| keilsteven | 08.06.2013 22:45 |
Hallo Leo,
Danke für die schnelle Antwort,
hier die logs aufgelistet:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 22:02 on 08/06/2013 (A&A)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-OTL Logfile: Code:
OTL Extras logfile created on: 08.06.2013 22:00:36 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\A&A\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,68 Gb Total Physical Memory | 1,60 Gb Available Physical Memory | 43,50% Memory free
7,36 Gb Paging File | 5,09 Gb Available in Paging File | 69,14% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 452,66 Gb Total Space | 390,79 Gb Free Space | 86,33% Space Free | Partition Type: NTFS
Computer Name: ASCHKA | User Name: A&A | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~3\Office12\ONENOTE.EXE "%L"
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Scan with Trojan Remover] -- C:\Program Files (x86)\Trojan Remover\rmvtrjan.exe /d "%1" (Simply Super Software)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~3\Office12\ONENOTE.EXE "%L"
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Scan with Trojan Remover] -- C:\Program Files (x86)\Trojan Remover\rmvtrjan.exe /d "%1" (Simply Super Software)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03ED5FF5-2CD0-48C2-A14D-9E06158B0940}" = lport=445 | protocol=6 | dir=in | app=system |
"{079F3BE5-A8AD-4673-99F4-D4C2CAC47A35}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{1AFF5DB9-7684-46BE-B7E8-976B3316FA8C}" = lport=139 | protocol=6 | dir=in | app=system |
"{373C04E8-81BD-4F37-8C9C-DBB26CECD383}" = lport=2869 | protocol=6 | dir=in | app=system |
"{38C01B50-F651-4281-81B3-8C321CD6976B}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{41579053-A980-488D-8999-064E8ADE79D9}" = rport=139 | protocol=6 | dir=out | app=system |
"{445187AF-A38B-4688-B64E-D117F927F816}" = rport=137 | protocol=17 | dir=out | app=system |
"{489B5A35-DA9B-447F-BA8B-7608E41C1C0C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{4AD5FEDD-E9FD-47C8-90A7-E380FAC9C266}" = rport=10243 | protocol=6 | dir=out | app=system |
"{53E539D1-4164-4B80-BD55-22E440DE6145}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{5546877C-19A7-4A88-9A34-64978955BA1A}" = lport=10243 | protocol=6 | dir=in | app=system |
"{6D0B5CCF-2731-4E8F-8AC2-E2072E7E5279}" = lport=2869 | protocol=6 | dir=in | app=system |
"{70687E83-A416-4358-B839-C5AE8F1B7926}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{82799461-968B-4B81-85C7-031F33F2F8E3}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{8F5BCA95-42B2-4E53-8DDC-14C7BEECA963}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{94205AF5-FB26-4640-ABA2-160DF1E7991A}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{963564AD-FDEA-4F09-B885-4A9ED6EE9D57}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{A2DFBC58-B4F1-491C-8612-7AA1C645CDE8}" = lport=2869 | protocol=6 | dir=in | app=system |
"{B292582D-A5A5-4A86-A5DD-7A8D3D51977B}" = lport=138 | protocol=17 | dir=in | app=system |
"{BB05AF3B-2EB7-44E5-9541-374DB5150BC6}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{BC8F3C69-EC30-4F04-A296-18687972A80A}" = rport=445 | protocol=6 | dir=out | app=system |
"{BD6ABC8B-C1E5-4DD1-9854-6B255A1B20DD}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{D75B20E7-C73A-4F0A-B52D-FACF92672ACD}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{EA89F80A-014C-4DE2-8C0D-B750914E8F40}" = lport=137 | protocol=17 | dir=in | app=system |
"{EAF46D5B-3252-4B83-84C7-FF5648E196FD}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F95C287F-ACBF-42AA-B628-6DEF87D3461B}" = rport=138 | protocol=17 | dir=out | app=system |
"{FEA0496A-BE73-4599-B33E-17E2A52DDECE}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03BF54C3-67B4-4107-BB70-2D3BDB0D1147}" = protocol=17 | dir=in | app=c:\program files (x86)\nvidia corporation\nvidia updatus\daemonu.exe |
"{0804B787-DFE6-495A-A3AF-902BBFDFD1E8}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{087DF774-6011-41C4-B0F8-863DCADE0F71}" = protocol=6 | dir=out | app=system |
"{0A3D273F-560E-40A4-B364-99BDC19F6B08}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{18B1563C-C866-45C7-AE29-F90E725A2D31}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{203C1713-613A-4C42-A6CE-632B70603BA4}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{24580A2F-AE28-468A-B150-9F0EA7629F80}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{246F0FA6-8477-4011-B847-EFE008870199}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{29F5A9D7-34D4-4130-A539-FBFBC454F307}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{2C069F00-9048-44BE-B451-D5914E64F43E}" = protocol=6 | dir=out | app=%systemroot%\system32\wudfhost.exe |
"{38C68E03-C6BC-4F6D-A7A6-A070F9C9DE6C}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{57FC8B01-D42F-4DE4-BEED-B39705B1B14C}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{5F641B83-723A-483C-ABEB-1F5AB88790E2}" = protocol=6 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{857B1E61-F0D1-4E11-A184-A0BA9836A77F}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{88666192-B2FD-42A8-B52D-06AEB67669B3}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd9\powerdvd9.exe |
"{8AE93045-0577-4245-8828-439A5AF06071}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{8BA79AC4-F0F0-4C84-87E1-BE221F218CC2}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{8E7E3F41-7BC1-4A7D-9F30-0EF5F9FDAB81}" = protocol=6 | dir=in | app=c:\program files (x86)\sony ericsson\update engine\sony ericsson update engine.exe |
"{988C465F-018B-4685-B5FB-29EE7BF3F19B}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{98969C93-338E-4364-9160-7074F30DCF85}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{99C7AF41-95EA-4347-BB51-39BECE61BCA4}" = dir=in | app=c:\program files (x86)\windows live\messenger\wlcsdk.exe |
"{A12BE971-EA4E-4479-B53B-CBC84CCFCD5A}" = protocol=6 | dir=in | app=c:\program files (x86)\nvidia corporation\nvidia updatus\daemonu.exe |
"{A1BA724B-AE00-4A89-AB69-9606623C420A}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{A3CD4141-AA69-4585-8EE9-38049D1F0B89}" = dir=in | app=c:\program files (x86)\windows live\sync\windowslivesync.exe |
"{B084421C-24D4-4FAF-8C5B-53CFB3D3F5EE}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{B13DFF4E-7E5A-4642-A6C8-D5D454EF9B43}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{B168C35A-4B1F-45F4-B1D0-2479D23155CE}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{B89279FF-8690-4493-BAA3-6DBB765C0C44}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{B9D92D84-DEDC-4C31-9267-E89CB95F4B8C}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{BA68BB00-6021-4760-BCC4-A45A1C7BEEFB}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{CA6AD314-FC59-4E84-97B4-8F7857D902E7}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{D001BBCF-80FB-49C7-8488-10F09B9A7440}" = protocol=17 | dir=in | app=c:\program files (x86)\sony ericsson\update engine\sony ericsson update engine.exe |
"{EF3B9DC9-D3CF-4C62-9D20-F0DE410753E4}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{1F557316-CFC0-41BD-AFF7-8BC49CE444D7}" = Shredder
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A84DB02B-9C2B-4272-9D2D-A80E00A56513}" = Broadcom Gigabit NetLink Controller
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{F651E81A-6D79-4004-9D49-DB3DA159CDD7}" = ActivDriver x64 v5.4.6
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"SynTPDeinstKey" = Synaptics Pointing Device Driver
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0D7CD0D9-4A88-4A63-8F91-3F4E8F371768}" = MyWinLocker
"{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}" = PlayStation(R)Store
"{15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693}" = BrowserDefender
"{167A1F6A-9BF2-4B24-83DB-C6D659F680EA}" = Media Go
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{20B1B020-DEAE-48D1-9960-D4C3185D758B}" = Phase 5 HTML-Editor
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java(TM) 6 Update 33
"{26A24AE4-039D-4CA4-87B4-2F83217009FF}" = Java 7 Update 9
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{3DB0448D-AD82-4923-B305-D001E521A964}" = Acer ePower Management
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}" = Norton Online Backup
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4DD1AF59-5121-421F-B92D-EEBF3F20345A}" = Official Video Converter
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync
"{58F4D244-314F-4D26-B5EF-C28AB32E22CB}_is1" = Acer GameZone Console
"{5AF4B3C4-C393-48D7-AC7E-8E7615579548}" = Adobe AIR
"{5E21B617-F52E-BB10-92F9-C8AB2C799A8A}" = Adobe Download Assistant
"{60CE924D-12CB-4A96-8B75-18F92CE1D585}" = CrazyTalk v6.21 SE
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Backup Manager Basic
"{738BF5C3-AF7B-4BB0-B7EF-E505EFC756BE}" = MyWinLocker Suite
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{782E1916-7A78-47F7-9AF3-2233B83026F2}" = ActivInspire HWR Resources (INT) v1
"{7970AA03-F817-4916-AE77-80DC801646CC}" = ActivInspire v1
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{850C7BD3-9F3F-46AD-9396-E7985B38C55E}" = Windows Live Fotogalerie
"{8A809006-C25A-4A3A-9DAB-94659BCDB107}" = NVIDIA PhysX
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0407-1000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A7496F46-78AE-4DB2-BCF5-95F210FA6F96}" = Windows Live Movie Maker
"{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9
"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.02) - Deutsch
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{B6659DD8-00A7-4A24-BBFB-C1F6982E5D66}" = PlayStation(R)Network Downloader
"{C2695E83-CF1D-43D1-84FE-B3BEC561012A}" = Shredder
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{D0ACE89D-EC7F-470F-80BE-4C98ED366B32}" = Acer Crystal Eye webcam Ver:1.1.194.1021
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D3D5C4E8-040F-4C6F-8105-41D43CF94F44}" = NTI Media Maker 9
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E0B19DF7-B1C7-4937-82C4-0E4B1E346965}" = eBay Worldwide
"{EA17F4FC-FDBF-4CF8-A529-2D983132D053}" = Skype™ 6.0
"{EE171732-BEB4-4576-887D-CB62727F01CA}" = Acer Updater
"{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}" = Sony PC Companion 2.10.155
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Graphics Media Accelerator Driver
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{FDA68135-F483-422B-8579-7A7191B7091F}" = ActivInspire Help (DEU) v1
"Acer Registration" = Acer Registration
"Acer Screensaver" = Acer ScreenSaver
"Acer Welcome Center" = Welcome Center
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"bi_uninstaller" = Bundled software uninstaller
"com.adobe.downloadassistant.AdobeDownloadAssistant" = Adobe Download Assistant
"DealPly" = DealPly (remove only)
"delta" = Delta toolbar
"Free Audio CD to MP3 Converter_is1" = Free Audio CD to MP3 Converter version 1.3.12.1228
"Free AVI Video Converter_is1" = Free AVI Video Converter version 5.0.24.430
"GeoGebra" = GeoGebra
"GEONExT_is1" = GEONExT 1.74
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"Identity Card" = Identity Card
"InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Acer Backup Manager
"InstallShield_{738BF5C3-AF7B-4BB0-B7EF-E505EFC756BE}" = MyWinLocker Suite
"InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9
"InstallShield_{D3D5C4E8-040F-4C6F-8105-41D43CF94F44}" = NTI Media Maker 9
"LManager" = Launch Manager
"lrcspal@xinghao.net" = LyricsPal
"McAfee Security Scan" = McAfee Security Scan Plus
"Mozilla Firefox 21.0 (x86 de)" = Mozilla Firefox 21.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIA.Updatus" = NVIDIA Updatus
"PricePeep" = PricePeep
"Trojan Remover_is1" = Trojan Remover 6.8.6
"Update Engine" = Sony Ericsson Update Engine
"VLC media player" = VLC media player 2.0.1
"WinLiveSuite_Wave3" = Windows Live Essentials
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"DealPly" = DealPly
"GeoGebraPrim" = GeoGebraPrim
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 11.05.2013 14:13:45 | Computer Name = Aschka | Source = Application Hang | ID = 1002
Description = Programm videopad.exe, Version 0.0.0.0 kann nicht mehr unter Windows
ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: ebc Startzeit:
01ce4e73281a8548 Endzeit: 47 Anwendungspfad: C:\Program Files (x86)\NCH Software\VideoPad\videopad.exe
Berichts-ID:
81e9fd69-ba66-11e2-9632-1c7508347054
Error - 14.05.2013 08:40:10 | Computer Name = Aschka | Source = SideBySide | ID = 16842787
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files
(x86)\windows live\photo gallery\MovieMaker.Exe". Fehler in Manifest- oder Richtliniendatei
"c:\program files (x86)\windows live\photo gallery\WLMFDS.DLL" in Zeile 8. Die
im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente
überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition:
WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie
das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error - 15.05.2013 09:35:15 | Computer Name = Aschka | Source = SideBySide | ID = 16842787
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files
(x86)\Windows Live\Photo Gallery\MovieMaker.Exe". Fehler in Manifest- oder Richtliniendatei
"C:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL" in Zeile 8. Die
im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente
überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition:
WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie
das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error - 20.05.2013 11:22:30 | Computer Name = Aschka | Source = SideBySide | ID = 16842787
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files
(x86)\windows live\photo gallery\MovieMaker.Exe". Fehler in Manifest- oder Richtliniendatei
"c:\program files (x86)\windows live\photo gallery\WLMFDS.DLL" in Zeile 8. Die
im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente
überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition:
WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie
das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error - 22.05.2013 15:39:27 | Computer Name = Aschka | Source = SideBySide | ID = 16842787
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files
(x86)\Windows Live\Photo Gallery\MovieMaker.exe". Fehler in Manifest- oder Richtliniendatei
"C:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL" in Zeile 8. Die
im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente
überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition:
WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie
das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error - 23.05.2013 14:55:08 | Computer Name = Aschka | Source = SideBySide | ID = 16842787
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files
(x86)\Windows Live\Photo Gallery\MovieMaker.exe". Fehler in Manifest- oder Richtliniendatei
"C:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL" in Zeile 8. Die
im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente
überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition:
WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie
das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error - 23.05.2013 14:55:13 | Computer Name = Aschka | Source = SideBySide | ID = 16842787
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files
(x86)\Windows Live\Photo Gallery\MovieMaker.Exe". Fehler in Manifest- oder Richtliniendatei
"C:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL" in Zeile 8. Die
im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente
überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition:
WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie
das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error - 23.05.2013 15:05:16 | Computer Name = Aschka | Source = SideBySide | ID = 16842787
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files
(x86)\Windows Live\Photo Gallery\MovieMaker.Exe". Fehler in Manifest- oder Richtliniendatei
"C:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL" in Zeile 8. Die
im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente
überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition:
WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie
das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error - 27.05.2013 05:20:29 | Computer Name = Aschka | Source = SideBySide | ID = 16842787
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files
(x86)\Windows Live\Photo Gallery\MovieMaker.Exe". Fehler in Manifest- oder Richtliniendatei
"C:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL" in Zeile 8. Die
im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente
überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition:
WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie
das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error - 27.05.2013 05:21:47 | Computer Name = Aschka | Source = Avira AntiVir | ID = 4118
Description = AUSNAHMEFEHLER beim Aufruf der Funktion <Scan> für die Datei E:\DCIM\100CANON\IMG_2048.JPG.
[ACCESS_VIOLATION Exception!! EIP = 0x72de7f32] Bitte Avira informieren und die
obige Datei übersenden!
[ Media Center Events ]
Error - 31.05.2013 12:41:41 | Computer Name = Aschka | Source = MCUpdate | ID = 0
Description = 18:41:41 - Fehler beim Herstellen der Internetverbindung. 18:41:41
- Serververbindung konnte nicht hergestellt werden..
Error - 31.05.2013 12:41:55 | Computer Name = Aschka | Source = MCUpdate | ID = 0
Description = 18:41:46 - Fehler beim Herstellen der Internetverbindung. 18:41:46
- Serververbindung konnte nicht hergestellt werden..
Error - 01.06.2013 05:15:07 | Computer Name = Aschka | Source = MCUpdate | ID = 0
Description = 11:15:07 - Fehler beim Herstellen der Internetverbindung. 11:15:07
- Serververbindung konnte nicht hergestellt werden..
Error - 01.06.2013 05:15:18 | Computer Name = Aschka | Source = MCUpdate | ID = 0
Description = 11:15:12 - Fehler beim Herstellen der Internetverbindung. 11:15:12
- Serververbindung konnte nicht hergestellt werden..
Error - 01.06.2013 10:34:19 | Computer Name = Aschka | Source = MCUpdate | ID = 0
Description = 16:34:19 - Fehler beim Herstellen der Internetverbindung. 16:34:19
- Serververbindung konnte nicht hergestellt werden..
Error - 01.06.2013 10:34:27 | Computer Name = Aschka | Source = MCUpdate | ID = 0
Description = 16:34:24 - Fehler beim Herstellen der Internetverbindung. 16:34:24
- Serververbindung konnte nicht hergestellt werden..
Error - 01.06.2013 12:04:04 | Computer Name = Aschka | Source = MCUpdate | ID = 0
Description = 18:04:04 - Fehler beim Herstellen der Internetverbindung. 18:04:04
- Serververbindung konnte nicht hergestellt werden..
Error - 01.06.2013 12:04:13 | Computer Name = Aschka | Source = MCUpdate | ID = 0
Description = 18:04:10 - Fehler beim Herstellen der Internetverbindung. 18:04:10
- Serververbindung konnte nicht hergestellt werden..
Error - 01.06.2013 14:58:25 | Computer Name = Aschka | Source = MCUpdate | ID = 0
Description = 20:58:25 - Fehler beim Herstellen der Internetverbindung. 20:58:25
- Serververbindung konnte nicht hergestellt werden..
Error - 01.06.2013 14:58:39 | Computer Name = Aschka | Source = MCUpdate | ID = 0
Description = 20:58:30 - Fehler beim Herstellen der Internetverbindung. 20:58:30
- Serververbindung konnte nicht hergestellt werden..
[ OSession Events ]
Error - 18.06.2012 14:25:57 | Computer Name = Aschka | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.6600.1000, Microsoft Office Version: 12.0.6612.1000. This session
lasted 121 seconds with 60 seconds of active time. This session ended with a crash.
[ System Events ]
Error - 01.06.2013 05:11:06 | Computer Name = Aschka | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
Error - 01.06.2013 05:11:06 | Computer Name = Aschka | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
Error - 01.06.2013 05:11:07 | Computer Name = Aschka | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
Error - 01.06.2013 10:34:07 | Computer Name = Aschka | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
Error - 01.06.2013 10:34:09 | Computer Name = Aschka | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
Error - 01.06.2013 16:21:29 | Computer Name = Aschka | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
Error - 01.06.2013 17:22:04 | Computer Name = Aschka | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
Error - 04.06.2013 04:56:18 | Computer Name = Aschka | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
Error - 04.06.2013 06:27:47 | Computer Name = Aschka | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
Error - 07.06.2013 06:05:42 | Computer Name = Aschka | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
< End of report >
--- --- ---GMER Logfile: Code:
GMER 2.1.19163 - GMER - Rootkit Detector and Remover
Rootkit scan 2013-06-08 23:03:24
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD50 rev.01.0 465,76GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\A&A\AppData\Local\Temp\pwldrpow.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1872] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007591cfca 5 bytes JMP 0000000173614970
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1872] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077741465 2 bytes [74, 77]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1872] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777414bb 2 bytes [74, 77]
.text ... * 2
.text C:\Program Files (x86)\Launch Manager\dsiwmis.exe[1160] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007591cfca 5 bytes JMP 0000000173614970
.text C:\Program Files (x86)\Launch Manager\dsiwmis.exe[1160] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077741465 2 bytes [74, 77]
.text C:\Program Files (x86)\Launch Manager\dsiwmis.exe[1160] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777414bb 2 bytes [74, 77]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007591cfca 5 bytes JMP 0000000173614970
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077741465 2 bytes [74, 77]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777414bb 2 bytes [74, 77]
.text ... * 2
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2016] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007591cfca 5 bytes JMP 0000000173614970
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2016] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077741465 2 bytes [74, 77]
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2016] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777414bb 2 bytes [74, 77]
.text ... * 2
.text C:\Program Files\Acer\Acer Updater\UpdaterService.exe[2136] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007591cfca 5 bytes JMP 0000000173614970
.text C:\Program Files\Acer\Acer Updater\UpdaterService.exe[2136] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077741465 2 bytes [74, 77]
.text C:\Program Files\Acer\Acer Updater\UpdaterService.exe[2136] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777414bb 2 bytes [74, 77]
.text ... * 2
.text C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe[2216] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007591cfca 5 bytes JMP 0000000173614970
.text C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe[2216] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077741465 2 bytes [74, 77]
.text C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe[2216] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777414bb 2 bytes [74, 77]
.text ... * 2
.text C:\Windows\PLFSetI.exe[2564] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007591cfca 5 bytes JMP 0000000173614970
.text C:\Windows\PLFSetI.exe[2564] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077741465 2 bytes [74, 77]
.text C:\Windows\PLFSetI.exe[2564] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777414bb 2 bytes [74, 77]
.text ... * 2
.text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[3140] C:\Windows\syswow64\USER32.dll!GetMenu + 412 00000000759051dd 7 bytes JMP 0000000110053ac0
.text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[3140] C:\Windows\syswow64\USER32.dll!PeekMessageA + 407 000000007590610b 7 bytes JMP 0000000110053c10
.text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[3140] C:\Windows\syswow64\USER32.dll!CreateDialogIndirectParamW + 131 000000007590c6c1 7 bytes JMP 0000000110053bf0
.text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[3140] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007591cfca 5 bytes JMP 0000000173614970
.text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[3140] C:\Windows\syswow64\USER32.dll!MessageBoxIndirectA + 199 000000007594fc98 7 bytes JMP 0000000110053c60
.text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[3140] C:\Windows\syswow64\USER32.dll!MessageBoxIndirectW + 52 000000007594fcd1 7 bytes JMP 0000000110053d30
.text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[3140] C:\Windows\syswow64\USER32.dll!MessageBoxExA + 31 000000007594fcf5 7 bytes JMP 0000000110053ce0
.text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[3140] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077741465 2 bytes [74, 77]
.text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[3140] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777414bb 2 bytes [74, 77]
.text ... * 2
.text C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe[3220] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007591cfca 5 bytes JMP 0000000173614970
.text C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe[3220] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077741465 2 bytes [74, 77]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe[3220] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777414bb 2 bytes [74, 77]
.text ... * 2
.text C:\Program Files\Activ Software\ActivDriver\activmgr.exe[3640] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007591cfca 5 bytes JMP 0000000173614970
.text C:\Program Files\Activ Software\ActivDriver\activmgr.exe[3640] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077741465 2 bytes [74, 77]
.text C:\Program Files\Activ Software\ActivDriver\activmgr.exe[3640] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777414bb 2 bytes [74, 77]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3836] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007591cfca 5 bytes JMP 0000000173614970
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3836] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077741465 2 bytes [74, 77]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3836] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777414bb 2 bytes [74, 77]
.text ... * 2
.text C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe[3900] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007591cfca 5 bytes JMP 0000000173614970
.text C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe[3900] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077741465 2 bytes [74, 77]
.text C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe[3900] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777414bb 2 bytes [74, 77]
.text ... * 2
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe[3920] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077741465 2 bytes [74, 77]
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe[3920] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777414bb 2 bytes [74, 77]
.text ... * 2
.text C:\Program Files (x86)\Launch Manager\LManager.exe[3960] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007591cfca 5 bytes JMP 0000000173614970
.text C:\Program Files (x86)\Launch Manager\LManager.exe[3960] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077741465 2 bytes [74, 77]
.text C:\Program Files (x86)\Launch Manager\LManager.exe[3960] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777414bb 2 bytes [74, 77]
.text ... * 2
.text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe[3972] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077741465 2 bytes [74, 77]
.text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe[3972] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777414bb 2 bytes [74, 77]
.text ... * 2
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3980] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007591cfca 5 bytes JMP 0000000173614970
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[3132] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007591cfca 5 bytes JMP 0000000173614970
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[3132] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077741465 2 bytes [74, 77]
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[3132] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777414bb 2 bytes [74, 77]
.text ... * 2
.text C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe[3336] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007591cfca 5 bytes JMP 0000000173614970
.text C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe[3336] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077741465 2 bytes [74, 77]
.text C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe[3336] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777414bb 2 bytes [74, 77]
.text ... * 2
---- EOF - GMER 2.1 ----OTL Logfile:
--- --- --- Code:
OTL logfile created on: 08.06.2013 22:00:36 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\A&A\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,68 Gb Total Physical Memory | 1,60 Gb Available Physical Memory | 43,50% Memory free
7,36 Gb Paging File | 5,09 Gb Available in Paging File | 69,14% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 452,66 Gb Total Space | 390,79 Gb Free Space | 86,33% Space Free | Partition Type: NTFS
Computer Name: ASCHKA | User Name: A&A | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2013.06.08 22:00:06 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\A&A\Downloads\OTL.exe
PRC - [2013.06.08 21:57:52 | 000,050,477 | ---- | M] () -- C:\Users\A&A\Downloads\Defogger.exe
PRC - [2013.05.27 10:31:56 | 000,920,472 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2013.05.23 11:09:59 | 002,827,728 | ---- | M] () -- C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe
PRC - [2013.05.15 16:12:12 | 001,855,880 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe
PRC - [2013.03.18 17:47:58 | 000,448,736 | ---- | M] (Sony) -- C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe
PRC - [2013.02.05 17:48:44 | 000,272,248 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe
PRC - [2013.02.04 17:13:54 | 000,070,832 | ---- | M] () -- C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe
PRC - [2012.12.18 21:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.07.02 16:37:37 | 000,484,008 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe
PRC - [2011.07.02 16:37:37 | 000,400,040 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe
PRC - [2011.07.02 16:37:37 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.03.28 16:15:04 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2011.03.28 16:14:56 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.11.20 14:17:36 | 000,179,712 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\schtasks.exe
PRC - [2010.11.16 20:37:38 | 000,206,208 | ---- | M] () -- C:\Windows\PLFSetI.exe
PRC - [2010.10.27 22:02:56 | 001,620,584 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
PRC - [2010.08.10 11:06:16 | 000,975,952 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LManager.exe
PRC - [2010.08.10 11:06:16 | 000,321,104 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe
PRC - [2010.08.10 11:06:16 | 000,305,744 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LMworker.exe
PRC - [2010.06.29 00:23:12 | 000,265,984 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
PRC - [2010.06.29 00:23:06 | 000,255,744 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
PRC - [2010.05.27 04:41:24 | 000,349,552 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
PRC - [2010.04.13 18:57:58 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2010.04.13 18:57:56 | 000,284,696 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2010.03.18 06:57:02 | 002,320,920 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2010.03.18 06:56:56 | 000,268,824 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2010.03.11 07:11:56 | 000,407,920 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
PRC - [2010.03.11 07:11:42 | 000,201,584 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
PRC - [2010.01.29 01:27:36 | 000,243,232 | ---- | M] (Acer Group) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe
PRC - [2010.01.08 15:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
PRC - [2009.10.22 16:48:38 | 000,453,400 | ---- | M] () -- C:\Programme\Activ Software\ActivDriver\ActivMgr.exe
========== Modules (No Company Name) ==========
MOD - [2013.06.08 21:57:52 | 000,050,477 | ---- | M] () -- C:\Users\A&A\Downloads\Defogger.exe
MOD - [2013.05.27 10:31:55 | 003,128,728 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2013.05.23 11:09:59 | 002,827,728 | ---- | M] () -- C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe
MOD - [2013.05.23 11:09:01 | 002,521,040 | ---- | M] () -- C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.dll
MOD - [2013.05.15 20:38:21 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\30e3a21202000677d0a9270572251477\System.Windows.Forms.ni.dll
MOD - [2013.05.15 20:37:58 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\716959df79685a1eae0fc14275a32b0f\WindowsBase.ni.dll
MOD - [2013.05.15 20:37:51 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\764f15e86c82662e977bd418bd6318c1\System.Configuration.ni.dll
MOD - [2013.05.15 16:12:11 | 016,033,160 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll
MOD - [2013.03.18 15:46:26 | 000,606,720 | ---- | M] () -- C:\Program Files (x86)\Sony\Sony PC Companion\PhoneUpdate.dll
MOD - [2013.02.04 17:13:54 | 000,070,832 | ---- | M] () -- C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe
MOD - [2013.01.11 13:30:05 | 000,452,608 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\8ee98383179eca974083a41a8ca0c213\IAStorUtil.ni.dll
MOD - [2013.01.09 22:03:13 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\90b89f6e8032310e9ac72a309fd49e83\System.Runtime.Remoting.ni.dll
MOD - [2013.01.09 22:02:39 | 001,592,832 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eead6629e384a5b69f9ae35284b7eeed\System.Drawing.ni.dll
MOD - [2013.01.09 22:02:22 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\f687c43e9fdec031988b33ae722c4613\System.Xml.ni.dll
MOD - [2013.01.09 22:02:18 | 007,989,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll
MOD - [2013.01.09 22:02:11 | 011,493,376 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll
MOD - [2013.01.09 20:53:24 | 000,605,049 | ---- | M] () -- C:\Program Files (x86)\Sony\Sony PC Companion\sqlite3.dll
MOD - [2012.11.07 16:25:36 | 000,204,288 | ---- | M] () -- C:\Program Files (x86)\Sony\Sony PC Companion\MExplorer.dll
MOD - [2012.04.30 10:57:42 | 000,039,936 | ---- | M] () -- C:\Program Files (x86)\Sony\Sony PC Companion\TMonitorAPI.dll
MOD - [2011.07.07 14:54:36 | 000,233,984 | ---- | M] () -- C:\Program Files (x86)\Sony\Sony PC Companion\Report.dll
MOD - [2010.11.17 05:07:22 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll
MOD - [2010.11.16 20:37:38 | 000,206,208 | ---- | M] () -- C:\Windows\PLFSetI.exe
MOD - [2010.11.13 02:08:41 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010.10.28 04:06:00 | 000,010,856 | ---- | M] () -- C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll
MOD - [2010.06.29 00:20:54 | 000,465,576 | ---- | M] () -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\sqlite3.dll
MOD - [2010.06.17 15:27:02 | 000,355,688 | ---- | M] () -- C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
MOD - [2010.01.11 15:44:54 | 000,053,248 | ---- | M] () -- C:\Program Files (x86)\Sony\Sony PC Companion\VObject.dll
MOD - [2009.10.22 16:48:54 | 000,223,016 | ---- | M] () -- C:\Windows\libactivboardex.dll
MOD - [2009.10.22 16:48:48 | 000,342,808 | ---- | M] () -- C:\Programme\Activ Software\ActivDriver\QtXml4.dll
MOD - [2009.10.22 16:48:44 | 000,880,928 | ---- | M] () -- C:\Programme\Activ Software\ActivDriver\QtNetwork4.dll
MOD - [2009.10.22 16:48:42 | 007,469,848 | ---- | M] () -- C:\Programme\Activ Software\ActivDriver\QtGui4.dll
MOD - [2009.10.22 16:48:42 | 002,018,584 | ---- | M] () -- C:\Programme\Activ Software\ActivDriver\QtCore4.dll
MOD - [2009.10.22 16:48:38 | 000,453,400 | ---- | M] () -- C:\Programme\Activ Software\ActivDriver\ActivMgr.exe
MOD - [2009.05.20 08:02:04 | 000,072,200 | ---- | M] () -- C:\Program Files (x86)\Launch Manager\CdDirIo.dll
========== Services (SafeList) ==========
SRV - [2013.05.27 10:31:55 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.05.23 11:09:59 | 002,827,728 | ---- | M] () [Auto | Running] -- C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe -- (BrowserDefendert)
SRV - [2013.05.15 16:12:12 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.02.05 17:48:00 | 000,235,216 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe -- (McComponentHostService)
SRV - [2013.02.04 17:43:22 | 000,155,824 | ---- | M] (Avanquest Software) [On_Demand | Stopped] -- C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe -- (Sony PC Companion)
SRV - [2012.12.18 21:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.11.09 12:21:24 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2011.07.02 16:37:37 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.03.28 16:15:04 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010.11.16 20:48:35 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010.10.27 22:02:56 | 001,620,584 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2010.08.10 11:06:16 | 000,321,104 | ---- | M] (Dritek System Inc.) [Auto | Running] -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe -- (DsiWMIService)
SRV - [2010.06.29 00:23:06 | 000,255,744 | ---- | M] (NewTech Infosystems, Inc.) [Auto | Running] -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2010.06.11 15:27:26 | 000,868,896 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Acer ePower Management\ePowerSvc.exe -- (ePowerSvc)
SRV - [2010.06.02 00:31:28 | 002,804,568 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe -- (NOBU)
SRV - [2010.05.27 04:41:06 | 000,305,520 | ---- | M] (Egis Technology Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe -- (MWLService)
SRV - [2010.04.13 18:57:58 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.03.18 06:57:02 | 002,320,920 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2010.03.18 06:56:56 | 000,268,824 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2010.01.29 01:27:36 | 000,243,232 | ---- | M] (Acer Group) [Auto | Running] -- C:\Programme\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)
SRV - [2010.01.08 15:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe -- (GREGService)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
========== Driver Services (SafeList) ==========
DRV:64bit: - [2012.11.14 21:17:07 | 000,027,760 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ggsemc.sys -- (ggsemc)
DRV:64bit: - [2012.11.14 21:17:07 | 000,014,448 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ggflt.sys -- (ggflt)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.07.02 16:37:37 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2011.07.02 16:37:37 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.10.28 04:06:00 | 000,024,680 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\nvpciflt.sys -- (nvpciflt)
DRV:64bit: - [2010.08.25 20:36:04 | 010,611,552 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2010.07.09 05:51:50 | 000,017,408 | ---- | M] (NTI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper)
DRV:64bit: - [2010.06.21 11:45:56 | 000,287,232 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)
DRV:64bit: - [2010.06.17 11:18:28 | 000,246,376 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2010.05.15 14:48:28 | 000,384,040 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a)
DRV:64bit: - [2010.05.11 12:11:38 | 002,229,608 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2010.04.20 04:35:14 | 000,018,432 | ---- | M] (NTI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr)
DRV:64bit: - [2010.04.13 18:44:22 | 000,540,696 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010.02.27 01:32:14 | 000,158,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd)
DRV:64bit: - [2009.12.10 13:25:10 | 000,301,104 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2009.10.05 17:56:58 | 000,091,992 | ---- | M] (Promethean Technologies Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ACTIVhidmini.sys -- (ACTIVhidmini)
DRV:64bit: - [2009.10.05 17:56:58 | 000,008,152 | ---- | M] (Promethean Technologies Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\activmouse.sys -- (prmvmouse)
DRV:64bit: - [2009.09.17 07:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.06.03 04:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)
DRV:64bit: - [2009.06.03 04:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)
DRV:64bit: - [2009.06.03 04:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)
DRV:64bit: - [2009.05.05 17:26:00 | 000,065,152 | ---- | M] (Promethean Technologies Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\activhidsermini.sys -- (ActivHidSerMini)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Deutschland: Aktuelle Nachrichten, Outlook.com Email und Skype Login.
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = MSN Deutschland: Aktuelle Nachrichten, Outlook.com Email und Skype Login.
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Deutschland: Aktuelle Nachrichten, Outlook.com Email und Skype Login.
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = MSN Deutschland: Aktuelle Nachrichten, Outlook.com Email und Skype Login.
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Deutschland: Aktuelle Nachrichten, Outlook.com Email und Skype Login.
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Babylon Search
IE - HKCU\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=121562&tt=gc_&babsrc=SP_ss_din2g&mntrId=2A7518F46A337AB6
IE - HKCU\..\SearchScopes\{715E2853-4A1B-4796-AF1F-1446B684935A}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=U3&apn_dtid=OSJ000YYDE&apn_uid=65FD95EC-C280-44F2-B6B7-27CD335E5618&apn_sauid=2E48F657-59EE-4E8E-9C12-44C080E0F94C
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = hxxp://isearch.avg.com/search?cid={6B382EEF-5EBB-426A-9A3B-0465F1160567}&mid=97d4de14c63647d0b83ccd3c4ed099a7-dcd898748af92402dded43f905cd318d50e862f7&lang=de&ds=od011&pr=sa&d=2012-07-17 18:20:31&v=11.1.0.12&sap=dsp&q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.defaultengine: "Google"
FF - prefs.js..browser.search.order.1: "Delta Search"
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledAddons: %7B184AA5E6-741D-464a-820E-94B3ABC2F3B4%7D:1.0
FF - prefs.js..extensions.enabledAddons: lrcspal%40xinghao.net:1.111
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0
FF - prefs.js..network.proxy.type: 0
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/McAfeeMssPlugin: C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@playstation.com/PsndlCheck,version=1.00: C:\Program Files (x86)\Sony\PLAYSTATION Network Downloader\nppsndl.dll (Sony Computer Entertainment Inc.)
FF - HKLM\Software\MozillaPlugins\@SonyCreativeSoftware.com/Media Go,version=1.0: C:\Program Files (x86)\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.04.12 19:40:06 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\A&A\AppData\Roaming\11004 [2012.03.29 21:16:58 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\extensions\\lrcspal@xinghao.net: C:\Program Files (x86)\XingHaoLyrics\FF\ [2013.05.30 17:22:16 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.04.12 19:40:06 | 000,000,000 | ---D | M]
[2011.12.11 21:26:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\A&A\AppData\Roaming\mozilla\Extensions
[2013.06.08 21:27:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\A&A\AppData\Roaming\mozilla\Firefox\Profiles\eqcb0zvb.default\extensions
[2013.06.08 21:27:40 | 000,870,680 | ---- | M] () (No name found) -- C:\Users\A&A\AppData\Roaming\mozilla\firefox\profiles\eqcb0zvb.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013.02.08 15:53:16 | 000,002,333 | ---- | M] () -- C:\Users\A&A\AppData\Roaming\mozilla\firefox\profiles\eqcb0zvb.default\searchplugins\askcom.xml
[2013.05.30 17:30:58 | 000,006,503 | ---- | M] () -- C:\Users\A&A\AppData\Roaming\mozilla\firefox\profiles\eqcb0zvb.default\searchplugins\babylon.xml
[2013.05.30 17:30:58 | 000,006,503 | ---- | M] () -- C:\Users\A&A\AppData\Roaming\mozilla\firefox\profiles\eqcb0zvb.default\searchplugins\BrowserProtect.xml
[2013.05.30 17:31:07 | 000,001,294 | ---- | M] () -- C:\Users\A&A\AppData\Roaming\mozilla\firefox\profiles\eqcb0zvb.default\searchplugins\delta.xml
[2013.05.27 10:31:57 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2013.04.12 19:40:06 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2013.05.27 10:31:56 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions
[2013.05.27 10:31:56 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2013.05.30 17:22:16 | 000,000,000 | ---D | M] ("LyricsPal") -- C:\PROGRAM FILES (X86)\XINGHAOLYRICS\FF
[2012.03.29 21:16:58 | 000,000,000 | ---D | M] (Java String Helper) -- C:\USERS\A&A\APPDATA\ROAMING\11004
[2012.07.17 18:20:29 | 000,003,750 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (MSS+ Identifier) - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (LyricsPal) - {A3DAEB01-4C15-4AC6-A689-6406FD954EE0} - C:\Program Files (x86)\XingHaoLyrics\lrcspal.dll (XingHao Software)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (DealPly) - {EF7BD87A-8024-11E2-F316-F3E56188709B} - C:\Program Files (x86)\DealPly\DealPlyIE.dll (DealPly)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Programme\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [ActivControl] C:\Programme\Activ Software\ActivDriver\ActivControl2x64.exe (Promethean Technologies Group Ltd)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe (Egis Technology Inc.)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [PLD_FrameworkRun] c:\OEM\Preload\utility\_NowIntoDT.vbs ()
O4:64bit: - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.)
O4 - HKLM..\Run: [EgisTecPMMUpdate] C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [EgisUpdate] C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe (Symantec Corporation)
O4 - HKLM..\Run: [SuiteTray] C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe (Egis Technology Inc.)
O4 - HKCU..\Run: [Sony PC Companion] C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe (Sony)
O4:64bit: - HKLM..\RunOnce: [PLD_FrameworkRunOnce] C:\Windows\SysNative\OEM\_waitAndLaunch_PLD_Framework_NoWait.vbs ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~3\Office12\REFIEBAR.DLL (Microsoft Corporation)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 10.9.2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 193.189.244.202 193.189.244.194
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3DE1FAC4-B916-448F-A747-E5A362D2FC66}: DhcpNameServer = 172.20.129.11
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7D12A5DE-8ECC-461E-BAA5-F03305BA3B56}: DhcpNameServer = 192.168.1.1 193.189.244.202 193.189.244.194
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation)
O20 - AppInit_DLLs: (c:\progra~3\browse~2\261339~1.144\{c16c1~1\browse~1.dll) - c:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.dll ()
O20 - AppInit_DLLs: (c:\windows\syswow64\nvinit.dll) - c:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{37ede71e-af3d-11e2-a739-1c7508347054}\Shell - "" = AutoRun
O33 - MountPoints2\{37ede71e-af3d-11e2-a739-1c7508347054}\Shell\AutoRun\command - "" = F:\Startme.exe
O33 - MountPoints2\{3ed80f79-888f-11e2-9aae-1c7508347054}\Shell - "" = AutoRun
O33 - MountPoints2\{3ed80f79-888f-11e2-9aae-1c7508347054}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
O33 - MountPoints2\{c4892ad4-3a15-11e2-99a4-1c7508347054}\Shell - "" = AutoRun
O33 - MountPoints2\{c4892ad4-3a15-11e2-99a4-1c7508347054}\Shell\AutoRun\command - "" = E:\Startme.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 30 Days ==========
[2013.06.08 21:41:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Trojan Remover
[2013.06.04 14:07:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GEONExT
[2013.06.04 14:07:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\GEONExT
[2013.05.30 17:31:18 | 000,000,000 | ---D | C] -- C:\Users\A&A\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BrowserDefender
[2013.05.30 17:31:15 | 000,000,000 | ---D | C] -- C:\ProgramData\BrowserDefender
[2013.05.30 17:30:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
[2013.05.30 17:30:42 | 000,000,000 | ---D | C] -- C:\Users\A&A\AppData\Roaming\DVDVideoSoft
[2013.05.30 17:30:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DVDVideoSoft
[2013.05.30 17:30:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DVDVideoSoft
[2013.05.30 17:23:16 | 000,000,000 | ---D | C] -- C:\Users\A&A\Local Settings
[2013.05.30 17:23:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OfficialVideoConverter
[2013.05.30 17:22:21 | 000,000,000 | ---D | C] -- C:\Users\A&A\AppData\Roaming\DealPly
[2013.05.30 17:22:19 | 000,000,000 | ---D | C] -- C:\Users\A&A\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DealPly
[2013.05.30 17:22:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DealPly
[2013.05.30 17:22:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PricePeep
[2013.05.30 17:22:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\XingHaoLyrics
[2013.05.30 17:13:18 | 000,000,000 | ---D | C] -- C:\Users\A&A\AppData\Roaming\MOVAVI
[2013.05.30 13:39:38 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\searchplugins
[2013.05.30 13:39:38 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Extensions
[2013.05.23 21:17:31 | 000,000,000 | ---D | C] -- C:\Users\A&A\Desktop\Deutsch
[2013.05.23 21:06:37 | 000,000,000 | ---D | C] -- C:\Users\A&A\AppData\Roaming\avidemux
[2013.05.23 20:47:39 | 000,000,000 | ---D | C] -- C:\Users\A&A\Documents\AVS4YOU
[2013.05.23 20:43:37 | 000,000,000 | ---D | C] -- C:\ProgramData\AVS4YOU
[2013.05.23 20:43:30 | 000,000,000 | ---D | C] -- C:\Users\A&A\AppData\Roaming\AVS4YOU
[2013.05.23 20:42:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\AVSMedia
[2013.05.23 20:42:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AVS4YOU
[2013.05.22 21:43:17 | 000,000,000 | ---D | C] -- C:\Users\A&A\AppData\Roaming\BabSolution
[2013.05.22 21:43:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Delta
[2013.05.20 16:44:19 | 000,000,000 | ---D | C] -- C:\Users\A&A\Desktop\Rente Russland
[2013.05.11 19:19:31 | 000,000,000 | ---D | C] -- C:\FFOutput
[2013.05.11 19:18:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\FreeTime
[2013.05.11 19:17:23 | 000,000,000 | ---D | C] -- C:\Users\A&A\AppData\Roaming\Babylon
[2013.05.11 19:17:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon
[2013.05.11 18:42:52 | 000,000,000 | ---D | C] -- C:\ProgramData\NCH Software
[2013.05.11 18:42:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NCH Software
[2013.05.11 18:42:03 | 000,000,000 | ---D | C] -- C:\Users\A&A\AppData\Roaming\NCH Software
[1 C:\Users\A&A\AppData\Roaming\*.tmp files -> C:\Users\A&A\AppData\Roaming\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2013.06.08 21:59:03 | 000,000,000 | ---- | M] () -- C:\Users\A&A\defogger_reenable
[2013.06.08 21:12:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.06.08 21:03:35 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.06.08 21:03:35 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.06.08 20:56:01 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.06.08 20:55:54 | 2962,259,968 | -HS- | M] () -- C:\hiberfil.sys
[2013.06.07 12:42:03 | 000,000,026 | ---- | M] () -- C:\Users\A&A\geonext.ini
[2013.06.06 18:07:41 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.06.06 18:07:41 | 000,654,400 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.06.06 18:07:41 | 000,616,242 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.06.06 18:07:41 | 000,130,240 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.06.06 18:07:41 | 000,106,622 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.06.04 14:07:55 | 000,001,874 | ---- | M] () -- C:\Users\A&A\Desktop\GEONExT.lnk
[2013.05.30 17:30:54 | 000,002,275 | ---- | M] () -- C:\Users\Public\Desktop\Free AVI Video Converter.lnk
[2013.05.30 17:30:54 | 000,001,243 | ---- | M] () -- C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk
[2013.05.27 10:25:23 | 004,934,432 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[1 C:\Users\A&A\AppData\Roaming\*.tmp files -> C:\Users\A&A\AppData\Roaming\*.tmp -> ]
========== Files Created - No Company Name ==========
[2013.06.08 21:59:03 | 000,000,000 | ---- | C] () -- C:\Users\A&A\defogger_reenable
[2013.06.04 14:09:04 | 000,000,026 | ---- | C] () -- C:\Users\A&A\geonext.ini
[2013.06.04 14:07:55 | 000,001,874 | ---- | C] () -- C:\Users\A&A\Desktop\GEONExT.lnk
[2013.05.30 17:30:54 | 000,002,275 | ---- | C] () -- C:\Users\Public\Desktop\Free AVI Video Converter.lnk
[2013.05.30 17:30:54 | 000,001,243 | ---- | C] () -- C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk
[2013.03.10 22:16:37 | 000,000,074 | RHS- | C] () -- C:\Windows\CT6STET.BIN
[2013.02.02 23:15:39 | 000,001,910 | ---- | C] () -- C:\Windows\CDPLAYER.INI
[2012.04.07 22:52:30 | 000,175,616 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2012.03.29 21:16:46 | 000,000,016 | ---- | C] () -- C:\Users\A&A\AppData\Roaming\blckdom.res
[2012.01.24 12:51:14 | 000,010,752 | ---- | C] () -- C:\Users\A&A\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.09.12 09:08:16 | 000,000,425 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2011.09.12 09:08:16 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI
[2011.09.10 22:51:57 | 000,004,096 | ---- | C] () -- C:\Windows\d3dx.dat
[2010.08.30 11:12:22 | 000,131,984 | ---- | C] () -- C:\ProgramData\FullRemove.exe
========== ZeroAccess Check ==========
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
========== LOP Check ==========
[2012.03.29 21:16:58 | 000,000,000 | ---D | M] -- C:\Users\A&A\AppData\Roaming\11004
[2011.09.26 19:36:43 | 000,000,000 | ---D | M] -- C:\Users\A&A\AppData\Roaming\ACTIV Software
[2013.05.23 21:13:09 | 000,000,000 | ---D | M] -- C:\Users\A&A\AppData\Roaming\avidemux
[2013.05.22 21:43:17 | 000,000,000 | ---D | M] -- C:\Users\A&A\AppData\Roaming\BabSolution
[2013.05.11 19:17:23 | 000,000,000 | ---D | M] -- C:\Users\A&A\AppData\Roaming\Babylon
[2013.03.10 20:32:36 | 000,000,000 | ---D | M] -- C:\Users\A&A\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
[2012.01.06 19:17:11 | 000,000,000 | ---D | M] -- C:\Users\A&A\AppData\Roaming\Cornelsen
[2013.05.30 17:22:21 | 000,000,000 | ---D | M] -- C:\Users\A&A\AppData\Roaming\DealPly
[2013.05.30 17:30:59 | 000,000,000 | ---D | M] -- C:\Users\A&A\AppData\Roaming\DVDVideoSoft
[2013.03.17 21:09:16 | 000,000,000 | ---D | M] -- C:\Users\A&A\AppData\Roaming\eSobi
[2012.03.29 21:16:27 | 000,000,000 | ---D | M] -- C:\Users\A&A\AppData\Roaming\kock
[2013.05.30 17:17:21 | 000,000,000 | ---D | M] -- C:\Users\A&A\AppData\Roaming\MOVAVI
[2013.05.30 17:30:42 | 000,000,000 | ---D | M] -- C:\Users\A&A\AppData\Roaming\OpenCandy
[2012.07.17 17:49:31 | 000,000,000 | ---D | M] -- C:\Users\A&A\AppData\Roaming\pdfforge
[2011.03.26 13:22:36 | 000,000,000 | ---D | M] -- C:\Users\A&A\AppData\Roaming\PlayFirst
[2011.09.26 20:44:56 | 000,000,000 | ---D | M] -- C:\Users\A&A\AppData\Roaming\Promethean
[2013.06.08 22:15:52 | 000,000,000 | ---D | M] -- C:\Users\A&A\AppData\Roaming\Simply Super Software
[2012.02.18 17:37:35 | 000,000,000 | ---D | M] -- C:\Users\A&A\AppData\Roaming\Sony
[2011.11.24 14:48:08 | 000,000,000 | ---D | M] -- C:\Users\A&A\AppData\Roaming\Telefónica
[2013.03.19 13:35:40 | 000,000,000 | ---D | M] -- C:\Users\A&A\AppData\Roaming\TuneUp Software
[2012.03.29 21:20:45 | 000,000,000 | ---D | M] -- C:\Users\A&A\AppData\Roaming\UAs
[2012.03.29 21:21:32 | 000,000,000 | ---D | M] -- C:\Users\A&A\AppData\Roaming\xmldm
========== Purity Check ==========
========== Files - Unicode (All) ==========
[2013.02.16 21:09:17 | 000,183,680 | ---- | M] ()(C:\Users\A&A\Desktop\????? ???????.pdf) -- C:\Users\A&A\Desktop\Ответ Клиенту.pdf
[2013.02.16 21:09:17 | 000,183,680 | ---- | C] ()(C:\Users\A&A\Desktop\????? ???????.pdf) -- C:\Users\A&A\Desktop\Ответ Клиенту.pdf
[2013.02.16 21:09:02 | 000,013,315 | ---- | M] ()(C:\Users\A&A\Desktop\????? ???????.docx) -- C:\Users\A&A\Desktop\Ответ Клиенту.docx
[2013.02.16 21:09:02 | 000,013,315 | ---- | C] ()(C:\Users\A&A\Desktop\????? ???????.docx) -- C:\Users\A&A\Desktop\Ответ Клиенту.docx
========== Alternate Data Streams ==========
@Alternate Data Stream - 152 bytes -> C:\ProgramData\Temp:CB0AACC9
@Alternate Data Stream - 144 bytes -> C:\ProgramData\Temp:5D7E5A8F
@Alternate Data Stream - 140 bytes -> C:\ProgramData\Temp:1A60DE96
@Alternate Data Stream - 121 bytes -> C:\ProgramData\Temp:0B9176C0
@Alternate Data Stream - 120 bytes -> C:\ProgramData\Temp:CDFF58FE
< End of report >
--- --- --- |
Hinweise zum Ablauf
AdwCleaner auf deinen Desktop.
Malwarebytes Anti-Malware 
SecurityCheck und:
Textbox. 