Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:19:09, on 30.04.2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.18005)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\avmwlanstick\WLanGUI.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\DT\Speedport W 100 Stick\Wifiusb.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Users\XXX\Downloads\HiJackThis204.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.qip.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2475029
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.qip.ru/ie
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: QIPBHO Class - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: (no name) -  - (no file)
R3 - URLSearchHook: MyAshampoo Toolbar - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyAs.dll
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: MyAshampoo Toolbar - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyAs.dll
O2 - BHO: QIPBHO - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: MyAshampoo Toolbar - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyAs.dll
O3 - Toolbar: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [AVMWlanClient] C:\Program Files\avmwlanstick\wlangui.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" -H
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [auditask] rundll32 "C:\Users\XXX\AppData\Local\Temp\drivgini.dll",DllEntryPoint
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\steam.exe" -silent
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Speedport W 100 Stick WLAN Manager.lnk = C:\Program Files\DT\Speedport W 100 Stick\Wifiusb.exe
O8 - Extra context menu item: Free YouTube Download - C:\Users\XXX\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\XXX\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O10 - Unknown file in Winsock LSP: c:\program files\nvidia corporation\networkaccessmanager\bin32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\nvidia corporation\networkaccessmanager\bin32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\nvidia corporation\networkaccessmanager\bin32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\nvidia corporation\networkaccessmanager\bin32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\nvidia corporation\networkaccessmanager\bin32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\nvidia corporation\networkaccessmanager\bin32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\nvidia corporation\networkaccessmanager\bin32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\nvidia corporation\networkaccessmanager\bin32\nvlsp.dll
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: AVM WLAN Connection Service - AVM Berlin - C:\Program Files\avmwlanstick\WlanNetService.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update-Dienst (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: TeamViewer 6 (TeamViewer6) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe

--
End of file - 9444 bytes
         

Edit.:
Bekomme bei jedem Systemstart eine Fehlermeldung in Form eines PopUps die lautet:
RunDLL
Fehler beim Laden von C:\Users\MeinName\AppData\Local \Temp\drivgini.dll
Das angegebene Modul wurde nicht gefunden.

habe mich damit erst an Cosmiq gewand und mir wurde geraten ein HiJackThis-Scan zu machen und hier zu posten
das is die Geschichte

Achja: Hatte ma Trojaner auf dem Rechner o.o
und die Meldung kommt schon ein Jahr lang

Hallo und

Achja: Hatte ma Trojaner auf dem Rechner o.o
und die Meldung kommt schon ein Jahr lang

scheinbar ist es dir egal, ob andere Nutzer des Internets von deinem System aus eventuell zugespammt werden...

HiJackThis Log zum auswerten

Was denkst du warum einer der oben angepinnten Beiträge heißt
"Bitte keine HijackThis Logfiles posten"?

Überprüfe dein System mit Malwarebytes und erstelle anschließend ein Log mit OTL , poste alle Logs hierher, dann sehen wir weiter.

MFG

Zitat von nochdigger

scheinbar ist es dir egal, ob andere Nutzer des Internets von deinem System aus eventuell zugespammt werden...

Tut mir Leid nicht jeder kennt sich so blendend aus wie ihr und ich ging nicht von einem Virus aus und habe die Fehlermeldung aus gewohnheit immer weggeklickt.

Zitat von nochdigger

Was denkst du warum einer der oben angepinnten Beiträge heißt
"Bitte keine HijackThis Logfiles posten"?

Nochmal tut mir Leid, habe gesagt bekommen ich solle HijackThis benutzen und habe den angepinnten Beitrag wohl in meiner Eile übersehen.
Scan mit Malwarebytes läuft und ich werde die Logs dann versuchen übersichtlich hier einzufügen.

Edit.:
Soll ich nur die Logs von OTL posten?
Oder auch von Malwarebytes?

OTL logfile created on: 30.04.2011 17:32:38 - Run 1
OTL by OldTimer - Version 3.2.22.3     Folder = C:\Users\XXX\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 41,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 68,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 232,88 Gb Total Space | 57,05 Gb Free Space | 24,50% Space Free | Partition Type: NTFS
 
Computer Name: XXX | User Name: XXX | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\XXX\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files\Steam\Steam.exe (Valve Corporation)
PRC - C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
PRC - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files\Unlocker\UnlockerAssistant.exe ()
PRC - C:\Program Files\ICQ6Toolbar\ICQ Service.exe ()
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe ()
PRC - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe ()
PRC - C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
PRC - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe (Logitech, Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files\avmwlanstick\WLanGUI.exe (AVM Berlin)
PRC - C:\Program Files\avmwlanstick\WLanNetService.exe (AVM Berlin)
PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Program Files\DT\Speedport W 100 Stick\Wifiusb.exe (TECOM)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\XXX\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (TeamViewer6) -- C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (Hamachi2Svc) -- C:\Program Files\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (ICQ Service) -- C:\Program Files\ICQ6Toolbar\ICQ Service.exe ()
SRV - (npggsvc) -- C:\Windows\System32\GameMon.des (INCA Internet Co., Ltd.)
SRV - (nSvcIp) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe ()
SRV - (ForceWare Intelligent Application Manager (IAM)) ForceWare Intelligent Application Manager (IAM) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe ()
SRV - (LBTServ) -- C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (Stereo Service) -- C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (AVM WLAN Connection Service) -- C:\Program Files\avmwlanstick\WLanNetService.exe (AVM Berlin)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (atksgt) -- C:\Windows\System32\drivers\atksgt.sys ()
DRV - (lirsgt) -- C:\Windows\System32\drivers\lirsgt.sys ()
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (hamachi) -- C:\Windows\System32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (NVNET) -- C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation)
DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (nvsmu) -- C:\Windows\System32\drivers\nvsmu.sys (NVIDIA Corporation)
DRV - (LUsbFilt) -- C:\Windows\System32\drivers\LUsbFilt.sys (Logitech, Inc.)
DRV - (LMouKE) -- C:\Windows\System32\drivers\LMouKE.Sys (Logitech, Inc.)
DRV - (LMouFilt) -- C:\Windows\System32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LHidFilt) -- C:\Windows\System32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (L8042mou) -- C:\Windows\System32\drivers\L8042mou.Sys (Logitech, Inc.)
DRV - (L8042Kbd) -- C:\Windows\System32\drivers\L8042Kbd.sys (Logitech, Inc.)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avgio) -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (fwlanusbn) -- C:\Windows\System32\drivers\fwlanusbn.sys (AVM GmbH)
DRV - (avmeject) -- C:\Windows\System32\drivers\avmeject.sys (AVM Berlin)
DRV - (sfdrv01) StarForce Protection Environment Driver (version 1.x) -- C:\Windows\System32\drivers\sfdrv01.sys (Protection Technology (StarForce))
DRV - (sfhlp02) StarForce Protection Helper Driver (version 2.x) -- C:\Windows\System32\drivers\sfhlp02.sys (Protection Technology (StarForce))
DRV - (sfvfs02) StarForce Protection VFS Driver (version 2.x) -- C:\Windows\System32\drivers\sfvfs02.sys (Protection Technology)
DRV - (PRISM_A02) -- C:\Windows\System32\drivers\PRISMA02.sys (Conexant Systems, Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKLM\..\URLSearchHook: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyAs.dll (Conduit Ltd.)
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://qip.ru
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.qip.ru
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.qip.ru
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2475029
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.qip.ru/ie
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\..\URLSearchHook: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyAs.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "QIP Search"
FF - prefs.js..browser.search.defaultthis.engineName: "MyAshampoo Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2475029&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "MyAshampoo Customized Web Search"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {59c81df5-4b7a-477b-912d-4e0fdf64e5f2}:0.9.86.1
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.2
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {7BDB48D1-CD94-4B99-A5A4-E418B9EE6532}:1.1.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {32a1fd71-835e-4b11-8e54-886fda0b4c89}:1.1
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2
FF - prefs.js..extensions.enabledItems: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6
FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2475029&q="
FF - prefs.js..network.proxy.backup.ftp: ""
FF - prefs.js..network.proxy.backup.ftp_port: 0
FF - prefs.js..network.proxy.backup.gopher: ""
FF - prefs.js..network.proxy.backup.gopher_port: 0
FF - prefs.js..network.proxy.backup.socks: ""
FF - prefs.js..network.proxy.backup.socks_port: 0
FF - prefs.js..network.proxy.backup.ssl: ""
FF - prefs.js..network.proxy.backup.ssl_port: 0
FF - prefs.js..network.proxy.ftp: "128.220.231.4"
FF - prefs.js..network.proxy.ftp_port: 3124
FF - prefs.js..network.proxy.gopher: "128.220.231.4"
FF - prefs.js..network.proxy.gopher_port: 3124
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "128.220.231.4"
FF - prefs.js..network.proxy.socks_port: 3124
FF - prefs.js..network.proxy.ssl: "128.220.231.4"
FF - prefs.js..network.proxy.ssl_port: 3124
 
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.04.30 10:45:01 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.04.30 10:44:57 | 000,000,000 | ---D | M]
 
[2009.01.07 01:06:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\Extensions
[2011.04.29 11:44:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions
[2011.02.01 00:44:57 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.09.18 10:16:59 | 000,000,000 | ---D | M] (QipAuthorizer) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{32a1fd71-835e-4b11-8e54-886fda0b4c89}
[2011.04.29 09:54:13 | 000,000,000 | ---D | M] (ChatZilla [de]) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{59c81df5-4b7a-477b-912d-4e0fdf64e5f2}
[2011.02.01 00:44:50 | 000,000,000 | ---D | M] (Destroy the Web) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{7BDB48D1-CD94-4B99-A5A4-E418B9EE6532}
[2011.04.29 09:54:19 | 000,000,000 | ---D | M] (MyAshampoo Community Toolbar) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}
[2010.05.31 16:58:33 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.04.29 09:54:16 | 000,000,000 | ---D | M] (myBabylon EnglishBB Community Toolbar) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}
[2011.04.22 17:50:11 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2011.04.29 09:54:14 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2011.04.29 09:54:18 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\engine@conduit.com
[2010.12.15 17:12:32 | 000,000,923 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\n3jvvnj1.default\searchplugins\conduit.xml
[2011.04.24 22:15:50 | 000,001,056 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\n3jvvnj1.default\searchplugins\icqplugin.xml
[2010.10.14 12:52:01 | 000,002,062 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\n3jvvnj1.default\searchplugins\qip-search.xml
[2011.04.30 10:45:01 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010.07.16 11:56:32 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.08.21 11:14:49 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
File not found (No name found) -- 
[2011.04.14 18:40:03 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2010.07.17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.08.02 14:40:19 | 000,002,226 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (MyAshampoo Toolbar) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyAs.dll (Conduit Ltd.)
O2 - BHO: (QIPBHO Class) - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (MyAshampoo Toolbar) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyAs.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (MyAshampoo Toolbar) - {A1E75A0E-4397-4BA8-BB50-E19FB66890F4} - C:\Program Files\MyAshampoo\tbMyAs.dll (Conduit Ltd.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [AVMWlanClient] C:\Program Files\avmwlanstick\WLanGUI.exe (AVM Berlin)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [auditask]  File not found
O4 - HKCU..\Run: [Steam] C:\Program Files\Steam\steam.exe (Valve Corporation)
O4 - Startup: C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O8 - Extra context menu item: Free YouTube Download - C:\Users\XXX\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\XXX\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab (Oberon Flash Game Host)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\XXX\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\XXX\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{2093246f-dc05-11dd-8eff-001e90f7e9a3}\Shell - "" = AutoRun
O33 - MountPoints2\{2093246f-dc05-11dd-8eff-001e90f7e9a3}\Shell\AutoRun\command - "" = E:\pushinst.exe
O33 - MountPoints2\{27a4deb1-eca6-11de-9468-001c4afc5051}\Shell\AutoRun\command - "" = I:\installer.exe
O33 - MountPoints2\{27a4deb1-eca6-11de-9468-001c4afc5051}\Shell\verb\command - "" = I:\installer.exe
O33 - MountPoints2\{3606af13-828e-11de-bdcc-001c4afc5051}\Shell - "" = AutoRun
O33 - MountPoints2\{3606af13-828e-11de-bdcc-001c4afc5051}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
O33 - MountPoints2\{823e65cf-ca16-11de-9806-00191548cc45}\Shell\AutoRun\command - "" = I:\installer.exe
O33 - MountPoints2\{823e65cf-ca16-11de-9806-00191548cc45}\Shell\verb\command - "" = I:\installer.exe
O33 - MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\Shell - "" = AutoRun
O33 - MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\Shell\AutoRun\command - "" = L:\autorun.exe
O33 - MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\Shell\directx\command - "" = L:\DirectX9\dxsetup.exe
O33 - MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\Shell\setup\command - "" = L:\setup.exe
O33 - MountPoints2\{af9c9acf-4235-11df-ab32-001e90f7e9a3}\Shell - "" = AutoRun
O33 - MountPoints2\{af9c9acf-4235-11df-ab32-001e90f7e9a3}\Shell\AutoRun\command - "" = K:\pushinst.exe
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\pushinst.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.04.30 17:00:33 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\Malwarebytes
[2011.04.30 17:00:22 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011.04.30 17:00:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programme\Malwarebytes' Anti-Malware
[2011.04.30 17:00:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.04.30 17:00:18 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.04.30 17:00:17 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011.04.30 14:14:46 | 000,000,000 | ---D | C] -- C:\Program Files\Deep Silver
[2011.04.30 14:13:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programme\Deep Silver
[2011.04.30 13:18:02 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{ADC7B78E-C2D0-4BC1-8454-C1571DBFA712}
[2011.04.30 11:49:01 | 000,000,000 | ---D | C] -- C:\Users\XXX\Documents\bitComposer Games
[2011.04.30 11:48:51 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\ProtectDISC
[2011.04.30 11:45:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programme\bitComposer Games
[2011.04.30 11:39:47 | 000,000,000 | ---D | C] -- C:\Program Files\bitComposer Games
[2011.04.29 23:31:44 | 000,000,000 | --SD | C] -- C:\Users\XXX\Desktop\Feelings
[2011.04.29 22:30:30 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{5BE83DA6-9AF3-415D-81CE-182E14DE44AA}
[2011.04.27 12:42:11 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{C0EF2A53-44CD-4000-9251-86DEC5DC10FE}
[2011.04.27 11:23:59 | 004,240,384 | ---- | C] (Microsoft) -- C:\Windows\System32\GameUXLegacyGDFs.dll
[2011.04.27 11:23:59 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Apphlpdm.dll
[2011.04.27 11:23:36 | 000,876,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll
[2011.04.26 10:42:23 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{05C5AE65-6FDC-4543-83BA-E69A8A629E5F}
[2011.04.25 14:02:24 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{482AC479-AEAB-4231-82FB-D4948B7A1653}
[2011.04.24 18:59:35 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{2B075415-F68A-444D-8F24-2FA5FF01BBFD}
[2011.04.24 15:05:59 | 000,000,000 | ---D | C] -- C:\Users\XXX\Desktop\100DEADRABBITS_the american wet dream_xalaniconx@DIS
[2011.04.24 14:51:31 | 000,000,000 | ---D | C] -- C:\Users\XXX\Desktop\100DeadRabbits - Teeth
[2011.04.24 14:18:25 | 000,000,000 | ---D | C] -- C:\Users\XXX\Desktop\Guardians
[2011.04.23 23:28:44 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{5AC403B2-7548-4F0C-8171-7D7E52048DB4}
[2011.04.23 11:28:08 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{8DDAC91D-E5DA-4293-A810-7187B1E60BA1}
[2011.04.22 23:27:37 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{9085AAC8-98AB-453A-AEF1-AE6DEF16C948}
[2011.04.22 11:26:03 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{D88CF7C9-F665-437C-ABE9-2DA5C71E18E9}
[2011.04.21 19:38:35 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{35D3369E-B044-4644-8D38-9EA34716CD37}
[2011.04.20 22:33:00 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{6E1E6C04-96E8-4ACC-A6E3-FB23F9F86367}
[2011.04.20 10:32:16 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{BC16BF92-09F2-4566-9F81-E45DE69DF619}
[2011.04.19 16:26:55 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{3FF9804E-B80D-4DFD-91C6-56CB09E907EE}
[2011.04.18 16:18:30 | 004,223,008 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\NVStWiz.exe
[2011.04.18 16:15:25 | 000,705,536 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\cohelper.dll
[2011.04.18 13:09:21 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{C88ADE74-5F43-47A1-BE6F-A9599E07B0B2}
[2011.04.17 08:54:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Electronic Arts
[2011.04.17 08:54:22 | 000,000,000 | ---D | C] -- C:\ProgramData\EA Core
[2011.04.17 08:54:21 | 000,000,000 | ---D | C] -- C:\Users\XXX\Documents\Electronic Arts
[2011.04.17 08:41:59 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft WSE
[2011.04.13 18:42:45 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{F830BCC6-F6FE-4A04-BC6F-AB57CCCC0B60}
[2011.04.13 17:02:16 | 000,512,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll
[2011.04.13 17:02:16 | 000,430,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll
[2011.04.13 17:02:08 | 000,671,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2011.04.13 17:02:08 | 000,389,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2011.04.13 17:02:07 | 000,471,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2011.04.13 17:02:07 | 000,380,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2011.04.13 17:02:07 | 000,193,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2011.04.13 17:02:07 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieencode.dll
[2011.04.13 17:02:02 | 002,041,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2011.04.13 17:00:59 | 000,292,864 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2011.04.13 17:00:58 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2011.04.13 17:00:41 | 001,162,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc42u.dll
[2011.04.13 17:00:41 | 001,136,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc42.dll
[2011.04.13 17:00:32 | 000,025,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dnscacheugc.exe
[2011.04.11 19:02:35 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{8BBF2F40-8056-457B-BB84-D590D20D6117}
[2011.04.11 15:00:31 | 000,000,000 | ---D | C] -- C:\Program Files\TeamViewer
[2011.04.10 14:27:59 | 000,000,000 | ---D | C] -- C:\Program Files\Firefly Studios
[2011.04.09 15:55:04 | 000,000,000 | ---D | C] -- C:\Users\XXX\Desktop\Projekt 'Gone Forever'
[2011.04.06 19:58:41 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{116E227F-EEB5-4BB3-B04B-A003F6C6F66C}
[2011.04.05 19:01:05 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{508B8996-0C4E-4F5E-9B7E-56AA9ACCC308}
[2011.04.04 20:33:25 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{219C707D-BEE3-41A1-BBAA-321FDD8F0C02}
[2011.04.03 18:52:00 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{B053FA9C-42BC-45BE-85E2-4D8544D0FC4C}
[2011.04.02 21:54:09 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{B46EE753-F79E-435F-AB28-1878D5345107}
[2011.03.31 18:02:21 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{5B2588FF-3BC2-413B-B3FE-9C281814D2B7}
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.04.30 17:30:22 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.04.30 17:30:20 | 000,032,879 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2011.04.30 17:30:19 | 000,032,879 | ---- | M] () -- C:\ProgramData\nvModes.001
[2011.04.30 17:27:29 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.04.30 17:25:11 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.04.30 17:25:10 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.04.30 17:24:52 | 1878,163,456 | -HS- | M] () -- C:\hiberfil.sys
[2011.04.30 17:00:22 | 000,000,866 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.04.30 11:52:30 | 000,004,096 | ---- | M] () -- C:\Users\Public\Documents\00001BF6.LCS
[2011.04.30 11:45:36 | 000,001,043 | ---- | M] () -- C:\Users\XXX\Desktop\Starte Wildlife Park 3 Demo.lnk
[2011.04.30 10:41:10 | 000,670,708 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.04.30 10:41:10 | 000,631,438 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.04.30 10:41:10 | 000,143,876 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.04.30 10:41:10 | 000,118,064 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.04.27 16:46:21 | 000,511,290 | ---- | M] () -- C:\Users\XXX\Documents\WoWScrnShot_042711_164511.jpg
[2011.04.25 15:43:36 | 000,244,711 | ---- | M] () -- C:\Users\XXX\Documents\WoWScrnShot_042511_154240.jpg
[2011.04.24 23:35:13 | 000,235,916 | ---- | M] () -- C:\Users\XXX\Documents\WoWScrnShot_042411_233235.jpg
[2011.04.22 12:19:05 | 000,001,356 | ---- | M] () -- C:\Users\XXX\AppData\Local\d3d9caps.dat
[2011.04.17 08:41:00 | 000,002,019 | ---- | M] () -- C:\Users\Public\Desktop\Die*Sims™*Mittelalter.lnk
[2011.04.13 17:29:54 | 000,254,160 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.04.11 18:33:44 | 034,741,575 | ---- | M] () -- C:\Users\XXX\Documents\coole gang - bitte abspielen.mp4
[2011.04.11 15:00:39 | 000,000,915 | ---- | M] () -- C:\Users\Public\Desktop\TeamViewer 6.lnk
[2011.04.09 15:36:49 | 000,208,896 | ---- | M] () -- C:\Users\XXX\Desktop\skype remix.MSWMM
[2011.04.02 19:57:51 | 261,414,153 | ---- | M] () -- C:\Windows\MEMORY.DMP
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.04.30 17:00:22 | 000,000,866 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.04.30 11:48:58 | 000,004,096 | ---- | C] () -- C:\Users\Public\Documents\00001BF6.LCS
[2011.04.30 11:45:36 | 000,001,043 | ---- | C] () -- C:\Users\XXX\Desktop\Starte Wildlife Park 3 Demo.lnk
[2011.04.30 10:45:08 | 000,000,818 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011.04.27 16:45:56 | 000,511,290 | ---- | C] () -- C:\Users\XXX\Documents\WoWScrnShot_042711_164511.jpg
[2011.04.25 15:43:09 | 000,244,711 | ---- | C] () -- C:\Users\XXX\Documents\WoWScrnShot_042511_154240.jpg
[2011.04.24 23:34:53 | 000,235,916 | ---- | C] () -- C:\Users\XXX\Documents\WoWScrnShot_042411_233235.jpg
[2011.04.18 16:15:25 | 000,006,136 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2011.04.17 08:41:00 | 000,002,019 | ---- | C] () -- C:\Users\Public\Desktop\Die*Sims™*Mittelalter.lnk
[2011.04.11 18:16:56 | 034,741,575 | ---- | C] () -- C:\Users\XXX\Documents\coole gang - bitte abspielen.mp4
[2011.04.11 15:00:39 | 000,000,927 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 6.lnk
[2011.04.11 15:00:39 | 000,000,915 | ---- | C] () -- C:\Users\Public\Desktop\TeamViewer 6.lnk
[2011.04.09 15:36:49 | 000,208,896 | ---- | C] () -- C:\Users\XXX\Desktop\skype remix.MSWMM
[2010.12.31 22:37:03 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2010.11.14 14:13:57 | 000,000,034 | ---- | C] () -- C:\Windows\cdplayer.ini
[2010.10.23 16:14:44 | 000,000,222 | ---- | C] () -- C:\Users\XXX\AppData\Local\Temp1812435.dat
[2010.10.14 02:36:44 | 000,179,263 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2010.07.21 14:12:13 | 000,032,879 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2010.07.21 14:12:13 | 000,032,879 | ---- | C] () -- C:\ProgramData\nvModes.001
[2010.07.01 16:07:53 | 000,000,009 | ---- | C] () -- C:\Windows\ULEAD32.INI
[2010.04.07 23:09:58 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2010.04.07 23:09:57 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2010.04.07 14:19:36 | 000,015,573 | ---- | C] () -- C:\Windows\System32\drivers\fwlanusbn.bin
[2010.02.11 07:30:38 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2010.01.12 15:29:44 | 000,000,410 | ---- | C] () -- C:\Windows\{27018D57-D152-44EF-BCE0-5E3B3445EABE}_WiseFW.ini
[2009.12.28 15:13:00 | 000,000,161 | ---- | C] () -- C:\Users\XXX\AppData\Roaming\default.rss
[2009.12.28 15:13:00 | 000,000,000 | ---- | C] () -- C:\Users\XXX\AppData\Roaming\downloads.m3u
[2009.11.19 15:26:56 | 000,000,041 | -HS- | C] () -- C:\ProgramData\.zreglib
[2009.08.04 19:36:49 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.08.04 19:36:49 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009.06.16 22:24:04 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2009.04.24 00:29:16 | 000,189,051 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2009.02.20 19:18:46 | 000,097,792 | ---- | C] () -- C:\Users\XXX\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.01.01 22:55:13 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2008.12.28 12:01:04 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008.12.27 12:13:43 | 000,000,713 | ---- | C] () -- C:\Windows\disney.ini
[2008.12.13 21:00:45 | 000,022,328 | ---- | C] () -- C:\Users\XXX\AppData\Roaming\PnkBstrK.sys
[2008.12.13 21:00:30 | 000,107,832 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe
[2008.12.12 16:52:21 | 000,045,568 | ---- | C] () -- C:\Windows\UniFish3.exe
[2008.12.12 16:22:15 | 000,001,356 | ---- | C] () -- C:\Users\XXX\AppData\Local\d3d9caps.dat
[2008.10.07 09:13:30 | 000,197,912 | ---- | C] () -- C:\Windows\System32\physxcudart_20.dll
[2008.10.07 09:13:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll
[2008.01.21 09:15:58 | 000,670,708 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2008.01.21 09:15:58 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2008.01.21 09:15:58 | 000,143,876 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2008.01.21 09:15:58 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:47:37 | 000,254,160 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:33:01 | 000,631,438 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,118,064 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2002.09.18 00:45:00 | 000,119,808 | ---- | C] () -- C:\Windows\lsb_un20.exe
[1996.04.03 21:33:26 | 000,005,248 | ---- | C] () -- C:\Windows\System32\giveio.sys
 
========== LOP Check ==========
 
[2011.01.27 20:17:05 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\.minecraft
[2010.08.02 14:48:01 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\AnvSoft
[2011.03.20 12:29:19 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Ashampoo
[2011.03.20 12:01:24 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Canneverbe Limited
[2009.07.14 12:49:29 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Command & Conquer 3 Kanes Rache
[2009.07.09 16:13:37 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Command & Conquer 3 Tiberium Wars
[2010.12.02 15:48:26 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\de.3m5.wendel.flcd.FLCDB.4E7DF207D694E815646D9C9DD7DC91A41EB7FD23.1
[2011.02.18 19:19:23 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.03.26 12:34:03 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\gtk-2.0
[2011.04.26 11:09:51 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\ICQ
[2010.12.24 22:42:16 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Leadertech
[2010.07.03 22:41:33 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\LolClient
[2009.10.29 15:18:16 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\MP3Rocket
[2010.11.14 14:16:44 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\NCH Swift Sound
[2010.09.16 14:28:51 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Notepad++
[2009.02.24 21:46:15 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\OpenOffice.org
[2010.06.13 20:39:54 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\phonostar GmbH
[2009.08.22 14:08:42 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Propellerhead Software
[2011.04.30 11:48:51 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\ProtectDISC
[2010.07.13 22:14:07 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Publish Providers
[2010.09.18 10:17:42 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\QIP
[2010.07.13 22:14:50 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Sony
[2010.05.13 13:53:37 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\SPORE Creature Creator
[2011.04.11 15:01:00 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\TeamViewer
[2009.12.26 00:58:01 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Teeworlds
[2010.05.31 17:33:10 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\TS3Client
[2011.04.30 17:23:51 | 000,032,634 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 64 bytes -> C:\Users\XXX\I've been looking for Grindcore.avi:TOC.WMV
@Alternate Data Stream - 24 bytes -> C:\Windows:8917AFFB20020C2F

< End of report >
         

OTL Extras logfile created on: 30.04.2011 17:32:38 - Run 1
OTL by OldTimer - Version 3.2.22.3     Folder = C:\Users\XXX\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 41,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 68,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 232,88 Gb Total Space | 57,05 Gb Free Space | 24,50% Space Free | Partition Type: NTFS
 
Computer Name: XXX | User Name: XXX | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0306F3E2-9C81-406F-A37F-7A3BBBBEA536}" = lport=8395 | protocol=6 | dir=in | name=league of legends launcher | 
"{174C0CE7-0769-447A-A02B-1D386E4EF259}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{1A59280C-1696-4CEB-BC34-A5C5D8F22363}" = rport=445 | protocol=6 | dir=out | app=system | 
"{20FADCBB-9755-4E52-93F5-BCE7B4059346}" = lport=138 | protocol=17 | dir=in | app=system | 
"{2A538D11-AAE4-473F-80EA-FD9B8A469BFD}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{2D14A448-6CE3-437B-87DC-7D855E123E3B}" = lport=8395 | protocol=17 | dir=in | name=league of legends launcher | 
"{3D7BEC21-3A78-4A54-B297-CE5B8FFB66CA}" = rport=137 | protocol=17 | dir=out | app=system | 
"{5129C9C2-C1CA-4ECA-84F1-D188C5ED5D88}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{5BCC88C8-E477-4AAE-BF86-478B56A31C74}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{61C6220F-2710-45AB-843D-9C8B086365F2}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{63680296-963E-4DDB-B29F-730F80968A89}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{6C6B9830-B4AA-4A0D-B20F-9130F1EF05F0}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{6C85F2CA-C9E1-43BD-AE68-AD499E2F2492}" = lport=8396 | protocol=6 | dir=in | name=league of legends launcher | 
"{7508B32D-AFA7-4670-BA46-3ECF0C7739CE}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{76396E19-DA5D-4F85-9095-A64C740EBA23}" = lport=139 | protocol=6 | dir=in | app=system | 
"{95732DBD-26A8-466D-8DD0-CA8CC9897CF0}" = lport=445 | protocol=6 | dir=in | app=system | 
"{A7EEA845-722D-4997-93FA-84FE37C3F725}" = lport=8396 | protocol=17 | dir=in | name=league of legends launcher | 
"{BCD479E1-438D-4CAC-B7C0-0C918610E009}" = lport=8394 | protocol=17 | dir=in | name=league of legends launcher | 
"{C013AB1A-19B9-4B21-BF71-E6D2A9E5C514}" = rport=139 | protocol=6 | dir=out | app=system | 
"{C30A0653-8CEC-4D48-BD61-10E7E50B93A3}" = lport=8394 | protocol=6 | dir=in | name=league of legends launcher | 
"{C4DA8887-3DC1-433E-BF28-4BA6A5CA04F8}" = lport=137 | protocol=17 | dir=in | app=system | 
"{CDD1BD0B-323F-484F-B20E-23E3070FDAE7}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{DDA27137-DEFD-4147-B86C-9A05A3E4D119}" = rport=138 | protocol=17 | dir=out | app=system | 
"{E12D4EC0-06C8-4AE6-A19D-24012871C2C8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{F1B93033-C511-449D-9347-4A55334EFE82}" = lport=3724 | protocol=6 | dir=in | name=blizzard downloader: 3724 | 
"{F2A662CE-F5D6-41D0-8A8A-BB4C1D13AF2D}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework\v4.0.30319\smsvchost.exe | 
"{F37D1D76-0C45-41FF-9351-0A9423C17C28}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{FFF66874-9EC2-467B-A684-B93AD924D95D}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{026ED4C1-ACA5-4880-AFD6-EC42668F1FD5}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\txnudel18\day of defeat source\hl2.exe | 
"{02D46EE0-531C-44F2-AA52-7E74DB80CE9A}" = protocol=17 | dir=in | app=c:\users\XXX\downloads\videoconverter_setup.exe | 
"{033E345A-D14A-4845-BF33-677C5C05A34D}" = protocol=17 | dir=in | app=c:\program files\xblades\xblades.exe | 
"{0DE67D9C-B036-4D2E-AF52-EAA4EFFF24DA}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\trackmania nations forever\tmforeverlauncher.exe | 
"{1192FAD7-4433-4B3C-AB71-049DF46C9682}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\txnudel18\counter-strike source\hl2.exe | 
"{11B34716-2180-44EB-878A-B554D58EAC8A}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{15636E99-7007-4C20-8D38-DFE3F0C70BA0}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe | 
"{1936A750-313A-4716-B4CC-F3CAB39E73FD}" = protocol=6 | dir=in | app=c:\program files\world of warcraft official\launcher.exe | 
"{1C050A66-4A43-4F98-BAB2-1A996251322F}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{1CEB9585-239D-4B60-A17B-046A171E67D2}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\trackmania nations forever\tmforever.exe | 
"{1FB2D413-CF84-4E5C-975B-85D702FBAEFF}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{22DFB616-4127-4B5B-B089-033B0E3F4AEB}" = protocol=6 | dir=in | app=c:\program files\xblades\xblades.exe | 
"{2723388B-69A8-4D53-B9E9-468651868567}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version6\teamviewer.exe | 
"{28D41F80-ABA0-478F-B2FB-B9A3F4E84A65}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.0.9.9551-to-3.1.0.9767-dede-downloader.exe | 
"{2F6F3C9A-1DDC-4103-8033-BE35FE37757D}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\txnudel18\day of defeat source\hl2.exe | 
"{35FFA151-248C-4688-AA55-16EE1D26EE84}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\txnudel18\counter-strike source\hl2.exe | 
"{36E65C6F-E605-4639-B4D0-D34095C99C6E}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\trackmania nations forever\tmforever.exe | 
"{3AE11712-6623-4DA1-9D1C-A5D14F547812}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{3C1E1DED-8A85-4B04-82F8-9B0B62D3159C}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\trackmania nations forever\tmforeverlauncher.exe | 
"{45123B98-5E9E-4CD5-9AA5-AA6098381015}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version6\teamviewer_service.exe | 
"{4681CEF1-EDF5-430B-BE16-1D333A5B077F}" = protocol=6 | dir=in | app=c:\program files\league of legends\air\lolclient.exe | 
"{4A8311B6-84E1-4631-8C69-27885997BD84}" = protocol=17 | dir=in | app=c:\program files\electronic arts\battleforge\battleforge.exe | 
"{4E8D8DC3-F2EC-4DFA-93A0-30085E0B28A3}" = protocol=17 | dir=in | app=c:\programdata\nexoneu\ngm\ngm.exe | 
"{4EAE00CC-CC21-4AC9-A6EE-C22BF18577CC}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{5A0A1DA6-3147-48F6-B736-D41A10A02F40}" = protocol=17 | dir=in | app=c:\program files\thq\gas powered games\gpgnet\gpg.multiplayer.client.exe | 
"{5A9AC4DA-365F-4AF4-9E58-0584FDF319A5}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{5B9D6F4A-460D-4892-8EF0-EAB9ACD70147}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe | 
"{5CF91297-9EB2-4D06-A270-C59546292762}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{5F7980C2-65B0-419D-A5D3-20828EE35C5D}" = protocol=17 | dir=in | app=c:\program files\electronic arts\battleforge\bootstrapper.exe | 
"{60A16EB2-3B4B-45DD-A02B-F810E0725B4B}" = dir=in | app=c:\program files\electronic arts\command & conquer 3 kanes rache\retailexe\1.0\cnc3ep1.dat | 
"{633D1A6E-9C2C-42EB-B4C5-0B96E4008B61}" = protocol=6 | dir=in | app=c:\program files\world of warcraft official\launcher.patch.exe | 
"{63929DF8-31FD-4AB7-9A5A-905483011616}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\txnudel18\day of defeat source\hl2.exe | 
"{68D59BB1-380A-4F9D-AE88-40E357BC9251}" = protocol=17 | dir=in | app=c:\program files\league of legends\game\league of legends.exe | 
"{6BF52568-5F84-4D97-B213-2B9FDD329D29}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{72FEB34F-2937-4CC8-88AF-F5F36ED87A8E}" = protocol=6 | dir=in | app=c:\programdata\nexonus\ngm\ngm.exe | 
"{7812A4ED-2E36-4800-B35F-06825B62E3E7}" = protocol=6 | dir=in | app=c:\users\XXX\downloads\videoconverter_setup.exe | 
"{7882FE34-498D-4923-BF0D-B3272D19A094}" = protocol=6 | dir=in | app=c:\program files\xblades\launcher.exe | 
"{7C37BCC0-285D-41A8-AE44-3B6D8A48335C}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{80493DB6-F4F9-47FC-ADA4-EF20461E5F14}" = protocol=17 | dir=in | app=c:\programdata\nexonus\ngm\ngm.exe | 
"{893F9885-C70D-4586-BA44-C1D43EDBCD17}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe | 
"{8CAD818C-11DB-4DCB-9594-B88D2A658BF4}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{8F8311A3-88A5-4DEC-A18C-49398312FFF0}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{8FF1D142-1DC0-4D1F-A611-3E91ABE3710D}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.0.9.9551-to-3.1.0.9767-dede-downloader.exe | 
"{90ABE924-5B74-4EC3-8A11-59A9D817C3A3}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{941E72A7-B732-48BD-86A0-74636C36AB45}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 
"{96711F9A-9BA2-417D-8C57-939467A63F92}" = protocol=17 | dir=in | app=c:\program files\world of warcraft official\launcher.patch.exe | 
"{9804EE36-60D7-40B7-BE00-C435875ED7BA}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{A7AEEDB8-CC5F-4F38-A7AE-D0F585B2A59B}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe | 
"{A9794E76-5C67-485F-9343-37B2DF3FEE56}" = protocol=6 | dir=in | app=c:\programdata\nexoneu\ngm\ngm.exe | 
"{B02FBC98-9680-4B46-9C11-B650946A4E85}" = protocol=6 | dir=in | app=c:\program files\thq\gas powered games\gpgnet\gpg.multiplayer.client.exe | 
"{B28F880B-5827-46EA-BDB1-ECE1B1F3B141}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{B70582CF-8C63-47E8-9743-29EA07D3CD71}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{B7374434-FD22-4F78-9AF9-EB2A4F65193E}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{B9314FE6-35C8-41E3-81E5-ACFE5ECA4C7B}" = protocol=6 | dir=in | app=c:\program files\electronic arts\battleforge\battleforge.exe | 
"{BAE5740B-D651-4C1B-9FC3-E20EAC38EFFA}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version6\teamviewer_service.exe | 
"{BBE3DA33-6339-43B8-8EB3-7E9492CA9376}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{C9D08A51-3A75-4C0E-A951-D13F370F2394}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe | 
"{CA19EF67-8578-4C94-A396-1ED3354062B2}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{CDED4011-291E-4ED0-AA1E-1DEBAF564622}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{D4EE839E-628B-4408-A92C-7AEC3AA91A84}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{DA10C03B-E910-41D4-9CD1-B20E34D775CA}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{DD1C9532-CC97-4536-9D43-48D63F975EE2}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 
"{DE2A38A0-5B97-488C-B221-B38EC1BA4E19}" = protocol=17 | dir=in | app=c:\program files\league of legends\air\lolclient.exe | 
"{E11952CB-32EE-4869-8472-3599A0CAC40C}" = protocol=17 | dir=in | app=c:\program files\world of warcraft official\launcher.exe | 
"{E88F6BAF-A7DC-44DB-9BB0-691FE107EABF}" = protocol=6 | dir=in | app=c:\program files\electronic arts\battleforge\bootstrapper.exe | 
"{EA5476CB-0F15-4B59-BC12-C15F1C9A9208}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{F0E1C797-3798-4FD4-83BA-ECB93C4BEE02}" = protocol=6 | dir=in | app=c:\program files\league of legends\game\league of legends.exe | 
"{F6793210-5083-44B9-BC24-6705378089C7}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\txnudel18\day of defeat source\hl2.exe | 
"{FA23EE17-2D14-4BD0-B19A-330AC70961AB}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{FB321834-4439-42FF-B2E3-DE99071311BB}" = protocol=17 | dir=in | app=c:\program files\xblades\launcher.exe | 
"{FB543ABA-CFD2-468D-AB57-974A53DF8829}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version6\teamviewer.exe | 
"{FBA6D5D6-5F41-4D4D-9740-C43633D46FAE}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"TCP Query User{0A7F7F1A-AFFE-4DEB-BDEC-3A683E52CCDE}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe | 
"TCP Query User{1E3EF580-4046-4AFC-8A9D-B34E8CBF5953}C:\program files\world of warcraft official\launcher.exe" = protocol=6 | dir=in | app=c:\program files\world of warcraft official\launcher.exe | 
"TCP Query User{2B1A9D42-B406-4B9F-B031-92878944A632}C:\program files\wow!!\launcher.exe" = protocol=6 | dir=in | app=c:\program files\wow!!\launcher.exe | 
"TCP Query User{30B20F6E-AA97-43B7-A4D3-56FA43827575}C:\users\XXX\appdata\local\temp\rar$ex05.148\wow-dede-installer-downloader.exe" = protocol=6 | dir=in | app=c:\users\XXX\appdata\local\temp\rar$ex05.148\wow-dede-installer-downloader.exe | 
"TCP Query User{33FBE456-D9D0-4734-93D7-2AAEAFC0AFE1}C:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe" = protocol=6 | dir=in | app=c:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe | 
"TCP Query User{3517994D-5807-4968-B300-F93BF9761B4E}C:\program files\littlefighter2\lf2_v2.0\lf2.exe" = protocol=6 | dir=in | app=c:\program files\littlefighter2\lf2_v2.0\lf2.exe | 
"TCP Query User{4267079E-CD7F-486B-9483-5702051FF240}C:\users\public\games\world of warcraft trial\launcher.exe" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft trial\launcher.exe | 
"TCP Query User{48C67306-C8BD-4257-AA48-6842897D0ACE}C:\program files\world of warcraft\wow-3.3.3.11723-to-3.3.5.12213-dede-downloader.exe" = protocol=6 | dir=in | app=c:\program files\world of warcraft\wow-3.3.3.11723-to-3.3.5.12213-dede-downloader.exe | 
"TCP Query User{509C3A5A-CCF8-4BDF-8454-3D1B908BBD93}C:\program files\gamers.irc\mirc.exe" = protocol=6 | dir=in | app=c:\program files\gamers.irc\mirc.exe | 
"TCP Query User{5B574814-344A-44BD-BE64-A72CEC694F48}C:\program files\duty calls\binaries\win32\dutycalls.exe" = protocol=6 | dir=in | app=c:\program files\duty calls\binaries\win32\dutycalls.exe | 
"TCP Query User{5CD6A04B-0325-4227-ADC0-271992D9E17E}C:\program files\steam\steamapps\txnudel18\half-life 2 deathmatch\hl2.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\txnudel18\half-life 2 deathmatch\hl2.exe | 
"TCP Query User{5ED840D9-C2AA-4576-B9A6-662499621B9C}C:\program files\serious sam 2\bin\sam2.exe" = protocol=6 | dir=in | app=c:\program files\serious sam 2\bin\sam2.exe | 
"TCP Query User{72129B08-58E0-49AA-96C5-5A53408B38F2}C:\program files\java\jre1.6.0_01\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre1.6.0_01\bin\javaw.exe | 
"TCP Query User{72C9792B-9F0B-421A-B504-68CA3FDB1C28}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"TCP Query User{8220C040-DA0E-4A77-8EA8-8946645D1ABD}C:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe" = protocol=6 | dir=in | app=c:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe | 
"TCP Query User{84B5DDB1-DD3B-43AE-8D46-97148A8C48C3}C:\program files\world of warcraft\launcher.exe" = protocol=6 | dir=in | app=c:\program files\world of warcraft\launcher.exe | 
"TCP Query User{8E066FF7-75F3-404F-9D77-BD616A6CE6DF}C:\program files\team17\worms armageddon\wa.exe" = protocol=6 | dir=in | app=c:\program files\team17\worms armageddon\wa.exe | 
"TCP Query User{B900FD0D-2EC9-4C64-98A5-95451A119353}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"TCP Query User{C762DB23-97E0-4515-B723-7CFAFF4B65F4}C:\users\XXX\appdata\local\temp\rar$ex04.234\wow-burningcrusade-dede-installer-downloader.exe" = protocol=6 | dir=in | app=c:\users\XXX\appdata\local\temp\rar$ex04.234\wow-burningcrusade-dede-installer-downloader.exe | 
"TCP Query User{C7D26486-55DC-4E02-941D-3DA3246CE344}C:\program files\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe | 
"TCP Query User{C9B404A0-1EA7-49EC-8FFF-6B66FF17F24A}C:\program files\empire interactive\flatout2\flatout2.exe" = protocol=6 | dir=in | app=c:\program files\empire interactive\flatout2\flatout2.exe | 
"TCP Query User{DDD412BA-714F-48E0-8B36-4D08A9B1FB3A}C:\program files\thq\dawn of war - dark crusade\darkcrusade.exe" = protocol=6 | dir=in | app=c:\program files\thq\dawn of war - dark crusade\darkcrusade.exe | 
"TCP Query User{E105AABD-474C-4A8A-9643-2AB97AAF2ECE}C:\program files\electronic arts\armies of exigo\exigo.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\armies of exigo\exigo.exe | 
"TCP Query User{EC6B5404-064C-43AA-B441-1E91F3C0DBBF}C:\program files\wow!!!\dark-thunder\launcher.exe" = protocol=6 | dir=in | app=c:\program files\wow!!!\dark-thunder\launcher.exe | 
"TCP Query User{EF9BB07E-8868-4A67-B258-DD80C184BF80}C:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe" = protocol=6 | dir=in | app=c:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe | 
"TCP Query User{FE3C417D-E0C6-4CC6-950F-7A1574F3CD98}C:\program files\unreal tournament 3 (lg)\binaries\ut3.exe" = protocol=6 | dir=in | app=c:\program files\unreal tournament 3 (lg)\binaries\ut3.exe | 
"UDP Query User{0E4B664C-2F7F-4079-8B76-47D25CC92D9B}C:\program files\team17\worms armageddon\wa.exe" = protocol=17 | dir=in | app=c:\program files\team17\worms armageddon\wa.exe | 
"UDP Query User{1A194E0A-557C-4BC4-A94B-FDDD43E76D12}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"UDP Query User{2BF720B7-D3CC-4459-B078-5587C3433836}C:\program files\world of warcraft official\launcher.exe" = protocol=17 | dir=in | app=c:\program files\world of warcraft official\launcher.exe | 
"UDP Query User{2EF47BD3-7CD5-4622-9FFC-DA877C2FC2A5}C:\program files\unreal tournament 3 (lg)\binaries\ut3.exe" = protocol=17 | dir=in | app=c:\program files\unreal tournament 3 (lg)\binaries\ut3.exe | 
"UDP Query User{3C2A5A80-28FD-4E56-B7F6-0AF2F31DE6DC}C:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe" = protocol=17 | dir=in | app=c:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe | 
"UDP Query User{3EA1DB5B-999A-4B96-BF1C-CC2529BD8880}C:\program files\serious sam 2\bin\sam2.exe" = protocol=17 | dir=in | app=c:\program files\serious sam 2\bin\sam2.exe | 
"UDP Query User{47C9E7F5-6D1C-4951-8D70-47D662A2F224}C:\program files\electronic arts\armies of exigo\exigo.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\armies of exigo\exigo.exe | 
"UDP Query User{509C7ECC-B927-4912-A9BF-D392F4F045C6}C:\users\XXX\appdata\local\temp\rar$ex05.148\wow-dede-installer-downloader.exe" = protocol=17 | dir=in | app=c:\users\XXX\appdata\local\temp\rar$ex05.148\wow-dede-installer-downloader.exe | 
"UDP Query User{5F4DE307-1049-40C9-9C9B-79DC2C5D720F}C:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe" = protocol=17 | dir=in | app=c:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe | 
"UDP Query User{6E5926F5-740B-464F-B49A-82D6CAEB1DCC}C:\users\XXX\appdata\local\temp\rar$ex04.234\wow-burningcrusade-dede-installer-downloader.exe" = protocol=17 | dir=in | app=c:\users\XXX\appdata\local\temp\rar$ex04.234\wow-burningcrusade-dede-installer-downloader.exe | 
"UDP Query User{753C0D5E-8AE4-4823-8187-5300BD1F9A5F}C:\program files\littlefighter2\lf2_v2.0\lf2.exe" = protocol=17 | dir=in | app=c:\program files\littlefighter2\lf2_v2.0\lf2.exe | 
"UDP Query User{784BCB21-66C5-4DA6-85FE-14B86E464B54}C:\program files\steam\steamapps\txnudel18\half-life 2 deathmatch\hl2.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\txnudel18\half-life 2 deathmatch\hl2.exe | 
"UDP Query User{79704B58-23A6-431E-842F-140B3F018B2B}C:\users\public\games\world of warcraft trial\launcher.exe" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft trial\launcher.exe | 
"UDP Query User{7DC24D1B-25C7-4870-8C26-552066C0DE24}C:\program files\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe | 
"UDP Query User{85145550-EF6C-433E-9AF0-6C356E4B62A0}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe | 
"UDP Query User{8E55ED00-C2ED-4FE4-8F53-08ACF5F346F8}C:\program files\thq\dawn of war - dark crusade\darkcrusade.exe" = protocol=17 | dir=in | app=c:\program files\thq\dawn of war - dark crusade\darkcrusade.exe | 
"UDP Query User{91CDE51B-CAC0-40A1-AEC8-8089DA2DE7D2}C:\program files\java\jre1.6.0_01\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre1.6.0_01\bin\javaw.exe | 
"UDP Query User{A80B53FD-002D-4C41-94AE-B69361E5D66A}C:\program files\wow!!\launcher.exe" = protocol=17 | dir=in | app=c:\program files\wow!!\launcher.exe | 
"UDP Query User{AD0AD7E4-9EF2-4251-BFC6-DA44B684B83F}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"UDP Query User{AFB0FA4D-A7FA-4484-A515-D2FE470EBB01}C:\program files\world of warcraft\wow-3.3.3.11723-to-3.3.5.12213-dede-downloader.exe" = protocol=17 | dir=in | app=c:\program files\world of warcraft\wow-3.3.3.11723-to-3.3.5.12213-dede-downloader.exe | 
"UDP Query User{B084B04E-6142-4FA5-970E-95604CDE2C42}C:\program files\gamers.irc\mirc.exe" = protocol=17 | dir=in | app=c:\program files\gamers.irc\mirc.exe | 
"UDP Query User{B665952B-7990-43DE-BFEE-E3D1B52573BD}C:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe" = protocol=17 | dir=in | app=c:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe | 
"UDP Query User{B894E9CB-C207-49AF-B787-849D364475D5}C:\program files\duty calls\binaries\win32\dutycalls.exe" = protocol=17 | dir=in | app=c:\program files\duty calls\binaries\win32\dutycalls.exe | 
"UDP Query User{C9E0E35A-9F73-4091-97F2-17E482EDAE7A}C:\program files\empire interactive\flatout2\flatout2.exe" = protocol=17 | dir=in | app=c:\program files\empire interactive\flatout2\flatout2.exe | 
"UDP Query User{CCAA270A-C7F1-481E-8356-BF42EA1796D5}C:\program files\world of warcraft\launcher.exe" = protocol=17 | dir=in | app=c:\program files\world of warcraft\launcher.exe | 
"UDP Query User{FE47344A-4F02-44F0-98AC-67AF7A7FFB7A}C:\program files\wow!!!\dark-thunder\launcher.exe" = protocol=17 | dir=in | app=c:\program files\wow!!!\dark-thunder\launcher.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0125D081-30D0-4A97-82A8-C28D444B6256}" = Microsoft SQL Server Compact 3.5 SP2 DEU
"{0138F525-6C8A-333F-A105-14AE030B9A54}" = Visual C++ 9.0 CRT (x86) WinSXS MSM
"{01521746-02A6-4A72-00BD-A285DF6B80C6}" = Die Sims 2: Wilde Campus-Jahre
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{04B45310-A5FE-4425-BFCA-1A6D8920DE74}" = OpenOffice.org 3.0
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{086BADF8-9B1F-4E89-B207-2EDA520972D6}" = Grand Theft Auto San Andreas
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0AEB967F-1D12-43C8-A59C-D93DA8EE4A4E}" = Duty Calls
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0C826C5B-B131-423A-A229-C71B3CACCD6A}" = CDDRV_Installer
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319
"{1D328E11-3B0C-388C-835D-C9C20E8C7734}" = Microsoft Help Viewer 1.0 Language Pack - DEU
"{1FDA5A37-B22D-43FF-B582-B8964050DC13}" = Microsoft Games for Windows - LIVE Redistributable
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 21
"{27018D57-D152-44EF-BCE0-5E3B3445EABE}" = X-Blades
"{3101CB58-3482-4D21-AF1A-7057FC935355}" = KhalInstallWrapper
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java(TM) SE Runtime Environment 6 Update 1
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{47C39E4A-28F2-33B1-B9B7-97F24E52D917}" = Microsoft Help Viewer 1.0
"{47FDEFC7-BFE6-FD75-41D1-28DD572BD2D9}" = ATI Catalyst Install Manager
"{4817189D-1785-4627-A33C-39FD90919300}" = Die Sims™ 2 Haustiere
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5A08C9D1-37AD-4A8D-90D3-33F92C578AA5}" = Microsoft SQL Server System CLR Types
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{5EE3204B-EF7D-4D3E-91A8-5863910CDF6C}" = Speedport W 100 Stick
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{616C6F39-4CE1-3434-A665-2F6A04C09A7F}" = Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools
"{61AD15B2-50DB-4686-A739-14FE180D4429}" = Windows Live ID Sign-in Assistant
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{68A35043-C55A-4237-88C9-37EE1C63ED71}" = Microsoft Visual J# 2.0 Redistributable Package
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6E7DD182-9FC6-4651-0095-2E666CC6AF35}" = Die Sims 2
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{72263053-50D1-4598-9502-51ED64E54C51}" = Borland Delphi 7
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2
"{7B3577F5-1D82-4C9B-008B-69D026FD8BCA}" = Die Sims 2: Open For Business
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager
"{7E641E46-81DB-4D1D-906A-48342523051C}" = FlatOut2
"{80464ABC-A520-453F-A383-6E7B92E0C3B3}" = Armies of Exigo
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83BEEFB4-8C28-4F4F-8A9D-E0D1ADCE335B}" = Die*Sims*Mittelalter
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{86A4C6D9-29EE-4719-AFA1-BA3341862B83}" = Microsoft Games for Windows - LIVE
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{873E4648-6F6E-47F6-A7B2-A6F8DFABDCE6}" = Windows Live Messenger
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A06714C-F24B-4144-9BA2-788B5DD4F270}_is1" = ICQ Ignore Checker 1.3
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8AF3E926-ED59-11D4-A44B-0000E86D2305}" = Ulead GIF Animator 5 Test
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90687432-4103-416F-B0C9-649D8CBD986F}" = Wildlife Park 2 Demo
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9580813D-94B1-4C28-9426-A441E2BB29A5}" = Counter-Strike: Source
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9DBCF44B-77AC-81D8-0F8E-1E60D6330AC2}" = Catalyst Control Center InstallProxy
"{9E012857-0B5E-40A0-A36A-36751966A79B}_is1" = ICQ Status Checker 1.7
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A106D33E-6B43-42C0-9BFC-D03303261FA7}" = Microsoft SQL Server 2008 R2 Management Objects
"{A498D9EB-927B-459B-85D6-DD6EF8C2C564}" = erLT
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A93944F2-D2D4-4750-BFE7-9A288FEAF2CF}" = Apple Application Support
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.4 - Deutsch
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B7E38540-E355-3503-AFD7-635B2F2F76E1}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974
"{B83FC356-B7C0-441F-8A4D-D71E088E7974}" = NVIDIA PhysX
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C580908C-B3BA-4C19-BD60-16F02F272201}" = BattleForge™
"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE4A3D0F-D1B0-47D1-BF99-3E957C548D12}" = LogMeIn Hamachi
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CFCB8616-A5D1-4281-80E8-389F685BFAE2}" = Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 DEU
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D81641E8-ABF1-3D07-803B-60E8FC619368}" = Microsoft Visual C# 2010 Express - DEU
"{DA507A38-4B2A-40C0-90AC-E30AAA0B757C}" = Vegas Movie Studio Platinum 9.0
"{DFEF49D9-FC95-4301-99B9-2FB91C6ABA06}" = Die Sims™ 2 Vier Jahreszeiten
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.1
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{ECEE0279-785F-4CB3-9F28-E69813234BF8}" = SPORE™ Labor Basisversion
"{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}" = Logitech SetPoint
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F7529650-B9DB-481B-0089-A2AC3C2821C1}" = Die Sims 2: Nightlife
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{F9D54D77-01A4-7D34-6F3C-EDC9F8F466E3}" = Fragen-Lern-CD 4.0
"7-Zip" = 7-Zip 9.14 beta
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"AnalogX AutoTune" = AnalogX AutoTune
"Any Video Converter_is1" = Any Video Converter 3.0.3
"Ashampoo Burning Studio 2010 Advanced_is1" = Ashampoo Burning Studio 2010 Advanced 9.25
"Audiograbber" = Audiograbber 1.83 SE 
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"AVMWLANCLI" = AVM FRITZ!WLAN
"CABAL Online (Europe)_is1" = CABAL Online
"CABAL Online: Illusion Castle Patch_is1" = Cabal Online Europe - Illusion Castle
"CABAL Online_is1" = CABAL Online
"conduitEngine" = Conduit Engine
"de.3m5.wendel.flcd.FLCDB.4E7DF207D694E815646D9C9DD7DC91A41EB7FD23.1" = Fragen-Lern-CD 4.0
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"Fraps" = Fraps (remove only)
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.7
"Free Video to Flash Converter_is1" = Free Video to Flash Converter version 4.2
"Free Video to JPG Converter_is1" = Free Video to JPG Converter version 1.5
"Free Video to MP3 Converter_is1" = Free Video to MP3 Converter version 3.2
"Free YouTube Download_is1" = Free YouTube Download 2.10
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.9.35.324
"GoldWave v5.56" = GoldWave v5.56
"ICQToolbar" = ICQ Toolbar
"InstallShield_{5EE3204B-EF7D-4D3E-91A8-5863910CDF6C}" = Speedport W 100 Stick
"InstallShield_{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager
"League of Legends_is1" = League of Legends
"LogMeIn Hamachi" = LogMeIn Hamachi
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0
"Microsoft Help Viewer 1.0 Language Pack - DEU" = Microsoft Help Viewer 1.0 Language Pack - DEU
"Microsoft Visual C# 2010 Express - DEU" = Microsoft Visual C# 2010 Express - DEU
"Microsoft Visual J# 2.0 Redistributable Package" = Microsoft Visual J# 2.0 Redistributable Package
"Mortal Kombat_is1" = Mortal Kombat
"Mozilla Firefox 4.0.1 (x86 de)" = Mozilla Firefox 4.0.1 (x86 de)
"MyAshampoo Toolbar" = MyAshampoo Toolbar
"Notepad++" = Notepad++
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Pivot 2.3.0 Deutsch" = Pivot 2.3.0 Deutsch
"Plants vs. Zombies" = Plants vs. Zombies
"Steam App 11020" = TrackMania Nations Forever
"Steam App 240" = Counter-Strike: Source
"Steam App 300" = Day of Defeat: Source
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"TeamViewer 6" = TeamViewer 6
"Tunatic" = Tunatic
"Ulead GIF Animator Lite Edition 1.0" = Ulead GIF Animator Lite Edition 1.0
"Uninstall_is1" = Uninstall 1.0.0.1
"Unlocker" = Unlocker 1.9.0
"VLC media player" = VLC media player 1.1.7
"WavePad" = WavePad Sound Editor
"Wildlife Park 3 Demo_is1" = Wildlife Park 3 Demo v1.03
"WinGimp-2.0_is1" = GIMP 2.6.8
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR
"World of Warcraft" = World of Warcraft
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"GeoGebra WebStart" = GeoGebra WebStart
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 01.10.2010 09:22:14 | Computer Name = XXX | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 01.10.2010 09:22:14 | Computer Name = XXX | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 01.10.2010 09:22:15 | Computer Name = XXX | Source = WinMgmt | ID = 10
Description = 
 
Error - 01.10.2010 11:04:53 | Computer Name = XXX | Source = Application Hang | ID = 1002
Description = Programm battleforge.exe, Version 1.2.0.0 arbeitet nicht mehr mit 
Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet 
"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über
 das Problem zu suchen.  Prozess-ID: 17fc  Anfangszeit: 01cb616e57efe5ef  Zeitpunkt der
 Beendigung: 1725
 
Error - 02.10.2010 03:32:49 | Computer Name = XXX | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 02.10.2010 03:32:49 | Computer Name = XXX | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 02.10.2010 03:33:16 | Computer Name = XXX | Source = WinMgmt | ID = 10
Description = 
 
Error - 02.10.2010 07:51:42 | Computer Name = XXX | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 02.10.2010 07:51:42 | Computer Name = XXX | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 02.10.2010 07:52:42 | Computer Name = XXX | Source = WinMgmt | ID = 10
Description = 
 
[ System Events ]
Error - 30.04.2011 11:38:06 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
 
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
 
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
 
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
 
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
 
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
 
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
 
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
 
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
 
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
 
 
< End of report >
         

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6478

Windows 6.0.6002 Service Pack 2
Internet Explorer 7.0.6002.18005

30.04.2011 17:21:45
mbam-log-2011-04-30 (17-21-45).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 151646
Laufzeit: 11 Minute(n), 18 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 3

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Users\XXX\AppData\Local\Temp\comver.dll (Adware.GameSpyArcade) -> Quarantined and deleted successfully.
c:\Users\XXX\AppData\Roaming\avdrn.dat (Malware.Trace) -> Quarantined and deleted successfully.
c:\Users\XXX\AppData\Roaming\fvgqad.dat (Malware.Trace) -> Quarantined and deleted successfully.
         

Hallo

Fixen mit OTL

• Starte bitte die OTL.exe.
  Vista und Win7 User: mit Rechtsklick "als Administrator starten"
• Kopiere nun den Inhalt in die Textbox.

:OTL
O4 - HKCU..\Run: [auditask]  File not found
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab (Oberon Flash Game Host)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O33 - MountPoints2\{2093246f-dc05-11dd-8eff-001e90f7e9a3}\Shell - "" = AutoRun
O33 - MountPoints2\{2093246f-dc05-11dd-8eff-001e90f7e9a3}\Shell\AutoRun\command - "" = E:\pushinst.exe
O33 - MountPoints2\{27a4deb1-eca6-11de-9468-001c4afc5051}\Shell\AutoRun\command - "" = I:\installer.exe
O33 - MountPoints2\{27a4deb1-eca6-11de-9468-001c4afc5051}\Shell\verb\command - "" = I:\installer.exe
O33 - MountPoints2\{3606af13-828e-11de-bdcc-001c4afc5051}\Shell - "" = AutoRun
O33 - MountPoints2\{3606af13-828e-11de-bdcc-001c4afc5051}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
O33 - MountPoints2\{823e65cf-ca16-11de-9806-00191548cc45}\Shell\AutoRun\command - "" = I:\installer.exe
O33 - MountPoints2\{823e65cf-ca16-11de-9806-00191548cc45}\Shell\verb\command - "" = I:\installer.exe
O33 - MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\Shell - "" = AutoRun
O33 - MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\Shell\AutoRun\command - "" = L:\autorun.exe
O33 - MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\Shell\directx\command - "" = L:\DirectX9\dxsetup.exe
O33 - MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\Shell\setup\command - "" = L:\setup.exe
O33 - MountPoints2\{af9c9acf-4235-11df-ab32-001e90f7e9a3}\Shell - "" = AutoRun
O33 - MountPoints2\{af9c9acf-4235-11df-ab32-001e90f7e9a3}\Shell\AutoRun\command - "" = K:\pushinst.exe
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\pushinst.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

@Alternate Data Stream - 64 bytes -> C:\Users\XXX\I've been looking for Grindcore.avi:TOC.WMV
@Alternate Data Stream - 24 bytes -> C:\Windows:8917AFFB20020C2F
:Services

:Reg

:Files

:Commands
[purity]
[emptytemp]
[Reboot]
         

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument.
  Kopiere nun den Inhalt hier in Deinen Thread

Bitte den MBRCheck durchführen
http://www.trojaner-board.de/88319-mbrcheck-exe.html

Anschließend Antivir updaten und mit diesen Einstellungen scannen lassen
http://www.trojaner-board.de/54192-a...tellungen.html
poste die enstandenen Logs bitte wieder hierher.

MFG

All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\auditask deleted successfully.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {D0C0F75C-683A-4390-A791-1ACFD5599AB8}
C:\Windows\Downloaded Program Files\OberonGameHost_dbg.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{D0C0F75C-683A-4390-A791-1ACFD5599AB8}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D0C0F75C-683A-4390-A791-1ACFD5599AB8}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{D0C0F75C-683A-4390-A791-1ACFD5599AB8}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D0C0F75C-683A-4390-A791-1ACFD5599AB8}\ not found.
Starting removal of ActiveX control {D27CDB6E-AE6D-11CF-96B8-444553540000}
C:\Windows\Downloaded Program Files\swflash.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{D27CDB6E-AE6D-11CF-96B8-444553540000}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{D27CDB6E-AE6D-11CF-96B8-444553540000}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2093246f-dc05-11dd-8eff-001e90f7e9a3}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2093246f-dc05-11dd-8eff-001e90f7e9a3}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2093246f-dc05-11dd-8eff-001e90f7e9a3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2093246f-dc05-11dd-8eff-001e90f7e9a3}\ not found.
File E:\pushinst.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{27a4deb1-eca6-11de-9468-001c4afc5051}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27a4deb1-eca6-11de-9468-001c4afc5051}\ not found.
File I:\installer.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{27a4deb1-eca6-11de-9468-001c4afc5051}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27a4deb1-eca6-11de-9468-001c4afc5051}\ not found.
File I:\installer.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3606af13-828e-11de-bdcc-001c4afc5051}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3606af13-828e-11de-bdcc-001c4afc5051}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3606af13-828e-11de-bdcc-001c4afc5051}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3606af13-828e-11de-bdcc-001c4afc5051}\ not found.
File E:\LaunchU3.exe -a not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{823e65cf-ca16-11de-9806-00191548cc45}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{823e65cf-ca16-11de-9806-00191548cc45}\ not found.
File I:\installer.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{823e65cf-ca16-11de-9806-00191548cc45}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{823e65cf-ca16-11de-9806-00191548cc45}\ not found.
File I:\installer.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\ not found.
File L:\autorun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\ not found.
File L:\DirectX9\dxsetup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\ not found.
File L:\setup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{af9c9acf-4235-11df-ab32-001e90f7e9a3}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{af9c9acf-4235-11df-ab32-001e90f7e9a3}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{af9c9acf-4235-11df-ab32-001e90f7e9a3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{af9c9acf-4235-11df-ab32-001e90f7e9a3}\ not found.
File K:\pushinst.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ not found.
File E:\pushinst.exe not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:autocheck autochk * deleted successfully.
Unable to delete ADS C:\Users\XXX\I've been looking for Grindcore.avi:TOC.WMV .
ADS C:\Windows:8917AFFB20020C2F deleted successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: XXX
->Temp folder emptied: 5249620176 bytes
->Temporary Internet Files folder emptied: 133794396 bytes
->Java cache emptied: 28676661 bytes
->FireFox cache emptied: 247081134 bytes
->Flash cache emptied: 877905 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56502 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 684836841 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 6.051,00 mb
 
 
OTL by OldTimer - Version 3.2.22.3 log created on 05032011_000753

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...
         

Die anderen Logs folgen...
PS: Nach dem Neustart erscheint ein PopUp - JavaUpdate verfügbar
Sollte ich das intallieren oder eher nicht?
Danke schonmal

Edit.:
Kann auf den Link http://www.trojaner-board.de/88319-mbrcheck-exe.html nicht zugreifen - habe keine Berechtigung - bitte um Alternative
Werde den PC jetzt runterfahren, hoffe das macht nichts