Hallo und

Achja: Hatte ma Trojaner auf dem Rechner o.o
und die Meldung kommt schon ein Jahr lang

scheinbar ist es dir egal, ob andere Nutzer des Internets von deinem System aus eventuell zugespammt werden...

HiJackThis Log zum auswerten

Was denkst du warum einer der oben angepinnten Beiträge heißt
"Bitte keine HijackThis Logfiles posten"?

Überprüfe dein System mit Malwarebytes und erstelle anschließend ein Log mit OTL , poste alle Logs hierher, dann sehen wir weiter.

MFG

Zitat von nochdigger

scheinbar ist es dir egal, ob andere Nutzer des Internets von deinem System aus eventuell zugespammt werden...

Tut mir Leid nicht jeder kennt sich so blendend aus wie ihr und ich ging nicht von einem Virus aus und habe die Fehlermeldung aus gewohnheit immer weggeklickt.

Zitat von nochdigger

Was denkst du warum einer der oben angepinnten Beiträge heißt
"Bitte keine HijackThis Logfiles posten"?

Nochmal tut mir Leid, habe gesagt bekommen ich solle HijackThis benutzen und habe den angepinnten Beitrag wohl in meiner Eile übersehen.
Scan mit Malwarebytes läuft und ich werde die Logs dann versuchen übersichtlich hier einzufügen.

Edit.:
Soll ich nur die Logs von OTL posten?
Oder auch von Malwarebytes?

OTL logfile created on: 30.04.2011 17:32:38 - Run 1
OTL by OldTimer - Version 3.2.22.3     Folder = C:\Users\XXX\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 41,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 68,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 232,88 Gb Total Space | 57,05 Gb Free Space | 24,50% Space Free | Partition Type: NTFS
 
Computer Name: XXX | User Name: XXX | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\XXX\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files\Steam\Steam.exe (Valve Corporation)
PRC - C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
PRC - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files\Unlocker\UnlockerAssistant.exe ()
PRC - C:\Program Files\ICQ6Toolbar\ICQ Service.exe ()
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe ()
PRC - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe ()
PRC - C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
PRC - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe (Logitech, Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files\avmwlanstick\WLanGUI.exe (AVM Berlin)
PRC - C:\Program Files\avmwlanstick\WLanNetService.exe (AVM Berlin)
PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Program Files\DT\Speedport W 100 Stick\Wifiusb.exe (TECOM)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\XXX\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (TeamViewer6) -- C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (Hamachi2Svc) -- C:\Program Files\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (ICQ Service) -- C:\Program Files\ICQ6Toolbar\ICQ Service.exe ()
SRV - (npggsvc) -- C:\Windows\System32\GameMon.des (INCA Internet Co., Ltd.)
SRV - (nSvcIp) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe ()
SRV - (ForceWare Intelligent Application Manager (IAM)) ForceWare Intelligent Application Manager (IAM) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe ()
SRV - (LBTServ) -- C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (Stereo Service) -- C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (AVM WLAN Connection Service) -- C:\Program Files\avmwlanstick\WLanNetService.exe (AVM Berlin)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (atksgt) -- C:\Windows\System32\drivers\atksgt.sys ()
DRV - (lirsgt) -- C:\Windows\System32\drivers\lirsgt.sys ()
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (hamachi) -- C:\Windows\System32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (NVNET) -- C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation)
DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (nvsmu) -- C:\Windows\System32\drivers\nvsmu.sys (NVIDIA Corporation)
DRV - (LUsbFilt) -- C:\Windows\System32\drivers\LUsbFilt.sys (Logitech, Inc.)
DRV - (LMouKE) -- C:\Windows\System32\drivers\LMouKE.Sys (Logitech, Inc.)
DRV - (LMouFilt) -- C:\Windows\System32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LHidFilt) -- C:\Windows\System32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (L8042mou) -- C:\Windows\System32\drivers\L8042mou.Sys (Logitech, Inc.)
DRV - (L8042Kbd) -- C:\Windows\System32\drivers\L8042Kbd.sys (Logitech, Inc.)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avgio) -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (fwlanusbn) -- C:\Windows\System32\drivers\fwlanusbn.sys (AVM GmbH)
DRV - (avmeject) -- C:\Windows\System32\drivers\avmeject.sys (AVM Berlin)
DRV - (sfdrv01) StarForce Protection Environment Driver (version 1.x) -- C:\Windows\System32\drivers\sfdrv01.sys (Protection Technology (StarForce))
DRV - (sfhlp02) StarForce Protection Helper Driver (version 2.x) -- C:\Windows\System32\drivers\sfhlp02.sys (Protection Technology (StarForce))
DRV - (sfvfs02) StarForce Protection VFS Driver (version 2.x) -- C:\Windows\System32\drivers\sfvfs02.sys (Protection Technology)
DRV - (PRISM_A02) -- C:\Windows\System32\drivers\PRISMA02.sys (Conexant Systems, Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKLM\..\URLSearchHook: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyAs.dll (Conduit Ltd.)
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://qip.ru
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.qip.ru
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.qip.ru
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2475029
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.qip.ru/ie
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\..\URLSearchHook: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyAs.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "QIP Search"
FF - prefs.js..browser.search.defaultthis.engineName: "MyAshampoo Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2475029&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "MyAshampoo Customized Web Search"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {59c81df5-4b7a-477b-912d-4e0fdf64e5f2}:0.9.86.1
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.2
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {7BDB48D1-CD94-4B99-A5A4-E418B9EE6532}:1.1.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {32a1fd71-835e-4b11-8e54-886fda0b4c89}:1.1
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2
FF - prefs.js..extensions.enabledItems: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6
FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2475029&q="
FF - prefs.js..network.proxy.backup.ftp: ""
FF - prefs.js..network.proxy.backup.ftp_port: 0
FF - prefs.js..network.proxy.backup.gopher: ""
FF - prefs.js..network.proxy.backup.gopher_port: 0
FF - prefs.js..network.proxy.backup.socks: ""
FF - prefs.js..network.proxy.backup.socks_port: 0
FF - prefs.js..network.proxy.backup.ssl: ""
FF - prefs.js..network.proxy.backup.ssl_port: 0
FF - prefs.js..network.proxy.ftp: "128.220.231.4"
FF - prefs.js..network.proxy.ftp_port: 3124
FF - prefs.js..network.proxy.gopher: "128.220.231.4"
FF - prefs.js..network.proxy.gopher_port: 3124
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "128.220.231.4"
FF - prefs.js..network.proxy.socks_port: 3124
FF - prefs.js..network.proxy.ssl: "128.220.231.4"
FF - prefs.js..network.proxy.ssl_port: 3124
 
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.04.30 10:45:01 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.04.30 10:44:57 | 000,000,000 | ---D | M]
 
[2009.01.07 01:06:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\Extensions
[2011.04.29 11:44:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions
[2011.02.01 00:44:57 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.09.18 10:16:59 | 000,000,000 | ---D | M] (QipAuthorizer) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{32a1fd71-835e-4b11-8e54-886fda0b4c89}
[2011.04.29 09:54:13 | 000,000,000 | ---D | M] (ChatZilla [de]) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{59c81df5-4b7a-477b-912d-4e0fdf64e5f2}
[2011.02.01 00:44:50 | 000,000,000 | ---D | M] (Destroy the Web) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{7BDB48D1-CD94-4B99-A5A4-E418B9EE6532}
[2011.04.29 09:54:19 | 000,000,000 | ---D | M] (MyAshampoo Community Toolbar) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}
[2010.05.31 16:58:33 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.04.29 09:54:16 | 000,000,000 | ---D | M] (myBabylon EnglishBB Community Toolbar) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}
[2011.04.22 17:50:11 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2011.04.29 09:54:14 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2011.04.29 09:54:18 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\engine@conduit.com
[2010.12.15 17:12:32 | 000,000,923 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\n3jvvnj1.default\searchplugins\conduit.xml
[2011.04.24 22:15:50 | 000,001,056 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\n3jvvnj1.default\searchplugins\icqplugin.xml
[2010.10.14 12:52:01 | 000,002,062 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\n3jvvnj1.default\searchplugins\qip-search.xml
[2011.04.30 10:45:01 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010.07.16 11:56:32 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.08.21 11:14:49 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
File not found (No name found) -- 
[2011.04.14 18:40:03 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2010.07.17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.08.02 14:40:19 | 000,002,226 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (MyAshampoo Toolbar) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyAs.dll (Conduit Ltd.)
O2 - BHO: (QIPBHO Class) - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (MyAshampoo Toolbar) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyAs.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (MyAshampoo Toolbar) - {A1E75A0E-4397-4BA8-BB50-E19FB66890F4} - C:\Program Files\MyAshampoo\tbMyAs.dll (Conduit Ltd.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [AVMWlanClient] C:\Program Files\avmwlanstick\WLanGUI.exe (AVM Berlin)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [auditask]  File not found
O4 - HKCU..\Run: [Steam] C:\Program Files\Steam\steam.exe (Valve Corporation)
O4 - Startup: C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O8 - Extra context menu item: Free YouTube Download - C:\Users\XXX\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\XXX\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab (Oberon Flash Game Host)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\XXX\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\XXX\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{2093246f-dc05-11dd-8eff-001e90f7e9a3}\Shell - "" = AutoRun
O33 - MountPoints2\{2093246f-dc05-11dd-8eff-001e90f7e9a3}\Shell\AutoRun\command - "" = E:\pushinst.exe
O33 - MountPoints2\{27a4deb1-eca6-11de-9468-001c4afc5051}\Shell\AutoRun\command - "" = I:\installer.exe
O33 - MountPoints2\{27a4deb1-eca6-11de-9468-001c4afc5051}\Shell\verb\command - "" = I:\installer.exe
O33 - MountPoints2\{3606af13-828e-11de-bdcc-001c4afc5051}\Shell - "" = AutoRun
O33 - MountPoints2\{3606af13-828e-11de-bdcc-001c4afc5051}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
O33 - MountPoints2\{823e65cf-ca16-11de-9806-00191548cc45}\Shell\AutoRun\command - "" = I:\installer.exe
O33 - MountPoints2\{823e65cf-ca16-11de-9806-00191548cc45}\Shell\verb\command - "" = I:\installer.exe
O33 - MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\Shell - "" = AutoRun
O33 - MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\Shell\AutoRun\command - "" = L:\autorun.exe
O33 - MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\Shell\directx\command - "" = L:\DirectX9\dxsetup.exe
O33 - MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\Shell\setup\command - "" = L:\setup.exe
O33 - MountPoints2\{af9c9acf-4235-11df-ab32-001e90f7e9a3}\Shell - "" = AutoRun
O33 - MountPoints2\{af9c9acf-4235-11df-ab32-001e90f7e9a3}\Shell\AutoRun\command - "" = K:\pushinst.exe
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\pushinst.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.04.30 17:00:33 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\Malwarebytes
[2011.04.30 17:00:22 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011.04.30 17:00:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programme\Malwarebytes' Anti-Malware
[2011.04.30 17:00:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.04.30 17:00:18 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.04.30 17:00:17 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011.04.30 14:14:46 | 000,000,000 | ---D | C] -- C:\Program Files\Deep Silver
[2011.04.30 14:13:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programme\Deep Silver
[2011.04.30 13:18:02 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{ADC7B78E-C2D0-4BC1-8454-C1571DBFA712}
[2011.04.30 11:49:01 | 000,000,000 | ---D | C] -- C:\Users\XXX\Documents\bitComposer Games
[2011.04.30 11:48:51 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\ProtectDISC
[2011.04.30 11:45:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programme\bitComposer Games
[2011.04.30 11:39:47 | 000,000,000 | ---D | C] -- C:\Program Files\bitComposer Games
[2011.04.29 23:31:44 | 000,000,000 | --SD | C] -- C:\Users\XXX\Desktop\Feelings
[2011.04.29 22:30:30 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{5BE83DA6-9AF3-415D-81CE-182E14DE44AA}
[2011.04.27 12:42:11 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{C0EF2A53-44CD-4000-9251-86DEC5DC10FE}
[2011.04.27 11:23:59 | 004,240,384 | ---- | C] (Microsoft) -- C:\Windows\System32\GameUXLegacyGDFs.dll
[2011.04.27 11:23:59 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Apphlpdm.dll
[2011.04.27 11:23:36 | 000,876,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll
[2011.04.26 10:42:23 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{05C5AE65-6FDC-4543-83BA-E69A8A629E5F}
[2011.04.25 14:02:24 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{482AC479-AEAB-4231-82FB-D4948B7A1653}
[2011.04.24 18:59:35 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{2B075415-F68A-444D-8F24-2FA5FF01BBFD}
[2011.04.24 15:05:59 | 000,000,000 | ---D | C] -- C:\Users\XXX\Desktop\100DEADRABBITS_the american wet dream_xalaniconx@DIS
[2011.04.24 14:51:31 | 000,000,000 | ---D | C] -- C:\Users\XXX\Desktop\100DeadRabbits - Teeth
[2011.04.24 14:18:25 | 000,000,000 | ---D | C] -- C:\Users\XXX\Desktop\Guardians
[2011.04.23 23:28:44 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{5AC403B2-7548-4F0C-8171-7D7E52048DB4}
[2011.04.23 11:28:08 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{8DDAC91D-E5DA-4293-A810-7187B1E60BA1}
[2011.04.22 23:27:37 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{9085AAC8-98AB-453A-AEF1-AE6DEF16C948}
[2011.04.22 11:26:03 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{D88CF7C9-F665-437C-ABE9-2DA5C71E18E9}
[2011.04.21 19:38:35 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{35D3369E-B044-4644-8D38-9EA34716CD37}
[2011.04.20 22:33:00 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{6E1E6C04-96E8-4ACC-A6E3-FB23F9F86367}
[2011.04.20 10:32:16 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{BC16BF92-09F2-4566-9F81-E45DE69DF619}
[2011.04.19 16:26:55 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{3FF9804E-B80D-4DFD-91C6-56CB09E907EE}
[2011.04.18 16:18:30 | 004,223,008 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\NVStWiz.exe
[2011.04.18 16:15:25 | 000,705,536 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\cohelper.dll
[2011.04.18 13:09:21 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{C88ADE74-5F43-47A1-BE6F-A9599E07B0B2}
[2011.04.17 08:54:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Electronic Arts
[2011.04.17 08:54:22 | 000,000,000 | ---D | C] -- C:\ProgramData\EA Core
[2011.04.17 08:54:21 | 000,000,000 | ---D | C] -- C:\Users\XXX\Documents\Electronic Arts
[2011.04.17 08:41:59 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft WSE
[2011.04.13 18:42:45 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{F830BCC6-F6FE-4A04-BC6F-AB57CCCC0B60}
[2011.04.13 17:02:16 | 000,512,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll
[2011.04.13 17:02:16 | 000,430,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll
[2011.04.13 17:02:08 | 000,671,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2011.04.13 17:02:08 | 000,389,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2011.04.13 17:02:07 | 000,471,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2011.04.13 17:02:07 | 000,380,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2011.04.13 17:02:07 | 000,193,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2011.04.13 17:02:07 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieencode.dll
[2011.04.13 17:02:02 | 002,041,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2011.04.13 17:00:59 | 000,292,864 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2011.04.13 17:00:58 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2011.04.13 17:00:41 | 001,162,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc42u.dll
[2011.04.13 17:00:41 | 001,136,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc42.dll
[2011.04.13 17:00:32 | 000,025,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dnscacheugc.exe
[2011.04.11 19:02:35 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{8BBF2F40-8056-457B-BB84-D590D20D6117}
[2011.04.11 15:00:31 | 000,000,000 | ---D | C] -- C:\Program Files\TeamViewer
[2011.04.10 14:27:59 | 000,000,000 | ---D | C] -- C:\Program Files\Firefly Studios
[2011.04.09 15:55:04 | 000,000,000 | ---D | C] -- C:\Users\XXX\Desktop\Projekt 'Gone Forever'
[2011.04.06 19:58:41 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{116E227F-EEB5-4BB3-B04B-A003F6C6F66C}
[2011.04.05 19:01:05 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{508B8996-0C4E-4F5E-9B7E-56AA9ACCC308}
[2011.04.04 20:33:25 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{219C707D-BEE3-41A1-BBAA-321FDD8F0C02}
[2011.04.03 18:52:00 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{B053FA9C-42BC-45BE-85E2-4D8544D0FC4C}
[2011.04.02 21:54:09 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{B46EE753-F79E-435F-AB28-1878D5345107}
[2011.03.31 18:02:21 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{5B2588FF-3BC2-413B-B3FE-9C281814D2B7}
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.04.30 17:30:22 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.04.30 17:30:20 | 000,032,879 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2011.04.30 17:30:19 | 000,032,879 | ---- | M] () -- C:\ProgramData\nvModes.001
[2011.04.30 17:27:29 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.04.30 17:25:11 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.04.30 17:25:10 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.04.30 17:24:52 | 1878,163,456 | -HS- | M] () -- C:\hiberfil.sys
[2011.04.30 17:00:22 | 000,000,866 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.04.30 11:52:30 | 000,004,096 | ---- | M] () -- C:\Users\Public\Documents\00001BF6.LCS
[2011.04.30 11:45:36 | 000,001,043 | ---- | M] () -- C:\Users\XXX\Desktop\Starte Wildlife Park 3 Demo.lnk
[2011.04.30 10:41:10 | 000,670,708 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.04.30 10:41:10 | 000,631,438 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.04.30 10:41:10 | 000,143,876 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.04.30 10:41:10 | 000,118,064 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.04.27 16:46:21 | 000,511,290 | ---- | M] () -- C:\Users\XXX\Documents\WoWScrnShot_042711_164511.jpg
[2011.04.25 15:43:36 | 000,244,711 | ---- | M] () -- C:\Users\XXX\Documents\WoWScrnShot_042511_154240.jpg
[2011.04.24 23:35:13 | 000,235,916 | ---- | M] () -- C:\Users\XXX\Documents\WoWScrnShot_042411_233235.jpg
[2011.04.22 12:19:05 | 000,001,356 | ---- | M] () -- C:\Users\XXX\AppData\Local\d3d9caps.dat
[2011.04.17 08:41:00 | 000,002,019 | ---- | M] () -- C:\Users\Public\Desktop\Die*Sims™*Mittelalter.lnk
[2011.04.13 17:29:54 | 000,254,160 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.04.11 18:33:44 | 034,741,575 | ---- | M] () -- C:\Users\XXX\Documents\coole gang - bitte abspielen.mp4
[2011.04.11 15:00:39 | 000,000,915 | ---- | M] () -- C:\Users\Public\Desktop\TeamViewer 6.lnk
[2011.04.09 15:36:49 | 000,208,896 | ---- | M] () -- C:\Users\XXX\Desktop\skype remix.MSWMM
[2011.04.02 19:57:51 | 261,414,153 | ---- | M] () -- C:\Windows\MEMORY.DMP
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.04.30 17:00:22 | 000,000,866 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.04.30 11:48:58 | 000,004,096 | ---- | C] () -- C:\Users\Public\Documents\00001BF6.LCS
[2011.04.30 11:45:36 | 000,001,043 | ---- | C] () -- C:\Users\XXX\Desktop\Starte Wildlife Park 3 Demo.lnk
[2011.04.30 10:45:08 | 000,000,818 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011.04.27 16:45:56 | 000,511,290 | ---- | C] () -- C:\Users\XXX\Documents\WoWScrnShot_042711_164511.jpg
[2011.04.25 15:43:09 | 000,244,711 | ---- | C] () -- C:\Users\XXX\Documents\WoWScrnShot_042511_154240.jpg
[2011.04.24 23:34:53 | 000,235,916 | ---- | C] () -- C:\Users\XXX\Documents\WoWScrnShot_042411_233235.jpg
[2011.04.18 16:15:25 | 000,006,136 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2011.04.17 08:41:00 | 000,002,019 | ---- | C] () -- C:\Users\Public\Desktop\Die*Sims™*Mittelalter.lnk
[2011.04.11 18:16:56 | 034,741,575 | ---- | C] () -- C:\Users\XXX\Documents\coole gang - bitte abspielen.mp4
[2011.04.11 15:00:39 | 000,000,927 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 6.lnk
[2011.04.11 15:00:39 | 000,000,915 | ---- | C] () -- C:\Users\Public\Desktop\TeamViewer 6.lnk
[2011.04.09 15:36:49 | 000,208,896 | ---- | C] () -- C:\Users\XXX\Desktop\skype remix.MSWMM
[2010.12.31 22:37:03 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2010.11.14 14:13:57 | 000,000,034 | ---- | C] () -- C:\Windows\cdplayer.ini
[2010.10.23 16:14:44 | 000,000,222 | ---- | C] () -- C:\Users\XXX\AppData\Local\Temp1812435.dat
[2010.10.14 02:36:44 | 000,179,263 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2010.07.21 14:12:13 | 000,032,879 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2010.07.21 14:12:13 | 000,032,879 | ---- | C] () -- C:\ProgramData\nvModes.001
[2010.07.01 16:07:53 | 000,000,009 | ---- | C] () -- C:\Windows\ULEAD32.INI
[2010.04.07 23:09:58 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2010.04.07 23:09:57 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2010.04.07 14:19:36 | 000,015,573 | ---- | C] () -- C:\Windows\System32\drivers\fwlanusbn.bin
[2010.02.11 07:30:38 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2010.01.12 15:29:44 | 000,000,410 | ---- | C] () -- C:\Windows\{27018D57-D152-44EF-BCE0-5E3B3445EABE}_WiseFW.ini
[2009.12.28 15:13:00 | 000,000,161 | ---- | C] () -- C:\Users\XXX\AppData\Roaming\default.rss
[2009.12.28 15:13:00 | 000,000,000 | ---- | C] () -- C:\Users\XXX\AppData\Roaming\downloads.m3u
[2009.11.19 15:26:56 | 000,000,041 | -HS- | C] () -- C:\ProgramData\.zreglib
[2009.08.04 19:36:49 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.08.04 19:36:49 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009.06.16 22:24:04 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2009.04.24 00:29:16 | 000,189,051 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2009.02.20 19:18:46 | 000,097,792 | ---- | C] () -- C:\Users\XXX\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.01.01 22:55:13 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2008.12.28 12:01:04 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008.12.27 12:13:43 | 000,000,713 | ---- | C] () -- C:\Windows\disney.ini
[2008.12.13 21:00:45 | 000,022,328 | ---- | C] () -- C:\Users\XXX\AppData\Roaming\PnkBstrK.sys
[2008.12.13 21:00:30 | 000,107,832 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe
[2008.12.12 16:52:21 | 000,045,568 | ---- | C] () -- C:\Windows\UniFish3.exe
[2008.12.12 16:22:15 | 000,001,356 | ---- | C] () -- C:\Users\XXX\AppData\Local\d3d9caps.dat
[2008.10.07 09:13:30 | 000,197,912 | ---- | C] () -- C:\Windows\System32\physxcudart_20.dll
[2008.10.07 09:13:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll
[2008.01.21 09:15:58 | 000,670,708 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2008.01.21 09:15:58 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2008.01.21 09:15:58 | 000,143,876 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2008.01.21 09:15:58 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:47:37 | 000,254,160 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:33:01 | 000,631,438 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,118,064 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2002.09.18 00:45:00 | 000,119,808 | ---- | C] () -- C:\Windows\lsb_un20.exe
[1996.04.03 21:33:26 | 000,005,248 | ---- | C] () -- C:\Windows\System32\giveio.sys
 
========== LOP Check ==========
 
[2011.01.27 20:17:05 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\.minecraft
[2010.08.02 14:48:01 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\AnvSoft
[2011.03.20 12:29:19 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Ashampoo
[2011.03.20 12:01:24 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Canneverbe Limited
[2009.07.14 12:49:29 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Command & Conquer 3 Kanes Rache
[2009.07.09 16:13:37 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Command & Conquer 3 Tiberium Wars
[2010.12.02 15:48:26 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\de.3m5.wendel.flcd.FLCDB.4E7DF207D694E815646D9C9DD7DC91A41EB7FD23.1
[2011.02.18 19:19:23 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.03.26 12:34:03 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\gtk-2.0
[2011.04.26 11:09:51 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\ICQ
[2010.12.24 22:42:16 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Leadertech
[2010.07.03 22:41:33 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\LolClient
[2009.10.29 15:18:16 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\MP3Rocket
[2010.11.14 14:16:44 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\NCH Swift Sound
[2010.09.16 14:28:51 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Notepad++
[2009.02.24 21:46:15 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\OpenOffice.org
[2010.06.13 20:39:54 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\phonostar GmbH
[2009.08.22 14:08:42 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Propellerhead Software
[2011.04.30 11:48:51 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\ProtectDISC
[2010.07.13 22:14:07 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Publish Providers
[2010.09.18 10:17:42 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\QIP
[2010.07.13 22:14:50 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Sony
[2010.05.13 13:53:37 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\SPORE Creature Creator
[2011.04.11 15:01:00 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\TeamViewer
[2009.12.26 00:58:01 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Teeworlds
[2010.05.31 17:33:10 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\TS3Client
[2011.04.30 17:23:51 | 000,032,634 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 64 bytes -> C:\Users\XXX\I've been looking for Grindcore.avi:TOC.WMV
@Alternate Data Stream - 24 bytes -> C:\Windows:8917AFFB20020C2F

< End of report >
         

OTL Extras logfile created on: 30.04.2011 17:32:38 - Run 1
OTL by OldTimer - Version 3.2.22.3     Folder = C:\Users\XXX\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 41,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 68,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 232,88 Gb Total Space | 57,05 Gb Free Space | 24,50% Space Free | Partition Type: NTFS
 
Computer Name: XXX | User Name: XXX | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0306F3E2-9C81-406F-A37F-7A3BBBBEA536}" = lport=8395 | protocol=6 | dir=in | name=league of legends launcher | 
"{174C0CE7-0769-447A-A02B-1D386E4EF259}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{1A59280C-1696-4CEB-BC34-A5C5D8F22363}" = rport=445 | protocol=6 | dir=out | app=system | 
"{20FADCBB-9755-4E52-93F5-BCE7B4059346}" = lport=138 | protocol=17 | dir=in | app=system | 
"{2A538D11-AAE4-473F-80EA-FD9B8A469BFD}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{2D14A448-6CE3-437B-87DC-7D855E123E3B}" = lport=8395 | protocol=17 | dir=in | name=league of legends launcher | 
"{3D7BEC21-3A78-4A54-B297-CE5B8FFB66CA}" = rport=137 | protocol=17 | dir=out | app=system | 
"{5129C9C2-C1CA-4ECA-84F1-D188C5ED5D88}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{5BCC88C8-E477-4AAE-BF86-478B56A31C74}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{61C6220F-2710-45AB-843D-9C8B086365F2}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{63680296-963E-4DDB-B29F-730F80968A89}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{6C6B9830-B4AA-4A0D-B20F-9130F1EF05F0}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{6C85F2CA-C9E1-43BD-AE68-AD499E2F2492}" = lport=8396 | protocol=6 | dir=in | name=league of legends launcher | 
"{7508B32D-AFA7-4670-BA46-3ECF0C7739CE}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{76396E19-DA5D-4F85-9095-A64C740EBA23}" = lport=139 | protocol=6 | dir=in | app=system | 
"{95732DBD-26A8-466D-8DD0-CA8CC9897CF0}" = lport=445 | protocol=6 | dir=in | app=system | 
"{A7EEA845-722D-4997-93FA-84FE37C3F725}" = lport=8396 | protocol=17 | dir=in | name=league of legends launcher | 
"{BCD479E1-438D-4CAC-B7C0-0C918610E009}" = lport=8394 | protocol=17 | dir=in | name=league of legends launcher | 
"{C013AB1A-19B9-4B21-BF71-E6D2A9E5C514}" = rport=139 | protocol=6 | dir=out | app=system | 
"{C30A0653-8CEC-4D48-BD61-10E7E50B93A3}" = lport=8394 | protocol=6 | dir=in | name=league of legends launcher | 
"{C4DA8887-3DC1-433E-BF28-4BA6A5CA04F8}" = lport=137 | protocol=17 | dir=in | app=system | 
"{CDD1BD0B-323F-484F-B20E-23E3070FDAE7}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{DDA27137-DEFD-4147-B86C-9A05A3E4D119}" = rport=138 | protocol=17 | dir=out | app=system | 
"{E12D4EC0-06C8-4AE6-A19D-24012871C2C8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{F1B93033-C511-449D-9347-4A55334EFE82}" = lport=3724 | protocol=6 | dir=in | name=blizzard downloader: 3724 | 
"{F2A662CE-F5D6-41D0-8A8A-BB4C1D13AF2D}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework\v4.0.30319\smsvchost.exe | 
"{F37D1D76-0C45-41FF-9351-0A9423C17C28}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{FFF66874-9EC2-467B-A684-B93AD924D95D}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{026ED4C1-ACA5-4880-AFD6-EC42668F1FD5}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\txnudel18\day of defeat source\hl2.exe | 
"{02D46EE0-531C-44F2-AA52-7E74DB80CE9A}" = protocol=17 | dir=in | app=c:\users\XXX\downloads\videoconverter_setup.exe | 
"{033E345A-D14A-4845-BF33-677C5C05A34D}" = protocol=17 | dir=in | app=c:\program files\xblades\xblades.exe | 
"{0DE67D9C-B036-4D2E-AF52-EAA4EFFF24DA}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\trackmania nations forever\tmforeverlauncher.exe | 
"{1192FAD7-4433-4B3C-AB71-049DF46C9682}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\txnudel18\counter-strike source\hl2.exe | 
"{11B34716-2180-44EB-878A-B554D58EAC8A}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{15636E99-7007-4C20-8D38-DFE3F0C70BA0}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe | 
"{1936A750-313A-4716-B4CC-F3CAB39E73FD}" = protocol=6 | dir=in | app=c:\program files\world of warcraft official\launcher.exe | 
"{1C050A66-4A43-4F98-BAB2-1A996251322F}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{1CEB9585-239D-4B60-A17B-046A171E67D2}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\trackmania nations forever\tmforever.exe | 
"{1FB2D413-CF84-4E5C-975B-85D702FBAEFF}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{22DFB616-4127-4B5B-B089-033B0E3F4AEB}" = protocol=6 | dir=in | app=c:\program files\xblades\xblades.exe | 
"{2723388B-69A8-4D53-B9E9-468651868567}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version6\teamviewer.exe | 
"{28D41F80-ABA0-478F-B2FB-B9A3F4E84A65}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.0.9.9551-to-3.1.0.9767-dede-downloader.exe | 
"{2F6F3C9A-1DDC-4103-8033-BE35FE37757D}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\txnudel18\day of defeat source\hl2.exe | 
"{35FFA151-248C-4688-AA55-16EE1D26EE84}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\txnudel18\counter-strike source\hl2.exe | 
"{36E65C6F-E605-4639-B4D0-D34095C99C6E}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\trackmania nations forever\tmforever.exe | 
"{3AE11712-6623-4DA1-9D1C-A5D14F547812}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{3C1E1DED-8A85-4B04-82F8-9B0B62D3159C}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\trackmania nations forever\tmforeverlauncher.exe | 
"{45123B98-5E9E-4CD5-9AA5-AA6098381015}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version6\teamviewer_service.exe | 
"{4681CEF1-EDF5-430B-BE16-1D333A5B077F}" = protocol=6 | dir=in | app=c:\program files\league of legends\air\lolclient.exe | 
"{4A8311B6-84E1-4631-8C69-27885997BD84}" = protocol=17 | dir=in | app=c:\program files\electronic arts\battleforge\battleforge.exe | 
"{4E8D8DC3-F2EC-4DFA-93A0-30085E0B28A3}" = protocol=17 | dir=in | app=c:\programdata\nexoneu\ngm\ngm.exe | 
"{4EAE00CC-CC21-4AC9-A6EE-C22BF18577CC}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{5A0A1DA6-3147-48F6-B736-D41A10A02F40}" = protocol=17 | dir=in | app=c:\program files\thq\gas powered games\gpgnet\gpg.multiplayer.client.exe | 
"{5A9AC4DA-365F-4AF4-9E58-0584FDF319A5}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{5B9D6F4A-460D-4892-8EF0-EAB9ACD70147}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe | 
"{5CF91297-9EB2-4D06-A270-C59546292762}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{5F7980C2-65B0-419D-A5D3-20828EE35C5D}" = protocol=17 | dir=in | app=c:\program files\electronic arts\battleforge\bootstrapper.exe | 
"{60A16EB2-3B4B-45DD-A02B-F810E0725B4B}" = dir=in | app=c:\program files\electronic arts\command & conquer 3 kanes rache\retailexe\1.0\cnc3ep1.dat | 
"{633D1A6E-9C2C-42EB-B4C5-0B96E4008B61}" = protocol=6 | dir=in | app=c:\program files\world of warcraft official\launcher.patch.exe | 
"{63929DF8-31FD-4AB7-9A5A-905483011616}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\txnudel18\day of defeat source\hl2.exe | 
"{68D59BB1-380A-4F9D-AE88-40E357BC9251}" = protocol=17 | dir=in | app=c:\program files\league of legends\game\league of legends.exe | 
"{6BF52568-5F84-4D97-B213-2B9FDD329D29}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{72FEB34F-2937-4CC8-88AF-F5F36ED87A8E}" = protocol=6 | dir=in | app=c:\programdata\nexonus\ngm\ngm.exe | 
"{7812A4ED-2E36-4800-B35F-06825B62E3E7}" = protocol=6 | dir=in | app=c:\users\XXX\downloads\videoconverter_setup.exe | 
"{7882FE34-498D-4923-BF0D-B3272D19A094}" = protocol=6 | dir=in | app=c:\program files\xblades\launcher.exe | 
"{7C37BCC0-285D-41A8-AE44-3B6D8A48335C}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{80493DB6-F4F9-47FC-ADA4-EF20461E5F14}" = protocol=17 | dir=in | app=c:\programdata\nexonus\ngm\ngm.exe | 
"{893F9885-C70D-4586-BA44-C1D43EDBCD17}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe | 
"{8CAD818C-11DB-4DCB-9594-B88D2A658BF4}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{8F8311A3-88A5-4DEC-A18C-49398312FFF0}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{8FF1D142-1DC0-4D1F-A611-3E91ABE3710D}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.0.9.9551-to-3.1.0.9767-dede-downloader.exe | 
"{90ABE924-5B74-4EC3-8A11-59A9D817C3A3}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{941E72A7-B732-48BD-86A0-74636C36AB45}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 
"{96711F9A-9BA2-417D-8C57-939467A63F92}" = protocol=17 | dir=in | app=c:\program files\world of warcraft official\launcher.patch.exe | 
"{9804EE36-60D7-40B7-BE00-C435875ED7BA}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{A7AEEDB8-CC5F-4F38-A7AE-D0F585B2A59B}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe | 
"{A9794E76-5C67-485F-9343-37B2DF3FEE56}" = protocol=6 | dir=in | app=c:\programdata\nexoneu\ngm\ngm.exe | 
"{B02FBC98-9680-4B46-9C11-B650946A4E85}" = protocol=6 | dir=in | app=c:\program files\thq\gas powered games\gpgnet\gpg.multiplayer.client.exe | 
"{B28F880B-5827-46EA-BDB1-ECE1B1F3B141}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{B70582CF-8C63-47E8-9743-29EA07D3CD71}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{B7374434-FD22-4F78-9AF9-EB2A4F65193E}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{B9314FE6-35C8-41E3-81E5-ACFE5ECA4C7B}" = protocol=6 | dir=in | app=c:\program files\electronic arts\battleforge\battleforge.exe | 
"{BAE5740B-D651-4C1B-9FC3-E20EAC38EFFA}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version6\teamviewer_service.exe | 
"{BBE3DA33-6339-43B8-8EB3-7E9492CA9376}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{C9D08A51-3A75-4C0E-A951-D13F370F2394}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe | 
"{CA19EF67-8578-4C94-A396-1ED3354062B2}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{CDED4011-291E-4ED0-AA1E-1DEBAF564622}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{D4EE839E-628B-4408-A92C-7AEC3AA91A84}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{DA10C03B-E910-41D4-9CD1-B20E34D775CA}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{DD1C9532-CC97-4536-9D43-48D63F975EE2}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 
"{DE2A38A0-5B97-488C-B221-B38EC1BA4E19}" = protocol=17 | dir=in | app=c:\program files\league of legends\air\lolclient.exe | 
"{E11952CB-32EE-4869-8472-3599A0CAC40C}" = protocol=17 | dir=in | app=c:\program files\world of warcraft official\launcher.exe | 
"{E88F6BAF-A7DC-44DB-9BB0-691FE107EABF}" = protocol=6 | dir=in | app=c:\program files\electronic arts\battleforge\bootstrapper.exe | 
"{EA5476CB-0F15-4B59-BC12-C15F1C9A9208}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{F0E1C797-3798-4FD4-83BA-ECB93C4BEE02}" = protocol=6 | dir=in | app=c:\program files\league of legends\game\league of legends.exe | 
"{F6793210-5083-44B9-BC24-6705378089C7}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\txnudel18\day of defeat source\hl2.exe | 
"{FA23EE17-2D14-4BD0-B19A-330AC70961AB}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{FB321834-4439-42FF-B2E3-DE99071311BB}" = protocol=17 | dir=in | app=c:\program files\xblades\launcher.exe | 
"{FB543ABA-CFD2-468D-AB57-974A53DF8829}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version6\teamviewer.exe | 
"{FBA6D5D6-5F41-4D4D-9740-C43633D46FAE}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"TCP Query User{0A7F7F1A-AFFE-4DEB-BDEC-3A683E52CCDE}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe | 
"TCP Query User{1E3EF580-4046-4AFC-8A9D-B34E8CBF5953}C:\program files\world of warcraft official\launcher.exe" = protocol=6 | dir=in | app=c:\program files\world of warcraft official\launcher.exe | 
"TCP Query User{2B1A9D42-B406-4B9F-B031-92878944A632}C:\program files\wow!!\launcher.exe" = protocol=6 | dir=in | app=c:\program files\wow!!\launcher.exe | 
"TCP Query User{30B20F6E-AA97-43B7-A4D3-56FA43827575}C:\users\XXX\appdata\local\temp\rar$ex05.148\wow-dede-installer-downloader.exe" = protocol=6 | dir=in | app=c:\users\XXX\appdata\local\temp\rar$ex05.148\wow-dede-installer-downloader.exe | 
"TCP Query User{33FBE456-D9D0-4734-93D7-2AAEAFC0AFE1}C:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe" = protocol=6 | dir=in | app=c:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe | 
"TCP Query User{3517994D-5807-4968-B300-F93BF9761B4E}C:\program files\littlefighter2\lf2_v2.0\lf2.exe" = protocol=6 | dir=in | app=c:\program files\littlefighter2\lf2_v2.0\lf2.exe | 
"TCP Query User{4267079E-CD7F-486B-9483-5702051FF240}C:\users\public\games\world of warcraft trial\launcher.exe" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft trial\launcher.exe | 
"TCP Query User{48C67306-C8BD-4257-AA48-6842897D0ACE}C:\program files\world of warcraft\wow-3.3.3.11723-to-3.3.5.12213-dede-downloader.exe" = protocol=6 | dir=in | app=c:\program files\world of warcraft\wow-3.3.3.11723-to-3.3.5.12213-dede-downloader.exe | 
"TCP Query User{509C3A5A-CCF8-4BDF-8454-3D1B908BBD93}C:\program files\gamers.irc\mirc.exe" = protocol=6 | dir=in | app=c:\program files\gamers.irc\mirc.exe | 
"TCP Query User{5B574814-344A-44BD-BE64-A72CEC694F48}C:\program files\duty calls\binaries\win32\dutycalls.exe" = protocol=6 | dir=in | app=c:\program files\duty calls\binaries\win32\dutycalls.exe | 
"TCP Query User{5CD6A04B-0325-4227-ADC0-271992D9E17E}C:\program files\steam\steamapps\txnudel18\half-life 2 deathmatch\hl2.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\txnudel18\half-life 2 deathmatch\hl2.exe | 
"TCP Query User{5ED840D9-C2AA-4576-B9A6-662499621B9C}C:\program files\serious sam 2\bin\sam2.exe" = protocol=6 | dir=in | app=c:\program files\serious sam 2\bin\sam2.exe | 
"TCP Query User{72129B08-58E0-49AA-96C5-5A53408B38F2}C:\program files\java\jre1.6.0_01\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre1.6.0_01\bin\javaw.exe | 
"TCP Query User{72C9792B-9F0B-421A-B504-68CA3FDB1C28}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"TCP Query User{8220C040-DA0E-4A77-8EA8-8946645D1ABD}C:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe" = protocol=6 | dir=in | app=c:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe | 
"TCP Query User{84B5DDB1-DD3B-43AE-8D46-97148A8C48C3}C:\program files\world of warcraft\launcher.exe" = protocol=6 | dir=in | app=c:\program files\world of warcraft\launcher.exe | 
"TCP Query User{8E066FF7-75F3-404F-9D77-BD616A6CE6DF}C:\program files\team17\worms armageddon\wa.exe" = protocol=6 | dir=in | app=c:\program files\team17\worms armageddon\wa.exe | 
"TCP Query User{B900FD0D-2EC9-4C64-98A5-95451A119353}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"TCP Query User{C762DB23-97E0-4515-B723-7CFAFF4B65F4}C:\users\XXX\appdata\local\temp\rar$ex04.234\wow-burningcrusade-dede-installer-downloader.exe" = protocol=6 | dir=in | app=c:\users\XXX\appdata\local\temp\rar$ex04.234\wow-burningcrusade-dede-installer-downloader.exe | 
"TCP Query User{C7D26486-55DC-4E02-941D-3DA3246CE344}C:\program files\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe | 
"TCP Query User{C9B404A0-1EA7-49EC-8FFF-6B66FF17F24A}C:\program files\empire interactive\flatout2\flatout2.exe" = protocol=6 | dir=in | app=c:\program files\empire interactive\flatout2\flatout2.exe | 
"TCP Query User{DDD412BA-714F-48E0-8B36-4D08A9B1FB3A}C:\program files\thq\dawn of war - dark crusade\darkcrusade.exe" = protocol=6 | dir=in | app=c:\program files\thq\dawn of war - dark crusade\darkcrusade.exe | 
"TCP Query User{E105AABD-474C-4A8A-9643-2AB97AAF2ECE}C:\program files\electronic arts\armies of exigo\exigo.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\armies of exigo\exigo.exe | 
"TCP Query User{EC6B5404-064C-43AA-B441-1E91F3C0DBBF}C:\program files\wow!!!\dark-thunder\launcher.exe" = protocol=6 | dir=in | app=c:\program files\wow!!!\dark-thunder\launcher.exe | 
"TCP Query User{EF9BB07E-8868-4A67-B258-DD80C184BF80}C:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe" = protocol=6 | dir=in | app=c:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe | 
"TCP Query User{FE3C417D-E0C6-4CC6-950F-7A1574F3CD98}C:\program files\unreal tournament 3 (lg)\binaries\ut3.exe" = protocol=6 | dir=in | app=c:\program files\unreal tournament 3 (lg)\binaries\ut3.exe | 
"UDP Query User{0E4B664C-2F7F-4079-8B76-47D25CC92D9B}C:\program files\team17\worms armageddon\wa.exe" = protocol=17 | dir=in | app=c:\program files\team17\worms armageddon\wa.exe | 
"UDP Query User{1A194E0A-557C-4BC4-A94B-FDDD43E76D12}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"UDP Query User{2BF720B7-D3CC-4459-B078-5587C3433836}C:\program files\world of warcraft official\launcher.exe" = protocol=17 | dir=in | app=c:\program files\world of warcraft official\launcher.exe | 
"UDP Query User{2EF47BD3-7CD5-4622-9FFC-DA877C2FC2A5}C:\program files\unreal tournament 3 (lg)\binaries\ut3.exe" = protocol=17 | dir=in | app=c:\program files\unreal tournament 3 (lg)\binaries\ut3.exe | 
"UDP Query User{3C2A5A80-28FD-4E56-B7F6-0AF2F31DE6DC}C:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe" = protocol=17 | dir=in | app=c:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe | 
"UDP Query User{3EA1DB5B-999A-4B96-BF1C-CC2529BD8880}C:\program files\serious sam 2\bin\sam2.exe" = protocol=17 | dir=in | app=c:\program files\serious sam 2\bin\sam2.exe | 
"UDP Query User{47C9E7F5-6D1C-4951-8D70-47D662A2F224}C:\program files\electronic arts\armies of exigo\exigo.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\armies of exigo\exigo.exe | 
"UDP Query User{509C7ECC-B927-4912-A9BF-D392F4F045C6}C:\users\XXX\appdata\local\temp\rar$ex05.148\wow-dede-installer-downloader.exe" = protocol=17 | dir=in | app=c:\users\XXX\appdata\local\temp\rar$ex05.148\wow-dede-installer-downloader.exe | 
"UDP Query User{5F4DE307-1049-40C9-9C9B-79DC2C5D720F}C:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe" = protocol=17 | dir=in | app=c:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe | 
"UDP Query User{6E5926F5-740B-464F-B49A-82D6CAEB1DCC}C:\users\XXX\appdata\local\temp\rar$ex04.234\wow-burningcrusade-dede-installer-downloader.exe" = protocol=17 | dir=in | app=c:\users\XXX\appdata\local\temp\rar$ex04.234\wow-burningcrusade-dede-installer-downloader.exe | 
"UDP Query User{753C0D5E-8AE4-4823-8187-5300BD1F9A5F}C:\program files\littlefighter2\lf2_v2.0\lf2.exe" = protocol=17 | dir=in | app=c:\program files\littlefighter2\lf2_v2.0\lf2.exe | 
"UDP Query User{784BCB21-66C5-4DA6-85FE-14B86E464B54}C:\program files\steam\steamapps\txnudel18\half-life 2 deathmatch\hl2.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\txnudel18\half-life 2 deathmatch\hl2.exe | 
"UDP Query User{79704B58-23A6-431E-842F-140B3F018B2B}C:\users\public\games\world of warcraft trial\launcher.exe" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft trial\launcher.exe | 
"UDP Query User{7DC24D1B-25C7-4870-8C26-552066C0DE24}C:\program files\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe | 
"UDP Query User{85145550-EF6C-433E-9AF0-6C356E4B62A0}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe | 
"UDP Query User{8E55ED00-C2ED-4FE4-8F53-08ACF5F346F8}C:\program files\thq\dawn of war - dark crusade\darkcrusade.exe" = protocol=17 | dir=in | app=c:\program files\thq\dawn of war - dark crusade\darkcrusade.exe | 
"UDP Query User{91CDE51B-CAC0-40A1-AEC8-8089DA2DE7D2}C:\program files\java\jre1.6.0_01\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre1.6.0_01\bin\javaw.exe | 
"UDP Query User{A80B53FD-002D-4C41-94AE-B69361E5D66A}C:\program files\wow!!\launcher.exe" = protocol=17 | dir=in | app=c:\program files\wow!!\launcher.exe | 
"UDP Query User{AD0AD7E4-9EF2-4251-BFC6-DA44B684B83F}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"UDP Query User{AFB0FA4D-A7FA-4484-A515-D2FE470EBB01}C:\program files\world of warcraft\wow-3.3.3.11723-to-3.3.5.12213-dede-downloader.exe" = protocol=17 | dir=in | app=c:\program files\world of warcraft\wow-3.3.3.11723-to-3.3.5.12213-dede-downloader.exe | 
"UDP Query User{B084B04E-6142-4FA5-970E-95604CDE2C42}C:\program files\gamers.irc\mirc.exe" = protocol=17 | dir=in | app=c:\program files\gamers.irc\mirc.exe | 
"UDP Query User{B665952B-7990-43DE-BFEE-E3D1B52573BD}C:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe" = protocol=17 | dir=in | app=c:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe | 
"UDP Query User{B894E9CB-C207-49AF-B787-849D364475D5}C:\program files\duty calls\binaries\win32\dutycalls.exe" = protocol=17 | dir=in | app=c:\program files\duty calls\binaries\win32\dutycalls.exe | 
"UDP Query User{C9E0E35A-9F73-4091-97F2-17E482EDAE7A}C:\program files\empire interactive\flatout2\flatout2.exe" = protocol=17 | dir=in | app=c:\program files\empire interactive\flatout2\flatout2.exe | 
"UDP Query User{CCAA270A-C7F1-481E-8356-BF42EA1796D5}C:\program files\world of warcraft\launcher.exe" = protocol=17 | dir=in | app=c:\program files\world of warcraft\launcher.exe | 
"UDP Query User{FE47344A-4F02-44F0-98AC-67AF7A7FFB7A}C:\program files\wow!!!\dark-thunder\launcher.exe" = protocol=17 | dir=in | app=c:\program files\wow!!!\dark-thunder\launcher.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0125D081-30D0-4A97-82A8-C28D444B6256}" = Microsoft SQL Server Compact 3.5 SP2 DEU
"{0138F525-6C8A-333F-A105-14AE030B9A54}" = Visual C++ 9.0 CRT (x86) WinSXS MSM
"{01521746-02A6-4A72-00BD-A285DF6B80C6}" = Die Sims 2: Wilde Campus-Jahre
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{04B45310-A5FE-4425-BFCA-1A6D8920DE74}" = OpenOffice.org 3.0
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{086BADF8-9B1F-4E89-B207-2EDA520972D6}" = Grand Theft Auto San Andreas
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0AEB967F-1D12-43C8-A59C-D93DA8EE4A4E}" = Duty Calls
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0C826C5B-B131-423A-A229-C71B3CACCD6A}" = CDDRV_Installer
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319
"{1D328E11-3B0C-388C-835D-C9C20E8C7734}" = Microsoft Help Viewer 1.0 Language Pack - DEU
"{1FDA5A37-B22D-43FF-B582-B8964050DC13}" = Microsoft Games for Windows - LIVE Redistributable
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 21
"{27018D57-D152-44EF-BCE0-5E3B3445EABE}" = X-Blades
"{3101CB58-3482-4D21-AF1A-7057FC935355}" = KhalInstallWrapper
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java(TM) SE Runtime Environment 6 Update 1
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{47C39E4A-28F2-33B1-B9B7-97F24E52D917}" = Microsoft Help Viewer 1.0
"{47FDEFC7-BFE6-FD75-41D1-28DD572BD2D9}" = ATI Catalyst Install Manager
"{4817189D-1785-4627-A33C-39FD90919300}" = Die Sims™ 2 Haustiere
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5A08C9D1-37AD-4A8D-90D3-33F92C578AA5}" = Microsoft SQL Server System CLR Types
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{5EE3204B-EF7D-4D3E-91A8-5863910CDF6C}" = Speedport W 100 Stick
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{616C6F39-4CE1-3434-A665-2F6A04C09A7F}" = Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools
"{61AD15B2-50DB-4686-A739-14FE180D4429}" = Windows Live ID Sign-in Assistant
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{68A35043-C55A-4237-88C9-37EE1C63ED71}" = Microsoft Visual J# 2.0 Redistributable Package
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6E7DD182-9FC6-4651-0095-2E666CC6AF35}" = Die Sims 2
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{72263053-50D1-4598-9502-51ED64E54C51}" = Borland Delphi 7
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2
"{7B3577F5-1D82-4C9B-008B-69D026FD8BCA}" = Die Sims 2: Open For Business
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager
"{7E641E46-81DB-4D1D-906A-48342523051C}" = FlatOut2
"{80464ABC-A520-453F-A383-6E7B92E0C3B3}" = Armies of Exigo
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83BEEFB4-8C28-4F4F-8A9D-E0D1ADCE335B}" = Die*Sims*Mittelalter
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{86A4C6D9-29EE-4719-AFA1-BA3341862B83}" = Microsoft Games for Windows - LIVE
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{873E4648-6F6E-47F6-A7B2-A6F8DFABDCE6}" = Windows Live Messenger
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A06714C-F24B-4144-9BA2-788B5DD4F270}_is1" = ICQ Ignore Checker 1.3
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8AF3E926-ED59-11D4-A44B-0000E86D2305}" = Ulead GIF Animator 5 Test
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90687432-4103-416F-B0C9-649D8CBD986F}" = Wildlife Park 2 Demo
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9580813D-94B1-4C28-9426-A441E2BB29A5}" = Counter-Strike: Source
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9DBCF44B-77AC-81D8-0F8E-1E60D6330AC2}" = Catalyst Control Center InstallProxy
"{9E012857-0B5E-40A0-A36A-36751966A79B}_is1" = ICQ Status Checker 1.7
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A106D33E-6B43-42C0-9BFC-D03303261FA7}" = Microsoft SQL Server 2008 R2 Management Objects
"{A498D9EB-927B-459B-85D6-DD6EF8C2C564}" = erLT
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A93944F2-D2D4-4750-BFE7-9A288FEAF2CF}" = Apple Application Support
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.4 - Deutsch
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B7E38540-E355-3503-AFD7-635B2F2F76E1}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974
"{B83FC356-B7C0-441F-8A4D-D71E088E7974}" = NVIDIA PhysX
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C580908C-B3BA-4C19-BD60-16F02F272201}" = BattleForge™
"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE4A3D0F-D1B0-47D1-BF99-3E957C548D12}" = LogMeIn Hamachi
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CFCB8616-A5D1-4281-80E8-389F685BFAE2}" = Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 DEU
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D81641E8-ABF1-3D07-803B-60E8FC619368}" = Microsoft Visual C# 2010 Express - DEU
"{DA507A38-4B2A-40C0-90AC-E30AAA0B757C}" = Vegas Movie Studio Platinum 9.0
"{DFEF49D9-FC95-4301-99B9-2FB91C6ABA06}" = Die Sims™ 2 Vier Jahreszeiten
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.1
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{ECEE0279-785F-4CB3-9F28-E69813234BF8}" = SPORE™ Labor Basisversion
"{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}" = Logitech SetPoint
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F7529650-B9DB-481B-0089-A2AC3C2821C1}" = Die Sims 2: Nightlife
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{F9D54D77-01A4-7D34-6F3C-EDC9F8F466E3}" = Fragen-Lern-CD 4.0
"7-Zip" = 7-Zip 9.14 beta
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"AnalogX AutoTune" = AnalogX AutoTune
"Any Video Converter_is1" = Any Video Converter 3.0.3
"Ashampoo Burning Studio 2010 Advanced_is1" = Ashampoo Burning Studio 2010 Advanced 9.25
"Audiograbber" = Audiograbber 1.83 SE 
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"AVMWLANCLI" = AVM FRITZ!WLAN
"CABAL Online (Europe)_is1" = CABAL Online
"CABAL Online: Illusion Castle Patch_is1" = Cabal Online Europe - Illusion Castle
"CABAL Online_is1" = CABAL Online
"conduitEngine" = Conduit Engine
"de.3m5.wendel.flcd.FLCDB.4E7DF207D694E815646D9C9DD7DC91A41EB7FD23.1" = Fragen-Lern-CD 4.0
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"Fraps" = Fraps (remove only)
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.7
"Free Video to Flash Converter_is1" = Free Video to Flash Converter version 4.2
"Free Video to JPG Converter_is1" = Free Video to JPG Converter version 1.5
"Free Video to MP3 Converter_is1" = Free Video to MP3 Converter version 3.2
"Free YouTube Download_is1" = Free YouTube Download 2.10
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.9.35.324
"GoldWave v5.56" = GoldWave v5.56
"ICQToolbar" = ICQ Toolbar
"InstallShield_{5EE3204B-EF7D-4D3E-91A8-5863910CDF6C}" = Speedport W 100 Stick
"InstallShield_{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager
"League of Legends_is1" = League of Legends
"LogMeIn Hamachi" = LogMeIn Hamachi
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0
"Microsoft Help Viewer 1.0 Language Pack - DEU" = Microsoft Help Viewer 1.0 Language Pack - DEU
"Microsoft Visual C# 2010 Express - DEU" = Microsoft Visual C# 2010 Express - DEU
"Microsoft Visual J# 2.0 Redistributable Package" = Microsoft Visual J# 2.0 Redistributable Package
"Mortal Kombat_is1" = Mortal Kombat
"Mozilla Firefox 4.0.1 (x86 de)" = Mozilla Firefox 4.0.1 (x86 de)
"MyAshampoo Toolbar" = MyAshampoo Toolbar
"Notepad++" = Notepad++
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Pivot 2.3.0 Deutsch" = Pivot 2.3.0 Deutsch
"Plants vs. Zombies" = Plants vs. Zombies
"Steam App 11020" = TrackMania Nations Forever
"Steam App 240" = Counter-Strike: Source
"Steam App 300" = Day of Defeat: Source
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"TeamViewer 6" = TeamViewer 6
"Tunatic" = Tunatic
"Ulead GIF Animator Lite Edition 1.0" = Ulead GIF Animator Lite Edition 1.0
"Uninstall_is1" = Uninstall 1.0.0.1
"Unlocker" = Unlocker 1.9.0
"VLC media player" = VLC media player 1.1.7
"WavePad" = WavePad Sound Editor
"Wildlife Park 3 Demo_is1" = Wildlife Park 3 Demo v1.03
"WinGimp-2.0_is1" = GIMP 2.6.8
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR
"World of Warcraft" = World of Warcraft
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"GeoGebra WebStart" = GeoGebra WebStart
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 01.10.2010 09:22:14 | Computer Name = XXX | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 01.10.2010 09:22:14 | Computer Name = XXX | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 01.10.2010 09:22:15 | Computer Name = XXX | Source = WinMgmt | ID = 10
Description = 
 
Error - 01.10.2010 11:04:53 | Computer Name = XXX | Source = Application Hang | ID = 1002
Description = Programm battleforge.exe, Version 1.2.0.0 arbeitet nicht mehr mit 
Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet 
"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über
 das Problem zu suchen.  Prozess-ID: 17fc  Anfangszeit: 01cb616e57efe5ef  Zeitpunkt der
 Beendigung: 1725
 
Error - 02.10.2010 03:32:49 | Computer Name = XXX | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 02.10.2010 03:32:49 | Computer Name = XXX | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 02.10.2010 03:33:16 | Computer Name = XXX | Source = WinMgmt | ID = 10
Description = 
 
Error - 02.10.2010 07:51:42 | Computer Name = XXX | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 02.10.2010 07:51:42 | Computer Name = XXX | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 02.10.2010 07:52:42 | Computer Name = XXX | Source = WinMgmt | ID = 10
Description = 
 
[ System Events ]
Error - 30.04.2011 11:38:06 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
 
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
 
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
 
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
 
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
 
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
 
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
 
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
 
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
 
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
 
 
< End of report >
         

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6478

Windows 6.0.6002 Service Pack 2
Internet Explorer 7.0.6002.18005

30.04.2011 17:21:45
mbam-log-2011-04-30 (17-21-45).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 151646
Laufzeit: 11 Minute(n), 18 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 3

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Users\XXX\AppData\Local\Temp\comver.dll (Adware.GameSpyArcade) -> Quarantined and deleted successfully.
c:\Users\XXX\AppData\Roaming\avdrn.dat (Malware.Trace) -> Quarantined and deleted successfully.
c:\Users\XXX\AppData\Roaming\fvgqad.dat (Malware.Trace) -> Quarantined and deleted successfully.
         

Hallo

Fixen mit OTL

• Starte bitte die OTL.exe.
  Vista und Win7 User: mit Rechtsklick "als Administrator starten"
• Kopiere nun den Inhalt in die Textbox.

:OTL
O4 - HKCU..\Run: [auditask]  File not found
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab (Oberon Flash Game Host)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O33 - MountPoints2\{2093246f-dc05-11dd-8eff-001e90f7e9a3}\Shell - "" = AutoRun
O33 - MountPoints2\{2093246f-dc05-11dd-8eff-001e90f7e9a3}\Shell\AutoRun\command - "" = E:\pushinst.exe
O33 - MountPoints2\{27a4deb1-eca6-11de-9468-001c4afc5051}\Shell\AutoRun\command - "" = I:\installer.exe
O33 - MountPoints2\{27a4deb1-eca6-11de-9468-001c4afc5051}\Shell\verb\command - "" = I:\installer.exe
O33 - MountPoints2\{3606af13-828e-11de-bdcc-001c4afc5051}\Shell - "" = AutoRun
O33 - MountPoints2\{3606af13-828e-11de-bdcc-001c4afc5051}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
O33 - MountPoints2\{823e65cf-ca16-11de-9806-00191548cc45}\Shell\AutoRun\command - "" = I:\installer.exe
O33 - MountPoints2\{823e65cf-ca16-11de-9806-00191548cc45}\Shell\verb\command - "" = I:\installer.exe
O33 - MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\Shell - "" = AutoRun
O33 - MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\Shell\AutoRun\command - "" = L:\autorun.exe
O33 - MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\Shell\directx\command - "" = L:\DirectX9\dxsetup.exe
O33 - MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\Shell\setup\command - "" = L:\setup.exe
O33 - MountPoints2\{af9c9acf-4235-11df-ab32-001e90f7e9a3}\Shell - "" = AutoRun
O33 - MountPoints2\{af9c9acf-4235-11df-ab32-001e90f7e9a3}\Shell\AutoRun\command - "" = K:\pushinst.exe
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\pushinst.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

@Alternate Data Stream - 64 bytes -> C:\Users\XXX\I've been looking for Grindcore.avi:TOC.WMV
@Alternate Data Stream - 24 bytes -> C:\Windows:8917AFFB20020C2F
:Services

:Reg

:Files

:Commands
[purity]
[emptytemp]
[Reboot]
         

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument.
  Kopiere nun den Inhalt hier in Deinen Thread

Bitte den MBRCheck durchführen
http://www.trojaner-board.de/88319-mbrcheck-exe.html

Anschließend Antivir updaten und mit diesen Einstellungen scannen lassen
http://www.trojaner-board.de/54192-a...tellungen.html
poste die enstandenen Logs bitte wieder hierher.

MFG

All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\auditask deleted successfully.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {D0C0F75C-683A-4390-A791-1ACFD5599AB8}
C:\Windows\Downloaded Program Files\OberonGameHost_dbg.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{D0C0F75C-683A-4390-A791-1ACFD5599AB8}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D0C0F75C-683A-4390-A791-1ACFD5599AB8}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{D0C0F75C-683A-4390-A791-1ACFD5599AB8}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D0C0F75C-683A-4390-A791-1ACFD5599AB8}\ not found.
Starting removal of ActiveX control {D27CDB6E-AE6D-11CF-96B8-444553540000}
C:\Windows\Downloaded Program Files\swflash.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{D27CDB6E-AE6D-11CF-96B8-444553540000}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{D27CDB6E-AE6D-11CF-96B8-444553540000}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2093246f-dc05-11dd-8eff-001e90f7e9a3}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2093246f-dc05-11dd-8eff-001e90f7e9a3}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2093246f-dc05-11dd-8eff-001e90f7e9a3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2093246f-dc05-11dd-8eff-001e90f7e9a3}\ not found.
File E:\pushinst.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{27a4deb1-eca6-11de-9468-001c4afc5051}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27a4deb1-eca6-11de-9468-001c4afc5051}\ not found.
File I:\installer.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{27a4deb1-eca6-11de-9468-001c4afc5051}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27a4deb1-eca6-11de-9468-001c4afc5051}\ not found.
File I:\installer.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3606af13-828e-11de-bdcc-001c4afc5051}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3606af13-828e-11de-bdcc-001c4afc5051}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3606af13-828e-11de-bdcc-001c4afc5051}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3606af13-828e-11de-bdcc-001c4afc5051}\ not found.
File E:\LaunchU3.exe -a not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{823e65cf-ca16-11de-9806-00191548cc45}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{823e65cf-ca16-11de-9806-00191548cc45}\ not found.
File I:\installer.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{823e65cf-ca16-11de-9806-00191548cc45}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{823e65cf-ca16-11de-9806-00191548cc45}\ not found.
File I:\installer.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\ not found.
File L:\autorun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\ not found.
File L:\DirectX9\dxsetup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\ not found.
File L:\setup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{af9c9acf-4235-11df-ab32-001e90f7e9a3}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{af9c9acf-4235-11df-ab32-001e90f7e9a3}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{af9c9acf-4235-11df-ab32-001e90f7e9a3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{af9c9acf-4235-11df-ab32-001e90f7e9a3}\ not found.
File K:\pushinst.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ not found.
File E:\pushinst.exe not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:autocheck autochk * deleted successfully.
Unable to delete ADS C:\Users\XXX\I've been looking for Grindcore.avi:TOC.WMV .
ADS C:\Windows:8917AFFB20020C2F deleted successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: XXX
->Temp folder emptied: 5249620176 bytes
->Temporary Internet Files folder emptied: 133794396 bytes
->Java cache emptied: 28676661 bytes
->FireFox cache emptied: 247081134 bytes
->Flash cache emptied: 877905 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56502 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 684836841 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 6.051,00 mb
 
 
OTL by OldTimer - Version 3.2.22.3 log created on 05032011_000753

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...
         

Die anderen Logs folgen...
PS: Nach dem Neustart erscheint ein PopUp - JavaUpdate verfügbar
Sollte ich das intallieren oder eher nicht?
Danke schonmal

Edit.:
Kann auf den Link http://www.trojaner-board.de/88319-mbrcheck-exe.html nicht zugreifen - habe keine Berechtigung - bitte um Alternative
Werde den PC jetzt runterfahren, hoffe das macht nichts

Hallo

Kann auf den Link http://www.trojaner-board.de/88319-mbrcheck-exe.html nicht zugreifen - habe keine Berechtigung - bitte um Alternative

Ja hab ich verpennt, nun aber so
Downloade Dir bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

• Doppelklick auf die MBRCheck.exe.
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Das Tool braucht nur eine Sekunde.
• Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

Deinstalliere bitte erstmal alle vorhandenen Javaversionen und lade dir anschließend die aktuelle Version von hier
Download der kostenlosen Java-Software

Werde den PC jetzt runterfahren, hoffe das macht nichts

Ich denke nicht, kommt die Fehlermeldung noch?

EDIT:denk bitte an Antivir

MFG

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:			
Windows Version:		Windows Vista Home Premium Edition
Windows Information:		Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer:	ECS
BIOS Manufacturer:		American Megatrends Inc.
System Manufacturer:		ECS
System Product Name:		GeForce 8000 series
Logical Drives Mask:		0x00000d9d

Kernel Drivers (total 150):
  0x82443000 \SystemRoot\system32\ntkrnlpa.exe
  0x82410000 \SystemRoot\system32\hal.dll
  0x8040B000 \SystemRoot\system32\kdcom.dll
  0x80412000 \SystemRoot\system32\PSHED.dll
  0x80423000 \SystemRoot\system32\BOOTVID.dll
  0x8042B000 \SystemRoot\system32\CLFS.SYS
  0x8046C000 \SystemRoot\system32\CI.dll
  0x8054C000 \SystemRoot\system32\drivers\Wdf01000.sys
  0x805C8000 \SystemRoot\system32\drivers\WDFLDR.SYS
  0x80609000 \SystemRoot\system32\drivers\acpi.sys
  0x8064F000 \SystemRoot\system32\drivers\WMILIB.SYS
  0x80658000 \SystemRoot\system32\drivers\msisadrv.sys
  0x80660000 \SystemRoot\system32\drivers\pci.sys
  0x80687000 \SystemRoot\System32\drivers\partmgr.sys
  0x80696000 \SystemRoot\system32\drivers\volmgr.sys
  0x806A5000 \SystemRoot\System32\drivers\volmgrx.sys
  0x806EF000 \SystemRoot\system32\drivers\pciide.sys
  0x806F6000 \SystemRoot\system32\drivers\PCIIDEX.SYS
  0x80704000 \SystemRoot\System32\drivers\mountmgr.sys
  0x80714000 \SystemRoot\system32\drivers\atapi.sys
  0x8071C000 \SystemRoot\system32\drivers\ataport.SYS
  0x8073A000 \SystemRoot\system32\drivers\fltmgr.sys
  0x8076C000 \SystemRoot\system32\drivers\fileinfo.sys
  0x8077C000 \SystemRoot\System32\Drivers\ksecdd.sys
  0x82A03000 \SystemRoot\system32\drivers\ndis.sys
  0x82B0E000 \SystemRoot\system32\drivers\msrpc.sys
  0x82B39000 \SystemRoot\system32\drivers\NETIO.SYS
  0x8760F000 \SystemRoot\System32\drivers\tcpip.sys
  0x876F9000 \SystemRoot\System32\drivers\fwpkclnt.sys
  0x87808000 \SystemRoot\System32\Drivers\Ntfs.sys
  0x87918000 \SystemRoot\system32\drivers\volsnap.sys
  0x87951000 \SystemRoot\System32\Drivers\spldr.sys
  0x8796C000 \SystemRoot\System32\drivers\sfhlp02.sys
  0x87986000 \SystemRoot\System32\Drivers\mup.sys
  0x87995000 \SystemRoot\System32\drivers\ecache.sys
  0x879BC000 \SystemRoot\system32\drivers\disk.sys
  0x879CD000 \SystemRoot\system32\drivers\CLASSPNP.SYS
  0x879EE000 \SystemRoot\system32\drivers\crcdisk.sys
  0x87714000 \SystemRoot\system32\DRIVERS\tunnel.sys
  0x8771F000 \SystemRoot\system32\DRIVERS\tunmp.sys
  0x87728000 \SystemRoot\system32\DRIVERS\amdk8.sys
  0x87738000 \SystemRoot\system32\DRIVERS\fdc.sys
  0x87743000 \SystemRoot\system32\DRIVERS\parport.sys
  0x8775B000 \SystemRoot\system32\DRIVERS\i8042prt.sys
  0x87800000 \SystemRoot\system32\DRIVERS\L8042Kbd.sys
  0x8776E000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0x87779000 \SystemRoot\system32\DRIVERS\nvsmu.sys
  0x87782000 \SystemRoot\system32\DRIVERS\usbohci.sys
  0x8778C000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0x877CA000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0x877D9000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0x8B40F000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
  0x8B49C000 \SystemRoot\system32\DRIVERS\nvmfdx32.sys
  0x8B601000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
  0x8BF1F000 \SystemRoot\system32\DRIVERS\nvBridge.kmd
  0x8BF21000 \SystemRoot\System32\drivers\dxgkrnl.sys
  0x8BFC1000 \SystemRoot\System32\drivers\watchdog.sys
  0x8BFCD000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
  0x8B4E0000 \SystemRoot\system32\DRIVERS\msiscsi.sys
  0x8B50F000 \SystemRoot\system32\DRIVERS\storport.sys
  0x8BFD6000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0x8BFE1000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
  0x8B550000 \SystemRoot\system32\DRIVERS\ndistapi.sys
  0x8B55B000 \SystemRoot\system32\DRIVERS\ndiswan.sys
  0x8B57E000 \SystemRoot\system32\DRIVERS\raspppoe.sys
  0x8B58D000 \SystemRoot\system32\DRIVERS\raspptp.sys
  0x8B5A1000 \SystemRoot\system32\DRIVERS\rassstp.sys
  0x8BFF8000 \SystemRoot\system32\DRIVERS\hamachi.sys
  0x8B5B6000 \SystemRoot\system32\DRIVERS\termdd.sys
  0x8B5C6000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0x8BFFD000 \SystemRoot\system32\DRIVERS\swenum.sys
  0x8B5D1000 \SystemRoot\system32\DRIVERS\ks.sys
  0x8B400000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0x877F1000 \SystemRoot\system32\DRIVERS\umbus.sys
  0x87600000 \SystemRoot\system32\DRIVERS\flpydisk.sys
  0x82B74000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0x82BA9000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0x82BBA000 \SystemRoot\system32\drivers\HdAudio.sys
  0x8C60A000 \SystemRoot\system32\drivers\portcls.sys
  0x8C637000 \SystemRoot\system32\drivers\drmk.sys
  0x8C65C000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
  0x8C665000 \SystemRoot\System32\Drivers\Null.SYS
  0x8C66C000 \SystemRoot\System32\Drivers\Beep.SYS
  0x8C673000 \SystemRoot\System32\drivers\vga.sys
  0x8C67F000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
  0x8C6A0000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0x8C6A8000 \SystemRoot\system32\drivers\rdpencdd.sys
  0x8C6B0000 \SystemRoot\System32\Drivers\Msfs.SYS
  0x8C6BB000 \SystemRoot\System32\Drivers\Npfs.SYS
  0x8C6C9000 \SystemRoot\System32\DRIVERS\rasacd.sys
  0x8C6D2000 \SystemRoot\system32\DRIVERS\tdx.sys
  0x8C6E8000 \SystemRoot\system32\DRIVERS\smb.sys
  0x8C6FC000 \SystemRoot\system32\drivers\afd.sys
  0x8C744000 \SystemRoot\System32\DRIVERS\netbt.sys
  0x8C776000 \SystemRoot\system32\DRIVERS\pacer.sys
  0x8C78C000 \SystemRoot\system32\DRIVERS\netbios.sys
  0x8C79A000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0x8C7AD000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
  0x8C7B3000 \SystemRoot\system32\DRIVERS\rdbss.sys
  0x8C7EF000 \SystemRoot\system32\drivers\nsiproxy.sys
  0x805D5000 \SystemRoot\System32\Drivers\dfsc.sys
  0x8C80A000 \SystemRoot\system32\DRIVERS\avipbb.sys
  0x8C830000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys
  0x8C832000 \SystemRoot\system32\DRIVERS\cdfs.sys
  0x8C848000 \SystemRoot\System32\Drivers\crashdmp.sys
  0x8C855000 \SystemRoot\System32\Drivers\dump_dumpata.sys
  0x8C860000 \SystemRoot\System32\Drivers\dump_atapi.sys
  0x8C868000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
  0x8C87D000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0x8C87F000 \SystemRoot\system32\DRIVERS\usbccgp.sys
  0x8C896000 \SystemRoot\System32\Drivers\LUsbFilt.Sys
  0x8C89C000 \SystemRoot\system32\DRIVERS\hidusb.sys
  0x8C8A5000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
  0x8C8B5000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
  0x8C8BC000 \SystemRoot\system32\drivers\usbaudio.sys
  0x8C8CE000 \SystemRoot\system32\DRIVERS\LHidFilt.Sys
  0x8C8D6000 \SystemRoot\system32\DRIVERS\mouhid.sys
  0x8C8DE000 \SystemRoot\system32\DRIVERS\LMouFilt.Sys
  0x8C8E6000 \SystemRoot\system32\DRIVERS\fwlanusbn.sys
  0x81670000 \SystemRoot\System32\win32k.sys
  0x8C949000 \SystemRoot\System32\drivers\Dxapi.sys
  0x8C953000 \SystemRoot\system32\DRIVERS\monitor.sys
  0x81890000 \SystemRoot\System32\TSDDD.dll
  0x818B0000 \SystemRoot\System32\cdd.dll
  0x8C962000 \SystemRoot\system32\drivers\luafv.sys
  0x8C97D000 \SystemRoot\system32\DRIVERS\avgntflt.sys
  0x9AA0B000 \SystemRoot\system32\drivers\spsys.sys
  0x9AABB000 \SystemRoot\system32\DRIVERS\lltdio.sys
  0x9AACB000 \SystemRoot\system32\DRIVERS\nwifi.sys
  0x9AAF5000 \SystemRoot\system32\DRIVERS\ndisuio.sys
  0x9AAFF000 \SystemRoot\system32\DRIVERS\rspndr.sys
  0x9AB12000 \SystemRoot\system32\DRIVERS\asyncmac.sys
  0x9AB1B000 \SystemRoot\system32\drivers\HTTP.sys
  0x9AB88000 \SystemRoot\System32\DRIVERS\srvnet.sys
  0x9ABA5000 \SystemRoot\system32\DRIVERS\bowser.sys
  0x9ABBE000 \SystemRoot\System32\drivers\mpsdrv.sys
  0x9ABD3000 \SystemRoot\system32\drivers\mrxdav.sys
  0x8C992000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0x8C9B1000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
  0x9C60B000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
  0x9C623000 \SystemRoot\System32\DRIVERS\srv2.sys
  0x9C64B000 \SystemRoot\System32\DRIVERS\srv.sys
  0x9C69A000 \SystemRoot\system32\DRIVERS\parvdm.sys
  0x9C6A1000 \SystemRoot\system32\DRIVERS\atksgt.sys
  0x9C6E4000 \SystemRoot\system32\DRIVERS\lirsgt.sys
  0x9C6E9000 \SystemRoot\system32\drivers\peauth.sys
  0x9C7C7000 \SystemRoot\System32\drivers\tcpipreg.sys
  0x9C7D3000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
  0x9C7E8000 \SystemRoot\system32\DRIVERS\WUDFPf.sys
  0x77500000 \Windows\System32\ntdll.dll

Processes (total 73):
       0 System Idle Process
       4 System
     384 C:\Windows\System32\smss.exe
     512 csrss.exe
     572 C:\Windows\System32\wininit.exe
     584 csrss.exe
     616 C:\Windows\System32\services.exe
     628 C:\Windows\System32\lsass.exe
     636 C:\Windows\System32\lsm.exe
     748 C:\Windows\System32\winlogon.exe
     832 C:\Windows\System32\svchost.exe
     896 C:\Windows\System32\nvvsvc.exe
     928 C:\Windows\System32\svchost.exe
     964 C:\Windows\System32\svchost.exe
    1056 C:\Windows\System32\Ati2evxx.exe
    1080 C:\Windows\System32\svchost.exe
    1108 C:\Windows\System32\svchost.exe
    1120 C:\Windows\System32\svchost.exe
    1232 C:\Windows\System32\audiodg.exe
    1280 C:\Windows\System32\SLsvc.exe
    1316 C:\Windows\System32\svchost.exe
    1396 C:\Windows\System32\Ati2evxx.exe
    1412 C:\Windows\System32\nvvsvc.exe
    1516 C:\Windows\System32\svchost.exe
    1740 C:\Windows\System32\spoolsv.exe
    1836 C:\Program Files\Avira\AntiVir Desktop\sched.exe
    1848 C:\Windows\System32\svchost.exe
    2044 C:\Windows\System32\taskeng.exe
    1216 C:\Windows\System32\dwm.exe
    1296 C:\Windows\System32\taskeng.exe
    1248 C:\Windows\explorer.exe
    1388 C:\Program Files\Windows Defender\MSASCui.exe
     304 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
     288 C:\Program Files\avmwlanstick\WLanGUI.exe
    1464 C:\Program Files\Unlocker\UnlockerAssistant.exe
    2124 C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe
    2172 C:\Program Files\Common Files\Java\Java Update\jusched.exe
    2184 C:\Windows\ehome\ehtray.exe
    2192 C:\Program Files\Skype\Phone\Skype.exe
    2208 C:\Program Files\Logitech\SetPoint\SetPoint.exe
    2236 C:\Program Files\DT\Speedport W 100 Stick\Wifiusb.exe
    2292 C:\Windows\ehome\ehmsas.exe
    2368 C:\Program Files\OpenOffice.org 3\program\soffice.exe
    2424 C:\Program Files\OpenOffice.org 3\program\soffice.bin
    2708 C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
    2788 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    2808 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
    2972 C:\Program Files\Skype\Plugin Manager\skypePM.exe
    3164 C:\Program Files\avmwlanstick\WLanNetService.exe
    3520 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
    3644 C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
    3676 C:\Program Files\ICQ6Toolbar\ICQ Service.exe
    3724 C:\Windows\System32\svchost.exe
    3892 C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
    3912 C:\Windows\System32\svchost.exe
    3928 C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe
    2640 C:\Windows\System32\svchost.exe
    1024 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
    1432 C:\Windows\System32\SearchIndexer.exe
    1892 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
    2832 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
    1096 WUDFHost.exe
    1792 WmiPrvSE.exe
    2264 C:\Windows\System32\svchost.exe
    2096 C:\Windows\System32\taskeng.exe
    3028 C:\Program Files\Mozilla Firefox\firefox.exe
    5004 C:\Windows\System32\SearchProtocolHost.exe
     276 <unknown>
    4428 C:\Windows\servicing\TrustedInstaller.exe
    5804 C:\Windows\System32\SearchFilterHost.exe
    5420 C:\Windows\System32\conime.exe
    4348 C:\Windows\System32\wuauclt.exe
    2552 C:\Users\XXX\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00100000  (NTFS)

PhysicalDrive0 Model Number: ExcelStorTechnologyJ9250S, Rev: GM2OA52A

      Size  Device Name          MBR Status
  --------------------------------------------
    232 GB  \\.\PhysicalDrive0   Windows 2008 MBR code detected
            SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979


Done!
         

Zitat von nochdigger

Ich denke nicht, kommt die Fehlermeldung noch?

Hab garnich drauf geachtet aber ich glaube sie is nich gekommen o.o
Scheint also funktioniert zu haben
was war das jetzt genau, wenn ich fragen darf?

Zitat von nochdigger

EDIT:denk bitte an Antivir

MFG

in Bearbeitung...