| raymond0587 | 10.06.2013 17:50 |
Win32/Toolbar.Zugo - yahoo! mail verschickt Spam-Nachrichten von selbst
Liebes trojaner-board,
gestern um 5 Uhr morgens hat sich mein yahoo! Mail Account selbstständig gemacht und Spam-Nachrichten an meine Kontakte verschickt. Die eMails wurden tatsächlich versandt, da sie im Sent Ordner zu finden sind.
Passwort wurde geändert und Kontakte habe ich auch gelöscht.
MSE: hat leider nichts gefunden
Malwarebytes hat den Win32/Toolbar.Zugo und nach zweimaligem Löschen kann ich die Datei nicht mehr finden (im abgesicherten Modus).
SuperAntiSpyware hat sogar 7 Sachen gefunden.
Ich habe jetzt OTL und Gmer ausgeführt, beim ersten Gmer-Scan ist der PC abgestürzt und gerade eben nochmal, das System läuft instabil hab ich das Gefühl:
OTL
[CODEOTL Logfile: Code:
OTL logfile created on: 10.06.2013 18:00:32 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = D:\Users\***\Desktop\Virenbekämpfung
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
7,68 Gb Total Physical Memory | 5,94 Gb Available Physical Memory | 77,40% Memory free
15,35 Gb Paging File | 13,48 Gb Available in Paging File | 87,78% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 70,00 Gb Total Space | 8,27 Gb Free Space | 11,81% Space Free | Partition Type: NTFS
Drive D: | 160,42 Gb Total Space | 21,06 Gb Free Space | 13,13% Space Free | Partition Type: NTFS
Drive E: | 931,51 Gb Total Space | 145,83 Gb Free Space | 15,66% Space Free | Partition Type: NTFS
Computer Name: DHV | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2013.06.10 17:47:06 | 000,602,112 | ---- | M] (OldTimer Tools) -- D:\Users\***\Desktop\Virenbekämpfung\OTL.exe
PRC - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013.04.05 12:59:08 | 000,059,720 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
PRC - [2011.11.22 10:59:30 | 000,018,432 | ---- | M] () -- D:\Users\***\AppData\LocalLow\StumbleUpon\IE\StumbleUponUpdater.exe
PRC - [2011.02.14 14:23:50 | 000,044,736 | ---- | M] (Sony Corporation) -- C:\Programme\Sony\VAIO Care\VCService.exe
PRC - [2011.01.29 06:36:18 | 000,081,016 | ---- | M] (Sony of America Corporation) -- C:\Programme\Sony\VAIO Care\listener.exe
PRC - [2010.07.01 10:38:26 | 000,083,512 | ---- | M] (ArcSoft, Inc.) -- D:\Users\***\AppData\Roaming\HP SimpleSave Application\uUACTokenSvc.exe
PRC - [2010.06.03 14:23:06 | 000,332,024 | ---- | M] (QUALCOMM, Inc.) -- c:\Program Files (x86)\QUALCOMM\QDLService2k\QDLService2kSony.exe
PRC - [2010.05.31 19:18:32 | 000,217,968 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe
PRC - [2010.05.31 19:18:32 | 000,120,176 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe
PRC - [2010.05.31 17:01:52 | 000,673,136 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe
PRC - [2010.05.18 19:36:48 | 000,253,440 | ---- | M] (Vodafone) -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe
PRC - [2010.05.18 19:36:30 | 000,009,216 | ---- | M] (Vodafone) -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe
PRC - [2010.03.23 13:19:32 | 001,528,616 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
PRC - [2010.03.04 05:16:06 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2010.03.04 05:16:04 | 000,284,696 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2010.02.23 22:52:04 | 002,320,920 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2010.02.23 22:52:00 | 000,268,824 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2009.09.23 16:45:50 | 001,287,176 | ---- | M] (Panda Security) -- C:\Program Files (x86)\Panda USB Vaccine\USBVaccine.exe
PRC - [2008.08.30 18:10:42 | 001,562,381 | ---- | M] () -- C:\Program Files (x86)\iPod Access for Windows\iPAHelper.exe
========== Modules (No Company Name) ==========
MOD - [2013.05.27 19:47:49 | 000,116,736 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Common\99c56363536370a61cd6b0f8d5baea26\Vodafone.Common.ni.dll
MOD - [2013.05.27 19:47:48 | 001,345,536 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Platform\7879b99363bee1769d83b353d94bedb2\Vodafone.Platform.ni.dll
MOD - [2013.05.27 17:35:32 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\30e3a21202000677d0a9270572251477\System.Windows.Forms.ni.dll
MOD - [2013.05.27 17:35:15 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\716959df79685a1eae0fc14275a32b0f\WindowsBase.ni.dll
MOD - [2013.05.27 17:35:12 | 000,687,104 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Security\23673bbebe3c0ca7c894e614bb3ffd1a\System.Security.ni.dll
MOD - [2013.05.27 17:35:11 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\764f15e86c82662e977bd418bd6318c1\System.Configuration.ni.dll
MOD - [2013.02.14 11:42:43 | 000,436,224 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.View.Secon#\8c84a3ba5d605db3c4e5e52a88893775\Vodafone.View.SecondaryWindows.ni.dll
MOD - [2013.02.14 11:42:43 | 000,056,832 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Vpn\26c218af2560dc13a28d84017318f089\Vodafone.Vpn.ni.dll
MOD - [2013.02.14 11:42:42 | 000,378,880 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.BusinessLo#\821644269832a3d0b21dcd972325aaaf\Vodafone.BusinessLogic.ni.dll
MOD - [2013.02.14 11:42:42 | 000,099,328 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\7be76e081583a5b6fb7296da24b32cf2\Vodafone.Contracts.View.ni.dll
MOD - [2013.02.14 11:42:42 | 000,036,352 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\d6f2a8f9313ae78339d610624bf1402f\Vodafone.Contracts.Presenter.ni.dll
MOD - [2013.02.14 11:42:41 | 000,345,088 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.CommonDial#\2e25aa42746fb707fc2e2f99a9c4d1ab\Vodafone.CommonDialogs.ni.dll
MOD - [2013.02.14 11:42:41 | 000,117,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\25f20a585dd0b062705779e6f4885fa0\Vodafone.Contracts.Model.ni.dll
MOD - [2013.02.14 11:42:40 | 001,081,856 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Connection#\ce57c4309968970ced3fefbb73656cb7\Vodafone.ConnectionServices.ni.dll
MOD - [2013.02.14 11:42:39 | 000,071,680 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\e143c73d632ec867c55a7de9b301d992\Vodafone.Contracts.Common.ni.dll
MOD - [2013.02.14 11:42:39 | 000,045,568 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Contracts.#\aac12649bd7969eb5f937d14a103f747\Vodafone.Contracts.Adapter.ni.dll
MOD - [2013.02.14 11:42:38 | 001,688,576 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Applicatio#\baa9058fdc93232aa3e04066db2abb68\Vodafone.ApplicationHost.Impl.ni.dll
MOD - [2013.02.14 11:42:37 | 000,375,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Data\9f044c983deddabc805951a779842a84\Vodafone.Data.ni.dll
MOD - [2013.02.14 11:42:37 | 000,259,072 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DataAccess#\389fbe9d5c33933fd3957da5c4f941cd\Vodafone.DataAccessor.ni.dll
MOD - [2013.02.14 11:42:36 | 000,249,856 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\MobileBroadband\0c39a05255ce3e02d613264d3461e3d6\MobileBroadband.ni.exe
MOD - [2013.02.13 18:01:39 | 010,580,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Design\31a8f96f8939ac18a867ee26cc37eda8\System.Design.ni.dll
MOD - [2013.02.13 18:01:39 | 000,212,992 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\7ff638de44686eab4afaa8b3c8a9cfca\System.ServiceProcess.ni.dll
MOD - [2013.02.13 18:01:34 | 011,833,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\5ecf01964c70e453d71e5d7653912ff9\System.Web.ni.dll
MOD - [2013.01.22 19:04:49 | 000,182,272 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Model.Conn#\4f9991daf878fa42d7e05a735998a63d\Vodafone.Model.Connection.ni.dll
MOD - [2013.01.22 19:04:49 | 000,062,464 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Model.Shor#\846c397f7a3a4cdea8a7b38161cd1ae8\Vodafone.Model.Shortcut.ni.dll
MOD - [2013.01.22 19:04:48 | 000,025,088 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.FortinetCo#\b25d6a4531a691a0635a2ce88871f7c9\Vodafone.FortinetConnector.ni.dll
MOD - [2013.01.22 19:04:47 | 000,218,624 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.DeviceMana#\145afb32e5c6cf0494c1c8ad7faa6786\Vodafone.DeviceManagement.ni.dll
MOD - [2013.01.22 19:04:47 | 000,211,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.LanWlanMan#\09666354085eccf4cb1af14d7df1b94d\Vodafone.LanWlanManager.ni.dll
MOD - [2013.01.22 19:04:46 | 002,104,320 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Spring.Core\4a69d3bfa1111bcd9328e15165ee78ad\Spring.Core.ni.dll
MOD - [2013.01.22 19:04:46 | 000,047,104 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Common.Logging\0c5008375abad2d7074f91953acd7158\Common.Logging.ni.dll
MOD - [2013.01.22 19:04:45 | 000,029,696 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.InstancePr#\d18ce47ec92816b8b5248a5365305627\Vodafone.InstanceProvider.Impl.ni.dll
MOD - [2013.01.22 19:04:44 | 000,333,824 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.ReportingM#\93bfa803b521fb7578915cb74920e2f1\Vodafone.ReportingManager.ni.dll
MOD - [2013.01.22 19:04:44 | 000,218,624 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Interop.FNCClient11#\7f77988c5a28f2dc6424e6061bd244ef\Interop.FNCClient11Lib.ni.dll
MOD - [2013.01.22 19:04:44 | 000,033,280 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.UpdateMana#\e3761a4a1ca386d1ec46ccedf2513c80\Vodafone.UpdateManager.ni.dll
MOD - [2013.01.22 19:04:42 | 000,731,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.WwanWrapper\6e33bdf82851fde9fd4c5288b7d9023f\Vodafone.WwanWrapper.ni.dll
MOD - [2013.01.22 19:04:42 | 000,192,000 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.SmsContact#\9dddcd332cca5048f6896785f54d39e4\Vodafone.SmsContactManager.ni.dll
MOD - [2013.01.22 19:04:42 | 000,119,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Interop.Shell32\1ec478df5eaa32e5063377fc796b67b7\Interop.Shell32.ni.dll
MOD - [2013.01.22 19:04:42 | 000,051,712 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.TrafficOpt#\9309da6c8e71dc1da69339211ebc428e\Vodafone.TrafficOptimiser.ni.dll
MOD - [2013.01.22 19:04:42 | 000,030,720 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.OutlookCon#\bd2a39db655db5318e68de06b81be584\Vodafone.OutlookConnector.ni.dll
MOD - [2013.01.22 19:04:41 | 000,035,328 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Connection#\60de5d15add08234a0c9cb06c0a8a34c\Vodafone.ConnectionManagement.ni.dll
MOD - [2013.01.22 19:04:41 | 000,018,944 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.MobileBroa#\4de5d56d8d91b0535cc058638ea19ae1\Vodafone.MobileBroadband.CallbackHandler.ni.dll
MOD - [2013.01.22 19:04:39 | 000,080,384 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.SmsProfile#\4289ee6b9a747e7bc76770e9fb33b0dc\Vodafone.SmsProfileManager.ni.dll
MOD - [2013.01.22 19:04:39 | 000,060,416 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Conflictin#\03658a6bc4484a2b177f41aee5d0ab77\Vodafone.ConflictingApplications.ni.dll
MOD - [2013.01.22 19:04:39 | 000,051,712 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.SettingsMa#\61a307d8230bcbc357d2745bb2b524d6\Vodafone.SettingsManager.ni.dll
MOD - [2013.01.22 19:04:38 | 000,932,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\MobileBroadbandReso#\908f155f653d51d69ebbd70b6eec54be\MobileBroadbandResources.ni.dll
MOD - [2013.01.22 19:04:38 | 000,300,544 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.Win32\b44362b8d32cba31e81cd89dfc58912e\Vodafone.Win32.ni.dll
MOD - [2013.01.22 19:04:38 | 000,067,072 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.NtServiceM#\5b4d17c27ee2c3a3c0b1125e7bc50228\Vodafone.NtServiceMessaging.ni.dll
MOD - [2013.01.22 19:04:36 | 000,074,240 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Vodafone.LogEngine\da96079fbd846fbf4245080777e4147b\Vodafone.LogEngine.ni.dll
MOD - [2013.01.22 19:04:34 | 001,051,136 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\302207b4fa3083899fd8ab4db98cecc5\System.Management.ni.dll
MOD - [2013.01.22 19:04:33 | 000,452,608 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\f7cb3ae5de64f8cbde3ccc57c780743a\IAStorUtil.ni.dll
MOD - [2013.01.22 11:53:08 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\90b89f6e8032310e9ac72a309fd49e83\System.Runtime.Remoting.ni.dll
MOD - [2013.01.22 11:53:07 | 006,611,456 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\81edf0da5f951bd97acfbb9d54504617\System.Data.ni.dll
MOD - [2013.01.22 11:53:07 | 000,627,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\536d704e93ffec9b54e4a0312fb5b996\System.Transactions.ni.dll
MOD - [2013.01.22 11:52:46 | 001,592,832 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eead6629e384a5b69f9ae35284b7eeed\System.Drawing.ni.dll
MOD - [2013.01.22 11:52:45 | 000,025,600 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\d908c91e24616e6b8d38c9da61038b25\Accessibility.ni.dll
MOD - [2013.01.22 11:52:34 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\f687c43e9fdec031988b33ae722c4613\System.Xml.ni.dll
MOD - [2013.01.22 11:52:29 | 007,989,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll
MOD - [2013.01.22 11:52:24 | 011,493,376 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll
MOD - [2011.09.27 07:23:00 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.09.27 07:22:40 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011.07.26 02:20:33 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll
MOD - [2010.11.13 02:08:41 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010.11.05 03:58:05 | 002,927,616 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
MOD - [2009.07.14 03:15:45 | 000,364,544 | ---- | M] () -- C:\Windows\SysWOW64\msjetoledb40.dll
MOD - [2009.06.10 23:23:19 | 000,261,632 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
========== Services (SafeList) ==========
SRV:64bit: - [2011.01.29 06:36:18 | 000,259,192 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files\Sony\VAIO Care\VCPerfService.exe -- (SampleCollector)
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV:64bit: - [2007.04.21 11:11:00 | 000,477,104 | ---- | M] ( ) [On_Demand | Stopped] -- C:\Windows\SysNative\GNabcoms.exe -- (gnab_device)
SRV - [2013.05.24 16:16:52 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013.05.08 00:37:15 | 000,143,088 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Programme\SUPERAntiSpyware\SASCore64.exe -- (!SASCORE)
SRV - [2013.02.28 18:45:16 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.10.26 10:44:28 | 001,286,784 | ---- | M] (Sony Corporation) [On_Demand | Running] -- C:\Programme\Sony\VAIO Update\VUAgent.exe -- (VUAgent)
SRV - [2012.10.22 23:23:36 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011.11.22 10:59:30 | 000,018,432 | ---- | M] () [Auto | Running] -- D:\Users\***\AppData\LocalLow\StumbleUpon\IE\StumbleUponUpdater.exe -- (StumbleUponUpdater)
SRV - [2011.09.27 21:04:08 | 000,359,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2011.07.27 18:43:55 | 000,411,432 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011.04.27 17:21:18 | 000,288,272 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- c:\Programme\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv)
SRV - [2011.04.27 17:21:18 | 000,012,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
SRV - [2011.02.14 14:23:50 | 000,044,736 | ---- | M] (Sony Corporation) [On_Demand | Running] -- C:\Programme\Sony\VAIO Care\VCService.exe -- (VCService)
SRV - [2010.07.01 10:38:26 | 000,083,512 | ---- | M] (ArcSoft, Inc.) [Auto | Running] -- D:\Users\***\AppData\Roaming\HP SimpleSave Application\uUACTokenSvc.exe -- (BackupService)
SRV - [2010.06.21 18:00:52 | 000,575,856 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Programme\Sony\VAIO Power Management\SPMService.exe -- (VAIO Power Management)
SRV - [2010.06.08 23:55:14 | 000,952,096 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Programme\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)
SRV - [2010.06.08 17:00:04 | 000,836,608 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Programme\Sony\VAIO Smart Network\VSNService.exe -- (VSNService)
SRV - [2010.06.03 14:23:06 | 000,332,024 | ---- | M] (QUALCOMM, Inc.) [Auto | Running] -- c:\Program Files (x86)\QUALCOMM\QDLService2k\QDLService2kSony.exe -- (QDLService2kSony)
SRV - [2010.05.31 19:18:32 | 000,217,968 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe -- (VAIO Event Service)
SRV - [2010.05.18 19:36:30 | 000,009,216 | ---- | M] (Vodafone) [Auto | Running] -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe -- (VmbService)
SRV - [2010.03.23 13:19:32 | 001,528,616 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND)
SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.03.18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2010.03.05 10:26:38 | 001,425,168 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programme\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV - [2010.03.05 10:06:22 | 000,831,760 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV - [2010.03.04 05:16:06 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2010.02.23 22:52:04 | 002,320,920 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2010.02.23 22:52:00 | 000,268,824 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008.08.30 18:10:42 | 001,562,381 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\iPod Access for Windows\iPAHelper.exe -- (iPAHelper.exe)
SRV - [2007.04.21 11:10:56 | 000,508,848 | ---- | M] ( ) [On_Demand | Stopped] -- C:\Windows\SysWOW64\GNabcoms.exe -- (gnab_device)
========== Driver Services (SafeList) ==========
DRV:64bit: - [2013.02.18 10:22:16 | 000,189,288 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2012.12.13 14:50:36 | 000,054,784 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2012.12.06 13:11:40 | 011,518,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Netwsw00.sys -- (NETwNs64)
DRV:64bit: - [2012.08.23 16:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2012.08.23 16:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2012.08.21 13:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.09.02 08:30:46 | 000,042,776 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LUsbFilt.sys -- (LUsbFilt)
DRV:64bit: - [2011.09.02 08:30:36 | 000,060,696 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt)
DRV:64bit: - [2011.09.02 08:30:24 | 000,076,056 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LEqdUsb.sys -- (LEqdUsb)
DRV:64bit: - [2011.09.02 08:30:24 | 000,066,840 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)
DRV:64bit: - [2011.09.02 08:30:24 | 000,015,128 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidEqd.sys -- (LHidEqd)
DRV:64bit: - [2011.07.27 23:51:36 | 000,834,544 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd)
DRV:64bit: - [2011.04.27 15:25:24 | 000,084,864 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 11:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2010.07.12 22:14:50 | 000,078,848 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\risdsne64.sys -- (risdsnpe)
DRV:64bit: - [2010.06.18 22:12:58 | 000,151,936 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd)
DRV:64bit: - [2010.06.18 22:11:36 | 000,094,208 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rimssne64.sys -- (rimspci)
DRV:64bit: - [2010.06.18 22:10:26 | 000,021,544 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid)
DRV:64bit: - [2010.06.18 22:10:24 | 000,342,056 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwampfl.sys -- (btwampfl)
DRV:64bit: - [2010.06.18 22:10:24 | 000,135,720 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt)
DRV:64bit: - [2010.06.18 22:10:24 | 000,102,952 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio)
DRV:64bit: - [2010.06.18 22:09:47 | 000,039,464 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap)
DRV:64bit: - [2010.06.03 11:17:50 | 000,442,368 | ---- | M] (QUALCOMM Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\qcusbnetsny2k.sys -- (qcusbnetsny2k)
DRV:64bit: - [2010.06.03 11:17:50 | 000,230,784 | ---- | M] (QUALCOMM Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\qcusbserSny2k.sys -- (qcusbserSny2k)
DRV:64bit: - [2010.06.03 11:17:50 | 000,137,800 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\qcombussny.sys -- (qcombussny)
DRV:64bit: - [2010.06.03 11:17:48 | 000,006,400 | ---- | M] (QUALCOMM Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\qcfiltersny2k.sys -- (qcfiltersny2k)
DRV:64bit: - [2010.05.31 12:05:06 | 007,689,216 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NETw5s64.sys -- (NETw5s64)
DRV:64bit: - [2010.04.26 22:20:29 | 000,012,032 | ---- | M] (Sony Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SFEP.sys -- (SFEP)
DRV:64bit: - [2010.03.23 13:29:46 | 000,304,784 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CVPNDRVA.sys -- (CVPNDRVA)
DRV:64bit: - [2010.03.08 22:10:27 | 000,294,064 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1k62x64.sys -- (e1kexpress)
DRV:64bit: - [2010.03.04 04:51:40 | 000,540,696 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010.03.01 10:35:21 | 000,299,568 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2010.02.08 08:32:00 | 000,014,992 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CVirtA64.sys -- (CVirtA)
DRV:64bit: - [2009.09.17 21:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV:64bit: - [2009.07.14 02:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)
DRV:64bit: - [2009.07.14 01:21:48 | 000,038,400 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tpm.sys -- (TPM)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2008.11.16 18:39:44 | 000,157,968 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dne64x.sys -- (DNE)
DRV - [2011.09.22 08:45:28 | 000,030,080 | ---- | M] (REALiX(tm)) [Kernel | System | Running] -- C:\Program Files (x86)\HWiNFO32\HWiNFO64A.SYS -- (HWiNFO32)
DRV - [2011.07.22 18:26:56 | 000,014,928 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\sasdifsv64.sys -- (SASDIFSV)
DRV - [2011.07.12 23:55:18 | 000,012,368 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\saskutil64.sys -- (SASKUTIL)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=SVEE&bmod=SVEE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=SVEE&bmod=SVEE
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{1D11CF59-DCAA-4025-AA9F-6688C2B243BE}: "URL" = hxxp://rover.ebay.com/rover/1/707-37276-16609-9/4?satitle={searchTerms}
IE - HKCU\..\SearchScopes\{47AEF237-4274-4F0E-A5F6-3DBB8EA3EB13}: "URL" = hxxp://de.shopping.com/?linkin_id=8056363
IE - HKCU\..\SearchScopes\{6983E10E-1B3F-49AB-B882-8CDFE6CBD55B}: "URL" = hxxp://services.zinio.com/search?s={searchTerms}&rf=sonyslices
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local
========== FireFox ==========
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledAddons: %7Ba3a5c777-f583-4fef-9380-ab4add1bc2a8%7D:5.0
FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:2.6.6.2
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.3.1: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.3.1: C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.19: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.05.25 22:20:19 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.05.25 22:20:19 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
[2011.07.26 02:45:44 | 000,000,000 | ---D | M] (No name found) -- D:\Users\***\AppData\Roaming\Mozilla\Extensions
[2013.05.28 22:39:27 | 000,000,000 | ---D | M] (No name found) -- D:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\gr7m9czx.default\extensions
[2013.05.28 22:39:27 | 000,000,000 | ---D | M] (DownloadHelper) -- D:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\gr7m9czx.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2013.02.16 00:11:04 | 000,000,000 | ---D | M] (StumbleUpon) -- D:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\gr7m9czx.default\extensions\toolbar@stumbleupon.com
[2013.05.25 14:04:26 | 000,534,261 | ---- | M] () (No name found) -- D:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\gr7m9czx.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2013.01.20 01:05:47 | 000,013,972 | ---- | M] () (No name found) -- D:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\gr7m9czx.default\extensions\{a3a5c777-f583-4fef-9380-ab4add1bc2a8}.xpi
[2013.05.24 16:16:54 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2013.05.24 16:15:58 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2013.05.24 16:15:58 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2013.05.24 16:15:58 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
[2013.05.24 16:16:53 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions
[2013.05.24 16:16:53 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
========== Chrome ==========
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: hxxp://www.google.com/ig/redirectdomain?brand=SVEE&bmod=SVEE
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.110\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.110\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.110\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 6 U31 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll
CHR - plugin: Veetle TV Player (Enabled) = C:\Program Files (x86)\Veetle\Player\npvlc.dll
CHR - plugin: Veetle TV Core (Enabled) = C:\Program Files (x86)\Veetle\plugins\npVeetle.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - Extension: Google-Suche = D:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1\
CHR - Extension: StumbleUpon = D:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgifblbjgdjhcelbanblbhkhmbnnmhfg\3.97.1_0\
CHR - Extension: Google Mail = D:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MIF5BA~1\Office12\GR469A~1.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (StumbleUpon) - {DB616CFF-D989-48A8-9C85-E2A8D56AB2CA} - D:\Users\***\AppData\LocalLow\StumbleUpon\IE\StumbleUpon.dll (StumbleUpon Inc.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4:64bit: - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\Windows\SysNative\LogiLDA.dll (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.dll (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [PSQLLauncher] C:\Program Files\Protector Suite\launcher.exe (UPEK Inc.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [ISBMgr.exe] C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)
O4 - HKLM..\Run: [MobileBroadband] C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe (Vodafone)
O4 - HKCU..\Run: [iCloudServices] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.)
O4 - HKCU..\Run: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe File not found
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MIF5BA~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MIF5BA~1\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MIF5BA~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MIF5BA~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MIF5BA~1\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 77.109.128.2 213.144.129.20
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BA23525E-17A8-418F-B10A-CFA1E8DC9CE0}: DhcpNameServer = 77.109.128.2 213.144.129.20
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MIF5BA~1\Office12\GRA32A~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Programme\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O20:64bit: - Winlogon\Notify\psfus: DllName - (C:\Program Files\Protector Suite\psqlpwd.dll) - C:\Programme\Protector Suite\psqlpwd.dll (UPEK Inc.)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MIF5BA~1\Office12\GR469A~1.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011.09.15 06:12:14 | 000,000,080 | -H-- | M] () - E:\autorun.inf -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 30 Days ==========
[2013.06.10 17:46:55 | 000,000,000 | ---D | C] -- D:\Users\***\Desktop\Virenbekämpfung
[2013.06.10 04:19:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2013.06.10 04:07:36 | 000,000,000 | ---D | C] -- D:\Users\***\AppData\Roaming\SUPERAntiSpyware.com
[2013.06.10 04:07:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2013.06.10 04:07:32 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2013.06.10 04:07:32 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2013.06.10 04:02:19 | 000,000,000 | ---D | C] -- D:\Users\***\AppData\Roaming\Malwarebytes
[2013.06.10 04:00:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.06.10 04:00:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.06.10 04:00:13 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013.06.10 04:00:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013.06.10 04:00:03 | 000,000,000 | ---D | C] -- D:\Users\***\AppData\Local\Programs
[2013.06.08 23:33:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2013.06.08 23:33:12 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2013.06.08 23:33:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes
[2013.06.08 23:33:12 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2013.06.08 23:33:12 | 000,000,000 | ---D | C] -- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
[2013.06.03 18:29:05 | 000,000,000 | ---D | C] -- D:\Users\***\Desktop\Viktor neu
[2013.06.01 22:43:23 | 000,000,000 | ---D | C] -- D:\Users\***\Documents\2013
[2013.05.31 23:57:38 | 000,000,000 | ---D | C] -- D:\Users\***\Desktop\Booz Workshop
[2013.05.31 14:48:25 | 000,000,000 | ---D | C] -- D:\Users\***\Desktop\Arbeitszeiten
[2013.05.27 01:36:41 | 000,000,000 | ---D | C] -- D:\Users\***\Desktop\Finance and Economic
[2013.05.25 22:20:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2013.05.25 22:20:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QuickTime
[2013.05.24 16:15:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2013.05.16 01:18:17 | 000,000,000 | ---D | C] -- D:\Users\***\AppData\Roaming\dvdcss
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2013.06.10 18:01:04 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.06.10 17:37:28 | 000,010,112 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.06.10 17:37:28 | 000,010,112 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.06.10 17:34:35 | 001,619,868 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.06.10 17:34:35 | 000,699,182 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.06.10 17:34:35 | 000,654,460 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.06.10 17:34:35 | 000,149,346 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.06.10 17:34:35 | 000,122,292 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.06.10 17:30:40 | 000,000,558 | ---- | M] () -- C:\Windows\tasks\MATLAB R2012a Startup Accelerator.job
[2013.06.10 17:30:35 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.06.10 17:30:19 | 000,065,536 | ---- | M] () -- C:\Windows\SysNative\Ikeext.etl
[2013.06.10 17:30:15 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.06.10 17:30:07 | 1887,821,823 | -HS- | M] () -- C:\hiberfil.sys
[2013.06.10 16:28:22 | 000,000,522 | ---- | M] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task e4924d39-ec30-42bf-bce3-cc566a6d6933.job
[2013.06.10 12:07:00 | 000,000,522 | ---- | M] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task c05d41db-af08-494c-b584-b2715e0a6bd6.job
[2013.06.10 04:07:35 | 000,001,686 | ---- | M] () -- D:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2013.06.10 04:00:19 | 000,000,983 | ---- | M] () -- D:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013.06.09 05:54:36 | 000,416,780 | ---- | M] () -- D:\Users\***\Desktop\MasterThesisTopics_HWS2013.pdf
[2013.06.09 05:53:58 | 000,379,874 | ---- | M] () -- D:\Users\***\Desktop\Diplomarbeiten_HWS010.pdf
[2013.06.09 05:53:49 | 000,227,360 | ---- | M] () -- D:\Users\***\Desktop\DA_FSS2011.pdf
[2013.06.09 05:53:37 | 000,650,499 | ---- | M] () -- D:\Users\***\Desktop\Diplomarbeiten_HWS011.pdf
[2013.06.09 05:52:55 | 000,418,460 | ---- | M] () -- D:\Users\***\Desktop\Masterarbeiten_FSS_2013.pdf
[2013.06.09 05:46:57 | 000,309,931 | ---- | M] () -- D:\Users\***\Desktop\03062013_Bachelorarbeitsthemen.pdf
[2013.06.08 23:33:28 | 000,001,689 | ---- | M] () -- D:\Users\Public\Desktop\iTunes.lnk
[2013.06.01 21:44:10 | 002,059,673 | ---- | M] () -- D:\Users\***\Desktop\Intro_to_the_Math__and_Stat__Foundations_of_Econometrics_-_H__Bierens.pdf
[2013.06.01 19:34:53 | 001,282,507 | ---- | M] () -- D:\Users\***\Desktop\Empirical_Example.zip
[2013.06.01 18:57:38 | 001,030,686 | ---- | M] () -- D:\Users\***\Desktop\project_explanation_Koval Mariia_corretto dal prof.pdf
[2013.06.01 18:53:08 | 000,526,061 | ---- | M] () -- D:\Users\***\Desktop\econ_604-lab_ex_2.pdf
[2013.06.01 03:07:29 | 000,000,264 | ---- | M] () -- D:\Users\***\Desktop\Results2Appello20052013.pdf
[2013.06.01 01:31:05 | 000,206,412 | ---- | M] () -- D:\Users\***\Desktop\abschlussarbeiten_themenliste_ba_ma__ibw_vwl_aktualisiert_20130318.pdf
[2013.05.31 23:48:37 | 000,369,320 | ---- | M] () -- D:\Users\***\Desktop\Language Text Bsp 2.png
[2013.05.31 23:48:09 | 000,385,401 | ---- | M] () -- D:\Users\***\Desktop\Language Text Bsp 1.png
[2013.05.31 23:27:05 | 001,077,494 | ---- | M] () -- D:\Users\***\Desktop\Passport.jpg
[2013.05.31 15:35:05 | 000,264,500 | ---- | M] () -- C:\test.xml
[2013.05.30 18:58:24 | 000,000,997 | ---- | M] () -- D:\Users\***\Desktop\Dropbox.lnk
[2013.05.27 19:54:22 | 002,341,520 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.05.26 19:26:19 | 000,044,691 | ---- | M] () -- D:\Users\***\Desktop\Text_exam_19-03-13.pdf
[2013.05.21 13:07:06 | 018,041,144 | ---- | M] () -- D:\Users\***\Desktop\upd-pcl6-x64-5.6.1.15198.exe
[2013.05.19 17:17:25 | 000,364,129 | ---- | M] () -- D:\Users\***\Desktop\mwsmile.pdf
[2013.05.15 22:02:19 | 000,097,596 | ---- | M] () -- D:\Users\***\Desktop\Anforderungsprofil.pdf
[2013.05.15 19:25:25 | 000,048,737 | ---- | M] () -- D:\Users\***\Desktop\Lebenslauf_Hahn_Sebastian.pdf
[2013.05.15 16:39:41 | 001,717,020 | ---- | M] () -- D:\Users\***\Desktop\Jahresbroschüre2014.pdf
[2013.05.15 16:37:03 | 001,294,290 | ---- | M] () -- D:\Users\***\Desktop\diGiovanni_Levchenko_Ortega.pdf
[2013.05.14 22:30:38 | 000,028,211 | ---- | M] () -- D:\Users\***\Desktop\MM-Card.pdf
[2013.05.13 21:08:33 | 000,637,711 | ---- | M] () -- D:\Users\***\Desktop\Azariadis 2013_slides.pdf
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files Created - No Company Name ==========
[2013.06.10 04:07:45 | 000,000,522 | ---- | C] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task e4924d39-ec30-42bf-bce3-cc566a6d6933.job
[2013.06.10 04:07:45 | 000,000,522 | ---- | C] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task c05d41db-af08-494c-b584-b2715e0a6bd6.job
[2013.06.10 04:07:35 | 000,001,686 | ---- | C] () -- D:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2013.06.10 04:00:19 | 000,000,983 | ---- | C] () -- D:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013.06.09 05:54:36 | 000,416,780 | ---- | C] () -- D:\Users\***\Desktop\MasterThesisTopics_HWS2013.pdf
[2013.06.09 05:53:57 | 000,379,874 | ---- | C] () -- D:\Users\***\Desktop\Diplomarbeiten_HWS010.pdf
[2013.06.09 05:53:47 | 000,227,360 | ---- | C] () -- D:\Users\***\Desktop\DA_FSS2011.pdf
[2013.06.09 05:53:35 | 000,650,499 | ---- | C] () -- D:\Users\***\Desktop\Diplomarbeiten_HWS011.pdf
[2013.06.09 05:52:55 | 000,418,460 | ---- | C] () -- D:\Users\***\Desktop\Masterarbeiten_FSS_2013.pdf
[2013.06.09 05:46:57 | 000,309,931 | ---- | C] () -- D:\Users\***\Desktop\03062013_Bachelorarbeitsthemen.pdf
[2013.06.08 23:33:28 | 000,001,689 | ---- | C] () -- D:\Users\Public\Desktop\iTunes.lnk
[2013.06.01 21:44:10 | 002,059,673 | ---- | C] () -- D:\Users\***\Desktop\Intro_to_the_Math__and_Stat__Foundations_of_Econometrics_-_H__Bierens.pdf
[2013.06.01 19:34:53 | 001,282,507 | ---- | C] () -- D:\Users\***\Desktop\Empirical_Example.zip
[2013.06.01 18:57:37 | 001,030,686 | ---- | C] () -- D:\Users\***\Desktop\project_explanation_Koval Mariia_corretto dal prof.pdf
[2013.06.01 18:53:08 | 000,526,061 | ---- | C] () -- D:\Users\***\Desktop\econ_604-lab_ex_2.pdf
[2013.06.01 03:07:29 | 000,000,264 | ---- | C] () -- D:\Users\***\Desktop\Results2Appello20052013.pdf
[2013.06.01 01:31:04 | 000,206,412 | ---- | C] () -- D:\Users\***\Desktop\abschlussarbeiten_themenliste_ba_ma__ibw_vwl_aktualisiert_20130318.pdf
[2013.05.31 23:48:37 | 000,369,320 | ---- | C] () -- D:\Users\***\Desktop\Language Text Bsp 2.png
[2013.05.31 23:48:09 | 000,385,401 | ---- | C] () -- D:\Users\***\Desktop\Language Text Bsp 1.png
[2013.05.31 23:27:04 | 001,077,494 | ---- | C] () -- D:\Users\***\Desktop\Passport.jpg
[2013.05.27 01:50:03 | 001,555,176 | ---- | C] () -- D:\Users\***\Desktop\Spreadsheet Modeling in Corp Finance for Brealey Myers.pdf
[2013.05.27 01:44:38 | 001,989,035 | ---- | C] () -- D:\Users\***\Desktop\The Dark Side of Valuation - Damodaran.pdf
[2013.05.27 01:42:40 | 001,952,974 | ---- | C] () -- D:\Users\***\Desktop\K. Sydsaeter, A. Strøm - Economists’ Mathematical Manual.pdf
[2013.05.27 01:42:15 | 026,006,434 | ---- | C] () -- D:\Users\***\Desktop\Alpha C. Chiang - Fundamental Methods of Mathematical Economics.pdf
[2013.05.26 19:26:19 | 000,044,691 | ---- | C] () -- D:\Users\***\Desktop\Text_exam_19-03-13.pdf
[2013.05.21 13:06:57 | 018,041,144 | ---- | C] () -- D:\Users\***\Desktop\upd-pcl6-x64-5.6.1.15198.exe
[2013.05.19 17:17:24 | 000,364,129 | ---- | C] () -- D:\Users\***\Desktop\mwsmile.pdf
[2013.05.15 22:02:18 | 000,097,596 | ---- | C] () -- D:\Users\***\Desktop\Anforderungsprofil.pdf
[2013.05.15 19:25:25 | 000,048,737 | ---- | C] () -- D:\Users\***\Desktop\Lebenslauf_Hahn_Sebastian.pdf
[2013.05.15 16:38:55 | 001,717,020 | ---- | C] () -- D:\Users\***\Desktop\Jahresbroschüre2014.pdf
[2013.05.15 16:37:02 | 001,294,290 | ---- | C] () -- D:\Users\***\Desktop\diGiovanni_Levchenko_Ortega.pdf
[2013.05.14 22:30:38 | 000,028,211 | ---- | C] () -- D:\Users\***\Desktop\MM-Card.pdf
[2013.05.13 21:08:30 | 000,637,711 | ---- | C] () -- D:\Users\***\Desktop\Azariadis 2013_slides.pdf
[2013.04.25 11:52:10 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\zlib.dll
[2013.04.25 11:52:04 | 001,208,320 | ---- | C] ( ) -- C:\Windows\SysWow64\GNabserv.dll
[2013.04.25 11:52:03 | 000,614,400 | ---- | C] ( ) -- C:\Windows\SysWow64\GNabcomc.dll
[2013.04.25 11:52:03 | 000,508,848 | ---- | C] ( ) -- C:\Windows\SysWow64\GNabcoms.exe
[2013.04.25 11:52:03 | 000,507,904 | ---- | C] ( ) -- C:\Windows\SysWow64\GNabhcp.dll
[2013.04.25 11:52:03 | 000,425,984 | ---- | C] ( ) -- C:\Windows\SysWow64\GNabcomm.dll
[2013.04.25 11:52:03 | 000,163,840 | ---- | C] ( ) -- C:\Windows\SysWow64\GNabprox.dll
[2013.02.11 17:32:00 | 000,000,045 | RH-- | C] () -- C:\Windows\sgc_user.dat
[2013.01.01 15:02:01 | 000,000,023 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2012.11.04 20:33:45 | 000,000,218 | ---- | C] () -- D:\Users\***\.recently-used.xbel
[2012.03.26 17:16:48 | 000,001,024 | ---- | C] () -- C:\Windows\SysWow64\clauth2.dll
[2012.03.26 17:16:48 | 000,001,024 | ---- | C] () -- C:\Windows\SysWow64\clauth1.dll
[2012.03.26 17:16:48 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\ssprs.dll
[2012.03.26 17:16:48 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\serauth2.dll
[2012.03.26 17:16:48 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\serauth1.dll
[2012.03.26 17:16:48 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\nsprs.dll
[2012.03.26 17:13:42 | 000,001,025 | ---- | C] () -- C:\Windows\SysWow64\sysprs7.dll
[2012.03.26 17:13:42 | 000,000,205 | ---- | C] () -- C:\Windows\SysWow64\lsprst7.dll
[2011.10.30 19:35:04 | 000,032,256 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll
[2011.10.30 19:31:18 | 000,107,520 | RHS- | C] () -- C:\Windows\SysWow64\TAKDSDecoder.dll
[2011.08.04 03:35:25 | 000,007,597 | ---- | C] () -- D:\Users\***\AppData\Local\Resmon.ResmonCfg
[2011.07.31 18:41:10 | 000,000,041 | -H-- | C] () -- D:\Users\***\AppData\Roaming\iPodAccessv4_OwnerName
[2011.07.31 18:41:10 | 000,000,041 | -H-- | C] () -- C:\ProgramData\iPodAccessv4_OwnerName
[2011.07.31 18:37:19 | 000,000,269 | ---- | C] () -- D:\Users\***\AppData\Roaming\iPod Access v4 Prefs
[2011.07.31 18:34:21 | 000,000,011 | -H-- | C] () -- D:\Users\***\AppData\Roaming\iPodAccess_Time
[2011.07.27 15:59:43 | 001,599,308 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010.05.17 14:20:06 | 000,157,382 | R--- | C] () -- C:\ProgramData\DeviceManager.xml.rc4
========== ZeroAccess Check ==========
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2012.08.21 15:11:31 | 000,857,088 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2012.08.21 15:37:44 | 000,636,928 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2012.08.21 15:08:38 | 000,453,120 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
========== LOP Check ==========
[2011.07.28 14:34:42 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\AusLogics
[2013.02.14 16:10:46 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\benibela
[2012.06.08 16:49:27 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\Bizagi Ltd
[2011.07.27 23:57:56 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\DAEMON Tools Lite
[2013.06.10 17:11:37 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\Dropbox
[2012.01.09 20:08:59 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\foobar2000
[2012.12.17 15:21:56 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\FreeFLVConverter
[2012.11.04 20:13:31 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\gretl
[2012.11.04 20:33:25 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\gtk-2.0
[2012.06.08 16:49:28 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\IsolatedStorage
[2012.01.28 22:14:40 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\Leadertech
[2013.01.01 15:06:26 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\MySQL
[2013.01.01 19:44:10 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\Oracle
[2011.07.26 02:45:15 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\Protector Suite
[2013.02.11 17:32:01 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\Quantitative Micro Software
[2012.10.12 13:18:57 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\RStudio
[2011.07.26 02:45:16 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\Vodafone
[2012.09.28 01:04:48 | 000,000,000 | ---D | M] -- D:\Users\***\AppData\Roaming\WindSolutions
========== Purity Check ==========
< End of report >
--- --- ---
Extras von OTL
OTL Logfile: Code:
OTL Extras logfile created on: 10.06.2013 18:00:32 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = D:\Users\***\Desktop\Virenbekämpfung
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
7,68 Gb Total Physical Memory | 5,94 Gb Available Physical Memory | 77,40% Memory free
15,35 Gb Paging File | 13,48 Gb Available in Paging File | 87,78% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 70,00 Gb Total Space | 8,27 Gb Free Space | 11,81% Space Free | Partition Type: NTFS
Drive D: | 160,42 Gb Total Space | 21,06 Gb Free Space | 13,13% Space Free | Partition Type: NTFS
Drive E: | 931,51 Gb Total Space | 145,83 Gb Free Space | 15,66% Space Free | Partition Type: NTFS
Computer Name: DHV | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.txt [@ = txtfile] -- Reg Error: Key error. File not found
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- Reg Error: Key error.
htmlfile [opennew] -- Reg Error: Key error.
htmlfile [print] -- Reg Error: Value error.
http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MIF5BA~1\Office12\ONENOTE.EXE "%L"
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- Reg Error: Key error.
htmlfile [opennew] -- Reg Error: Key error.
htmlfile [print] -- Reg Error: Value error.
http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MIF5BA~1\Office12\ONENOTE.EXE "%L"
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1E31CDE7-6213-4C88-BCF4-4A83EC3A4565}" = lport=445 | protocol=6 | dir=in | app=system |
"{20A55E47-BE57-4C6F-B940-589625E49E01}" = lport=138 | protocol=17 | dir=in | app=system |
"{2633206C-8F1C-4545-96A1-4129723C2A79}" = lport=139 | protocol=6 | dir=in | app=system |
"{314D390C-0395-43C5-99C8-354F2F7AE182}" = lport=2869 | protocol=6 | dir=in | app=system |
"{423D4CC6-0E7A-43EF-B795-3AC1AACF7777}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{652AF02F-A933-407C-800A-ADFAE27C2AFC}" = rport=445 | protocol=6 | dir=out | app=system |
"{6BD97993-F52D-435F-8DA0-BBC797267A43}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{8E9AD4F9-30E3-4603-B40D-71763B3B7A71}" = rport=138 | protocol=17 | dir=out | app=system |
"{94074545-A124-4BB6-8D11-EE7F1C6148A4}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{AB4C409B-F707-4D8A-BB10-54595E38A0B8}" = rport=137 | protocol=17 | dir=out | app=system |
"{B7F759B1-7BC5-477D-9B02-4ACCC85C616D}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{D09E7696-DC01-4F01-B855-B25D9F39CB35}" = rport=139 | protocol=6 | dir=out | app=system |
"{D258A55F-015E-4565-BF6C-461C051BA2F2}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{E30B5706-06E5-4BC1-B507-8837CF0D7E31}" = lport=137 | protocol=17 | dir=in | app=system |
"{EB89F02A-A12A-4B93-877D-374E6180DB46}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\outlook.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02DE9030-52B8-4E10-B527-F96FCB879BEA}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{05C65677-16D2-4AD2-AA3F-C8743EC0BEC9}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe |
"{09C98114-720E-41DD-ACFA-D2D812547B7D}" = protocol=6 | dir=in | app=c:\program files\hp\hp officejet 6500 e710n-z\bin\devicesetup.exe |
"{13F022BD-529E-44E8-9126-CB01E1472616}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe |
"{186D48EA-EBCB-46C9-9246-FEE654EE883F}" = protocol=6 | dir=in | app=c:\program files (x86)\giraffic\veoh_giraffic.exe |
"{1ED7E116-2DD4-442C-A6E9-1F102D1D154F}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{28C58EF1-2547-4436-A650-68FFED1D8AB3}" = dir=in | app=c:\program files (x86)\windows live\messenger\wlcsdk.exe |
"{2FF46896-662F-4E76-9840-F85ACAEC92D3}" = protocol=17 | dir=in | app=c:\program files (x86)\veoh networks\veohwebplayer\veohwebplayer.exe |
"{40C865DE-DBF9-41A3-91F1-5B6D49A770FB}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe |
"{41FFAD23-B932-46F1-B8C1-47B8B58C4DBC}" = protocol=17 | dir=in | app=c:\windows\system32\gnabcoms.exe |
"{461BBBE0-C4AD-4A87-ADB8-28AADC481ADD}" = protocol=17 | dir=in | app=c:\program files\hp\hp officejet 6500 e710n-z\bin\hpnetworkcommunicator.exe |
"{4BBFC7D5-0B20-487B-B58D-58472D06A01E}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{4F916CB9-CC5D-4EB1-BB4E-76DF43F94F4D}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{4FDC1387-36F4-4690-994C-A30A6383DA52}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe |
"{5452CFEE-2D30-469A-93BF-8DEBB6567B0C}" = protocol=6 | dir=in | app=d:\users\***\appdata\roaming\dropbox\bin\dropbox.exe |
"{75DD64DF-FC63-41D5-BA00-F2C2804646BA}" = protocol=17 | dir=in | app=c:\windows\system32\gnabcoms.exe |
"{7AB3540C-44BC-49B1-AE2A-9B0FF2902279}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{8E76A8C8-271C-446C-AA70-0E4A684DA5EB}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{8F66C473-157E-409F-82DA-0EA099C226FD}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{99E1E66F-6B6E-4635-9A0D-F31CDF1B47CC}" = protocol=17 | dir=in | app=c:\program files (x86)\giraffic\veoh_giraffic.exe |
"{9D3F9C5A-D7D6-4AFD-99E5-C03A1BD90F5D}" = protocol=17 | dir=in | app=c:\program files (x86)\giraffic\veoh_giraffic.exe |
"{A055F2F9-6500-4A14-9537-ADEB50A9AE4A}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{A2ADB9EC-A1CE-48D0-83F5-3FD7E15F0892}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{A7BBBE13-9647-4A1D-BB02-6C56D87F277D}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{AFD68EA8-DAC1-41B7-A00B-AA1863AF711A}" = protocol=6 | dir=in | app=c:\program files (x86)\veetle\player\veetlenet.exe |
"{B36E90A5-6FDE-4C1B-AB81-C49173F747DF}" = protocol=6 | dir=in | app=c:\program files (x86)\giraffic\veoh_girafficwatchdog.exe |
"{B5EB82F4-90EF-4C3C-9E4B-DE9A921BECBF}" = protocol=17 | dir=in | app=c:\program files\hp\hp officejet 6500 e710n-z\bin\devicesetup.exe |
"{B73202EE-187C-489E-949E-1E0BBD5B0D21}" = protocol=6 | dir=in | app=c:\windows\system32\gnabcoms.exe |
"{B94AA242-F301-40E4-94B3-CA5F598DC9AF}" = protocol=6 | dir=in | app=c:\windows\system32\gnabcoms.exe |
"{C206A8A5-3116-428A-AEE1-B16D8270B6E9}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{C391E1AE-5D1E-4A8D-B32C-D6CEC29AD93E}" = dir=in | app=c:\program files (x86)\windows live\sync\windowslivesync.exe |
"{C4AC250B-3ABD-499A-AE65-E8BDDC0D6FC1}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{C52A19BB-9CF8-4A8E-BF38-E53B127F8C81}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{D171CB29-D094-4AB5-A5A0-16B97A97B5E7}" = protocol=6 | dir=in | app=c:\program files\hp\hp officejet 6500 e710n-z\bin\hpnetworkcommunicator.exe |
"{D616A4F1-FC47-4D07-B1F0-3C06B79EC00E}" = protocol=6 | dir=in | app=c:\program files (x86)\giraffic\veoh_giraffic.exe |
"{D714052C-90BF-451B-AE81-9FD4D2139C70}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{DA4D3C0C-9BC4-4568-A706-AC29DD65F7B3}" = protocol=6 | dir=in | app=c:\program files (x86)\giraffic\veoh_girafficwatchdog.exe |
"{DC2C2CDA-4BD3-4CEC-A008-A76C43FFC00B}" = protocol=17 | dir=in | app=d:\users\***\appdata\roaming\dropbox\bin\dropbox.exe |
"{EF09818A-AD31-4FE9-936E-B0DC4F86D9AA}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{EF45EC90-77AD-4AE8-847D-91945335FF84}" = protocol=17 | dir=in | app=c:\program files (x86)\giraffic\veoh_girafficwatchdog.exe |
"{F08F0744-B981-4004-BF9E-8E269F238370}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{F0B50485-4D84-4624-AEB3-091614F55290}" = protocol=6 | dir=in | app=c:\program files (x86)\veoh networks\veohwebplayer\veohwebplayer.exe |
"{FAB3FE90-8C97-4781-B22E-6226AD56E68E}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{FC6C426D-0C52-43AB-BAF2-333FE51D4385}" = protocol=17 | dir=in | app=c:\program files (x86)\giraffic\veoh_girafficwatchdog.exe |
"{FF27D569-A7F1-448D-AD73-5726972257DF}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"TCP Query User{057B8122-8832-4A8D-951C-902CCEFF2B3A}C:\program files (x86)\java\jre7\bin\java.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\java.exe |
"TCP Query User{1FE1A380-E5D7-4B13-90E6-F7DAADF7B848}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"TCP Query User{3FD506FE-B6DC-42BF-A6E4-B663DAAEF414}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"TCP Query User{70FFBB5D-3AAA-46DC-B67F-F99B6430842D}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"TCP Query User{8B44EE64-4058-4330-A402-041AB75E84BB}C:\program files\hp\hp officejet 6500 e710n-z\bin\hpnetworkcommunicator.exe" = protocol=6 | dir=in | app=c:\program files\hp\hp officejet 6500 e710n-z\bin\hpnetworkcommunicator.exe |
"TCP Query User{99C1D233-CDFF-403C-8DDB-DFCE29BCDB24}C:\windows\syswow64\java.exe" = protocol=6 | dir=in | app=c:\windows\syswow64\java.exe |
"TCP Query User{9C1E601E-C37E-41A4-920E-50800E177CED}C:\program files (x86)\warcraft iii\war3.exe" = protocol=6 | dir=in | app=c:\program files (x86)\warcraft iii\war3.exe |
"TCP Query User{A6AAECF4-B768-4D9F-ACAE-5E873FC23A67}C:\program files\ibm\spss\statistics\20\jre\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\ibm\spss\statistics\20\jre\bin\javaw.exe |
"TCP Query User{BDAE7BB0-A3E6-4D86-B53A-78EA4EF8C1DF}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"TCP Query User{CCEF827A-F2A6-40A0-9B29-AF305AE0687E}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe |
"TCP Query User{CF3B0393-F4C7-4BFD-B1A0-2336ABB70C82}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe |
"UDP Query User{08662A52-4AAF-46CA-A331-13E800D84224}C:\program files\ibm\spss\statistics\20\jre\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\ibm\spss\statistics\20\jre\bin\javaw.exe |
"UDP Query User{148E2767-DBA9-4239-9B65-51D23914A3DA}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"UDP Query User{4C083E6E-CF12-4C88-8058-5ED789CC8FAF}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"UDP Query User{630B8240-43AF-49CB-8449-E95F8559CA44}C:\windows\syswow64\java.exe" = protocol=17 | dir=in | app=c:\windows\syswow64\java.exe |
"UDP Query User{76EA529A-180B-4676-8B7C-41E84E667E74}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"UDP Query User{8F8EB7FD-C7C9-4A32-8724-1843252CC7C8}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe |
"UDP Query User{A0BAEA2D-0EF8-4422-A5F6-2C9D5C999276}C:\program files\hp\hp officejet 6500 e710n-z\bin\hpnetworkcommunicator.exe" = protocol=17 | dir=in | app=c:\program files\hp\hp officejet 6500 e710n-z\bin\hpnetworkcommunicator.exe |
"UDP Query User{AA7790E4-A465-4B4E-A363-AE000F76930E}C:\program files (x86)\java\jre7\bin\java.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\java.exe |
"UDP Query User{ADB54784-74E8-44D1-BEB2-C97CC2ADEA75}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"UDP Query User{E65FCDAD-47B3-4AB0-86C0-7E4E9B14FDF5}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe |
"UDP Query User{F838F5A2-D21E-4D56-A6ED-84D2C33B633F}C:\program files (x86)\warcraft iii\war3.exe" = protocol=17 | dir=in | app=c:\program files (x86)\warcraft iii\war3.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{05BFB060-4F22-4710-B0A2-2801A1B606C5}" = Microsoft Antimalware
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{0F841121-4DB6-4B31-839F-7F5AB3BB3423}" = Protector Suite 2009
"{1111706F-666A-4037-7777-203648764D10}" = JavaFX 2.0.3 (64-bit)
"{1280E900-35DA-4E08-A700-B79A5B2B8532}" = Microsoft Antimalware Service DE-DE Language Pack
"{2222706F-666A-4037-7777-203648764D10}" = JavaFX 2.0.3 SDK (64-bit)
"{2F72F540-1F60-4266-9506-952B21D6640D}" = Apple Mobile Device Support
"{3156336D-8E44-3671-A6FE-AE51D3D6564E}" = Microsoft Windows SDK for Windows 7 (7.1)
"{42738DB0-FC3E-4672-A99B-9372F5696E30}" = Microsoft Security Client
"{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}" = WIDCOMM Bluetooth Software
"{467D5E81-8349-4892-9E81-C3674ED8E451}" = Cisco Systems VPN Client 5.0.07.0290
"{64A3A4F4-B792-11D6-A78A-00B0D0170030}" = Java(TM) SE Development Kit 7 Update 3 (64-bit)
"{68570626-1BF6-310B-AF69-6CD686C04AEA}" = Microsoft Windows SDK Net Fx Interop Headers And Libraries (30514)
"{6B7DE186-374B-4873-AEC1-7464DA337DD6}" = VU5x64
"{6C8D7973-31F9-32E1-A820-8DD857910323}" = Microsoft Windows SDK for Windows 7 Utilities for Win32 Development (30514)
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{704C0303-D20C-45AF-BD2B-556EAF31BE09}" = iCloud
"{76FF0F03-B707-4332-B5D1-A56C8303514E}" = iTunes
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{84452C2C-BDCC-36F3-A189-CE15F02A47FB}" = Microsoft Windows SDK for Windows 7 Headers and Libraries (30514)
"{84E30D73-E30F-3A02-BAA0-5353C04DD18A}" = Microsoft Windows SDK Intellisense and Reference Assemblies (30514)
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{951E6223-AC28-345E-BCF4-B55C1267E321}" = Microsoft Windows SDK for Windows 7 Samples (30514)
"{9ED333F8-3E6C-4A38-BAFA-728454121CDA}" = PDF-XChange Viewer
"{A0B0F02C-410B-3DE3-9740-EC4C3D902532}" = Microsoft Windows SDK for Windows 7 Common Utilities (30514)
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.3.18.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{C3600AE6-93A0-3DB7-B7AA-45BD58F133B5}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64)
"{C41713B3-DCB0-48C3-B830-47CB59C60B89}" = HP Officejet 6500 E710n-z - Grundlegende Software für das Gerät
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{D16A2127-B927-4379-B153-3DEC091E4EEB}" = Intel(R) PROSet/Wireless WiFi-Software
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
"{DC911ADF-7B60-40F2-A112-FB1EB6402D07}" = Microsoft Security Client DE-DE Language Pack
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FD868C71-6CCF-42E2-B90D-0504AB0036FE}" = 64 Bit HP CIO Components Installer
"CCleaner" = CCleaner
"Matlab R2012a" = MATLAB R2012a
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Microsoft Security Client" = Microsoft Security Essentials
"Microsoft Visual Studio 2010 Tools for Office Runtime (x64)" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64)
"NVIDIA Drivers" = NVIDIA Drivers
"OEM_HostCD" = Printer Software Uninstall
"ProInst" = Intel PROSet Wireless
"R for Windows 2.14.0_is1" = R for Windows 2.14.0
"Registry Toolkit (x64 Shareware)_is1" = Registry Toolkit (x64)
"SDKSetup_7.1.7600.0.30514" = Microsoft Windows SDK for Windows 7 (7.1)
"sp6" = Logitech SetPoint 6.32
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"WinRAR archiver" = WinRAR
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{00B03993-F5A1-47B1-9C54-EC8FBDDDE17E}" = VAIO Care
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0899D75A-C2FC-42EA-A702-5B9A5F24EAD5}" = VAIO Smart Network
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{1F4E59C0-EE31-47EE-BCC3-1A73C3F023BF}" = Qualcomm Gobi 2000 Package for Sony
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83217017FF}" = Java 7 Update 21
"{2BC21CD2-8053-406A-80F6-9AB61717B49D}" = ODF Add-In für Microsoft Office
"{2F9D63BE-A891-4E39-AFB3-7402D486800C}" = VAIO Hardware Diagnostics
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{36C5BBF0-E5BF-4DE1-B684-7E90B0C93FB5}" = VAIO Care
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.3
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{55A41219-9B22-4098-BAE7-AE289B3C569A}_is1" = Panda USB Vaccine 1.0.1.4
"{57B955CE-B5D3-495D-AF1B-FAEE0540BFEF}" = VAIO Data Restore Tool
"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync
"{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}" = Apple Application Support
"{5DDAFB4B-C52E-468A-9E23-3B0CEEB671BF}" = VAIO-Support für Übertragungen
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{6C29152D-3FF9-43B2-84E4-9B35FC0BF5C2}" = Vodafone Mobile Broadband
"{6D320CE8-79EB-4D45-8C6D-DEF74D84B49A}" =
"{70991E0A-1108-437E-BA7D-085702C670C0}" =
"{72042FA6-5609-489F-A8EA-3C2DD650F667}" = VAIO Control Center
"{787D1A33-A97B-4245-87C0-7174609A540C}" = HP Update
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{803E4FA5-A940-4420-B89D-A8BC2E160247}" =
"{8211C280-5B02-4E7E-B55F-845A207249BA}" = VAIO Data Restore Tool
"{82F09B1C-F602-4552-9C40-5BD5F8EAF750}" =
"{850C7BD3-9F3F-46AD-9396-E7985B38C55E}" = Windows Live Fotogalerie
"{855DDD3C-131E-42A8-BCBD-F9581F80CACB}" =
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A5B016F-D452-4650-92D4-219567EA257A}" = Bizagi Process Modeler
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00B2-0407-0000-0000000FF1CE}" = Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{9D12A8B5-9D41-4465-BF11-70719EB0CD02}" = VU5x86
"{9FF95DA2-7DA1-4228-93B7-DED7EC02B6B2}" = VAIO Update
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A7DA438C-2E43-4C20-BFDA-C1F4A6208558}" =
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.7) - Deutsch
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{B67BAFBA-4C9F-48FA-9496-933E3B255044}" = QuickTime
"{B68FC32E-D58F-4B74-A838-B265BF40A445}" = EViews 7
"{B93DCF58-AA57-41EC-8D69-B05C66C6312D}_is1" = SUPER © v2011.build.49 (July 1st, 2011) Version v2011.build.49
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{C6E893E7-E5EA-4CD5-917C-5443E753FCBD}" = VAIO-Handbuch
"{C7477742-DDB4-43E5-AC8D-0259E1E661B1}" =
"{CA6BCA2F-EDEB-408F-850B-31404BE16A61}" = I.R.I.S. OCR
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D2D23D08-D10E-43D6-883C-78E0B2AC9CC6}" = VU5x86
"{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}" = Intel(R) Turbo Boost Technology Driver
"{DE8AAC73-6D8D-483E-96EA-CAEDDADB9079}" = ArcSoft WebCam Companion 3
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E4197D6B-F046-33E7-ABDE-51FF373FDC76}" = Windows SDK IntellisenseNFX
"{EFBC0CB1-AFFD-4E74-ACEF-42099F1D49C3}" = HP Officejet 6500 E710n-z Hilfe
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{FB0C267C-8B4F-4867-8161-A6A3B66D42C1}" = Marketsplash Schnellzugriffe
"{FB77DB0C-6951-47B6-9D80-A0FDBEE0334C}" =
"5513-1208-7298-9440" = JDownloader 0.9
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"ENTERPRISE" = Microsoft Office Enterprise 2007
"ESET Online Scanner" = ESET Online Scanner v3
"foobar2000" = foobar2000 v1.1.8
"Google Chrome" = Google Chrome
"HWiNFO32_is1" = HWiNFO32 Version 3.90
"InstallShield_{8A5B016F-D452-4650-92D4-219567EA257A}" = Bizagi Process Modeler
"iPod Access for Windows_is1" = iPod Access for Windows v4.4.1
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.75.0.1300
"MiKTeX 2.9" = MiKTeX 2.9
"Mozilla Firefox 21.0 (x86 de)" = Mozilla Firefox 21.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"RStudio" = RStudio
"TexMakerX_is1" = TexMakerX 2.1
"VAIO Help and Support" =
"VAIO screensaver" = VAIO screensaver
"Veetle TV" = Veetle TV
"VLC media player" = VLC media player 1.1.5
"WinLiveSuite_Wave3" = Windows Live Essentials
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
Error encountered while reading event logs.
< End of report >
--- --- ---
Gmer
[Code]
GMER Logfile: Code:
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-06-10 18:26:23
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Intel___ rev.1.0. 238,50GB
Running: gmer_2.1.19163.exe; Driver: D:\Users\DINHHU~1\AppData\Local\Temp\pxldapow.sys
---- Kernel code sections - GMER 2.1 ----
.text C:\Windows\system32\drivers\USBPORT.SYS!DllUnload fffff88005a28d64 12 bytes {MOV RAX, 0xfffffa80099522a0; JMP RAX}
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe[2592] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075991465 2 bytes [99, 75]
.text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe[2592] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000759914bb 2 bytes [99, 75]
.text ... * 2
.text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[2984] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075991465 2 bytes [99, 75]
.text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[2984] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000759914bb 2 bytes [99, 75]
.text ... * 2
.text C:\Windows\SysWOW64\RunDll32.exe[5052] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075991465 2 bytes [99, 75]
.text C:\Windows\SysWOW64\RunDll32.exe[5052] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000759914bb 2 bytes [99, 75]
.text ... * 2
.text C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe[4504] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075991465 2 bytes [99, 75]
.text C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe[4504] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000759914bb 2 bytes [99, 75]
.text ... * 2
---- Devices - GMER 2.1 ----
Device \FileSystem\Ntfs \Ntfs fffffa800723b2c0
Device \Driver\NetBT \Device\NetBT_Tcpip_{CE145043-03E3-435E-A1F5-C59B2B060D88} fffffa8009a982c0
Device \Driver\usbehci \Device\USBPDO-1 fffffa8009e7d2c0
Device \Driver\cdrom \Device\CdRom0 fffffa8009a2c2c0
Device \Driver\usbehci \Device\USBFDO-0 fffffa8009e7d2c0
Device \Driver\usbehci \Device\USBFDO-1 fffffa8009e7d2c0
Device \Driver\volmgr \Device\HarddiskVolume1 fffffa80072332c0
Device \Driver\volmgr \Device\FtControl fffffa80072332c0
Device \Driver\volmgr \Device\VolMgrControl fffffa80072332c0
Device \Driver\volmgr \Device\HarddiskVolume2 fffffa80072332c0
Device \Driver\volmgr \Device\HarddiskVolume3 fffffa80072332c0
Device \Driver\volmgr \Device\HarddiskVolume4 fffffa80072332c0
Device \Driver\NetBT \Device\NetBT_Tcpip_{BA23525E-17A8-418F-B10A-CFA1E8DC9CE0} fffffa8009a982c0
Device \Driver\NetBT \Device\NetBt_Wins_Export fffffa8009a982c0
Device \Driver\usbehci \Device\USBPDO-0 fffffa8009e7d2c0
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\506313dbb8cf
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\c0cb38ef8cf0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x11 0xFF 0xEC 0x54 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\506313dbb8cf (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\c0cb38ef8cf0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x11 0xFF 0xEC 0x54 ...
---- EOF - GMER 2.1 ----
--- --- ---
Seit dem Absturz sehe ich eine desktop.ini auf meinem Desktop.
Daemon Tools habe ich vor der Anwendung deinstalliert.
Veoh Webplayer (wo der Virus war) habe ich auch deinstalliert, den Ordner gibt’s aber immer noch in C:
Kleine Anmerkung: meine Bibliotheken sind auf D: und nicht auf der Systemplatte, ausserdem benutze ich NoScript.
Ich bedanke mich für die Hilfe, dass der PC jetzt nicht funktioniert ist sehr ungünstig, da ich in der Prüfungsphase bin und auf den PC angewiesen bin.
lG Ray |
AdwCleaner auf deinen Desktop.
SecurityCheck und:
