System Tool loswerden

Fnyrri · 16.01.2011, 15:03

Huhu,

heute hat sich mir beim ganz normalen Surfen ein Programm namens System Tool, anscheinend von allein, installiert und die Herrschaft über den normalen Modus meines Laptops übernommen

Ich bin aktuell im abgesicherten Modus mit Netzwerktreibern unterwegs, da scheint alles zu funktionieren. Aber im normalen Modus startet sich dieses System Tool von allein, ändert mein Hintergrundbild, behauptet ständig, ich wäre von Spyware befallen und lässt mich keine Programme starten... das würde ich sehr gern loswerden!

Gibt es übrigens eine Möglichkeit, beim Starten des PCs direkt in den abgesicherten Modus mit Netzwerktreibern zu kommen? Ich mach aktuell immer Start im Normalmodus-Ausschalten per Power-Knopf gedrückt halten-Start mit "Windows wurde nicht ordnungsgemäß beendet, möchten sie im abgesicherten Modus starten"-abgesicherter Modus. Geht das irgendwie "eleganter"?

Malwarebytes-Scan:

Code:

ATTFilter

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 5098

Windows 6.0.6002 Service Pack 2 (Safe Mode)
Internet Explorer 7.0.6002.18005

16.01.2011 14:33:51
mbam-log-2011-01-16 (14-33-51).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 315602
Laufzeit: 55 Minute(n), 33 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Users\ACER\Desktop\System Tool 2011.LNK (Rogue.SystemTool) -> No action taken.

OTL-Log:

OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 16.01.2011 15:05:39 - Run 2
OTL by OldTimer - Version 3.2.20.2     Folder = C:\Users\ACER\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 83,00% Memory free
6,00 Gb Paging File | 6,00 Gb Available in Paging File | 94,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 144,04 Gb Total Space | 62,03 Gb Free Space | 43,06% Space Free | Partition Type: NTFS
Drive D: | 144,04 Gb Total Space | 143,95 Gb Free Space | 99,93% Space Free | Partition Type: NTFS
Drive E: | 5,73 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: ACER-PC | User Name: ACER | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\ACER\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Programme\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
PRC - C:\Programme\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\ACER\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (0313791284999801mcinstcleanup) McAfee Application Installer Cleanup (0313791284999801) --  File not found
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (Hamachi2Svc) -- C:\Program Files\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
SRV - (WPFFontCache_v0400) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (FsUsbExService) -- C:\Windows\System32\FsUsbExService.Exe (Teruten)
SRV - (IAANTMON) Intel(R) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (ServiceLayer) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (NTIBackupSvc) -- C:\Programme\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe (NewTech InfoSystems, Inc.)
SRV - (NTISchedulerSvc) -- C:\Programme\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe ()
SRV - (ETService) -- C:\Programme\Acer\Empowering Technology\Service\ETService.exe ()
SRV - (AgereModemAudio) -- C:\Windows\System32\agrsmsvc.exe (Agere Systems)
SRV - (eDataSecurity Service) -- C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe (Egis Incorporated)
SRV - (BUNAgentSvc) -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe (NewTech Infosystems, Inc.)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (CLHNService) -- C:\Programme\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe ()
SRV - (MobilityService) -- C:\Acer\Mobility Center\MobilityService.exe ()
SRV - (lxcg_device) -- C:\Windows\System32\lxcgcoms.exe ( )
 
 
========== Driver Services (SafeList) ==========
 
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (hamachi) -- C:\Windows\System32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (FsUsbExDisk) -- C:\Windows\System32\FsUsbExDisk.Sys ()
DRV - (ss_bmdm) -- C:\Windows\System32\drivers\ss_bmdm.sys (MCCI Corporation)
DRV - (ss_bbus) SAMSUNG USB Mobile Device (WDM) -- C:\Windows\System32\drivers\ss_bbus.sys (MCCI)
DRV - (ss_bmdfl) SAMSUNG USB Mobile Modem (Filter) -- C:\Windows\System32\drivers\ss_bmdfl.sys (MCCI Corporation)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (NVHDA) -- C:\Windows\System32\drivers\nvhda32v.sys (NVIDIA Corporation)
DRV - (iaStor) -- C:\Windows\system32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (DKbFltr) -- C:\Windows\System32\drivers\DKbFltr.sys (Dritek System Inc.)
DRV - (mod7700) -- C:\Windows\System32\drivers\dvb7700all.sys (DiBcom)
DRV - ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796}) -- C:\Programme\Acer Arcade Deluxe\PlayMovie\000.fcl (Cyberlink Corp.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (NETw5v32) Intel(R) -- C:\Windows\System32\drivers\NETw5v32.sys (Intel Corporation)
DRV - (JMCR) -- C:\Windows\System32\drivers\jmcr.sys (JMicron Technology Corp.)
DRV - (A310) -- C:\Windows\System32\drivers\AVerA310USB.sys (AVerMedia TECHNOLOGIES, Inc.)
DRV - (BDASwCap) -- C:\Windows\System32\drivers\AVerA310Cap.sys (AVerMedia TECHNOLOGIES, Inc.)
DRV - (b57nd60x) -- C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation)
DRV - (int15) -- C:\Windows\System32\drivers\int15.sys (Acer, Inc.)
DRV - (psdvdisk) -- C:\Windows\System32\drivers\PSDVdisk.sys (Egis Incorporated)
DRV - (PSDNServ) -- C:\Windows\System32\drivers\PSDNServ.sys (Egis Incorporated)
DRV - (PSDFilter) -- C:\Windows\system32\DRIVERS\psdfilter.sys (Egis Incorporated)
DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)
DRV - (NTIDrvr) -- C:\Windows\System32\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
DRV - (UBHelper) -- C:\Windows\System32\drivers\UBHelper.sys (NewTech Infosystems Corporation)
DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (SynTP) -- C:\Windows\System32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (NTIPPKernel) -- C:\Programme\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys (Cyberlink Corp.)
DRV - (pccsmcfd) -- C:\Windows\System32\drivers\pccsmcfd.sys (Nokia)
DRV - (winbondcir) -- C:\Windows\System32\drivers\winbondcir.sys (Winbond Electronics Corporation)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=1108&m=aspire_7730g
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://global.acer.com [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:2.0
FF - prefs.js..extensions.enabledItems: {35106bca-6c78-48c7-ac28-56df30b51d2a}:1.3.8
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q="
 
FF - HKLM\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2009.07.27 14:04:28 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{D3C23E26-C072-418C-8C69-320979274A33}: C:\Users\ACER\AppData\Local\{D3C23E26-C072-418C-8C69-320979274A33}
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.01.15 21:44:43 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.12.11 18:11:25 | 000,000,000 | ---D | M]
 
[2009.01.02 20:32:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\ACER\AppData\Roaming\mozilla\Extensions
[2011.01.14 13:52:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\ACER\AppData\Roaming\mozilla\Firefox\Profiles\wzcb5rou.default\extensions
[2010.12.17 06:47:23 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\ACER\AppData\Roaming\mozilla\Firefox\Profiles\wzcb5rou.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.02.21 17:31:25 | 000,000,000 | ---D | M] (Linkification) -- C:\Users\ACER\AppData\Roaming\mozilla\Firefox\Profiles\wzcb5rou.default\extensions\{35106bca-6c78-48c7-ac28-56df30b51d2a}
[2010.06.30 14:04:37 | 000,000,000 | ---D | M] (Fast Video Download (with SearchMenu)) -- C:\Users\ACER\AppData\Roaming\mozilla\Firefox\Profiles\wzcb5rou.default\extensions\{c50ca3c4-5656-43c2-a061-13e717f73fc8}
[2010.12.25 13:56:16 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\ACER\AppData\Roaming\mozilla\Firefox\Profiles\wzcb5rou.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2011.01.13 13:16:48 | 000,000,000 | ---D | M] (DownThemAll!) -- C:\Users\ACER\AppData\Roaming\mozilla\Firefox\Profiles\wzcb5rou.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
[2011.01.14 13:52:09 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2009.02.13 14:33:32 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
[2009.03.29 16:58:29 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
[2009.12.01 16:49:22 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
[2009.12.15 08:53:15 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
[2009.03.24 10:10:44 | 000,114,688 | ---- | M] (Zylom) -- C:\Programme\Mozilla Firefox\plugins\npzylomgamesplayer.dll
[2010.06.24 11:41:39 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.06.24 11:41:39 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.06.24 11:41:39 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.06.24 11:41:39 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.06.24 11:41:39 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010.09.20 18:21:32 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll (Egis)
O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Programme\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)
O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)
O4 - HKLM..\Run: [ArcadeDeluxeAgent] C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BkupTray] C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe ()
O4 - HKLM..\Run: [CLMLServer] C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [eAudio] C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe (Acer Incorporated)
O4 - HKLM..\Run: [eDataSecurity Loader] C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe (Egis Incorporated)
O4 - HKLM..\Run: [ePower_DMC] C:\Programme\Acer\Empowering Technology\ePower\ePower_DMC.exe (Acer Inc.)
O4 - HKLM..\Run: [EzPrint] C:\Program Files\Lexmark 2300 Series\ezprint.exe (Lexmark International Inc.)
O4 - HKLM..\Run: [hpqSRMon]  File not found
O4 - HKLM..\Run: [IAAnotif] C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [LManager] C:\Programme\Launch Manager\QtZgAcer.EXE (Dritek System Inc.)
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [lxcgmon.exe] C:\Program Files\Lexmark 2300 Series\lxcgmon.exe (Lexmark International, Inc.)
O4 - HKLM..\Run: [ Malwarebytes Anti-Malware  (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [PlayMovie] C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.)
O4 - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()
O4 - HKLM..\Run: [ProductReg] C:\Program Files\Acer\WR_PopUp\ProductReg.exe (Acer)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [AutoStartNPSAgent] C:\Programme\Samsung\Samsung New PC Studio\NPSAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKCU..\Run: [PMCLoader] C:\Program Files\Pinnacle\TVCenter Pro\PMCLoader.exe (Pinnacle Systems GmbH)
O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O4 - HKCU..\RunOnce: [mMmLk10800] C:\ProgramData\mMmLk10800\mMmLk10800.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: HP Intelligente Auswahl - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Programme\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab (Oberon Flash Game Host)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\ACER\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\ACER\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2007.02.25 19:06:14 | 000,029,696 | R--- | M] () - E:\Autolaunch.exe -- [ UDF ]
O32 - AutoRun File - [2006.02.16 11:56:14 | 001,052,672 | R--- | M] () - E:\autorun_en.exe -- [ UDF ]
O32 - AutoRun File - [2006.02.16 11:56:14 | 001,052,672 | R--- | M] () - E:\autorun_fr.exe -- [ UDF ]
O32 - AutoRun File - [2006.02.16 11:56:14 | 001,052,672 | R--- | M] () - E:\autorun_ge.exe -- [ UDF ]
O32 - AutoRun File - [2006.02.16 11:56:14 | 001,052,672 | R--- | M] () - E:\autorun_it.exe -- [ UDF ]
O32 - AutoRun File - [2007.07.18 10:43:19 | 000,000,055 | R--- | M] () - E:\autorun.inf -- [ UDF ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.01.16 15:04:25 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\ACER\Desktop\OTL.exe
[2011.01.16 13:22:50 | 000,000,000 | ---D | C] -- C:\Users\ACER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tool
[2011.01.16 13:12:41 | 000,000,000 | ---D | C] -- C:\ProgramData\mMmLk10800
[2011.01.12 09:52:47 | 000,413,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\odbc32.dll
[2011.01.12 09:52:43 | 001,169,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sdclt.exe
[2011.01.01 23:07:45 | 000,000,000 | ---D | C] -- C:\Users\ACER\Desktop\Silvester
[2010.12.20 20:58:43 | 000,000,000 | ---D | C] -- C:\Users\ACER\Desktop\Junction
[2009.05.29 09:57:40 | 000,413,696 | ---- | C] ( ) -- C:\Windows\System32\lxcginpa.dll
[2009.05.29 09:57:40 | 000,397,312 | ---- | C] ( ) -- C:\Windows\System32\lxcgiesc.dll
[2009.05.29 09:57:40 | 000,323,584 | ---- | C] ( ) -- C:\Windows\System32\lxcghcp.dll
[2009.05.29 09:57:39 | 001,224,704 | ---- | C] ( ) -- C:\Windows\System32\lxcgserv.dll
[2009.05.29 09:57:39 | 000,995,328 | ---- | C] ( ) -- C:\Windows\System32\lxcgusb1.dll
[2009.05.29 09:57:39 | 000,696,320 | ---- | C] ( ) -- C:\Windows\System32\lxcghbn3.dll
[2009.05.29 09:57:39 | 000,684,032 | ---- | C] ( ) -- C:\Windows\System32\lxcgcomc.dll
[2009.05.29 09:57:39 | 000,643,072 | ---- | C] ( ) -- C:\Windows\System32\lxcgpmui.dll
[2009.05.29 09:57:39 | 000,585,728 | ---- | C] ( ) -- C:\Windows\System32\lxcglmpm.dll
[2009.05.29 09:57:39 | 000,421,888 | ---- | C] ( ) -- C:\Windows\System32\lxcgcomm.dll
[2009.05.29 09:57:39 | 000,163,840 | ---- | C] ( ) -- C:\Windows\System32\lxcgprox.dll
[2009.05.29 09:57:39 | 000,094,208 | ---- | C] ( ) -- C:\Windows\System32\lxcgpplc.dll
[2008.07.22 09:01:25 | 000,049,152 | ---- | C] ( ) -- C:\Windows\Interop.IWshRuntimeLibrary.dll
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.01.16 14:51:39 | 000,627,756 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.01.16 14:51:39 | 000,595,386 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.01.16 14:51:39 | 000,125,870 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.01.16 14:51:39 | 000,103,460 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.01.16 14:49:03 | 000,008,268 | ---- | M] () -- C:\Users\ACER\AppData\Local\d3d9caps.dat
[2011.01.16 14:49:02 | 000,000,349 | ---- | M] () -- C:\Users\Public\Documents\PCLECHAL.INI
[2011.01.16 14:47:10 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.01.16 14:43:36 | 000,027,744 | ---- | M] () -- C:\ProgramData\nvModes.001
[2011.01.16 14:43:30 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.01.16 14:43:30 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.01.16 14:36:33 | 000,027,744 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2011.01.14 17:04:43 | 000,013,298 | ---- | M] () -- C:\Users\ACER\Desktop\Decklisten 15-01-2011.docx
[2011.01.13 16:04:51 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\ACER\Desktop\OTL.exe
[2011.01.12 19:33:50 | 000,581,683 | ---- | M] () -- C:\Users\ACER\Desktop\File0063.pdf
[2011.01.12 19:31:58 | 000,267,933 | ---- | M] () -- C:\Users\ACER\Desktop\File0062.pdf
[2011.01.12 19:28:24 | 000,762,476 | ---- | M] () -- C:\Users\ACER\Desktop\File0061.pdf
[2011.01.11 22:38:43 | 000,000,000 | ---- | M] () -- C:\Windows\System32\LogConfigTemp.xml
[2011.01.11 22:34:29 | 000,035,840 | ---- | M] () -- C:\Users\ACER\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.01.11 19:56:11 | 000,663,691 | ---- | M] () -- C:\Users\ACER\Desktop\Bild+207.jpg
[2011.01.11 19:55:58 | 000,635,174 | ---- | M] () -- C:\Users\ACER\Desktop\Bild+206.jpg
[2011.01.11 19:55:43 | 000,569,381 | ---- | M] () -- C:\Users\ACER\Desktop\Bild+205.jpg
[2011.01.11 19:55:20 | 000,591,512 | ---- | M] () -- C:\Users\ACER\Desktop\Bild+209.jpg
[2011.01.01 23:06:07 | 017,308,313 | ---- | M] () -- C:\Users\ACER\Desktop\Silvester.rar
[2011.01.01 20:55:41 | 000,221,970 | ---- | M] () -- C:\Users\ACER\Desktop\2011-01-01 03.12.23.jpg
[2010.12.28 16:55:03 | 000,413,696 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\odbc32.dll
[2010.12.20 19:48:19 | 000,135,096 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2010.12.18 11:56:27 | 000,334,080 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.01.14 16:57:53 | 000,013,298 | ---- | C] () -- C:\Users\ACER\Desktop\Decklisten 15-01-2011.docx
[2011.01.12 20:49:58 | 000,581,683 | ---- | C] () -- C:\Users\ACER\Desktop\File0063.pdf
[2011.01.12 20:49:50 | 000,267,933 | ---- | C] () -- C:\Users\ACER\Desktop\File0062.pdf
[2011.01.12 20:49:34 | 000,762,476 | ---- | C] () -- C:\Users\ACER\Desktop\File0061.pdf
[2011.01.11 22:03:32 | 012,406,997 | ---- | C] () -- C:\Users\ACER\Desktop\Warkeys-1.18.1.0b.exe
[2011.01.11 19:56:06 | 000,663,691 | ---- | C] () -- C:\Users\ACER\Desktop\Bild+207.jpg
[2011.01.11 19:55:54 | 000,635,174 | ---- | C] () -- C:\Users\ACER\Desktop\Bild+206.jpg
[2011.01.11 19:55:39 | 000,569,381 | ---- | C] () -- C:\Users\ACER\Desktop\Bild+205.jpg
[2011.01.11 19:55:08 | 000,591,512 | ---- | C] () -- C:\Users\ACER\Desktop\Bild+209.jpg
[2011.01.11 13:17:49 | 000,221,970 | ---- | C] () -- C:\Users\ACER\Desktop\2011-01-01 03.12.23.jpg
[2011.01.01 23:05:43 | 017,308,313 | ---- | C] () -- C:\Users\ACER\Desktop\Silvester.rar
[2010.12.20 20:58:11 | 000,079,623 | ---- | C] () -- C:\Users\ACER\Desktop\Junction.zip
[2010.12.17 18:26:16 | 000,357,519 | ---- | C] () -- C:\Users\ACER\Desktop\wissenstest.spiegel.de
[2010.11.29 21:23:20 | 000,022,723 | ---- | C] () -- C:\Windows\System32\SUGS2l3.dll
[2010.08.15 13:38:18 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2010.01.16 18:01:13 | 000,201,488 | ---- | C] () -- C:\Windows\System32\MACD32.DLL
[2010.01.16 18:01:13 | 000,144,144 | ---- | C] () -- C:\Windows\System32\MASE32.DLL
[2010.01.16 18:01:13 | 000,141,584 | ---- | C] () -- C:\Windows\System32\MAMC32.DLL
[2010.01.16 18:01:13 | 000,063,248 | ---- | C] () -- C:\Windows\System32\MASD32.DLL
[2010.01.16 18:01:13 | 000,033,040 | ---- | C] () -- C:\Windows\System32\MA32.DLL
[2010.01.08 12:02:42 | 000,110,592 | ---- | C] () -- C:\Windows\System32\FsUsbExDevice.Dll
[2010.01.08 12:02:42 | 000,036,608 | ---- | C] () -- C:\Windows\System32\FsUsbExDisk.Sys
[2009.12.13 22:30:51 | 000,000,272 | ---- | C] () -- C:\Windows\SIERRA.INI
[2009.08.18 20:16:29 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.07.27 13:58:28 | 000,002,171 | ---- | C] () -- C:\ProgramData\hpzinstall.log
[2009.07.22 11:49:48 | 000,040,960 | R--- | C] () -- C:\Windows\System32\psfind.dll
[2009.07.16 01:03:43 | 000,008,268 | ---- | C] () -- C:\Users\ACER\AppData\Local\d3d9caps.dat
[2009.06.30 14:33:29 | 000,035,840 | ---- | C] () -- C:\Users\ACER\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.05.29 09:57:40 | 000,274,432 | ---- | C] () -- C:\Windows\System32\lxcginst.dll
[2009.02.07 16:32:13 | 000,000,000 | ---- | C] () -- C:\Windows\PROTOCOL.INI
[2009.01.04 12:13:39 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2009.01.02 23:21:45 | 000,021,840 | ---- | C] () -- C:\Windows\System32\SIntfNT.dll
[2009.01.02 23:21:45 | 000,017,212 | ---- | C] () -- C:\Windows\System32\SIntf32.dll
[2009.01.02 23:21:45 | 000,012,067 | ---- | C] () -- C:\Windows\System32\SIntf16.dll
[2009.01.02 20:49:13 | 000,027,744 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2009.01.02 13:53:36 | 000,027,744 | ---- | C] () -- C:\ProgramData\nvModes.001
[2008.11.05 11:53:48 | 000,626,688 | ---- | C] () -- C:\Windows\Image.dll
[2008.11.05 11:53:48 | 000,000,036 | ---- | C] () -- C:\Windows\PidList.ini
[2008.04.18 19:25:22 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2008.04.18 10:49:14 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIOFM4.dll
[2008.04.18 10:49:14 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIBUN5.dll
[2008.04.18 09:56:05 | 000,204,800 | ---- | C] () -- C:\Windows\System32\SysHook.dll
[2008.04.18 09:52:45 | 000,487,424 | ---- | C] () -- C:\Windows\System32\INT15.dll
[2008.04.18 09:42:52 | 000,001,694 | ---- | C] () -- C:\Windows\RtDefLvl.ini
[2007.10.25 17:26:10 | 000,005,632 | ---- | C] () -- C:\Windows\System32\drivers\StarOpen.sys
[2007.02.22 17:32:00 | 000,344,064 | ---- | C] () -- C:\Windows\System32\lxcgcoin.dll
[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 11:25:25 | 000,557,568 | ---- | C] () -- C:\Windows\System32\hpotscld.dll
[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2005.08.18 05:26:46 | 000,040,960 | ---- | C] () -- C:\Windows\System32\lxcgvs.dll
[2005.03.13 13:32:14 | 000,061,440 | ---- | C] () -- C:\Windows\System32\lxcgcnv4.dll
[2001.12.26 15:12:30 | 000,065,536 | ---- | C] () -- C:\Windows\System32\multiplex_vcd.dll
[2001.09.03 22:46:38 | 000,110,592 | ---- | C] () -- C:\Windows\System32\Hmpg12.dll
[2001.07.30 15:33:56 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC.dll
[2001.07.23 21:04:36 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC_MMX.dll
[1997.06.14 10:56:08 | 000,056,832 | ---- | C] () -- C:\Windows\System32\iyvu9_32.dll

< End of report >

--- --- ---

OTL-Extras:

OTL Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 16.01.2011 15:05:39 - Run 2
OTL by OldTimer - Version 3.2.20.2     Folder = C:\Users\ACER\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 83,00% Memory free
6,00 Gb Paging File | 6,00 Gb Available in Paging File | 94,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 144,04 Gb Total Space | 62,03 Gb Free Space | 43,06% Space Free | Partition Type: NTFS
Drive D: | 144,04 Gb Total Space | 143,95 Gb Free Space | 99,93% Space Free | Partition Type: NTFS
Drive E: | 5,73 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: ACER-PC | User Name: ACER | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-7420075-3053948626-936591600-1000]
"EnableNotifications" = 1
"EnableNotificationsRef" = 1
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04BF22A4-C6A1-40BB-85B6-416822DA9EA0}" = rport=137 | protocol=17 | dir=out | app=system | 
"{09192CF9-479E-40DD-BCD3-7613CF252C2C}" = rport=445 | protocol=6 | dir=out | app=system | 
"{14CF7768-2A52-4F24-BFA4-4890A8F83B24}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{1AC07984-3473-4C65-9FF8-91BEFC04A95B}" = lport=139 | protocol=6 | dir=in | app=system | 
"{2F96B33C-9CED-4AFF-8505-2F476AA58C45}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{38A77539-D477-4814-AC56-7BC8282268DF}" = rport=139 | protocol=6 | dir=out | app=system | 
"{44C9EEBC-FE6F-4245-A444-A689BD76C07B}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{4A2AC76F-BA67-4793-B913-63E35E3E7B9C}" = lport=137 | protocol=17 | dir=in | app=system | 
"{57716658-BCC7-4E11-85BA-0E5A7B37890F}" = rport=138 | protocol=17 | dir=out | app=system | 
"{87E44066-3D04-4A13-BEFC-9C9E21005CA2}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{945ACD29-530E-438F-9715-1A4BAE5242D7}" = lport=138 | protocol=17 | dir=in | app=system | 
"{A7AEDBFC-3C8D-4004-A189-9EE76DD22B66}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{CCDAAAD6-B8A9-4499-95AF-73B226B6296C}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{CE2E0AAC-D7ED-4FD3-A649-4EC5FFC361C3}" = rport=427 | protocol=17 | dir=in | svc=hpslpsvc | app=c:\windows\system32\svchost.exe | 
"{CEAB9719-E068-406D-B0FA-B5B6103796DC}" = lport=445 | protocol=6 | dir=in | app=system | 
"{D232AC0D-CF44-486B-9EB9-61FE6AF19923}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{E0D744EA-BC7C-4A10-AB00-04449B91BB1F}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{F96B6E93-2B90-4F55-B32A-01681675BBEC}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe | 
"{FDF22675-D572-4895-8F61-14EB827ABFE9}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03964463-9A9E-4569-8A85-3A27F7347AB8}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{03EDA29E-15F3-43EC-9D1F-F2DF94F8F422}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpiscnapp.exe | 
"{048E7868-7EA9-47DF-AD25-E06149552152}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{06164584-5B03-4113-93FA-5AE316CAFAF3}" = protocol=6 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsasvr.exe | 
"{0689B3E6-8FF3-4612-8F2B-1F60272F8477}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{08A79550-56F9-42EC-81A3-06F5D87F821C}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{0ADFB58F-C2E1-4A28-82AE-7B3BCEA3830C}" = protocol=17 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsvsvr.exe | 
"{106A86ED-9516-46A2-AB0B-0E1BDB2B79D8}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{10FB71B5-4E15-4BCF-919A-4B7715848ACE}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{12184E5A-9CE2-4B47-95F3-2A883A973399}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\backupsvc.exe | 
"{1883A6FD-A874-473C-93F6-9E575BF74D2D}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{1962C344-A6F4-4422-B337-4C7B41D75A63}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{24EDBCEC-A7BC-4BA9-9A5D-33110194461F}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{28909649-D9EF-4C5D-81B9-B9D687429362}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{30725DB0-FE78-43B2-8FD1-45C1599AB623}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\schedulersvc.exe | 
"{31D97F2A-CDF6-462D-A3E4-F561795064F4}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{33E3E77B-EC79-43F4-AD9A-6B724767AC94}" = dir=in | app=c:\program files\hp\digital imaging\bin\hposid01.exe | 
"{358C294E-7D8C-49EE-A07C-D47F500AEBC9}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{36984233-0142-4CBB-8698-04C3C2D0523C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{379EC35C-E9AE-4E04-9C29-8B26F5F447C0}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{3A1AD0A6-53E9-480F-A143-07271A4A88C8}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{3AE8F041-56AE-4075-A345-EE77E43F4E4B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{3CA22460-B68D-426D-847F-525E82A6B401}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqpse.exe | 
"{3CFBCC3A-EB66-48C9-A1D6-78C3E95A3C6B}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqkygrp.exe | 
"{3DE70723-8D4C-451B-8B4F-6CD1A54A2A64}" = protocol=17 | dir=in | app=c:\program files\pinnacle\shared files\programs\strmserver\strmserver.exe | 
"{3EA95135-5084-4AA3-B45D-C49EA3FB4D7B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{3F386959-9EE7-402D-A3CC-C15EED40A42D}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{4195D402-85DE-4689-9BD7-E94AD8665D4E}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqste08.exe | 
"{42547E42-C6DB-4836-948F-1910840A7401}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{42A3AD09-15DC-46C4-A2FD-08A2933C83FB}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{449624C0-B221-4970-955C-3D36E9B3DF7E}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{44E86C24-8A31-4FA5-9FA5-A2EBBE8AE7C9}" = dir=in | app=c:\program files\acer arcade deluxe\homemedia\homemedia.exe | 
"{455A26F0-C6B0-46EF-82ED-33468C2FB9C7}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe | 
"{48AE5B90-5774-4043-984C-C985460226C0}" = dir=in | app=c:\program files\acer arcade deluxe\playmovie\playmovie.exe | 
"{4C334B15-E28E-49A7-8BDD-27213D1E759C}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{4C63D764-CAF1-4164-92B3-8E70D7F2B7B6}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{4E03EC53-8F38-4450-ACD3-A186E0F89E4F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{57364AF3-2209-4A6F-BD9A-C7E77B2DBEDE}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxcgpswx.exe | 
"{5817F6AE-D602-4074-8604-DA44100785F1}" = protocol=17 | dir=in | app=c:\windows\system32\lxcgcoms.exe | 
"{598A0C64-6A24-47FC-9E62-CBA61BF502BC}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{5AD39B15-C22D-4036-8D66-86BCD32BBC08}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{5B1471C9-9279-42F4-8FA7-4EF7A6F24BD9}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{5FD3D973-521D-4A30-B996-8B7E63F35A38}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgplgtupl.exe | 
"{607C6FAC-0624-4D8B-B5C3-5DAF98C0ACD3}" = dir=in | app=c:\program files\acer arcade deluxe\playmovie\pmvservice.exe | 
"{6393BA6E-80C4-4FCF-8556-0307B572851A}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{642003C1-A9F1-4167-8EA6-28C50D615383}" = dir=in | app=c:\program files\acer arcade deluxe\acer arcade deluxe\acer arcade deluxe.exe | 
"{7278A533-3279-40F9-8A0E-1DA60FB6D6A7}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{7546C3DD-D0EE-41BF-AD6D-738D34B51539}" = protocol=17 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe | 
"{75B19BA0-06B0-4A5F-9297-1AEE3842637E}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{75D3D0FD-0355-4728-8ABF-ADF498B928EF}" = protocol=6 | dir=in | app=c:\program files\pinnacle\shared files\programs\strmserver\strmserver.exe | 
"{77327392-9C9F-4138-99A8-B4067CE7E745}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{789E27A0-02D1-4968-9664-FCF32472A6CC}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{83D9A8D4-6724-41C5-AB4E-263C50205765}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{86D42E26-1064-4D2B-9F62-27FFF6ADA515}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqsudi.exe | 
"{86E10664-E6EA-495B-987E-11008B34294E}" = dir=in | app=c:\program files\common files\hp\digital imaging\bin\hpqphotocrm.exe | 
"{8737DBFA-FFA7-4D38-9D17-1590EC698208}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\backupsvc.exe | 
"{8B67F724-9D13-4C6E-997C-CFAF9506F9BF}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpoews01.exe | 
"{91A26CE9-397F-4EBF-9A94-4F7887E15DBB}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{94918DAD-5603-44A9-84B4-C855556A0569}" = protocol=6 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsvsvr.exe | 
"{9565A9BC-7126-42A4-A176-303884131A47}" = protocol=17 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsasvr.exe | 
"{95764E7D-0ACA-4F12-9C76-0D6FF381A20A}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{9C9B655E-CC7A-4BBD-AACB-F1378296CC58}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxcgpswx.exe | 
"{9F652C90-C337-4BA0-B1BE-25D2F95B9427}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{9FBBDF7F-D7C9-4732-A203-8714A5887650}" = protocol=6 | dir=in | app=c:\windows\system32\lxcgcoms.exe | 
"{A0C311F6-01FE-46EE-BBBB-A31546E2C522}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\client\agentsvc.exe | 
"{A31B2470-ADCD-4445-AB02-426E296D01CE}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{A6379ACE-C399-4BFE-A931-D38CE9CF8559}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{B1C3A12F-60AC-46D6-99DB-1042BA1EFD04}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{B3949B97-1E3A-4108-88BA-1EC635F1187E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{B58FD039-889A-4000-9A55-45C758B69FCD}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{BAD98A9C-44D3-46DB-A8F9-6251E613D9F9}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqpsapp.exe | 
"{BC3D4632-0058-4489-A7E2-05D654ED0601}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\schedulersvc.exe | 
"{BD499B23-723B-48C7-9BAB-2DFB0840D897}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{CA04CE74-B25B-4924-9C05-A4001889C66D}" = protocol=6 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe | 
"{D19013EB-25C4-407B-A663-29CD759FBD90}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{D4942B81-0E9C-4C55-9203-5EA2D89EE249}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{D7DDF90D-8E93-4952-AE73-D47531F262B6}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgpc01.exe | 
"{DBC71D6E-5325-45CF-8F72-EA52CE052DCC}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\client\agentsvc.exe | 
"{E269DBC0-160B-48A8-98BD-141531794A39}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{E5E3C61E-8932-4164-9572-31E9315D8643}" = dir=in | app=e:\setup\hpznui01.exe | 
"{E7F26E0B-B124-49FD-AEA9-7E5B2C7DE683}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{E997DD8F-6A7E-4EB8-BD4B-5823A7FAC112}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{EEF37707-4E68-44BB-AD46-2EC12D65BFE9}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqtra08.exe | 
"{EF403329-4050-4BF7-B4AF-0695F31E94F3}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{F2EEBE6A-8499-49D0-A216-85A700995754}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{F682FD8F-8395-4A54-B7E8-F97F6D84BCA2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{F88E3B51-3F02-4177-8337-3F2251A5233B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"TCP Query User{1108D6BC-6F4A-4A7A-99B7-38B8B41E4A88}C:\program files\mirc\mirc.exe" = protocol=6 | dir=in | app=c:\program files\mirc\mirc.exe | 
"TCP Query User{27EA11A7-5ED6-440B-A809-92ED373698D2}C:\program files\warcraft iii\war3.exe" = protocol=6 | dir=in | app=c:\program files\warcraft iii\war3.exe | 
"TCP Query User{4342102C-0590-4A01-87DE-21206FD574C2}C:\program files\microsoft games\age of empires ii\empires2.exe" = protocol=6 | dir=in | app=c:\program files\microsoft games\age of empires ii\empires2.exe | 
"TCP Query User{60E2272E-8942-4430-91F0-400173790A68}F:\aoe2\age2_exp.exe" = protocol=6 | dir=in | app=f:\aoe2\age2_exp.exe | 
"TCP Query User{689067D1-E251-4CD3-BB5C-FAA2C7730345}C:\windows\system32\dplaysvr.exe" = protocol=6 | dir=in | app=c:\windows\system32\dplaysvr.exe | 
"TCP Query User{86D2D3B3-0C04-4A3B-B6D2-27073E5E2F9C}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"TCP Query User{A596A85C-0CD8-4F40-AFD8-0AAF0C1BC387}G:\programme\icq6\icq.exe" = protocol=6 | dir=in | app=g:\programme\icq6\icq.exe | 
"TCP Query User{AA0CB18F-F891-4AC0-98F4-FFCA9789E951}F:\aoe2\age2_x1\age2_x1.exe" = protocol=6 | dir=in | app=f:\aoe2\age2_x1\age2_x1.exe | 
"TCP Query User{F82256EA-10F8-4233-A009-F6E55C143925}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"UDP Query User{097D2387-CC60-419D-B021-8BF2165F6887}C:\program files\warcraft iii\war3.exe" = protocol=17 | dir=in | app=c:\program files\warcraft iii\war3.exe | 
"UDP Query User{36E41E12-E12E-4505-B7D8-BC6E4CFE1A23}C:\program files\microsoft games\age of empires ii\empires2.exe" = protocol=17 | dir=in | app=c:\program files\microsoft games\age of empires ii\empires2.exe | 
"UDP Query User{7BCA0EA9-38FA-4C74-9FE0-78E5316B7658}C:\program files\mirc\mirc.exe" = protocol=17 | dir=in | app=c:\program files\mirc\mirc.exe | 
"UDP Query User{84477340-0FBF-43EE-A84E-EC214481242F}F:\aoe2\age2_x1\age2_x1.exe" = protocol=17 | dir=in | app=f:\aoe2\age2_x1\age2_x1.exe | 
"UDP Query User{9ED6306D-7BA0-4D3F-A272-EE7BAB619AF2}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"UDP Query User{B1E05235-8B3F-4527-8A7A-13C737FCC7B7}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"UDP Query User{B7F26432-3791-4BA9-BCBB-2B8E49B3B686}G:\programme\icq6\icq.exe" = protocol=17 | dir=in | app=g:\programme\icq6\icq.exe | 
"UDP Query User{F3D24196-4C9A-41D4-80E1-E304CDDB3EA9}C:\windows\system32\dplaysvr.exe" = protocol=17 | dir=in | app=c:\windows\system32\dplaysvr.exe | 
"UDP Query User{F80FDD2D-E0D4-419A-A917-2B99098479BF}F:\aoe2\age2_exp.exe" = protocol=17 | dir=in | app=f:\aoe2\age2_exp.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{0289B35E-DC07-4c7a-9710-BBD686EA4B7D}" = Status
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{09633A5E-3089-41A8-9FF1-382171423C5D}" = PSSWCORE
"{0AD84416-63A4-4CF3-BDDF-8FA866711FB0}" = Civilization III
"{10F498FF-5392-4DF3-8F73-FE172A9F3800}" = Winbond CIR Device Drivers
"{11316260-6666-467B-AC34-183FCB5D4335}" = Acer Mobility Center Plug-In
"{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now Standard
"{13D85C14-2B85-419F-AC41-C7F21E68B25D}" = Acer eSettings Management
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{15B8AFD9-92E9-4E86-96D9-83FAC510B82E}" = HPPhotoSmartPhotobookWebPack1
"{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}" = QuickTime
"{22F761D1-8063-4170-ADF7-2D2F47834CA9}" = VideoToolkit01
"{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
"{26604C7E-A313-4D12-867F-7C6E7820BE4C}" = JMicron JMB38X Flash Media Controller
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 17
"{2AFEAA03-2DFE-4519-A629-EDAB6541ABE9}" = HPSSupply
"{3700194C-C5DD-439A-BE06-A66960CA4C70}" = MSVCSetup
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{412B69AF-C352-4F6F-A318-B92B3CB9ACC6}" = Titan Quest
"{43C0C354-A185-4D2D-A057-67C9160460E1}" = PS_AIO_04_C4580_Software_Min
"{4A3D0CF8-60FF-4CEF-91A4-A1F001424602}" = DocProc
"{4E7C28C7-D5DA-4E9F-A1CA-60490B54AE35}" = UnloadSupport
"{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}" = Microsoft Works
"{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features
"{57265292-228A-41FA-9AEC-4620CBCC2739}" = Acer eAudio Management
"{58E5844B-7CE2-413D-83D1-99294BF6C74F}" = Acer ePower Management
"{5B09F344-4406-11D5-96E8-0050BA84F5F7}" = Baldurs Gate(TM) II - Thron des Bhaal (TM)
"{5B63A470-9334-44D1-AF61-6CE2DB565AE9}" = Orion
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{70E1E357-E57C-4284-B04E-58196DC27BC1}" = PanoStandAlone
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2
"{746F49C9-3789-4F8E-AF3A-3A4B42ACFAF8}" = Spellforce 2 Gold
"{7641710F-A4AD-4EAE-889C-4958BE3F169C}" = C4580
"{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver
"{7C7AC2D4-1077-45C8-826A-16445B5E0DB7}" = Pinnacle DistanTV Server
"{7E8242F8-BD2A-44D7-BCED-9B231A02B367}" = SpellForce 2 Patch
"{7E84FAC8-C518-40F9-9807-7455301D6D25}" = SamsungConnectivityCableDriver
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110111700}" = Zuma Deluxe
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11029123}" = Bricks of Egypt
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110322783}" = Big Kahuna Reef
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110411970}" = Chuzzle
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111118433}" = Mystery Case Files - Huntsville
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111199750}" = Cake Mania
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111252743}" = Mahjong Escape Ancient China
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111324990}" = Kick N Rush
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111543617}" = Backspin Billiards
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111692950}" = Mahjongg Artifacts
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111771833}" = Jewel Quest Solitaire
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111796363}" = Mystery Solitaire - Secret Island
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112531267}" = Chicken Invaders 3
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112615863}" = Agatha Christie Death on the Nile
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}" = Alice Greenfingers
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113009953}" = Turbo Pizza
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113080210}" = Azada
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{8A74DEFD-A224-49CC-AB80-4E88BC730125}" = LogMeIn Hamachi
"{8F1B6239-FEA0-450A-A950-B05276CE177C}" = Acer Empowering Technology
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{2AB528A5-BB1B-4EBE-8E51-AD0C4CD33CA9}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{3EC77D26-799B-4CD8-914F-C1565E796173}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{430971B1-C31E-45DA-81E0-72C095BAB72C}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{58FC5E37-DD28-4D4A-A549-125744C6763C}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{888B9AC7-8F5C-456B-A27A-157A6C310E52}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-00B2-0409-0000-0000000FF1CE}" = Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{BEE75E01-DD3F-4D5F-B96C-609E6538D419}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{99E862CC-6F69-4D39-99AA-DBF71BF3B585}" = OpenOffice.org 3.1
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C2D4047-0E40-499a-AC7A-C4B9BB12FE03}" = TrayApp
"{9F4EE72A-C5C9-42ad-ABEF-427690843577}" = MarketResearch
"{A5633652-3795-4829-BB0B-644F0279E279}" = Acer eDataSecurity Management
"{A64A5576-D862-44F8-89DC-2B17FCC9B86E}" = Broadcom Gigabit Integrated Controller
"{A6A195F5-BCAB-4F38-8459-DF693303CD8D}" = PS_AIO_04_C4580_ProductContext
"{A77255C4-AFCB-44A3-BF0F-2091A71FFD9E}" = Acer Crystal Eye Webcam 2.0.8
"{A82E3AFE-0BD9-4A17-9A58-9112B5C679C5}" = MyScript Notes Lite
"{AA2E8A46-B45E-4aea-8A23-88AB57D04523}" = WebReg
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC599724-5755-48C1-ABE7-ABB857652930}" = PC Connectivity Solution
"{AF7E85DC-317C-47F5-810E-B82EE093A612}" = Samsung New PC Studio USB Driver Installer
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B5C5C17E-FEF6-4062-8151-A427AE8AF9D7}" = Titan Quest Immortal Throne
"{BED1705F-7558-40f7-9F52-6C6FBD58EA2E}" = HP Photosmart C4500 All-In-One Driver Software 11.0 Rel .4
"{BF08AB1C-3357-4f20-A200-8EBB8EF27C59}" = BufferChm
"{C89B5E3A-690F-4CEE-909A-BF869E198B0A}" = Scan
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CC0E1AE3-091D-4969-B151-7AC142062C28}" = SmartWebPrinting
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe  1.4.142.1
"{D063F201-FAC4-4D5C-B10B-615058ADE5A7}" = HP Update
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D23E2520-0EAA-4AC3-A47E-A551C70D4FED}" = C4580_Help
"{D36DD326-7280-11D8-97C8-000129760CBE}" = PhotoNow!
"{D4278897-1541-493E-9D39-59CC6AB0FC09}" = PS_AIO_04_C4580_Software
"{D74CFE48-087F-46E1-80E6-E2950E1A8DCE}" = HP Photosmart Essential 2.5
"{DB833EF9-A198-49BE-970A-BD46F30BFBB4}" = ANNO 1503 GOLD
"{E535C94A-B87F-4182-BEA8-1E9322078D3E}" = Cards_Calendar_OrderGift_DoMorePlugout
"{E96B0085-6659-486b-A221-5042A042728D}" = Toolbox
"{EF1ADA5A-0B1A-4662-8C55-7475A61D8B65}" = DeviceDiscovery
"{EF9E56EE-0243-4BAD-88F4-5E7508AA7D96}" = Destination Component
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F7B0E599-C114-4493-BC4D-D8FC7CBBABBB}" = 32 Bit HP CIO Components Installer
"{F95F178B-56AD-4fab-87F8-FA81E66C7D68}" = Network
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"3A5DEFA413DDE699DBA6EBE0A63534ACA524D30F" = Windows-Treiberpaket - Nokia pccsmcfd  (10/12/2007 6.85.4.0)
"Acer GameZone Console_is1" = Acer GameZone Console 2.0.1.1
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Age of Empires 2.0" = Microsoft Age of Empires II
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Battle.net" = Battle.net
"Beyond Divinity_is1" = Beyond Divinity 1.47
"CCleaner" = CCleaner
"Diablo" = Diablo
"Diablo II" = Diablo II
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup.divx.com" = DivX-Setup
"EAX(tm) Unified (SHELL)" = EAX(tm) Unified (SHELL)
"FINAL FANTASY VIII" = FINAL FANTASY VIII
"GridVista" = Acer GridVista
"Heroes of Might and Magic II" = Heroes of Might and Magic II
"Heroes of Might and Magic® III" = Heroes of Might and Magic® III Complete
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"HP Imaging Device Functions" = HP Imaging Device Functions 11.0
"HP Photosmart Essential" = HP Photosmart Essential 3.0
"HP Smart Web Printing" = HP Smart Web Printing
"HPExtendedCapabilities" = HP Customer Participation Program 11.0
"HPOCR" = OCR Software by I.R.I.S. 11.0
"ImgBurn" = ImgBurn
"InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now 5
"InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
"InstallShield_{AF7E85DC-317C-47F5-810E-B82EE093A612}" = Samsung New PC Studio USB Driver Installer
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"Keeper" = Dungeon Keeper
"Lexmark 2300 Series" = Lexmark 2300 Series
"LManager" = Launch Manager
"LogMeIn Hamachi" = LogMeIn Hamachi
"Magic Set Editor 2_is1" = Magic Set Editor 2 - 0.3.8 beta
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"mIRC" = mIRC
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"NVIDIA Drivers" = NVIDIA Drivers
"RealPlayer 6.0" = RealPlayer
"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile Modem Device" = Samsung Mobile Modem Device Software
"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"SAMSUNG USB Mobile Device" = SAMSUNG USB Mobile Device Software
"Shockwave" = Shockwave
"Shop for HP Supplies" = Shop for HP Supplies
"Sierra Uninstall" = Sierra On-Line Games (Remove only)
"SumatraPDF" = SumatraPDF
"SUPER ©" = SUPER © Version 2008.bld.33 (Sep 2, 2008)
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"System Tool2011" = System Tool2011
"Tiberian Sun" = Command & Conquer Teil 3: Operation Tiberian Sun
"Veetle TV" = Veetle TV 0.9.18
"Warcraft III" = Warcraft III
"Winamp" = Winamp
"WinRAR archiver" = WinRAR
"WOLAPI" = Gemeinsam genutzte Internet-Komponenten von Westwood
"Zylom Games Player Plugin" = Zylom Games Player Plugin
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"NoNameScript" = NNScript
"pdfsam" = pdfsam
"Warcraft III" = Warcraft III: All Products
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >

--- --- ---

Schon im Voraus vielen, vielen Dank für eure Zeit und Mühe! Hoffe, mir kann geholfen werden

LG, Kevin

markusg · 16.01.2011, 15:32

die gibt es, werden wir aber nicht nutzen, da diese option probleme verursachen kann.
ich sehe mir otl logs an, moment.

markusg · 16.01.2011, 15:38

• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

:OTL
IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found
O4 - HKLM..\Run: [hpqSRMon] File not found
O4 - HKCU..\RunOnce: [mMmLk10800] C:\ProgramData\mMmLk10800\mMmLk10800.exe ()
:Files
C:\ProgramData\mMmLk10800
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
[2011.01.16 13:22:50 | 000,000,000 | ---D | C] -- C:\Users\ACER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tool
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
der start in den normalen modus sollte klappen!
öffne mein computer,, c: dann _OTL
dort rechtsklick auf moved files
wähle zu moved files.rar oder zip hinzufügen.
lade das archiv in unserem upload channel hoch.
http://www.trojaner-board.de/54791-a...ner-board.html

Fnyrri · 16.01.2011, 15:53

Normaler Modus funktioniert schon mal wieder! Juhu!

Archiv-Upload kommt sofort, hier der Inhalt des Textdokumentes:

Code:

ATTFilter

All processes killed
========== OTL ==========
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\hpqSRMon deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mMmLk10800 deleted successfully.
C:\ProgramData\mMmLk10800\mMmLk10800.exe moved successfully.
========== FILES ==========
C:\ProgramData\mMmLk10800 folder moved successfully.
File\Folder O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found not found.
File\Folder [2011.01.16 13:22:50 | 000,000,000 | ---D | C] -- C:\Users\ACER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tool not found.
========== COMMANDS ==========
 
[EMPTYFLASH]
 
User: ACER
->Flash cache emptied: 214051 bytes
 
User: All Users
 
User: Default
 
User: Default User
 
User: Public
 
Total Flash Files Cleaned = 0,00 mb
 
 
[EMPTYTEMP]
 
User: ACER
->Temp folder emptied: 210792187 bytes
->Temporary Internet Files folder emptied: 48170469 bytes
->Java cache emptied: 621850 bytes
->FireFox cache emptied: 126893529 bytes
->Flash cache emptied: 0 bytes
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 12663963 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 14726102 bytes
RecycleBin emptied: 1336555588 bytes
 
Total Files Cleaned = 1.669,00 mb
 
 
OTL by OldTimer - Version 3.2.20.2 log created on 01162011_154729

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

markusg · 16.01.2011, 15:58

nachdem du hochgeladen hast, kannst du das folgende otl script mal ausführen? hatte da nen kleinen fehler.

:OTL
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
[2011.01.16 13:22:50 | 000,000,000 | ---D | C] -- C:\Users\ACER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tool
:Files
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]

Fnyrri · 16.01.2011, 16:01

Ich habe eine rar-Datei so erstellt, wie von dir gesagt - allerdings meinte Winrar bei 2 Dateien "Zugriff verweigert". Es wurde eine rar-Datei erstellt, aber ich weiß dadurch nicht, ob das wirklich der vollständige Inhalt der MovedFiles ist. Ich hab's jedenfalls mal hochgeladen.

Das neue OTL-Script führe ich sofort aus.

Edit:

Hab's ausgeführt, nach Reboot hatte ich folgendes im Textdokument:

Code:

ATTFilter

All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found.
C:\Users\ACER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tool folder moved successfully.
========== FILES ==========
========== COMMANDS ==========
 
[EMPTYFLASH]
 
User: ACER
->Flash cache emptied: 0 bytes
 
User: All Users
 
User: Default
 
User: Default User
 
User: Public
 
Total Flash Files Cleaned = 0,00 mb
 
 
[EMPTYTEMP]
 
User: ACER
->Temp folder emptied: 437849 bytes
->Temporary Internet Files folder emptied: 61416 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 17265821 bytes
->Flash cache emptied: 0 bytes
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1643 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 17,00 mb
 
 
OTL by OldTimer - Version 3.2.20.2 log created on 01162011_160144

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

markusg · 16.01.2011, 16:08

nö das passt alles.
download malwarebytes:
Malwarebytes
instalieren, öffnen, registerkarte aktualisierung, programm updaten.
schalte alle laufenden programme ab, trenne die internetverbindung.
registerkarte scanner, komplett scan, funde entfernen, log posten.

Fnyrri · 16.01.2011, 16:11

Mach ich. Mein Malwarebytes-Vollscan, den ich vor Erstellen des Threads gemacht habe, hat beinahe eine Stunde gedauert, also nicht wundern, wenn ich eine Weile nichts von mir hören lasse.

markusg · 16.01.2011, 16:19

kein problem... ist ja noch genug zu tun :d

Fnyrri · 16.01.2011, 18:17

So, da bin ich wieder... im ersten Anlauf hat sich Malwarebytes leider nach 54 Minuten aufgehängt, darum musste ich es nochmals durchlaufen lassen.

Hier jetzt das Ergebnis
(Übrigens haben locker 20 Minuten / 50k Dateien der Analyse im Ordner C:\Windows\winsxs in irgendwelchen x86_blabla-Dateien stattgefunden, ist das normal?):

Code:

ATTFilter

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 5532

Windows 6.0.6002 Service Pack 2
Internet Explorer 7.0.6002.18005

16.01.2011 18:10:51
mbam-log-2011-01-16 (18-10-51).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 316306
Laufzeit: 55 Minute(n), 30 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\_OTL\movedfiles\01162011_154729\c_programdata\mmmlk10800\mmmlk10800.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

markusg · 16.01.2011, 18:20

sieht gut aus.
lade den CCleaner slim:
Piriform - Builds
falls der CCleaner bereits instaliert, überspringen.
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

Fnyrri · 16.01.2011, 18:38

Hier die Liste - leider mit ziemlich vielen "unbekannt". Wenn mal nichts dahintersteht, wie bei den zig Microsoft- und Samsung-Dingern, dann heißt das ebenfalls "unbekannt".

Code:

ATTFilter

Acer Arcade Deluxe	CyberLink Corp.	04.11.2008	83,1MB	2.0.5315 unbekannt
Acer Crystal Eye Webcam 2.0.8	SuYin	04.11.2008	2,95MB	2.0.8 notwendig
Acer eAudio Management	CyberLink Corp.	04.11.2008	2,17MB	3.0.3007 unbekannt
Acer eDataSecurity Management	Egis Inc.	17.04.2008	62,7MB	3.0.3060 unbekannt
Acer Empowering Technology	Acer Incorporated	17.04.2008	140,7MB	3.0.3006 unbekannt
Acer ePower Management	Acer Incorporated	17.04.2008	9,63MB	3.0.3008 unbekannt
Acer eRecovery Management	Acer Incorporated	04.11.2008	27,5MB	3.0.3013 unbekannt
Acer eSettings Management	Acer Incorporated	04.11.2008	27,4MB	3.0.3007 unbekannt
Acer GameZone Console 2.0.1.1	Oberon Media, Inc.	17.04.2008	38,5MB unbekannt
Acer GridVista		04.11.2008	1,51MB	2.72.317 unbekannt
Acer Mobility Center Plug-In	Acer Inc.	17.04.2008	4,13MB	3.0.3000 unbekannt
Acer ScreenSaver	Acer Incorporated	04.11.2008		1.12.0506 unbekannt
Activation Assistant for the 2007 Microsoft Office suites	Microsoft Corporation	04.11.2008	14,0MB unbekannt
Adobe Flash Player 10 Plugin	Adobe Systems Incorporated	30.10.2010		10.1.85.3 notwendig
Agatha Christie Death on the Nile	Oberon Media	04.11.2008	160,8MB	unnötig
Agere Systems HDA Modem	Agere Systems	17.04.2008 unbekannt		
Alice Greenfingers	Oberon Media	04.11.2008	13,3MB unbekannt	
ANNO 1503 GOLD		09.04.2009	1.530MB	1.05.00 notwendig
Apple Software Update	Apple Inc.	18.05.2009	2,16MB	2.1.1.116 unbekannt
Avira AntiVir Personal - Free Antivirus	Avira GmbH	19.12.2010	127,0MB	10.0.0.609 nowendig
Azada	Oberon Media	04.11.2008	61,8MB unbekannt
Backspin Billiards	Oberon Media	04.11.2008	9,09MB unbekannt
Baldurs Gate(TM) II - Thron des Bhaal (TM)		08.03.2009	2,26MB notwendig	
Battle.net		19.03.2010 notwendig		
Beyond Divinity 1.47	Larian Studios	27.09.2009	1.423MB	unnötig
Big Kahuna Reef	Oberon Media	04.11.2008	11,4MB unbekannt
Bricks of Egypt	Oberon Media	04.11.2008	6,73MB unbekannt
Broadcom Gigabit Integrated Controller	Broadcom Corporation	17.04.2008	1,01MB	11.11.03 unbekannt
Cake Mania	Oberon Media	04.11.2008	17,5MB unbekannt
CCleaner	Piriform	15.01.2011	2,95MB	3.02 notwendig ;)
Chicken Invaders 3	Oberon Media	04.11.2008	53,4MB unbekannt
Chuzzle	Oberon Media	04.11.2008	10,3MB unbekannt
Civilization III		11.02.2009	690MB notwendig
Command & Conquer Teil 3: Operation Tiberian Sun		09.10.2009	130,8MB	notwendig
Diablo		19.03.2010	12,8MB notwendig
Diablo II		01.01.2009	1.964MB	notwendig
DivX Converter	DivX, Inc.	21.05.2010	45,3MB	7.1.0  notwendig
DivX Plus DirectShow Filters	DivX, Inc.	21.05.2010	1,58MB unbekannt
DivX-Setup	DivX, Inc. 	14.11.2010	2,18MB	2.1.2.2 notwendig (?)
Dungeon Keeper		29.10.2010 unnötig		
EAX(tm) Unified (SHELL)		28.02.2009	8,00KB unbekannt
eSobi v2	esobi Inc.	17.04.2008	17,0MB	2.0.3.000189 unbekannt
FINAL FANTASY VIII		28.02.2009	298MB unnötig	
Gemeinsam genutzte Internet-Komponenten von Westwood		09.10.2009	0,61MB unbekannt
Heroes of Might and Magic II		18.07.2010 notwendig		
Heroes of Might and Magic® III Complete		10.09.2010	361MB notwendig	
HP Customer Participation Program 11.0	HP	26.07.2009	228MB	11.0 unnötig
HP Imaging Device Functions 11.0	HP	26.07.2009	2,41MB	11.0 unnötig
HP Photosmart C4500 All-In-One Driver Software 11.0 Rel .4	HP	26.07.2009	24,8MB	11.0 unnötig
HP Photosmart Essential 3.0	HP	26.07.2009	2,40MB	3.0 unnötig
HP Smart Web Printing	HP	26.07.2009	8,51MB	4.0 unnötig
HP Update	Hewlett-Packard	26.07.2009	3,43MB	4.000.009.002 unnötig
ICQ7.2	ICQ	28.10.2010	44,6MB	7.2 notwendig
ImgBurn	LIGHTNING UK!	28.09.2009	2,13MB	2.5.0.0 unbekannt
Intel® Matrix Storage Manager	Intel Corporation	04.11.2008	48,1MB	unbekannt
Java(TM) 6 Update 17	Sun Microsystems, Inc.	30.11.2009	97,7MB	6.0.170 notwendig
Jewel Quest Solitaire	Oberon Media	04.11.2008	27,0MB	unbekannt
JMicron JMB38X Flash Media Controller	JMicron Technology Corp.	17.04.2008	2,26MB	1.00.10.04 unbekannt
Kick N Rush	Oberon Media	04.11.2008	43,3MB	unbekannt
Launch Manager		04.11.2008	2,66MB	unbekannt
Lexmark 2300 Series	Lexmark International, Inc.	28.05.2009	78,6MB	unnötig
LogMeIn Hamachi	LogMeIn, Inc.	15.01.2011	2,93MB	2.0.3.89 notwendig
Magic Set Editor 2 - 0.3.8 beta		10.10.2009	43,6MB	notwendig
Mahjong Escape Ancient China	Oberon Media	04.11.2008	13,6MB	unbekannt
Mahjongg Artifacts	Oberon Media	04.11.2008	15,9MB	unbekannt
Malwarebytes' Anti-Malware	Malwarebytes Corporation	15.01.2011	3,90MB	notwendig
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU	Microsoft Corporation	14.08.2009	37,1MB	
Microsoft .NET Framework 3.5 SP1	Microsoft Corporation	07.08.2009	37,1MB	
Microsoft .NET Framework 4 Client Profile	Microsoft Corporation	01.10.2010	120,3MB	4.0.30319
Microsoft .NET Framework 4 Client Profile DEU Language Pack	Microsoft Corporation	01.10.2010	24,5MB	4.0.30319
Microsoft Age of Empires II		09.01.2010	345MB	notwendig
Microsoft Office Home and Student 2007	Microsoft Corporation	02.01.2009	298MB	12.0.4518.1014 notwendig
Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs	Microsoft Corporation	09.11.2010	0,13MB	12.0.4518.1014
Microsoft Visual C++ 2005 Redistributable	Microsoft Corporation	17.04.2008	0,41MB	8.0.56336
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022	Microsoft Corporation	30.11.2009	1,41MB	9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17	Microsoft Corporation	27.10.2009	0,58MB	9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148	Microsoft Corporation	21.09.2010	0,58MB	9.0.30729.4148
Microsoft Works	Microsoft Corporation	17.04.2008	283MB	08.05.0822
mIRC	mIRC Co. Ltd.	07.01.2011	25,2MB	6.34 notwendig
Mozilla Firefox (3.6.13)	Mozilla	10.12.2010	30,1MB	3.6.13 (de) notwendig
MSXML 4.0 SP2 (KB954430)	Microsoft Corporation	01.01.2009	1,28MB	4.20.9870.0 unbekannt
MSXML 4.0 SP2 (KB973688)	Microsoft Corporation	26.11.2009	1,34MB	4.20.9876.0 unbekannt
MSXML 4.0 SP2 Parser and SDK	Microsoft Corporation	14.01.2010	36,00KB	4.20.9818.0 unbekannt
MyScript Notes Lite	Vision Objects	27.12.2009	296MB	2.2.0.0 unbekannt
Mystery Case Files - Huntsville	Oberon Media	04.11.2008	24,4MB	 unbekannt
Mystery Solitaire - Secret Island	Oberon Media	04.11.2008	19,9MB	unbekannt
NNScript	ESNation	01.01.2009	25,2MB	4.22 notwendig
NTI Backup Now 5	NewTech Infosystems	17.04.2008	28,6MB	5.1.2.503 unbekannt
NTI Media Maker 8	NewTech Infosystems	17.04.2008	181,5MB	8.0.2.6322 unbekannt
NVIDIA Drivers		21.09.2010 unbekannt		
OCR Software by I.R.I.S. 11.0	HP	26.07.2009	2,40MB	11.0 unbekannt
OpenOffice.org 3.1	OpenOffice.org	30.11.2009	371MB	3.1.9420 notwendig
Orion	Convesoft	17.04.2008	12,2MB	2.0.1 unbekannt
PC Connectivity Solution	Nokia	07.01.2010	9,25MB	8.15.0.0 unbekannt
PDFCreator	Frank Heindörfer, Philip Chinery	14.08.2010	25,5MB	1.0.1 notwendig
pdfsam		14.11.2010	14,2MB	2.2.0 notwendig
PhotoNow!	CyberLink Corp.	04.11.2008	1,65MB	1.1.4619 unbekannt
Pinnacle DistanTV Server	Pinnacle Systems	15.01.2010	13,2MB	1.0.0.095 notwendig
PowerDirector	CyberLink Corp.	17.04.2008	199,6MB	6.5.2713 unbekannt
QuickTime	Apple Inc.	18.05.2009	74,4MB	7.60.92.0 unbekannt
RealPlayer	RealNetworks	17.05.2009	45,3MB	notwendig
Realtek High Definition Audio Driver	Realtek Semiconductor Corp.	17.04.2008	21,5MB	6.0.1.5612 unbekannt
SAMSUNG Mobile Composite Device Software		07.01.2010		
Samsung Mobile Modem Device Software		07.01.2010		
SAMSUNG Mobile Modem Driver Set		07.01.2010		
Samsung Mobile phone USB driver Software		07.01.2010		
SAMSUNG Mobile USB Modem 1.0 Software		07.01.2010		
SAMSUNG Mobile USB Modem Software		07.01.2010		
Samsung New PC Studio	Samsung Electronics Co., Ltd.	07.01.2010	177,8MB	1.00.0000
Samsung New PC Studio USB Driver Installer	Samsung Electronics Co., Ltd.	07.01.2010	8,55MB	1.00.0000
SAMSUNG USB Mobile Device Software		07.01.2010		
SamsungConnectivityCableDriver	Samsung	07.01.2010	0,62MB	6.83.6.2.1
Shockwave		31.12.2009 unbekannt		
Shop for HP Supplies	HP	26.07.2009	228MB	11.0 unnötig
Sierra On-Line Games (Remove only) 		12.12.2009	40,7MB	unnötig
Skype web features	Skype Technologies S.A.	01.08.2009	4,33MB	1.0.3810 notwendig
Skype™ 4.2	Skype Technologies S.A.	26.03.2010	31,1MB	4.2.155 notwendig
Spellforce 2 Gold	JoWooD Productions Software AG	03.12.2010	5.096MB	1.00.0000 notwendig
SumatraPDF	Krzysztof Kowalczyk	09.12.2010	1,67MB	1.2 notwendig
SUPER © Version 2008.bld.33 (Sep 2, 2008)	eRightSoft	03.01.2009	30,6MB	Version 2008.bld.33 (Sep 2, 2008) notwendig
Synaptics Pointing Device Driver	Synaptics	17.04.2008	14,0MB	10.2.4.0 unbekannt
System Tool2011		15.01.2011 unnötig!!		
Titan Quest	Iron Lore	21.07.2009	2.849MB	1.00.0000 notwendig
Titan Quest Immortal Throne	Iron Lore	21.07.2009	1.616MB	1.00.0000 notwendig
Turbo Pizza	Oberon Media	04.11.2008	175,4MB	unbekannt
Veetle TV 0.9.18	Veetle, Inc	28.11.2010	10,1MB	0.9.18 unbekannt
Warcraft III		19.06.2009	1.228MB	notwendig
Warcraft III: All Products		20.06.2009	1.228MB	notwendig
Winamp	Nullsoft, Inc	11.08.2009	30,7MB	5.56 notwendig
Winbond CIR Device Drivers	Winbond Electronics Corporation	17.04.2008	2,25MB	7.60.1012 unbekannt
Windows Media Player Firefox Plugin	Microsoft Corp	29.06.2009	0,29MB	1.0.0.8 notwendig
Windows-Treiberpaket - Nokia pccsmcfd  (10/12/2007 6.85.4.0)	Nokia	07.01.2010		10/12/2007 6.85.4.0 unbekannt
WinRAR		13.06.2009	3,72MB	notwendig
Zuma Deluxe	Oberon Media	04.11.2008	11,2MB	unbekannt
Zylom Games Player Plugin	Zylom Games	06.06.2009	1,61MB	unbekannt

markusg · 16.01.2011, 19:16

damit kann ich leben
deinstaliere:
Acer Arcade Deluxe
Acer Crystal Eye Webcam
Acer GameZone Console
Acer GridVista
Acer Mobility Center
Acer ScreenSaver
Agatha Christie
Apple Software Update

Beyond
Big Kahuna
Bricks of Egypt
Cake Mania
Chicken Invaders
Chuzzle
Dungeon Keeper
FINAL FANTASY VIII
ImgBurn
Java(TM) 6 Update 17
updaten:
Java SE Downloads
klicke auf "download jre"
deinstalire:
Jewel Quest Solitaire
Kick N Rush
Lexmark
Mahjong Escape
Mahjongg Artifacts
Mystery Case Files
Mystery Solitaire -
Orion
PC Connectivity Solution
PhotoNow
PowerDirector
QuickTime
Skype™ öffnen, updaten!
System Tool2011
Turbo Pizza
Veetle TV
Zuma Deluxe
Zylom Games Player
bereinige dann mit dem CCleaner dateien + registry.

Fnyrri · 16.01.2011, 19:26

Okay, vielen Dank!

Ich werd mich morgen hinsetzen und den ganzen unnützen Kram deinstallieren, ich hab nämlich noch zwei Tage Urlaub. Ich meld mich dann wieder, wenn alles runter ist.

LG, Kevin

markusg · 16.01.2011, 19:27

ok bis dann :-)

16.01.2011, 15:32	#2
markusg /// Malware-holic	System Tool loswerden die gibt es, werden wir aber nicht nutzen, da diese option probleme verursachen kann. ich sehe mir otl logs an, moment. __________________ __________________

16.01.2011, 16:19	#9
markusg /// Malware-holic	System Tool loswerden kein problem... ist ja noch genug zu tun :d __________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet

16.01.2011, 19:27	#15
markusg /// Malware-holic	System Tool loswerden ok bis dann :-) __________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet

System Tool loswerden

Plagegeister aller Art und deren Bekämpfung: System Tool loswerden