dll
[1997.08.04 11:16:44 | 001,201,206 | ---- | C] () -- C:\Windows\SysWow64\Kart24gd.dll
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.11.30 18:44:32 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Abacus
[2010.02.04 15:44:05 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\AccumulatedSummary
[2009.03.13 16:40:00 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\ACD Systems
[2010.11.27 13:59:04 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Adobe
[2010.05.16 11:38:18 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\anpo.republika.pl
[2010.03.13 21:46:21 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Apple Computer
[2009.01.28 23:35:40 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\ATI
[2010.02.08 14:05:49 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\BBBS_Year_View
[2009.02.05 21:39:44 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\BlogDesk
[2009.03.30 21:27:35 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\BloodTies
[2009.03.16 20:41:05 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\cerasus.media
[2009.04.27 14:19:47 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\concept design
[2009.03.29 18:06:01 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Crayon Physics Deluxe
[2009.02.25 10:53:47 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\DAEMON Tools
[2009.02.25 10:54:03 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\DAEMON Tools Lite
[2009.02.25 10:53:46 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\DAEMON Tools Pro
[2010.12.19 19:13:48 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\DAoC Portal
[2010.01.15 10:49:37 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\DivX
[2010.11.08 21:08:18 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Downloaded Installations
[2010.12.06 19:08:34 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Dropbox
[2010.04.19 12:07:46 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Easy Sync
[2009.02.10 12:47:24 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Electronic Arts
[2010.09.25 20:53:12 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\EurekaLog
[2010.11.27 13:25:13 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\FileZilla
[2010.05.16 11:32:18 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\fltk.org
[2010.11.22 19:47:53 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\fotobuch.de AG
[2010.02.03 14:42:15 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\GARMIN
[2010.02.17 17:03:33 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\gtk-2.0
[2010.11.20 16:21:48 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\HiFi
[2010.02.04 14:37:31 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\HighScorePlugin
[2009.01.28 23:35:26 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Identities
[2009.08.07 13:59:29 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\InstallShield
[2009.08.07 14:58:13 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\InstallShield Installation Information
[2010.10.05 17:49:53 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\JOSM
[2010.11.23 21:09:57 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Kalypso Media
[2010.10.28 22:59:19 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\KeePass
[2010.12.13 21:22:57 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Keza
[2010.05.26 16:37:27 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Klarmobilstick
[2010.11.30 23:35:26 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\LANGMaster
[2009.01.28 23:49:17 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Macromedia
[2010.12.29 18:12:38 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Malwarebytes
[2006.11.02 16:07:25 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Media Center Programs
[2009.12.29 18:11:33 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Media Player Classic
[2010.12.06 17:58:53 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Meoca
[2010.03.27 16:31:32 | 000,000,000 | --SD | M] -- C:\Users\*****\AppData\Roaming\Microsoft
[2010.04.30 21:37:56 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Mobile Atlas Creator
[2009.01.28 23:44:13 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Mozilla
[2010.01.28 12:39:21 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Mp3tag
[2010.03.10 18:23:59 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\MusicBrainz
[2010.11.28 16:07:26 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Nero
[2010.11.08 21:11:26 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Nitro PDF
[2010.05.12 16:51:27 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Nvu
[2009.02.10 22:50:57 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\OpenOffice.org
[2010.02.05 13:55:16 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\OverlayPlugin
[2010.02.08 14:28:10 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\PerformancePredictorPlugin
[2010.01.16 17:35:53 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Personal Video Database
[2009.03.28 22:22:53 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Philips
[2009.06.06 13:30:28 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Pirateville
[2010.11.14 18:36:48 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\ProtectDISC
[2010.11.17 19:38:33 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\RigNRoll
[2010.11.13 11:37:16 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\RigNRoll_ger
[2009.04.14 11:05:06 | 000,000,000 | RH-D | M] -- C:\Users\*****\AppData\Roaming\SecuROM
[2009.12.29 19:55:39 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Shark007
[2009.01.31 16:33:17 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\T-Online
[2009.01.31 15:57:55 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Talkback
[2010.11.14 23:00:56 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\TeamViewer
[2010.02.10 10:59:36 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Thunderbird
[2010.03.11 10:19:47 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\tidysongs15.27F6A35B76E5883BF9E6FEE514586561E60595CA.1
[2010.01.08 15:26:19 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\TrekBuddy Atlas Creator
[2010.02.04 15:30:01 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\TRIMPPlugin
[2010.11.30 20:14:41 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\TuneUp Software
[2010.01.11 13:27:20 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\VistaCodecs
[2010.12.08 22:59:27 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\vlc
[2010.01.04 12:39:32 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Windows Live Writer
[2009.02.06 19:17:30 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\WinRAR
[2010.04.19 11:20:15 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\XCPCSync.OEM
 
< %APPDATA%\*.exe /s >
[2002.08.13 15:04:12 | 000,217,088 | R--- | M] () -- C:\Users\*****\AppData\Roaming\MafiaSetup.exe
[2010.02.26 06:10:20 | 021,979,992 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe
[2010.11.28 15:19:06 | 000,089,831 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Dropbox\bin\Uninstall.exe
[2009.08.07 14:56:38 | 000,455,600 | ---- | M] (Macrovision Corporation) -- C:\Users\*****\AppData\Roaming\InstallShield Installation Information\{03748342-E2C2-4442-8D15-6A28D8A932BE}\setup.exe
[2007.07.10 20:55:02 | 000,455,600 | ---- | M] (Macrovision Corporation) -- C:\Users\*****\AppData\Roaming\InstallShield Installation Information\{92B44BC9-B9A1-43F7-ABBC-A197A34A656E}\setup.exe
[2007.01.20 04:46:42 | 000,455,600 | ---- | M] (Macrovision Corporation) -- C:\Users\*****\AppData\Roaming\InstallShield Installation Information\{BC2AB841-B2D9-400F-BF98-F2B620A2C233}\setup.exe
[2010.03.11 10:18:21 | 000,038,784 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2010.10.31 13:06:29 | 000,003,638 | R--- | M] () -- C:\Users\*****\AppData\Roaming\Microsoft\Installer\{2D50613C-6903-412A-9EAC-18F3890B0C55}\_6FEFF9B68218417F98F549.exe
[2010.11.20 16:22:32 | 000,027,006 | R--- | M] () -- C:\Users\*****\AppData\Roaming\Microsoft\Installer\{A06A6679-41D7-48C5-82F8-7D3B0B654720}\ARPPRODUCTICON.exe
[2010.11.20 16:22:32 | 000,027,006 | R--- | M] () -- C:\Users\*****\AppData\Roaming\Microsoft\Installer\{A06A6679-41D7-48C5-82F8-7D3B0B654720}\NewShortcut1_A103B1EA31E34C9C824F18268B22A933.exe
[2010.11.20 16:22:32 | 000,027,006 | R--- | M] () -- C:\Users\*****\AppData\Roaming\Microsoft\Installer\{A06A6679-41D7-48C5-82F8-7D3B0B654720}\NewShortcut2_26DC43EB77CF4E29AD5B37676CDD13D2.exe
[2010.11.20 16:22:32 | 000,027,006 | R--- | M] () -- C:\Users\*****\AppData\Roaming\Microsoft\Installer\{A06A6679-41D7-48C5-82F8-7D3B0B654720}\NewShortcut3_A2F2C2D876F44DC0B4D6FF6940E88C03.exe
[2010.11.20 16:22:32 | 000,027,006 | R--- | M] () -- C:\Users\*****\AppData\Roaming\Microsoft\Installer\{A06A6679-41D7-48C5-82F8-7D3B0B654720}\NewShortcut4_8030F19A553E4835B5F035D4276790A7.exe
[2010.03.03 15:22:25 | 000,053,248 | R--- | M] (Acresso Software Inc.) -- C:\Users\*****\AppData\Roaming\Microsoft\Installer\{DF6FE172-006A-4324-AF7F-ACFE4BA290FE}\ARPPRODUCTICON.exe
[2010.02.02 20:25:57 | 000,008,478 | R--- | M] () -- C:\Users\*****\AppData\Roaming\Microsoft\Installer\{EA312C43-6187-11D8-AEFD-00A0CC5F5288}\_4e146a1e.exe
[2010.02.02 20:25:57 | 000,003,262 | R--- | M] () -- C:\Users\*****\AppData\Roaming\Microsoft\Installer\{EA312C43-6187-11D8-AEFD-00A0CC5F5288}\_62cc3fcc.exe
[2010.02.02 20:25:57 | 000,003,262 | R--- | M] () -- C:\Users\*****\AppData\Roaming\Microsoft\Installer\{EA312C43-6187-11D8-AEFD-00A0CC5F5288}\_b5e19e6.exe
[2010.06.14 11:08:50 | 000,425,984 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\bmp853v9.default\extensions\piclens@cooliris.com\libs\LaunchCooliris.exe
[2010.06.14 11:08:50 | 000,545,280 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\bmp853v9.default\extensions\piclens@cooliris.com\libs\PicLensHelper.exe
[2010.03.25 19:02:59 | 000,583,168 | ---- | M] () -- C:\Users\*****\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\uno_packages\C719.tmp_\sun-pdfimport.oxt\xpdfimport.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2008.01.21 03:46:51 | 000,064,568 | ---- | M] (Microsoft Corporation) MD5=F6F6793B7F17B550ECFDBD3B229173F7 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_163188bf770e4ab0\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2008.01.21 03:46:50 | 000,022,584 | ---- | M] (Microsoft Corporation) MD5=1898FAE8E07D97F2F6C2D5326C633FAC -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_3956c39dd9e73fd2\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 12:16:48 | 000,014,848 | ---- | M] (Microsoft Corporation) MD5=21322B1A2AD337C579F4A65EA0D25193 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_424bc4aceb06de1c\cngaudit.dll
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\SysWOW64\cngaudit.dll
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\SysWOW64\cngaudit.dll
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: EVENTLOG.DLL  >
[2010.01.27 13:55:24 | 000,024,576 | ---- | M] () MD5=BF4811EDD902692339C135DCFB26F2AB -- C:\Users\*****\Downloads\ActivePerl-5.10.1.1007-MSWin32-x64-291969\perl\lib\auto\Win32\EventLog\EventLog.dll
 
< MD5 for: EXPLORER.EXE  >
[2008.10.29 07:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_b5f700fe698beb14\explorer.exe
[2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\SysWOW64\explorer.exe
[2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\SysWOW64\explorer.exe
[2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_b7eb106e66a7ac19\explorer.exe
[2008.10.29 07:15:50 | 003,087,360 | ---- | M] (Microsoft Corporation) MD5=50514057C28A74BAC2BD04B7B990D615 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_aba256ac352b2919\explorer.exe
[2008.10.30 04:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_b8583e9d7fda0512\explorer.exe
[2008.10.28 03:30:12 | 003,086,848 | ---- | M] (Microsoft Corporation) MD5=72B9990E45C25AA3C75C4FB50A9D6CE0 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_ac5266dd4e2b0a41\explorer.exe
[2008.10.29 07:49:22 | 003,080,704 | ---- | M] (Microsoft Corporation) MD5=BBD8E74F23D7605CB0CDB57A1B25D826 -- C:\Windows\explorer.exe
[2008.10.29 07:49:22 | 003,080,704 | ---- | M] (Microsoft Corporation) MD5=BBD8E74F23D7605CB0CDB57A1B25D826 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_ad96661c3246ea1e\explorer.exe
[2008.10.30 06:30:07 | 003,081,216 | ---- | M] (Microsoft Corporation) MD5=E404A65EF890140410E9F3D405841C95 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_ae03944b4b794317\explorer.exe
[2008.10.28 03:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_b6a7112f828bcc3c\explorer.exe
[2008.01.21 03:48:44 | 003,080,704 | ---- | M] (Microsoft Corporation) MD5=F6D765FB6B457542D954682F50C26E4F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_add342963219dff5\explorer.exe
[2008.01.21 03:49:23 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_b827ece8667aa1f0\explorer.exe
 
< MD5 for: IASTORV.SYS  >
[2008.01.21 03:46:59 | 000,290,872 | ---- | M] (Intel Corporation) MD5=3E3BF3627D886736D0B4E90054F929F6 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_0b2fedfc40256bc5\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2008.01.21 03:51:03 | 000,716,800 | ---- | M] (Microsoft Corporation) MD5=5D0A4891F8CD0E9E64FF57A6A34044F5 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_59d652c6f057598d\netlogon.dll
[2008.01.21 03:48:28 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\SysWOW64\netlogon.dll
[2008.01.21 03:48:28 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\SysWOW64\netlogon.dll
[2008.01.21 03:48:28 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_642afd1924b81b88\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2008.01.21 03:46:54 | 000,054,328 | ---- | M] (NVIDIA Corporation) MD5=F7EA0FE82842D05EDA3EFDD376DBFDBA -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_95f95eab775c159d\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.21 03:50:28 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\SysWOW64\scecli.dll
[2008.01.21 03:50:28 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\SysWOW64\scecli.dll
[2008.01.21 03:50:28 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_9e812831c5d9a243\scecli.dll
[2008.01.21 03:49:49 | 000,235,520 | ---- | M] (Microsoft Corporation) MD5=35F1DD99F9903BC267C2AF16B09F9BF7 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_942c7ddf9178e048\scecli.dll
 
< MD5 for: USER32.DLL  >
[2008.01.21 03:49:14 | 000,648,192 | ---- | M] (Microsoft Corporation) MD5=3D691030DBD3BD75DE1501BE54F0D425 -- C:\Windows\SysWOW64\user32.dll
[2008.01.21 03:49:14 | 000,648,192 | ---- | M] (Microsoft Corporation) MD5=3D691030DBD3BD75DE1501BE54F0D425 -- C:\Windows\SysWOW64\user32.dll
[2008.01.21 03:49:14 | 000,648,192 | ---- | M] (Microsoft Corporation) MD5=3D691030DBD3BD75DE1501BE54F0D425 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_33abb2175a1ab263\user32.dll
[2008.01.21 03:48:29 | 000,820,224 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_295707c525b9f068\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.21 03:50:36 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\SysWOW64\userinit.exe
[2008.01.21 03:50:36 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\SysWOW64\userinit.exe
[2008.01.21 03:50:36 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2008.01.21 03:49:46 | 000,028,160 | ---- | M] (Microsoft Corporation) MD5=A0AB2BB9A92293D9CE66E252719AB5FE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_384755998a0d6941\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2008.01.21 03:49:47 | 000,406,016 | ---- | M] (Microsoft Corporation) MD5=856491FCED98093D824B9EB2892F564A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_cbe19c9a8d4eed2b\winlogon.exe
[2008.01.21 03:50:38 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\SysWOW64\winlogon.exe
[2008.01.21 03:50:38 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\SysWOW64\winlogon.exe
[2008.01.21 03:50:38 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.01.21 03:49:42 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=8A900348370E359B6BFF6A550E4649E1 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_aba53c58802b1777\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2008.01.21 03:49:07 | 001,386,496 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\SysWOW64\msvbvm60.dll
[10 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:FC3D5E57
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:3BD4D405

< End of report >

markusg · 29.12.2010, 19:00

macht ja nichts :-)

• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

:OTL
O36 - AppCertDlls: fltMmmc - (C:\Windows\system32\nbtsntui.dll) - C:\Windows\SysWOW64\nbtsntui.dll ()
:Files
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort posten.

öffne mein computer, c: dann _OTL
dort rechtsklick auf moved files
wähle zu moved files.rar oder zip hinzufügen.
lade das archiv in unserem upload channel hoch.
http://www.trojaner-board.de/54791-a...ner-board.html

Satuiro · 29.12.2010, 19:15

Code:

ATTFilter

All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\\fltMmmc:C:\Windows\system32\nbtsntui.dll deleted successfully.
C:\Windows\SysWOW64\nbtsntui.dll moved successfully.
========== FILES ==========
========== COMMANDS ==========
 
[EMPTYFLASH]
 
User: Admin
->Flash cache emptied: 2425 bytes
 
User: All Users
 
User: AppData
 
User: Christian
->Flash cache emptied: 129335 bytes
 
User: Default
->Flash cache emptied: 41661 bytes
 
User: Default User
->Flash cache emptied: 0 bytes
 
User: Kerstin
->Flash cache emptied: 405 bytes
 
User: Public
 
Total Flash Files Cleaned = 0,00 mb
 
 
[EMPTYTEMP]
 
User: Admin
->Temp folder emptied: 177736 bytes
->Temporary Internet Files folder emptied: 11555736 bytes
->Java cache emptied: 7434808 bytes
->FireFox cache emptied: 45186003 bytes
->Flash cache emptied: 0 bytes
 
User: All Users
 
User: AppData
 
User: Christian
->Temp folder emptied: 12558517 bytes
->Temporary Internet Files folder emptied: 652557151 bytes
->Java cache emptied: 7845098 bytes
->FireFox cache emptied: 116397567 bytes
->Flash cache emptied: 0 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Kerstin
->Temp folder emptied: 1449153 bytes
->Temporary Internet Files folder emptied: 3143056 bytes
->Flash cache emptied: 0 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 7986704 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 330819300 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 45581599490 bytes
 
Total Files Cleaned = 44.612,00 mb
 
 
OTL by OldTimer - Version 3.2.18.1 log created on 12292010_190544

Files\Folders moved on Reboot...
File move failed. C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QF2AOJXM\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OIEMH446\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EMH1ZUR3\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2ABSEMLQ\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be moved on reboot.

Registry entries deleted on Reboot...

Die Datei wurde erfolgreich hochgeladen.

markusg · 29.12.2010, 19:24

hi.
Du solltest dich jetzt ans daten sichern machen, damit wir das system neu aufsetzen können.
du hast einige entscheidene fehler gemacht, die ne infektion ermöglicht haben. zb fehlen updates.
ich werde dir zeigen, wie diese fehler zu vermeiden sind.
melde dich, wenn du die daten gesichert hast, dann gehts weiter.

Satuiro · 29.12.2010, 20:30

Vielen Dank erstmal,

ist es für ein Neuaufsetzen erforderlich alle Festplatten zu formatieren?
Wäre interessant zu wissen für das Sichern der Daten.

Viele Grüße
Christian

markusg · 29.12.2010, 20:33

nur dort wo programme und windows instaliert sind, also das währen bei dir wohl c und d:

Satuiro · 31.12.2010, 16:16

Ich glaube nun alle benötigten Daten gesichert zu haben.
Es kann also losgehen. Ist es denn wirklich notwendig den Rechner neu aufzusetzen?

Viele Grüße
Christian

29.12.2010, 18:34	#4
markusg /// Malware-holic	HijackThis Log wegen Anruf von Sparkasse nö, otl.txt fehlt ja. __________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet

HijackThis Log wegen Anruf von Sparkasse

Log-Analyse und Auswertung: HijackThis Log wegen Anruf von Sparkasse