Trojaner-Board - Bin bei GMX gesperrt - Wie finde ich den Trojaner/Keylogger/...?

MBAM:

Code:

Malwarebytes Anti-Malware (Test) 1.61.0.1400

www.malwarebytes.org
 

Datenbank Version: v2012.04.25.03
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 8.0.7601.17514

root :: OKEANOS [Administrator]
 

Schutz: Aktiviert
 

25.04.2012 14:28:04

mbam-log-2012-04-25 (14-28-04).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 1235257

Laufzeit: 3 Stunde(n), 28 Minute(n), 51 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

OTL.Txt

Code:

OTL logfile created on: 25.04.2012 22:29:58 - Run 1

OTL by OldTimer - Version 3.2.42.0     Folder = C:\Users\root\Desktop

64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7601.17514)

Locale: 00000c07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy

 

4,00 Gb Total Physical Memory | 2,47 Gb Available Physical Memory | 61,79% Memory free

4,19 Gb Paging File | 2,35 Gb Available in Paging File | 55,97% Paging File free

Paging file location(s): c:\pagefile.sys 200 25000 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 199,90 Gb Total Space | 41,90 Gb Free Space | 20,96% Space Free | Partition Type: NTFS

Drive D: | 50,00 Gb Total Space | 17,33 Gb Free Space | 34,66% Space Free | Partition Type: NTFS

Drive E: | 1397,26 Gb Total Space | 110,88 Gb Free Space | 7,94% Space Free | Partition Type: NTFS

Drive F: | 81,51 Gb Total Space | 60,83 Gb Free Space | 74,63% Space Free | Partition Type: NTFS

Drive M: | 200,00 Gb Total Space | 39,00 Gb Free Space | 19,50% Space Free | Partition Type: NTFS

Drive V: | 300,00 Gb Total Space | 63,40 Gb Free Space | 21,13% Space Free | Partition Type: NTFS

Drive X: | 193,35 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS

 

Computer Name: OKEANOS | User Name: root | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\root\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

PRC - C:\Users\root\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)

PRC - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)

 

 
 ========== Modules (No Company Name) ==========

 

MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()

MOD - C:\Programme\WinRAR\RarExt32.dll ()

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)

SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)

SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)

SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)

SRV - (ServiceLayer) -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe (Nokia)

SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

SRV - (CLHNServiceForPowerDVD) -- C:\Program Files (x86)\CyberLink\PowerDVD11\Kernel\DMP\CLHNServiceForPowerDVD.exe ()

SRV - (CyberLink PowerDVD 11.0 Service) -- C:\Program Files (x86)\CyberLink\PowerDVD11\Common\MediaServer\CLMSServer.exe (CyberLink)

SRV - (CyberLink PowerDVD 11.0 Monitor Service) -- C:\Program Files (x86)\CyberLink\PowerDVD11\Common\MediaServer\CLMSMonitorService.exe (CyberLink)

SRV - (OpenVPNService) -- C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe ()

SRV - (TeamViewer6) -- C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)

SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)

SRV - (WAS) -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll (Microsoft Corporation)

SRV - (W3SVC) -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll (Microsoft Corporation)

SRV - (AppHostSvc) -- C:\Windows\SysWOW64\inetsrv\apphostsvc.dll (Microsoft Corporation)

SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)

SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)

SRV - (MsDepSvc) -- C:\Programme\IIS\Microsoft Web Deploy\MsDepSvc.exe (Microsoft Corporation)

SRV - (TunngleService) -- C:\Program Files (x86)\Tunngle\TnglCtrl.exe (Tunngle.net GmbH)

SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)

SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

SRV - (Adobe Version Cue CS3) -- C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe (Adobe Systems Incorporated)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)

DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)

DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)

DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)

DRV:64bit: - (UsbserFilt) -- C:\Windows\SysNative\drivers\usbser_lowerfltjx64.sys (Nokia)

DRV:64bit: - (upperdev) -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys (Nokia)

DRV:64bit: - (nmwcdc) -- C:\Windows\SysNative\drivers\ccdcmbox64.sys (Nokia)

DRV:64bit: - (nmwcd) -- C:\Windows\SysNative\drivers\ccdcmbx64.sys (Nokia)

DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH)

DRV:64bit: - (tap0901) -- C:\Windows\SysNative\drivers\tap0901.sys (The OpenVPN Project)

DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)

DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)

DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)

DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)

DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)

DRV:64bit: - (usbser) -- C:\Windows\SysNative\drivers\usbser.sys (Microsoft Corporation)

DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)

DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)

DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)

DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (ATI Technologies, Inc.)

DRV:64bit: - (RTHDMIAzAudService) -- C:\Windows\SysNative\drivers\RtHDMIVX.sys (Realtek Semiconductor Corp.)

DRV:64bit: - (npf) -- C:\Windows\SysNative\drivers\npf.sys (CACE Technologies, Inc.)

DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys (Duplex Secure Ltd.)

DRV:64bit: - (AtcL001) -- C:\Windows\SysNative\drivers\l160x64.sys (Atheros Communications, Inc.)

DRV:64bit: - (tap0901t) TAP-Win32 Adapter V9 (Tunngle) -- C:\Windows\SysNative\drivers\tap0901t.sys (Tunngle.net)

DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)

DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)

DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)

DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)

DRV:64bit: - (AtiHdmiService) -- C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Research Inc.)

DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)

DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)

DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)

DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)

DRV:64bit: - (pccsmcfd) -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys (Nokia)

DRV:64bit: - (Tileproxy) -- C:\Windows\SysNative\drivers\tileproxy.sys (Windows (R) Codename Longhorn DDK provider)

DRV:64bit: - (PRODIGY) -- C:\Windows\SysNative\drivers\prodigy.sys (B-phreaks)

DRV:64bit: - (MTsensor) -- C:\Windows\SysNative\drivers\ASACPI.sys ()

DRV - ({329F96B6-DF1E-4328-BFDA-39EA953C1312}) -- C:\Program Files (x86)\CyberLink\PowerDVD11\Common\NavFilter\000.fcl (CyberLink Corp.)

DRV - (ntk_PowerDVD) -- C:\Program Files (x86)\CyberLink\PowerDVD11\Kernel\DMP\ntk_PowerDVD_64.sys (Cyberlink Corp.)

DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://at.msn.com/?ocid=iehp

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-at

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 44 31 62 EE 5B 19 CD 01  [binary data]

IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3

FF - prefs.js..extensions.enabledItems: de-AT@dictionaries.addons.mozilla.org:2.0.2

FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.4

FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.6.2

FF - prefs.js..extensions.enabledItems: {35106bca-6c78-48c7-ac28-56df30b51d2a}:1.3.8

FF - prefs.js..extensions.enabledItems: {c45c406e-ab73-11d8-be73-000a95be3b12}:1.1.9

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22

FF - prefs.js..extensions.enabledItems: inspector@mozilla.org:2.0.9

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23

FF - prefs.js..extensions.enabledItems: {07b2a769-ed19-4483-87ce-c643914c81bb}:3.0.0.91

FF - prefs.js..keyword.URL: "hxxp://www.google.at/search?ie=UTF-8&oe=utf-8&q="

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_233.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/wpi,version=1.0: C:\Program Files\Microsoft\Web Platform Installer\\npwpidetector.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_233.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/wpi,version=1.1: C:\Program Files\Microsoft\Web Platform Installer\\npwpidetector.dll ()

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Users\root\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll File not found

FF - HKCU\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Users\root\AppData\Local\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\root\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\root\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\bkmrksync@nokia.com: C:\Program Files (x86)\Nokia\Nokia PC Suite 7\bkmrksync\ [2009.09.20 12:42:30 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.03.19 01:59:50 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.06.18 19:20:26 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\te_9.0@nokia.com: C:\Program Files (x86)\Nokia\Nokia Suite\Connectors\Thunderbird Connector\ThunderbirdExtension_9.0 [2012.02.10 21:51:38 | 000,000,000 | ---D | M]

 

[2009.08.13 18:16:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\root\AppData\Roaming\mozilla\Extensions

[2012.03.31 19:32:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\root\AppData\Roaming\mozilla\Firefox\Profiles\pak8z3xn.default\extensions

[2010.06.26 00:06:38 | 000,000,000 | ---D | M] (Vista-aero) -- C:\Users\root\AppData\Roaming\mozilla\Firefox\Profiles\pak8z3xn.default\extensions\{07b2a769-ed19-4483-87ce-c643914c81bb}

[2010.02.18 20:22:38 | 000,000,000 | ---D | M] (Linkification) -- C:\Users\root\AppData\Roaming\mozilla\Firefox\Profiles\pak8z3xn.default\extensions\{35106bca-6c78-48c7-ac28-56df30b51d2a}

[2011.11.25 06:57:02 | 000,000,000 | ---D | M] (iMacros for Firefox) -- C:\Users\root\AppData\Roaming\mozilla\Firefox\Profiles\pak8z3xn.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}

[2012.03.31 19:32:16 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\root\AppData\Roaming\mozilla\Firefox\Profiles\pak8z3xn.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

[2011.01.07 23:44:24 | 000,000,000 | ---D | M] (Web Developer) -- C:\Users\root\AppData\Roaming\mozilla\Firefox\Profiles\pak8z3xn.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}

[2010.11.18 00:14:57 | 000,000,000 | ---D | M] (German Dictionary, extended for Austria) -- C:\Users\root\AppData\Roaming\mozilla\Firefox\Profiles\pak8z3xn.default\extensions\de-AT@dictionaries.addons.mozilla.org

[2012.03.24 12:20:07 | 000,000,000 | ---D | M] (DOM Inspector) -- C:\Users\root\AppData\Roaming\mozilla\Firefox\Profiles\pak8z3xn.default\extensions\inspector@mozilla.org

[2011.04.29 23:07:49 | 000,000,000 | ---D | M] (Ovi Maps 3D browser plugin) -- C:\Users\root\AppData\Roaming\mozilla\Firefox\Profiles\pak8z3xn.default\extensions\maps@ovi.com

[2010.06.26 00:06:38 | 000,000,000 | ---D | M] (No name found) -- C:\Users\root\AppData\Roaming\mozilla\Firefox\Profiles\pak8z3xn.default\extensions\{07b2a769-ed19-4483-87ce-c643914c81bb}\chrome\mozapps\extensions

[2012.04.25 14:18:41 | 000,001,018 | ---- | M] () -- C:\Users\root\AppData\Roaming\Mozilla\Firefox\Profiles\pak8z3xn.default\searchplugins\facebook.xml

[2012.02.20 22:40:47 | 000,002,467 | ---- | M] () -- C:\Users\root\AppData\Roaming\Mozilla\Firefox\Profiles\pak8z3xn.default\searchplugins\googleat.xml

[2012.04.24 11:38:12 | 000,001,330 | ---- | M] () -- C:\Users\root\AppData\Roaming\Mozilla\Firefox\Profiles\pak8z3xn.default\searchplugins\wikipedia-en.xml

[2009.08.18 19:32:21 | 000,004,153 | ---- | M] () -- C:\Users\root\AppData\Roaming\Mozilla\Firefox\Profiles\pak8z3xn.default\searchplugins\youtube.xml

[2011.11.10 01:18:17 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

() (No name found) -- C:\USERS\ROOT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PAK8Z3XN.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI

() (No name found) -- C:\USERS\ROOT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PAK8Z3XN.DEFAULT\EXTENSIONS\FIREBUG@SOFTWARE.JOEHEWITT.COM.XPI

() (No name found) -- C:\USERS\ROOT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PAK8Z3XN.DEFAULT\EXTENSIONS\IENETRENDERER-NICO@NC.XPI

[2012.03.19 01:59:49 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2010.11.12 19:53:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll

[2011.03.23 23:03:21 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2011.03.23 23:03:21 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2011.03.23 23:03:21 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2011.03.23 23:03:21 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2011.03.23 23:03:21 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2011.03.23 23:03:21 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2011.08.23 14:50:16 | 000,003,814 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 activate.adobe.com

O1 - Hosts: 127.0.0.1 adobe.activate.com

O1 - Hosts: 127.0.0.1 practivate.adobe.com

O1 - Hosts: 127.0.0.1 ereg.adobe.com

O1 - Hosts: 127.0.0.1 adobeereg.com

O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com

O1 - Hosts: 127.0.0.1 wip3.adobe.com

O1 - Hosts: 127.0.0.1 3dns-3.adobe.com

O1 - Hosts: 127.0.0.1 3dns-2.adobe.com

O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com

O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com

O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com

O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com

O1 - Hosts: 127.0.0.1 activate-sea.adobe.com

O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com

O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com

O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com

O1 - Hosts: 127.0.0.1 hl2rcv.adobe.com

O1 - Hosts: 127.0.0.1 adobeereg.com

O1 - Hosts: 127.0.0.1 activate.adobe.com

O1 - Hosts: 127.0.0.1 practivate.adobe.com

O1 - Hosts: 127.0.0.1 ereg.adobe.com

O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com

O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com

O1 - Hosts: 127.0.0.1 wip3.adobe.com

O1 - Hosts: 71 more lines...

O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.

O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKCU..\Run: []  File not found

O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)

O4 - Startup: C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\root\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O8:64bit: - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~4\OFFICE11\EXCEL.EXE/3000 File not found

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~4\OFFICE11\EXCEL.EXE/3000 File not found

O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~4\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)

O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{08919409-BD53-45DF-9C95-D85C9EFC28AB}: DhcpNameServer = 10.0.0.251

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E24524DA-5C8B-4F33-B120-2AFF70937A27}: DhcpNameServer = 192.168.0.1

O18:64bit: - Protocol\Handler\livecall - No CLSID value found

O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found

O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found

O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found

O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found

O18:64bit: - Protocol\Handler\msnim - No CLSID value found

O18:64bit: - Protocol\Handler\mso-offdap - No CLSID value found

O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found

O18:64bit: - Protocol\Handler\wlpg - No CLSID value found

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation)

O18:64bit: - Protocol\Filter\text/xml - No CLSID value found

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [1999.03.29 11:08:26 | 000,000,059 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]

O33 - MountPoints2\{09a14e6e-d3be-11e0-94ed-001bfc3e892b}\Shell - "" = AutoRun

O33 - MountPoints2\{09a14e6e-d3be-11e0-94ed-001bfc3e892b}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a

O33 - MountPoints2\{6bc41af1-8818-11de-91f0-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{6bc41af1-8818-11de-91f0-806e6f6e6963}\Shell\AutoRun\command - "" = X:\SETUP.EXE -- [1999.03.29 11:08:26 | 000,082,432 | R--- | M] ()

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.04.25 14:25:59 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\root\Desktop\OTL.exe

[2012.04.25 14:25:39 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Roaming\Malwarebytes

[2012.04.25 14:25:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.04.25 14:25:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.04.25 14:25:32 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2012.04.25 14:25:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2012.04.25 14:16:50 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{035134A5-A0B2-479D-89F2-B1E5A1ADBE30}

[2012.04.25 14:16:35 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{CAC69907-3A00-43AD-8EEC-A1E07521716E}

[2012.04.25 03:33:07 | 000,607,260 | R--- | C] (Swearware) -- C:\Users\root\Desktop\dds.com

[2012.04.24 22:32:52 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{D546F820-8632-4634-9956-B02040D1223E}

[2012.04.24 22:32:37 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{CB236D45-C01D-4890-98DB-BA622212BB08}

[2012.04.24 15:57:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy

[2012.04.24 15:57:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy

[2012.04.24 15:57:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy

[2012.04.24 10:22:01 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{D84C651E-7537-4B62-9404-A48193E4B140}

[2012.04.24 10:21:48 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{AEAF2710-E68C-414C-9CE3-72D1AFF72495}

[2012.04.23 15:36:55 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{97D509BF-BC73-4B7E-BA86-DED3646E83CC}

[2012.04.23 15:36:44 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{812137DC-6764-4E1A-84B5-256AA4899DFB}

[2012.04.22 22:18:53 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{699AF856-CF22-4C88-BE66-D5689CFF4B79}

[2012.04.22 22:18:39 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{0DD3229E-C1C7-4F38-8640-C4641B083BFA}

[2012.04.21 14:01:36 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{64C3BDBF-96D3-453D-A43C-66CEC34F6D55}

[2012.04.21 14:01:24 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{DAADE23A-9465-43DB-9FB2-6415B8CCD480}

[2012.04.20 13:14:38 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{A8E29C21-03AA-40BC-8D27-70BD2B603A81}

[2012.04.20 13:14:25 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{CF6A3FEA-C191-40DD-99FC-07E28CCBDF66}

[2012.04.19 13:00:56 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{255F667A-760C-4D28-BCB1-D3482792D1D9}

[2012.04.19 13:00:44 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{2683821E-44B3-4DDE-9626-A408BDB4F2AA}

[2012.04.18 13:19:14 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{5FC16F10-D4FD-4C9C-8441-3713B990D70B}

[2012.04.18 13:19:02 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{27B62D37-A2C6-4245-B99F-55EFEF6FA001}

[2012.04.17 22:38:17 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{DFF3EAEA-76BC-4BBE-9EF5-CB44D59D504A}

[2012.04.17 22:38:03 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{DED27DD7-10B0-46D3-B703-571EFE02E89C}

[2012.04.17 02:24:53 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{5E263728-2DCD-4F39-B121-13450CD06BF6}

[2012.04.17 02:24:40 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{F68EF18A-1786-4A1B-8F7C-1CE726E1ADB5}

[2012.04.16 21:42:23 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games

[2012.04.16 21:39:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hasbro Interactive

[2012.04.16 21:38:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\RollerCoaster Tycoon

[2012.04.16 14:24:08 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{56E5BB74-F5F4-4A26-93F4-C32873FC7F75}

[2012.04.16 14:23:56 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{A312426D-D715-4C1E-9E27-FC865273E3D9}

[2012.04.15 21:42:01 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{6998F806-9FD7-4674-9AE8-116BF84C89CA}

[2012.04.15 21:41:49 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{E0FFB1DC-7ADC-47EB-8488-2C7D86EBC04B}

[2012.04.15 09:41:22 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{92393733-7951-4EB7-B976-125085B6F05F}

[2012.04.15 09:41:10 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{CABD6F6D-6750-4C2A-BAFA-9985BEB4A9BD}

[2012.04.14 10:55:01 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{7A88A106-5BE5-4801-AB21-D847BC190018}

[2012.04.14 10:54:48 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{35F07620-729D-4D27-B27C-5C0A97356923}

[2012.04.13 13:39:54 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{E1EAE3E6-2C9E-4BFA-BB84-64125063B625}

[2012.04.13 13:39:42 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{EF3E3249-8E1D-4600-A43C-4411FDC710D6}

[2012.04.13 01:39:17 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{BFCC8632-4913-4962-8B0D-743A9CB87585}

[2012.04.13 01:39:06 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{72F55DFF-1534-40CE-9E7E-704AACD7664F}

[2012.04.12 13:38:39 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{9BFF59F9-DEDE-46C9-BE48-22D26035B1A9}

[2012.04.12 13:38:27 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{D08AD9F3-FC8F-4BB8-856A-1DA40B63D5AC}

[2012.04.12 00:01:20 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{E132AA4E-3F17-4481-85FF-1D928A32ED45}

[2012.04.12 00:01:09 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{3B89BC6F-2310-4880-89BE-E99AF94C610E}

[2012.04.11 12:05:08 | 000,023,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\fs_rec.sys

[2012.04.11 12:05:07 | 000,081,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\imagehlp.dll

[2012.04.11 12:05:05 | 000,220,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll

[2012.04.11 12:04:15 | 000,702,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll

[2012.04.11 12:04:15 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll

[2012.04.11 12:04:15 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll

[2012.04.11 12:04:15 | 000,097,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll

[2012.04.11 12:04:15 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll

[2012.04.11 12:04:14 | 000,134,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll

[2012.04.11 12:04:14 | 000,132,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll

[2012.04.11 12:00:41 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{ABCDE5C6-A954-4754-865D-1798EAFEF337}

[2012.04.11 12:00:30 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{B058776E-AB98-44DF-AB91-22BDC5108AB7}

[2012.04.10 23:50:51 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{8D64CC9C-3BF1-4435-B049-3FB233CE39E2}

[2012.04.10 23:50:40 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{2AD19311-810A-4877-A591-CC02FDB0130C}

[2012.04.10 14:53:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator

[2012.04.10 14:53:50 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Roaming\pdfforge

[2012.04.10 14:53:48 | 000,662,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSCOMCT2.OCX

[2012.04.10 14:53:48 | 000,137,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSMAPI32.OCX

[2012.04.10 14:53:47 | 000,158,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSCMCDE.DLL

[2012.04.10 14:53:47 | 000,125,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\VB6DE.DLL

[2012.04.10 14:53:47 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSCC2DE.DLL

[2012.04.10 14:53:47 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSMPIDE.DLL

[2012.04.10 14:53:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PDFCreator

[2012.04.10 11:50:09 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{11A1AD9C-CCF8-44E2-ADF8-33A9667AB8AD}

[2012.04.10 11:49:53 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{17526836-10EB-4492-B947-8C738AF26783}

[2012.04.09 21:11:06 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{4D82EB78-AAF3-495C-8E00-146C20A44C91}

[2012.04.09 21:10:52 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{63AE9AC7-5334-48D0-9D34-02F30E92BA35}

[2012.04.09 19:24:12 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{A5680200-7412-470F-8E4F-3286002A0EA5}

[2012.04.08 00:03:02 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{1603A2DB-3F90-469B-8A7E-144C7611F61C}

[2012.04.08 00:02:51 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{C05C8D5B-2DA6-445E-AA68-225E0B28D788}

[2012.04.07 12:02:24 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{BDE4F3D2-DCD7-47EA-BF5F-6ABD8F8468EB}

[2012.04.07 12:02:11 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{DEF5A259-970D-4555-BB03-F9183665DDF2}

[2012.04.06 14:35:22 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{F601858D-D1B0-4498-9403-61E147844776}

[2012.04.06 14:35:10 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{044DCF49-0339-45FA-A2A5-7AF11423C643}

[2012.04.06 14:33:29 | 000,000,000 | ---D | C] -- C:\Windows\de

[2012.04.06 12:12:13 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{0F8E1860-5186-49E2-A7BE-4AC960FD6B92}

[2012.04.06 12:11:55 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{9EDB7E06-B9CB-4565-80B0-3A4555674749}

[2012.04.05 16:45:26 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{29849DA7-5857-45EE-BBC3-9AAEC33E5B27}

[2012.04.05 16:45:14 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{20F4D7ED-786A-4869-BE8B-8FF486112B86}

[2012.04.05 12:05:28 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{5B6F809F-EEED-40C6-AD5A-4145C48D8B70}

[2012.04.04 18:51:41 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{E6E21A35-CFB2-4D3B-B47B-AD6E8CB7472F}

[2012.04.03 09:55:08 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{853C748A-CD87-4925-A7D7-F8BEE7858D4E}

[2012.04.02 18:22:06 | 000,418,464 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe

[2012.04.02 13:53:05 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{7F7AD920-FF5D-4058-9038-7B81AE21E3E7}

[2012.04.01 19:13:53 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{4B40C212-BFE6-4AA2-8BA0-411D6912EFE8}

[2012.03.31 19:31:52 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{E2B404C0-C27C-4A77-B40E-10F6DCBC985F}

[2012.03.30 19:43:38 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{B158D144-6F96-4333-82C6-4778D3178B2A}

[2012.03.28 11:22:10 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{915F4C4C-A0E2-4707-AFB3-88FCEDC592FC}

[2012.03.28 11:21:59 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{A7A1FDE2-5BAC-4337-A1D0-B376B3552B8A}

[2012.03.27 22:16:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN

[2012.03.27 12:44:55 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{1BEC2490-91F2-4655-A473-FFC468241F0F}

[2012.03.27 12:44:41 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{D11F068A-D7E1-42B9-886C-87EAB4C5C731}

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.04.25 22:08:00 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1815528959-3452218465-1913872660-1000UA.job

[2012.04.25 21:59:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.04.25 21:46:25 | 000,017,136 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.04.25 21:46:25 | 000,017,136 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.04.25 21:38:56 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.04.25 21:38:50 | 3220,529,152 | -HS- | M] () -- C:\hiberfil.sys

[2012.04.25 14:26:01 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\root\Desktop\OTL.exe

[2012.04.25 03:44:13 | 000,010,001 | ---- | M] () -- C:\Users\root\Desktop\Attach.zip

[2012.04.25 03:33:22 | 000,607,260 | R--- | M] (Swearware) -- C:\Users\root\Desktop\dds.com

[2012.04.25 03:24:06 | 000,000,020 | ---- | M] () -- C:\Users\root\defogger_reenable

[2012.04.25 03:23:35 | 000,050,477 | ---- | M] () -- C:\Users\root\Desktop\Defogger.exe

[2012.04.24 23:08:00 | 000,001,064 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1815528959-3452218465-1913872660-1000Core.job

[2012.04.23 17:21:45 | 000,000,600 | ---- | M] () -- C:\Users\root\AppData\Roaming\winscp.rnd

[2012.04.17 23:50:43 | 000,001,048 | ---- | M] () -- C:\Users\root\Desktop\RollerCoaster Tycoon.lnk

[2012.04.17 13:29:07 | 001,704,878 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.04.17 13:29:07 | 000,735,654 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.04.17 13:29:07 | 000,683,876 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.04.17 13:29:07 | 000,158,636 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.04.17 13:29:07 | 000,129,762 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.04.17 11:47:13 | 000,418,464 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe

[2012.04.17 11:47:13 | 000,070,304 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

[2012.04.10 12:19:12 | 001,724,354 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2012.04.04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2012.04.02 20:11:35 | 000,002,095 | ---- | M] () -- C:\Users\Public\Desktop\Nokia Suite.lnk

 
 ========== Files Created - No Company Name ==========

 

[2012.04.25 03:44:13 | 000,010,001 | ---- | C] () -- C:\Users\root\Desktop\Attach.zip

[2012.04.25 03:24:06 | 000,000,020 | ---- | C] () -- C:\Users\root\defogger_reenable

[2012.04.25 03:23:30 | 000,050,477 | ---- | C] () -- C:\Users\root\Desktop\Defogger.exe

[2012.04.17 23:50:43 | 000,001,048 | ---- | C] () -- C:\Users\root\Desktop\RollerCoaster Tycoon.lnk

[2012.04.16 21:39:19 | 000,045,568 | ---- | C] () -- C:\Windows\UniFish3.exe

[2012.04.02 18:22:07 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.01.23 17:55:55 | 000,000,021 | ---- | C] () -- C:\Windows\SurCode.INI

[2011.11.18 21:19:37 | 000,073,216 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll

[2011.10.18 22:53:58 | 000,004,096 | -H-- | C] () -- C:\Users\root\AppData\Local\keyfile3.drm

[2011.03.15 00:51:29 | 000,000,035 | ---- | C] () -- C:\Windows\A6W.INI

[2011.03.15 00:51:19 | 000,000,116 | ---- | C] () -- C:\Windows\bfe_prog.ini

[2011.01.27 09:43:10 | 000,000,038 | -HS- | C] () -- C:\Windows\camcodec100.ini

[2011.01.27 09:43:10 | 000,000,028 | -HS- | C] () -- C:\Windows\lagarith.ini

[2011.01.08 22:45:19 | 000,000,015 | ---- | C] () -- C:\Windows\SysWow64\gwSettings.dat

[2010.06.16 00:28:54 | 000,002,857 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 1364 bytes -> C:\Program Files\Common Files\Microsoft Shared:gVyMClTxnuw7TuwvBEu8S0QVL

@Alternate Data Stream - 1296 bytes -> C:\ProgramData\Microsoft:8BfnWWQQNAao5375okYIV9ZWsZ

@Alternate Data Stream - 1243 bytes -> C:\Program Files\Common Files\System:rIrydIm3qUo8VHY3Te

@Alternate Data Stream - 1216 bytes -> C:\Users\root\AppData\Local\Temp:ubCdn5hpPHkLP4UhvkWX

@Alternate Data Stream - 1197 bytes -> C:\ProgramData\Microsoft:Bv8mOE0ix11I9YwWT15RvKUOvx
 

< End of report >

--- --- ---

Extras.Txt
OTL Logfile:

Code:

OTL Extras logfile created on: 25.04.2012 22:29:58 - Run 1

OTL by OldTimer - Version 3.2.42.0     Folder = C:\Users\root\Desktop

64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7601.17514)

Locale: 00000c07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy

 

4,00 Gb Total Physical Memory | 2,47 Gb Available Physical Memory | 61,79% Memory free

4,19 Gb Paging File | 2,35 Gb Available in Paging File | 55,97% Paging File free

Paging file location(s): c:\pagefile.sys 200 25000 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 199,90 Gb Total Space | 41,90 Gb Free Space | 20,96% Space Free | Partition Type: NTFS

Drive D: | 50,00 Gb Total Space | 17,33 Gb Free Space | 34,66% Space Free | Partition Type: NTFS

Drive E: | 1397,26 Gb Total Space | 110,88 Gb Free Space | 7,94% Space Free | Partition Type: NTFS

Drive F: | 81,51 Gb Total Space | 60,83 Gb Free Space | 74,63% Space Free | Partition Type: NTFS

Drive M: | 200,00 Gb Total Space | 39,00 Gb Free Space | 19,50% Space Free | Partition Type: NTFS

Drive V: | 300,00 Gb Total Space | 63,40 Gb Free Space | 21,13% Space Free | Partition Type: NTFS

Drive X: | 193,35 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS

 

Computer Name: OKEANOS | User Name: root | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5.1\Bridge.exe "%L" (Adobe Systems, Inc.)

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [MediaMonkey.1Play] -- "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" "%1" (Ventis Media Inc.)

Directory [MediaMonkey.2PlayNext] -- "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" /NEXT "%1" (Ventis Media Inc.)

Directory [MediaMonkey.3Enqueue] -- "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" /ADD "%1" (Ventis Media Inc.)

Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5.1\Bridge.exe "%L" (Adobe Systems, Inc.)

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [MediaMonkey.1Play] -- "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" "%1" (Ventis Media Inc.)

Directory [MediaMonkey.2PlayNext] -- "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" /NEXT "%1" (Ventis Media Inc.)

Directory [MediaMonkey.3Enqueue] -- "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" /ADD "%1" (Ventis Media Inc.)

Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 
 ========== Authorized Applications List ==========

 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack

"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector

"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)

"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"{0F37D969-1260-419E-B308-EF7D29ABDE20}" = Web Deployment Tool

"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant

"{1C7C8AAF-A16D-32E8-89E5-F6D165DE0BCE}" = Microsoft Visual C++ 2010  x64 Runtime - 10.0.40219

"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64

"{32508A23-C9EA-4D29-83CA-97A42A13701E}" = Microsoft Sync Framework Services v1.0 (x64)

"{34BD24DF-3B6F-8661-D4F0-0EBCACA2C834}" = ccc-utility64

"{3C983A67-DFB2-3D3D-AD9E-CA1A5A09FD18}" = Microsoft Visual Studio 2010 Express Prerequisites x64 - DEU

"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64

"{4B0748C5-2E63-B954-8C3F-71918C599800}" = WMV9/VC-1 Video Playback

"{4D668D4F-FAA2-4726-834C-31F4614F312E}" = MSVC80_x64_v2

"{53D7A054-4598-4947-A159-E8FCC77720AB}" = Microsoft Sync Framework Runtime v1.0 (x64)

"{59996900-0E6C-45B7-8C39-C64CB98462E4}" = Microsoft Web Platform Installer 2.0

"{680EDA59-9266-44B4-949E-0C24F65DFF82}" = Microsoft_VC100_CRT_SP1_x64

"{68660049-8D48-427C-9FF7-139D8340CDC0}" = MSVC80_x64

"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64

"{8E16BB50-E49A-3647-BD4D-4D150DCCBFAE}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU

"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended

"{8FCBB6DA-069C-8D08-DD99-F0881B9EECC3}" = AMD Drag and Drop Transcoding

"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64

"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting

"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64

"{AB071C8B-873C-459F-ACA9-9EBE03C3E89B}" = MSVC90_x64

"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)

"{B25BFFC9-FF51-44F2-9E46-4D93849C836F}" = SyncToy 2.0 (x64)

"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053

"{C214301F-F5D7-36D9-B3A2-1467C5586495}" = Microsoft Help Viewer 1.1 Language Pack - DEU

"{C3600AE6-93A0-3DB7-B7AA-45BD58F133B5}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64)

"{C3EAE456-7E7A-451F-80EF-F34C7A13C558}" = Microsoft SQL Server Compact 3.5 SP2 x64 DEU

"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64

"{CACBDC26-D504-49ED-3FEC-0CDDB3700240}" = ATI Catalyst Install Manager

"{DD7327D2-EC4B-4BA7-9A58-4EF457F2E9F9}" = ActivePerl 5.12.2 Build 1203 (64-bit)

"{E5748D30-7E6D-3A8E-BFE6-C1D02C6DDABB}" = Microsoft Help Viewer 1.1

"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile

"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit

"E8A6D621B6D3FC5D43C68C549D959DE76EEF5D84" = Windows-Treiberpaket - Nokia Modem  (06/01/2009 4.1)

"F779F5541ABD99C95C03B0FD5E3C058B22DA0FF7" = Windows-Treiberpaket - Nokia Modem  (06/01/2009 7.01.0.3)

"FCEC33AD40CEA5E0FC4CEE6E42041A0DA189652D" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)

"MatlabR2009b" = MATLAB R2009b

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended

"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack

"Microsoft Help Viewer 1.1" = Microsoft Help Viewer 1.1

"Microsoft Help Viewer 1.1 Language Pack - DEU" = Microsoft Help Viewer 1.1 Language Pack - DEU

"Microsoft Visual Studio 2010 Tools for Office Runtime (x64)" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64)

"Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU" = Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU

"WinRAR archiver" = WinRAR

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator

"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

"{0125D081-30D0-4A97-82A8-C28D444B6256}" = Microsoft SQL Server Compact 3.5 SP2 DEU

"{024521CF-C07E-4F8E-8481-0D75695E03AF}" = PxMergeModule

"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86

"{0497EAED-70DA-4BBE-BEB3-AF77FD8788EA}" = Adobe Premiere Pro CS5.5

"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3

"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting

"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86

"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer

"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86

"{1803A630-3C38-4D2B-9B9A-0CB37243539C}" = Microsoft ASP.NET MVC 2

"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin

"{19B98EFB-9493-4651-96DD-A6768A5024E3}_is1" = DfontSplitter 0.3.1

"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger

"{1D58229F-C505-45CA-8223-F35F3A34B963}" = Adobe Version Cue CS3 Server

"{1DE1B0F3-5897-4C66-BA18-F8A9E95FAE5C}" = ccc-core-static

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions

"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86

"{26A24AE4-039D-4CA4-87B4-2F83216015FF}" = Java(TM) 6 Update 23

"{27B6D024-FD7E-4A88-BC17-5AFBE33EC072}" = Microsoft F# Runtime for Silverlight 4

"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3

"{2CE77981-14DE-4773-8106-27C9C964720C}" = Microsoft ASP.NET MVC 2 - VWD Express 2010 Tools - DEU

"{2F8B731A-5F2D-3EA8-8B25-C3E5E43F4BDB}" = Microsoft Visual C++  Compilers 2010 Standard - enu - x86

"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery

"{3521BDBD-D453-5D9F-AA55-44B75D214629}" = Adobe Community Help

"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack

"{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729

"{3D39E775-DDDA-4327-B747-0BDC5F191331}" = Nokia PC Suite

"{411E0CC3-587A-468C-B461-95FAFD05E4DE}" = Adobe InDesign CS3

"{4393DE35-AD67-4F37-95E4-30F06EA0FDB2}" = Adobe Creative Suite 3 Design Premium

"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4AA5B8A5-BEEF-4AD8-B11D-4443A042EA4F}" = Adobe Dreamweaver CS3

"{4AA68A73-DB9C-439D-9481-981C82BD008B}" = Nokia Connectivity Cable Driver

"{4D481F91-44BA-F0FE-CD07-8B3429A2A821}" = Catalyst Control Center Graphics Previews Common

"{4D568C38-0552-4CDD-A643-01FAFA2957EF}" = Nokia Software Updater

"{4E33D05D-76CF-5D3C-4D5D-7727530FA161}" = Adobe Content Viewer

"{531E1936-95AC-4F7D-8071-BBE9502C670B}" = Stereoscopic Player

"{543A0462-62A8-59CA-8EA7-B2173DA96DAC}" = CCC Help English

"{5449FB4F-1802-4D5B-A6D8-087DB1142147}" = Realtek HDMI Audio Driver for ATI

"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3

"{5518E08A-2053-4A3E-85B2-F912D4666C9F}" = Adobe Setup

"{558358E5-E4F3-4374-BA1D-26FF39EF87D9}" = Microsoft Silverlight Tools for Visual Studio 2010

"{5809A31C-32FB-35CA-E1D2-0B898119E15F}" = Catalyst Control Center InstallProxy

"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync

"{587178E7-B1DF-494E-9838-FA4DD36E873C}" = ASUSUpdate

"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth

"{5AB7D739-1735-3A9E-BE73-C43507CB4E6F}" = Microsoft Visual Studio 2010 Service Pack 1

"{5BDFAB82-060E-438B-AB4F-A2331B2294C0}" = Microsoft ASP.NET MVC 2 - VWD Express 2010 Tools

"{5D9ED403-94DE-3BA0-B1D6-71F4BDA412E6}" = Microsoft Visual C++ 2010  x86 Runtime - 10.0.40219

"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053

"{5FD88490-011C-4DF1-B886-F298D955171B}" = MySQL Connector Net 5.2.5

"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM

"{616C6F39-4CE1-3434-A665-2F6A04C09A7F}" = Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools

"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86

"{638AA518-6A32-33CC-B88F-BCD20B2DCF2E}" = Microsoft Visual Web Developer 2010 Express - DEU

"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE

"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin

"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All

"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729

"{6B708481-748A-4EB4-97C1-CD386244FF77}" = Adobe MotionPicture Color Files

"{6BBAA81D-6A7E-43AD-8889-2F002DCAAFDD}" = AHV content for Acrobat and Flash

"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2

"{6F868980-FF49-011B-2C95-409F199B9C19}" = Catalyst Control Center Graphics Previews Vista

"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK

"{73B5D990-04EA-4751-B10F-5534770B91F2}" = Adobe Color EU Recommended Settings

"{76387E5D-852F-4F86-9928-0781C60C51EC}" = FSX Google Earth Tracker

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{7B2CC3DF-64FA-44AE-8F57-B0F915147E4F}_is1" = Need For Speed™ World

"{7D606567-5047-451A-B49E-29FCB6012B4E}" = Microsoft Flight Simulator X: Acceleration

"{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3

"{803910CC-3A39-45E3-A594-0D5512A60A86}" = Microsoft Silverlight 4 SDK - Deutsch

"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable

"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform

"{857CC5F0-040E-1016-A173-D55ADD80C260}" = Adobe InDesign CS5.5

"{85DF6786-66AA-42EE-8616-AE456B07BD99}" = Microsoft Flight Simulator SimConnect Client v10.0.61242.0

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8C640345-AF96-4ABA-A697-97D2A0B8C6DB}" = Adobe Flash CS3

"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3

"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT

"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support

"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system

"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In

"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3

"{91110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003

"{91F54E1D-804A-46D8-A56C-53EA9C4B3177}" = Microsoft Silverlight 3 SDK - Deutsch

"{92D1CEBC-7C72-4ECF-BFC6-C131EF3FE6A7}" = Nokia Suite

"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86

"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker

"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting

"{969E11AA-8F3A-F162-1A5A-0965E216B6CE}" = Adobe Download Assistant

"{96F9B265-1367-4E1A-B8B9-F8530EF3AA62}" = Add or Remove Adobe Premiere Pro CS5

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3

"{A2AA4204-C05A-4013-888A-AD153139297F}" = PC Connectivity Solution

"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps

"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific

"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5

"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common

"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5

"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings

"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.0) - Deutsch

"{ACE28263-76A4-4BF5-B6F4-8BD719595969}" = Microsoft SQL Server Database Publishing Wizard 1.4

"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86

"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie

"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0

"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy

"{B671CBFD-4109-4D35-9252-3062D3CCB7B2}" = Adobe SING CS3

"{B6C2D454-38CA-464F-B552-E47F8AE9B637}" = Nokia Symbian3 SDK v0.9_2 (C:\Nokia\devices\Nokia_Symbian3_SDK_v0.9_2)

"{B6D38690-755E-4F40-A35A-23F8BC2B86AC}" = Microsoft_VC90_MFCLOC_x86

"{B73CFB12-C814-4638-AFFD-7E3AAFAF0B4E}" = Adobe BridgeTalk Plugin CS3

"{B7E38540-E355-3503-AFD7-635B2F2F76E1}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974

"{B93DCF58-AA57-41EC-8D69-B05C66C6312D}_is1" = v2011.build.44

"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3

"{BC4F8E84-5E29-49EC-B4E7-E6F9CB50986C}" = Adobe Flash Player 9 ActiveX

"{BCEDD813-269C-4D8F-A4BA-01FDC66254D3}" = Adobe Flash Video Encoder

"{BE5F3842-8309-4754-92D5-83E02E6077A3}" = Adobe Extension Manager CS3

"{C28DD992-5B7B-D195-6841-4EC57DF512BD}" = Adobe Story

"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common

"{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2

"{C5BD220A-EFE8-48A5-B70E-9503D535FACE}" = Adobe WAS CS3

"{C668416A-9213-4058-B7F2-01A42D85559D}" = Microsoft SQL Server System CLR Types

"{C8D7A672-F697-4572-AC62-C856053A8DBC}" = Adobe Illustrator CS3

"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform

"{CFCB8616-A5D1-4281-80E8-389F685BFAE2}" = Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 DEU

"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack

"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client

"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86

"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files

"{D3C605D8-3A5E-4BAD-965D-2C61441BF2AC}" = Adobe Photoshop CS3

"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform

"{D81641E8-ABF1-3D07-803B-60E8FC619368}" = Microsoft Visual C# 2010 Express - DEU

"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86

"{D9E6001A-5DC3-4620-AF7A-80B6CD48645D}" = WCF RIA Services V1.0 SP1

"{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}" = Adobe Color Common Settings

"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings

"{DDA34038-89BD-4804-B0B8-DC48D5DFB463}" = Catalyst Control Center - Branding

"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player

"{DEEB5FE3-40F5-3C5B-8F85-5306EF3C08F4}" = Microsoft Visual C++ 2010 Express - DEU

"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10

"{E3B64CC5-C011-40C0-92BC-7316CD5E5688}" = Microsoft_VC100_CRT_SP1_x86

"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker

"{E4E9CBC9-1CF5-48E3-AF6F-1AB44A856346}" = Microsoft ASP.NET MVC 2 - DEU

"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger

"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3

"{E9089B6A-1FDE-47F3-8D29-175F5B7A0722}" = Microsoft SQL Server 2008 R2 Management Objects

"{EA7B3CC4-366D-4CF6-8350-FD7A7034116E}" = Adobe InDesign CS3 Icon Handler

"{EF32F291-8B08-43EF-8BAA-58B9F8C9540F}" = aerosoft's - Lukla X - Mount Everest

"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F232C87C-6E92-4775-8210-DFE90B7777D9}" = CyberLink PowerDVD 11

"{F535B2CF-C9BB-4162-B03A-02D6971F32CC}" = Microsoft Flight Simulator X

"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials

"{FD60FCEB-234F-4D1E-8E80-DA0DA166B0F7}" = Nokia Symbian3 SDK v0.9

"{FE0646A7-19D0-41B4-A2BB-2C35D644270D}" = Windows Live OneCare safety scanner

"{FF29A7E2-FF40-4D07-B7E4-2093DE59E10A}" = Adobe Color NA Extra Settings

"5513-1208-7298-9440" = JDownloader 0.9

"Adobe AIR" = Adobe AIR

"Adobe Shockwave Player" = Adobe Shockwave Player 11.6

"Adobe_061850775b1c6d22bf2a145678e05e0" = Adobe Creative Suite 3 Design Premium hinzufügen oder entfernen

"AMIP" = AMIP (remove only)

"AMIPConfigurator" = AMIPConfigurator (remove only)

"ANA 2.52 32-Bit für Windows 95 und NT 4.0" = ANA 2.52 32-Bit für Windows 95 und NT 4.0

"Avira AntiVir Desktop" = Avira Free Antivirus

"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help

"com.adobe.AdobeStory.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Story

"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player

"com.adobe.dmp.contentviewer" = Adobe Content Viewer

"com.adobe.downloadassistant.AdobeDownloadAssistant" = Adobe Download Assistant

"CSL Arm Toolchain (arm-symbianelf)_is1" = CSL ARM Toolchain (arm-symbianelf) 2005-Q1C

"DivX Setup.divx.com" = DivX-Setup

"EVEREST Ultimate Edition_is1" = EVEREST Ultimate Edition v5.02

"ffdshow_is1" = ffdshow v1.1.3892 [2011-06-20]

"FlightSim_{7D606567-5047-451A-B49E-29FCB6012B4E}" = Microsoft Flight Simulator X: Acceleration

"G-Force" = G-Force

"InstallShield_{F232C87C-6E92-4775-8210-DFE90B7777D9}" = CyberLink PowerDVD 11

"InstallShield_{F535B2CF-C9BB-4162-B03A-02D6971F32CC}" = Microsoft Flight Simulator X

"IrfanView" = IrfanView (remove only)

"LinuxLive USB Creator" = LinuxLive USB Creator

"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400

"MediaMonkey_is1" = MediaMonkey 4.0

"Microsoft Visual C# 2010 Express - DEU" = Microsoft Visual C# 2010 Express - DEU

"Microsoft Visual C++ 2010 Express - DEU" = Microsoft Visual C++ 2010 Express - DEU

"Microsoft Visual Studio 2010 Service Pack 1" = Microsoft Visual Studio 2010 Service Pack 1

"Microsoft Visual Web Developer 2010 Express - DEU" = Microsoft Visual Web Developer 2010 Express - DEU

"Mozilla Firefox 11.0 (x86 de)" = Mozilla Firefox 11.0 (x86 de)

"Nmap" = Nmap 5.21

"Nokia PC Suite" = Nokia PC Suite

"Nokia Suite" = Nokia Suite

"NSS" = NSS (remove only)

"OpenAL" = OpenAL

"OpenVPN" = OpenVPN 2.2.0

"Regelungstechnik" = Regelungstechnik

"RollerCoaster Tycoon Setup" = Roll

"RTMshadow_{7D606567-5047-451A-B49E-29FCB6012B4E}" = Flight Simulator X

"SP1shadow_{7D606567-5047-451A-B49E-29FCB6012B4E}" = Flight Simulator X Service Pack 1

"SpeedFan" = SpeedFan (remove only)

"SUPER ©" = SUPER © Version 2010.bld.37 (Jan 2, 2010)

"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2

"TeamViewer 6" = TeamViewer 6

"TileProxy" = The TileProxy Project for Microsoft FSX/2004/2002

"Tunngle beta_is1" = Tunngle beta

"vis_MojoMaster.dllWinamp" = Mojo Master Winamp Visualizer for Winamp (remove only)

"VLC media player" = VLC media player 2.0.1

"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner

"WinLiveSuite" = Windows Live Essentials

"WinPcapInst" = WinPcap 4.1.1

"winscp3_is1" = WinSCP 4.3.6

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"Dropbox" = Dropbox

"Qt SDK" = Qt SDK

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 25.04.2012 15:39:59 | Computer Name = Okeanos | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 25.04.2012 15:39:59 | Computer Name = Okeanos | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 25.04.2012 15:57:00 | Computer Name = Okeanos | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 25.04.2012 15:57:00 | Computer Name = Okeanos | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 25.04.2012 15:57:01 | Computer Name = Okeanos | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 25.04.2012 15:57:01 | Computer Name = Okeanos | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 25.04.2012 15:57:01 | Computer Name = Okeanos | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 25.04.2012 15:57:01 | Computer Name = Okeanos | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 25.04.2012 15:57:01 | Computer Name = Okeanos | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 25.04.2012 15:57:01 | Computer Name = Okeanos | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

[ System Events ]

Error - 16.04.2012 20:33:13 | Computer Name = Okeanos | Source = AtcL001 | ID = 194

Description = 

 

Error - 16.04.2012 20:33:14 | Computer Name = Okeanos | Source = AtcL001 | ID = 194

Description = 

 

Error - 16.04.2012 20:33:14 | Computer Name = Okeanos | Source = AtcL001 | ID = 194

Description = 

 

Error - 16.04.2012 20:48:33 | Computer Name = Okeanos | Source = AtcL001 | ID = 194

Description = 

 

Error - 16.04.2012 20:48:33 | Computer Name = Okeanos | Source = AtcL001 | ID = 194

Description = 

 

Error - 16.04.2012 20:55:34 | Computer Name = Okeanos | Source = AtcL001 | ID = 194

Description = 

 

Error - 16.04.2012 20:55:34 | Computer Name = Okeanos | Source = AtcL001 | ID = 194

Description = 

 

Error - 16.04.2012 20:55:35 | Computer Name = Okeanos | Source = AtcL001 | ID = 194

Description = 

 

Error - 16.04.2012 20:55:35 | Computer Name = Okeanos | Source = AtcL001 | ID = 194

Description = 

 

Error - 24.04.2012 16:32:52 | Computer Name = Okeanos | Source = WMPNetworkSvc | ID = 866300

Description = 

 

 

< End of report >

--- --- ---

install.txt (CCleaner)

Code:

ActivePerl 5.12.2 Build 1203 (64-bit)        ActiveState        07.01.2011        84,4MB        5.12.1203

Add or Remove Adobe Premiere Pro CS5        Adobe Systems Incorporated        17.02.2011        3.264MB        5.0

Adobe AIR        Adobe Systems Inc.        22.01.2012                2.5.1.17730

Adobe Community Help        Adobe Systems Incorporated.        22.01.2012                3.4.980

Adobe Content Viewer        Adobe Systems Incorporated        20.02.2012                1.4.0

Adobe Creative Suite 3 Design Premium hinzufügen oder entfernen        Adobe Systems Incorporated        21.09.2009        4.000MB        1.0

Adobe Download Assistant        Adobe Systems Incorporated        20.02.2012                1.0.6

Adobe Flash Player 11 Plugin 64-bit        Adobe Systems Incorporated        16.04.2012        6,00MB        11.2.202.233

Adobe Flash Player 9 ActiveX        Adobe Systems, Inc.        21.09.2009        2,66MB        9.0.45.0

Adobe InDesign CS5.5        Adobe Systems Incorporated        20.02.2012        2.234MB        7.5

Adobe Media Player        Adobe Systems Incorporated        17.02.2011                1.8

Adobe Premiere Pro CS5.5        Adobe Systems Incorporated        22.01.2012        3.082MB        5.5

Adobe Reader X (10.1.0) - Deutsch        Adobe Systems Incorporated        17.06.2011        165,4MB        10.1.0

Adobe Shockwave Player 11.6        Adobe Systems, Inc.        13.11.2011                11.6.3.633

Adobe Story        Adobe Systems Incorporated        22.01.2012                1.0.571

aerosoft's - Lukla X - Mount Everest        aerosoft        03.05.2011                1.00

AMIP (remove only)                23.08.2009                

AMIPConfigurator (remove only)                23.08.2009                

ANA 2.52 32-Bit für Windows 95 und NT 4.0                16.02.2011                

ASUSUpdate                17.08.2009                

ATI Catalyst Install Manager        ATI Technologies, Inc.        12.11.2010        22,4MB        3.0.795.0

Avira Free Antivirus        Avira        11.03.2012        109,2MB        12.0.0.898

CCleaner        Piriform        24.04.2012                3.18

Compatibility Pack for the 2007 Office system        Microsoft Corporation        13.12.2011        224MB        12.0.6612.1000

CSL ARM Toolchain (arm-symbianelf) 2005-Q1C        CodeSourcery, LLC        07.01.2011                2005-Q1C

CyberLink PowerDVD 11        CyberLink Corp.        31.12.2011        227MB        11.0.1719.51

DfontSplitter 0.3.1        Peter Upfold        21.02.2012        2,82MB        

DivX-Setup        DivX, Inc.         05.09.2010                2.0.4.2

Dropbox        Dropbox, Inc.        26.02.2012                1.2.52

EVEREST Ultimate Edition v5.02        Lavalys, Inc.        12.08.2009                5.02

ffdshow v1.1.3892 [2011-06-20]                17.11.2011        12,8MB        1.1.3892.0

FSX Google Earth Tracker        Jürgen Treml        06.01.2010        3,27MB        0.1.2

G-Force        SoundSpectrum        21.01.2012                4.3.2

Google Earth        Google        01.12.2011        92,7MB        6.1.0.5001

IrfanView (remove only)        Irfan Skiljan        24.03.2012        1,50MB        4.32

Java(TM) 6 Update 23        Sun Microsystems, Inc.        17.08.2009        95,0MB        6.0.230

JDownloader 0.9        AppWork GmbH        17.11.2011                0.9

LinuxLive USB Creator        Thibaut Lauziere        29.12.2011                2.8

Malwarebytes Anti-Malware Version 1.61.0.1400        Malwarebytes Corporation        24.04.2012        18,0MB        1.61.0.1400

MATLAB R2009b        The MathWorks, Inc.        05.12.2009                7.9

MediaMonkey 4.0        Ventis Media Inc.        04.03.2012        50,7MB        4.0

Microsoft .NET Framework 4 Client Profile        Microsoft Corporation        05.01.2011        38,8MB        4.0.30319

Microsoft .NET Framework 4 Client Profile DEU Language Pack        Microsoft Corporation        05.01.2011        2,94MB        4.0.30319

Microsoft .NET Framework 4 Extended        Microsoft Corporation        05.01.2011        52,0MB        4.0.30319

Microsoft .NET Framework 4 Extended DEU Language Pack        Microsoft Corporation        05.01.2011        10,7MB        4.0.30319

Microsoft .NET Framework 4 Multi-Targeting Pack        Microsoft Corporation        07.01.2011        83,5MB        4.0.30319

Microsoft ASP.NET MVC 2        Microsoft Corporation        07.01.2011        0,47MB        2.0.50217.0

Microsoft ASP.NET MVC 2 - DEU        Microsoft Corporation        07.01.2011        25,00KB        2.0.50331.0

Microsoft ASP.NET MVC 2 - VWD Express 2010 Tools        Microsoft Corporation        07.01.2011        2,24MB        2.0.50217.0

Microsoft ASP.NET MVC 2 - VWD Express 2010 Tools - DEU        Microsoft Corporation        07.01.2011        2,06MB        2.0.50331.0

Microsoft F# Runtime for Silverlight 4        Microsoft Corporation        15.01.2011        2,36MB        2.0.0.0

Microsoft Flight Simulator SimConnect Client v10.0.61242.0        Microsoft Corporation        26.10.2009        2,41MB        10.0.61242.0

Microsoft Flight Simulator X: Acceleration        Microsoft Game Studios        18.08.2009                10.0.61637.0

Microsoft Help Viewer 1.1        Microsoft Corporation        28.10.2011        3,97MB        1.1.40219

Microsoft Help Viewer 1.1 Language Pack - DEU        Microsoft Corporation        28.10.2011        1,95MB        1.1.40219

Microsoft Office File Validation Add-In        Microsoft Corporation        13.09.2011        7,95MB        14.0.5130.5003

Microsoft Office Professional Edition 2003        Microsoft Corporation        10.04.2012        1.537MB        11.0.8173.0

Microsoft Silverlight        Microsoft Corporation        14.02.2012        194,5MB        4.1.10111.0

Microsoft Silverlight 3 SDK - Deutsch        Microsoft Corporation        07.01.2011        32,8MB        3.0.40818.0

Microsoft Silverlight 4 SDK - Deutsch        Microsoft Corporation        15.01.2011        52,4MB        4.0.50826.0

Microsoft Silverlight Tools for Visual Studio 2010        Microsoft Corporation        15.01.2011        46,00KB        10.0.30319.400

Microsoft SQL Server 2005 Compact Edition [ENU]        Microsoft Corporation        16.01.2011        1,70MB        3.1.0000

Microsoft SQL Server 2008 R2 Management Objects        Microsoft Corporation        28.10.2011        14,4MB        10.50.1750.9

Microsoft SQL Server Compact 3.5 SP2 DEU        Microsoft Corporation        08.01.2011        3,69MB        3.5.8080.0

Microsoft SQL Server Compact 3.5 SP2 x64 DEU        Microsoft Corporation        08.01.2011        4,81MB        3.5.8080.0

Microsoft SQL Server Database Publishing Wizard 1.4        Microsoft Corporation        07.01.2011        10,2MB        10.1.2512.8

Microsoft SQL Server System CLR Types        Microsoft Corporation        28.10.2011        0,93MB        10.50.1750.9

Microsoft Sync Framework Runtime v1.0 (x64)        Microsoft Corporation        04.09.2009        0,78MB        1.0.1215.0

Microsoft Sync Framework Services v1.0 (x64)        Microsoft Corporation        04.09.2009        2,35MB        1.0.1215.0

Microsoft Visual C# 2010 Express - DEU        Microsoft Corporation        28.10.2011                10.0.40219

Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053        Microsoft Corporation        04.09.2009        0,25MB        8.0.50727.4053

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053        Microsoft Corporation        18.08.2009        0,25MB        8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable        Microsoft Corporation        14.06.2011        0,29MB        8.0.59193

Microsoft Visual C++ 2005 Redistributable (x64)        Microsoft Corporation        02.09.2009        0,69MB        8.0.61000

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148        Microsoft Corporation        18.08.2009        0,20MB        9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729        Microsoft Corporation        14.02.2010        0,57MB        9.0.30729

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17        Microsoft Corporation        12.08.2009        0,58MB        9.0.30729

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148        Microsoft Corporation        24.03.2010        0,58MB        9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974        Microsoft Corporation        07.01.2011        0,58MB        9.0.30729.4974

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161        Microsoft Corporation        17.06.2011        0,59MB        9.0.30729.6161

Microsoft Visual C++ 2010  x64 Runtime - 10.0.40219        Microsoft Corporation        28.10.2011        33,5MB        10.0.40219

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219        Microsoft Corporation        29.11.2011        15,0MB        10.0.40219

Microsoft Visual C++ 2010  x86 Runtime - 10.0.40219        Microsoft Corporation        28.10.2011        26,3MB        10.0.40219

Microsoft Visual C++ 2010 Express - DEU        Microsoft Corporation        28.10.2011                10.0.40219

Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools        Microsoft Corporation        28.10.2011        36,1MB        10.0.40219

Microsoft Visual Studio 2010 Express Prerequisites x64 - DEU        Microsoft Corporation        28.10.2011        21,7MB        10.0.40219

Microsoft Visual Studio 2010 Service Pack 1        Microsoft Corporation        28.10.2011        76,0MB        10.0.40219

Microsoft Visual Studio 2010 Tools for Office Runtime (x64)        Microsoft Corporation        15.01.2012                10.0.31119

Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU        Microsoft Corporation        28.10.2011                10.0.31007

Microsoft Visual Web Developer 2010 Express - DEU        Microsoft Corporation        28.10.2011                10.0.40219

Microsoft Web Platform Installer 2.0        Microsoft Corporation        05.01.2011        4,98MB        2.1.1

Mojo Master Winamp Visualizer for Winamp (remove only)                21.01.2012                

Mozilla Firefox 11.0 (x86 de)        Mozilla        18.03.2012        40,2MB        11.0

MSXML 4.0 SP2 (KB954430)        Microsoft Corporation        18.10.2009        1,28MB        4.20.9870.0

MSXML 4.0 SP2 (KB973688)        Microsoft Corporation        27.11.2009        1,33MB        4.20.9876.0

MSXML 4.0 SP2 Parser and SDK        Microsoft Corporation        12.08.2009        1,23MB        4.20.9818.0

MySQL Connector Net 5.2.5        MySQL AB        05.01.2011        3,61MB        5.2.5

Need For Speed™ World        Electronic Arts        16.09.2010                1.0.0.105

Nmap 5.21                29.06.2010                

Nokia Connectivity Cable Driver        Nokia        07.03.2012        3,94MB        7.1.69.0

Nokia PC Suite        Nokia        19.09.2009                7.1.30.9

Nokia Software Updater        Nokia Corporation        17.12.2010        45,4MB        02.06.006.44298

Nokia Suite        Nokia        01.04.2012                3.3.89.0

Nokia Symbian3 SDK v0.9        Nokia        07.01.2011                1.00.0000

Nokia Symbian3 SDK v0.9_2 (C:\Nokia\devices\Nokia_Symbian3_SDK_v0.9_2)        Nokia        07.01.2011                1.00.0000

NSS (remove only)        B-Phreaks Ltd        21.12.2010                1.0.38.15

OpenAL                30.12.2010                

OpenVPN 2.2.0                14.05.2011                2.2.0

PC Connectivity Solution        Nokia        07.03.2012        20,9MB        11.5.29.0

PDFCreator        Frank Heindörfer, Philip Chinery        09.04.2012                1.3.2

Qt SDK        Nokia        19.09.2011                1.1.0

Realtek HDMI Audio Driver for ATI        Realtek Semiconductor Corp.        12.11.2010                6.0.1.6121

Realtek High Definition Audio Driver        Realtek Semiconductor Corp.        12.11.2010                6.0.1.6235

Regelungstechnik                14.03.2011                

Skype™ 5.5        Skype Technologies S.A.        17.11.2011        17,0MB        5.5.124

SpeedFan (remove only)                12.08.2009                

Spybot - Search & Destroy        Safer Networking Limited        23.04.2012                1.6.2

Stereoscopic Player        3dtv.at        23.11.2011        15,5MB        1.7.6

SUPER © Version 2010.bld.37 (Jan 2, 2010)        eRightSoft        17.01.2010                Version 2010.bld.37 (Jan 2, 2010)

SyncToy 2.0 (x64)        Microsoft        04.09.2009        1,47MB        2.0.100.0

TeamSpeak 2 RC2        Dominating Bytes Design        02.10.2009                2.0.32.60

TeamViewer 6        TeamViewer GmbH        22.04.2011                6.0.10511

The TileProxy Project for Microsoft FSX/2004/2002                26.10.2009                

Tunngle beta        Tunngle.net GmbH        01.01.2010                

v2011.build.44        eRightSoft        26.01.2011        22,8MB        v2011.build.44

Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 DEU        Microsoft Corporation        12.10.2011        11,2MB        4.0.8080.0

VLC media player 2.0.1        VideoLAN        26.03.2012                2.0.1

WCF RIA Services V1.0 SP1        Microsoft Corporation        28.10.2011        12,3MB        4.1.60114.0

Web Deployment Tool        Microsoft Corporation        05.01.2011        5,46MB        1.1.0618

Windows Live Essentials        Microsoft Corporation        06.04.2012                15.4.3555.0308

Windows Live OneCare safety scanner        Microsoft Corporation        06.01.2010                

Windows Live Sync        Microsoft Corporation        03.12.2010        2,79MB        14.0.8117.416

Windows Media Player Firefox Plugin        Microsoft Corp        28.11.2009        0,29MB        1.0.0.8

Windows-Treiberpaket - Nokia Modem  (06/01/2009 4.1)        Nokia        19.09.2009                06/01/2009 4.1

Windows-Treiberpaket - Nokia Modem  (06/01/2009 7.01.0.3)        Nokia        19.09.2009                06/01/2009 7.01.0.3

Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)        Nokia        09.02.2012                08/22/2008 7.0.0.0

WinPcap 4.1.1        CACE Technologies        29.06.2010                4.1.0.1753

WinRAR                22.09.2009                

WinSCP 4.3.6        Martin Prikryl        23.01.2012        8,75MB        4.3.6

Danke für die Hilfe!

Sorry dass das so lange gedauert hat, hatte nicht jeden Tag Zeit und die Scans dauern z.T. doch auch einen halben Tag. Verwendet habe ich den PC kaum.

Ist es normal, dass bei mir im Firefox fast alle Suchmaschinen (u.a. google.at, wikipedia (en), yahoo, bing) aus der Schnellsuche verschwunden sind und gespeicherte Passwörter weg? Außerdem kommt jetzt bei fast jedem Programmstart ein Dialog "Benutzerkontrollzentrum". Ich vermute das liegt an den Fixes mit OTL.

Dann mal die Log-Files:

Code:

All processes killed

========== OTL ==========

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.

HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache| /E : value set successfully!

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!

Registry key HKEY_CURRENT_USER\Software\MozillaPlugins\@tools.google.com/Google Update;version=3\ deleted successfully.

C:\Users\root\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll moved successfully.

Registry key HKEY_CURRENT_USER\Software\MozillaPlugins\@tools.google.com/Google Update;version=9\ deleted successfully.

File C:\Users\root\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll not found.

C:\Users\root\AppData\Roaming\Mozilla\Firefox\Profiles\pak8z3xn.default\searchplugins\facebook.xml moved successfully.

C:\Users\root\AppData\Roaming\Mozilla\Firefox\Profiles\pak8z3xn.default\searchplugins\googleat.xml moved successfully.

C:\Users\root\AppData\Roaming\Mozilla\Firefox\Profiles\pak8z3xn.default\searchplugins\wikipedia-en.xml moved successfully.

C:\Users\root\AppData\Roaming\Mozilla\Firefox\Profiles\pak8z3xn.default\searchplugins\youtube.xml moved successfully.

C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml moved successfully.

C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml moved successfully.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{47833539-D0C5-4125-9FA8-0819E2EAAC93} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{47833539-D0C5-4125-9FA8-0819E2EAAC93}\ not found.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLUA deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\PromptOnSecureDesktop deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

File move failed. X:\AUTORUN.INF scheduled to be moved on reboot.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{09a14e6e-d3be-11e0-94ed-001bfc3e892b}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{09a14e6e-d3be-11e0-94ed-001bfc3e892b}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{09a14e6e-d3be-11e0-94ed-001bfc3e892b}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{09a14e6e-d3be-11e0-94ed-001bfc3e892b}\ not found.

File H:\LaunchU3.exe -a not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6bc41af1-8818-11de-91f0-806e6f6e6963}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6bc41af1-8818-11de-91f0-806e6f6e6963}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6bc41af1-8818-11de-91f0-806e6f6e6963}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6bc41af1-8818-11de-91f0-806e6f6e6963}\ not found.

File move failed. X:\Setup.exe scheduled to be moved on reboot.

C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1815528959-3452218465-1913872660-1000UA.job moved successfully.

C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1815528959-3452218465-1913872660-1000Core.job moved successfully.

ADS C:\Program Files\Common Files\Microsoft Shared:gVyMClTxnuw7TuwvBEu8S0QVL deleted successfully.

ADS C:\ProgramData\Microsoft:8BfnWWQQNAao5375okYIV9ZWsZ deleted successfully.

ADS C:\Program Files\Common Files\System:rIrydIm3qUo8VHY3Te deleted successfully.

ADS C:\Users\root\AppData\Local\Temp:ubCdn5hpPHkLP4UhvkWX deleted successfully.

ADS C:\ProgramData\Microsoft:Bv8mOE0ix11I9YwWT15RvKUOvx deleted successfully.

========== FILES ==========

C:\Users\root\AppData\Roaming\pdfforge\PDFArchitect folder moved successfully.

C:\Users\root\AppData\Roaming\pdfforge\Images2PDF folder moved successfully.

C:\Users\root\AppData\Roaming\pdfforge folder moved successfully.
 < ipconfig /flushdns /c >

Windows-IP-Konfiguration

Der DNS-Aufl”sungscache wurde geleert.

C:\Users\root\Desktop\cmd.bat deleted successfully.

C:\Users\root\Desktop\cmd.txt deleted successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 56502 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

User: DefaultAppPool

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 41620 bytes

 

User: Public

 

User: root

->Temp folder emptied: 5389512867 bytes

->Temporary Internet Files folder emptied: 56483989 bytes

->Java cache emptied: 63768634 bytes

->FireFox cache emptied: 703631168 bytes

->Flash cache emptied: 199511 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 116000891 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67765 bytes

RecycleBin emptied: 92967836092 bytes

 

Total Files Cleaned = 94.698,00 mb

 

 

OTL by OldTimer - Version 3.2.42.0 log created on 04272012_121844
 

Files\Folders moved on Reboot...

File move failed. X:\AUTORUN.INF scheduled to be moved on reboot.

File move failed. X:\Setup.exe scheduled to be moved on reboot.

File\Folder C:\Users\root\AppData\Local\Temp\ERT-Rehatechnik und AAL-2010.pdf  not found!

C:\Users\root\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
 

Registry entries deleted on Reboot...

Code:

SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 04/27/2012 at 03:04 PM
 

Application Version : 5.0.1148
 

Core Rules Database Version : 8521

Trace Rules Database Version: 6333
 

Scan type       : Complete Scan

Total Scan Time : 02:12:03
 

Operating System Information

Windows 7 Ultimate 64-bit, Service Pack 1 (Build 6.01.7601)

UAC On - Limited User
 

Memory items scanned      : 516

Memory threats detected   : 0

Registry items scanned    : 67301

Registry threats detected : 0

File items scanned        : 295664

File threats detected     : 5
 

Trojan.Agent/Gen-Dropper

        C:\USERS\ROOT\DOWNLOADS\CD\AUTORUN\AUTORUN.EXE
 

Trojan.Agent/Gen-UsrMgr

        C:\QT-SDK\MADDE\MADBIN\TARLISTED.EXE

        C:\QT-SDK\MADDE\MADLIB\UTFS-SERVER.EXE

        C:\QT-SDK\MADDE\TARGETS\HARMATTAN_10.2011.34-1\BIN\GCC.EXE

        C:\QT-SDK\MADDE\TEMPLATES\GCCWRAPPER.EXE

Anm.: Im Qt SDK ist das zu 99,9 % ein falsch positiver Fund. Hierbei handelt es sich um ein professionelles Programm und kein Spielzeug. Der zweite Treffer verwundert mich auch: Hierbei handelt es sich um eine Chemie-Übungs CD welche ich scheinbar vor gut 3 Jahren als ich in meinem Studium Chemie hatte installiert habe. Ich kann mich aber selber nicht mehr genau erinnern und musste nachschauen was das überhaupt ist. Im Readme-File steht drinnen wie man das ganze unter Win 3.1x und Win 95 zum laufen bringt, dürfte also recht alt sein diese Software ((c) 1999).

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=12098f8d121a564d94ddaf83a674c5ac

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-04-27 11:01:51

# local_time=2012-04-28 01:01:51 (+0100, Mitteleuropäische Sommerzeit)

# country="Austria"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=1792 16777215 100 0 85359454 85359454 0 0

# compatibility_mode=5893 16776573 100 94 18360 87169887 0 0

# compatibility_mode=8192 67108863 100 0 114 114 0 0

# scanned=1020159

# found=1

# cleaned=1

# scan_time=27674

C:\Users\root\Downloads\Utilities\ActivateKey.exe        a variant of Win32/Packed.ExeScript.B trojan (cleaned by deleting - quarantined)        00000000000000000000000000000000        C

Wofür diese exe genau ist kann ich nicht sagen, sie ist auf jeden Fall schon seit 2009 auf meinem PC. In diesem Ordner speichere ich alle möglichen kleinen Tools, die man meistens eh nur 1x braucht, ab. Vermutlich hätte diese exe irgendeines dieser Tools von Test- auf Vollversion upgegradet. Ich achte normalerweise auch darauf, solche Tools entweder direkt beim Hersteller/Programmierer oder auf einer bekannte Downloadseite wie chip.de, SourceForge, pcwelt.de, ... herunterzuladen.

Code:

OTL logfile created on: 29.04.2012 12:42:25 - Run 2

OTL by OldTimer - Version 3.2.42.0     Folder = C:\Users\root\Desktop

64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7601.17514)

Locale: 00000c07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy

 

4,00 Gb Total Physical Memory | 2,04 Gb Available Physical Memory | 51,10% Memory free

4,19 Gb Paging File | 1,92 Gb Available in Paging File | 45,86% Paging File free

Paging file location(s): c:\pagefile.sys 200 25000 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 199,90 Gb Total Space | 63,17 Gb Free Space | 31,60% Space Free | Partition Type: NTFS

Drive D: | 50,00 Gb Total Space | 20,54 Gb Free Space | 41,08% Space Free | Partition Type: NTFS

Drive E: | 1397,26 Gb Total Space | 172,11 Gb Free Space | 12,32% Space Free | Partition Type: NTFS

Drive F: | 81,51 Gb Total Space | 61,51 Gb Free Space | 75,47% Space Free | Partition Type: NTFS

Drive G: | 3,60 Gb Total Space | 3,60 Gb Free Space | 100,00% Space Free | Partition Type: FAT32

Drive H: | 3,72 Gb Total Space | 3,48 Gb Free Space | 93,45% Space Free | Partition Type: FAT32

Drive M: | 200,00 Gb Total Space | 45,02 Gb Free Space | 22,51% Space Free | Partition Type: NTFS

Drive V: | 300,00 Gb Total Space | 80,35 Gb Free Space | 26,78% Space Free | Partition Type: NTFS

Drive X: | 193,35 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS

 

Computer Name: OKEANOS | User Name: root | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.04.27 12:41:20 | 000,924,600 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe

PRC - [2012.04.25 14:26:01 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\root\Desktop\OTL.exe

PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

PRC - [2012.04.04 15:56:38 | 000,462,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

PRC - [2012.02.15 01:03:14 | 024,246,216 | ---- | M] (Dropbox, Inc.) -- C:\Users\root\AppData\Roaming\Dropbox\bin\Dropbox.exe

PRC - [2012.01.31 09:57:06 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

PRC - [2012.01.31 09:56:50 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

PRC - [2012.01.31 09:56:50 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

PRC - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2012.04.27 12:41:20 | 001,952,696 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - [2010.09.29 03:51:08 | 000,203,264 | ---- | M] (AMD) [Disabled | Stopped] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)

SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)

SRV - [2012.04.27 12:41:20 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2012.04.17 11:47:13 | 000,253,088 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2012.01.31 09:57:06 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2012.01.31 09:56:50 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2012.01.04 14:32:36 | 000,718,888 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)

SRV - [2011.08.12 01:38:04 | 000,140,672 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Programme\SUPERAntiSpyware\SASCore64.exe -- (!SASCORE)

SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2011.05.19 05:00:20 | 000,083,240 | ---- | M] () [Disabled | Stopped] -- C:\Program Files (x86)\CyberLink\PowerDVD11\Kernel\DMP\CLHNServiceForPowerDVD.exe -- (CLHNServiceForPowerDVD)

SRV - [2011.05.12 10:09:36 | 000,312,616 | ---- | M] (CyberLink) [Disabled | Stopped] -- C:\Program Files (x86)\CyberLink\PowerDVD11\Common\MediaServer\CLMSServer.exe -- (CyberLink PowerDVD 11.0 Service)

SRV - [2011.05.12 10:09:34 | 000,070,952 | ---- | M] (CyberLink) [Disabled | Stopped] -- C:\Program Files (x86)\CyberLink\PowerDVD11\Common\MediaServer\CLMSMonitorService.exe -- (CyberLink PowerDVD 11.0 Monitor Service)

SRV - [2011.04.26 11:21:06 | 000,014,848 | ---- | M] () [Disabled | Stopped] -- C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe -- (OpenVPNService)

SRV - [2011.04.15 11:43:20 | 002,280,312 | ---- | M] (TeamViewer GmbH) [Disabled | Stopped] -- C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe -- (TeamViewer6)

SRV - [2011.03.28 21:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)

SRV - [2010.11.20 14:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll -- (WAS)

SRV - [2010.11.20 14:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll -- (W3SVC)

SRV - [2010.11.20 14:18:03 | 000,061,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\inetsrv\apphostsvc.dll -- (AppHostSvc)

SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2010.02.19 14:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)

SRV - [2010.01.19 18:49:16 | 000,055,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\IIS\Microsoft Web Deploy\MsDepSvc.exe -- (MsDepSvc)

SRV - [2009.12.31 11:56:40 | 000,682,232 | ---- | M] (Tunngle.net GmbH) [Disabled | Stopped] -- C:\Program Files (x86)\Tunngle\TnglCtrl.exe -- (TunngleService)

SRV - [2009.09.22 23:24:59 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

SRV - [2007.03.20 16:41:24 | 000,153,792 | ---- | M] (Adobe Systems Incorporated) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe -- (Adobe Version Cue CS3)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2012.04.04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)

DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2012.01.31 09:57:31 | 000,132,320 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)

DRV:64bit: - [2012.01.31 09:57:30 | 000,097,312 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)

DRV:64bit: - [2011.11.01 11:07:26 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser_lowerfltjx64.sys -- (UsbserFilt)

DRV:64bit: - [2011.11.01 11:07:26 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys -- (upperdev)

DRV:64bit: - [2011.11.01 11:07:24 | 000,027,136 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ccdcmbox64.sys -- (nmwcdc)

DRV:64bit: - [2011.11.01 11:07:24 | 000,019,968 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ccdcmbx64.sys -- (nmwcd)

DRV:64bit: - [2011.09.16 17:09:16 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)

DRV:64bit: - [2011.04.26 11:21:06 | 000,031,232 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tap0901.sys -- (tap0901)

DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2010.11.20 13:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)

DRV:64bit: - [2010.11.20 12:43:57 | 000,032,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser.sys -- (usbser)

DRV:64bit: - [2010.09.29 04:26:12 | 007,883,264 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)

DRV:64bit: - [2010.09.29 04:26:12 | 007,883,264 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)

DRV:64bit: - [2010.09.29 03:14:48 | 000,285,696 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)

DRV:64bit: - [2010.08.16 12:42:00 | 000,116,240 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)

DRV:64bit: - [2010.05.24 21:07:58 | 000,253,728 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtHDMIVX.sys -- (RTHDMIAzAudService)

DRV:64bit: - [2010.01.27 04:09:02 | 000,047,632 | ---- | M] (CACE Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\npf.sys -- (npf)

DRV:64bit: - [2010.01.03 02:55:20 | 000,834,544 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd)

DRV:64bit: - [2009.10.13 03:15:52 | 000,061,440 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\l160x64.sys -- (AtcL001)

DRV:64bit: - [2009.09.16 08:02:42 | 000,031,232 | ---- | M] (Tunngle.net) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tap0901t.sys -- (tap0901t) TAP-Win32 Adapter V9 (Tunngle)

DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.07.09 04:00:00 | 000,055,280 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)

DRV:64bit: - [2009.06.29 15:00:00 | 000,116,752 | ---- | M] (ATI Research Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)

DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2008.08.28 12:44:42 | 000,025,600 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys -- (pccsmcfd)

DRV:64bit: - [2008.02.18 23:59:56 | 000,033,792 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tileproxy.sys -- (Tileproxy)

DRV:64bit: - [2006.08.29 16:56:20 | 000,032,377 | ---- | M] (B-phreaks) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\prodigy.sys -- (PRODIGY)

DRV:64bit: - [2005.03.29 01:30:38 | 000,008,192 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor)

DRV - [2011.07.22 18:26:56 | 000,014,928 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\sasdifsv64.sys -- (SASDIFSV)

DRV - [2011.07.12 23:55:18 | 000,012,368 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\saskutil64.sys -- (SASKUTIL)

DRV - [2011.05.20 16:31:06 | 000,148,976 | ---- | M] (CyberLink Corp.) [2012/01/01 22:34:27] [Kernel | Auto | Running] -- C:\Program Files (x86)\CyberLink\PowerDVD11\Common\NavFilter\000.fcl -- ({329F96B6-DF1E-4328-BFDA-39EA953C1312})

DRV - [2011.05.19 05:00:21 | 000,075,248 | ---- | M] (Cyberlink Corp.) [Kernel | Auto | Running] -- C:\Program Files (x86)\CyberLink\PowerDVD11\Kernel\DMP\ntk_PowerDVD_64.sys -- (ntk_PowerDVD)

DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-at

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 44 31 62 EE 5B 19 CD 01  [binary data]

IE - HKCU\..\SearchScopes,DefaultScope = 

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3

FF - prefs.js..extensions.enabledItems: de-AT@dictionaries.addons.mozilla.org:2.0.2

FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.4

FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.6.2

FF - prefs.js..extensions.enabledItems: {35106bca-6c78-48c7-ac28-56df30b51d2a}:1.3.8

FF - prefs.js..extensions.enabledItems: {c45c406e-ab73-11d8-be73-000a95be3b12}:1.1.9

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22

FF - prefs.js..extensions.enabledItems: inspector@mozilla.org:2.0.9

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23

FF - prefs.js..extensions.enabledItems: {07b2a769-ed19-4483-87ce-c643914c81bb}:3.0.0.91

FF - prefs.js..keyword.URL: "hxxp://www.google.at/search?ie=UTF-8&oe=utf-8&q="

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_233.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/wpi,version=1.0: C:\Program Files\Microsoft\Web Platform Installer\\npwpidetector.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_233.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/wpi,version=1.1: C:\Program Files\Microsoft\Web Platform Installer\\npwpidetector.dll ()

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Users\root\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll File not found

FF - HKCU\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Users\root\AppData\Local\Google\Google Earth\plugin\npgeplugin.dll (Google)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\bkmrksync@nokia.com: C:\Program Files (x86)\Nokia\Nokia PC Suite 7\bkmrksync\ [2009.09.20 12:42:30 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.04.27 12:41:20 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.04.27 12:39:25 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\te_9.0@nokia.com: C:\Program Files (x86)\Nokia\Nokia Suite\Connectors\Thunderbird Connector\ThunderbirdExtension_9.0 [2012.02.10 21:51:38 | 000,000,000 | ---D | M]

 

[2009.08.13 18:16:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\root\AppData\Roaming\mozilla\Extensions

[2012.04.27 12:35:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\root\AppData\Roaming\mozilla\Firefox\Profiles\pak8z3xn.default\extensions

[2010.06.26 00:06:38 | 000,000,000 | ---D | M] (Vista-aero) -- C:\Users\root\AppData\Roaming\mozilla\Firefox\Profiles\pak8z3xn.default\extensions\{07b2a769-ed19-4483-87ce-c643914c81bb}

[2010.02.18 20:22:38 | 000,000,000 | ---D | M] (Linkification) -- C:\Users\root\AppData\Roaming\mozilla\Firefox\Profiles\pak8z3xn.default\extensions\{35106bca-6c78-48c7-ac28-56df30b51d2a}

[2011.11.25 06:57:02 | 000,000,000 | ---D | M] (iMacros for Firefox) -- C:\Users\root\AppData\Roaming\mozilla\Firefox\Profiles\pak8z3xn.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}

[2012.03.31 19:32:16 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\root\AppData\Roaming\mozilla\Firefox\Profiles\pak8z3xn.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

[2011.01.07 23:44:24 | 000,000,000 | ---D | M] (Web Developer) -- C:\Users\root\AppData\Roaming\mozilla\Firefox\Profiles\pak8z3xn.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}

[2010.11.18 00:14:57 | 000,000,000 | ---D | M] (German Dictionary, extended for Austria) -- C:\Users\root\AppData\Roaming\mozilla\Firefox\Profiles\pak8z3xn.default\extensions\de-AT@dictionaries.addons.mozilla.org

[2012.03.24 12:20:07 | 000,000,000 | ---D | M] (DOM Inspector) -- C:\Users\root\AppData\Roaming\mozilla\Firefox\Profiles\pak8z3xn.default\extensions\inspector@mozilla.org

[2011.04.29 23:07:49 | 000,000,000 | ---D | M] (Ovi Maps 3D browser plugin) -- C:\Users\root\AppData\Roaming\mozilla\Firefox\Profiles\pak8z3xn.default\extensions\maps@ovi.com

[2010.06.26 00:06:38 | 000,000,000 | ---D | M] (No name found) -- C:\Users\root\AppData\Roaming\mozilla\Firefox\Profiles\pak8z3xn.default\extensions\{07b2a769-ed19-4483-87ce-c643914c81bb}\chrome\mozapps\extensions

[2012.04.27 12:41:23 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

() (No name found) -- C:\USERS\ROOT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PAK8Z3XN.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI

() (No name found) -- C:\USERS\ROOT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PAK8Z3XN.DEFAULT\EXTENSIONS\FIREBUG@SOFTWARE.JOEHEWITT.COM.XPI

() (No name found) -- C:\USERS\ROOT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PAK8Z3XN.DEFAULT\EXTENSIONS\IENETRENDERER-NICO@NC.XPI

[2012.04.27 12:41:20 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2012.04.27 12:37:51 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll

[2011.03.23 23:03:21 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2011.03.23 23:03:21 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2011.03.23 23:03:21 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2011.03.23 23:03:21 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

 

O1 HOSTS File: ([2011.08.23 14:50:16 | 000,003,814 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 activate.adobe.com

O1 - Hosts: 127.0.0.1 adobe.activate.com

O1 - Hosts: 127.0.0.1 practivate.adobe.com

O1 - Hosts: 127.0.0.1 ereg.adobe.com

O1 - Hosts: 127.0.0.1 adobeereg.com

O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com

O1 - Hosts: 127.0.0.1 wip3.adobe.com

O1 - Hosts: 127.0.0.1 3dns-3.adobe.com

O1 - Hosts: 127.0.0.1 3dns-2.adobe.com

O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com

O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com

O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com

O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com

O1 - Hosts: 127.0.0.1 activate-sea.adobe.com

O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com

O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com

O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com

O1 - Hosts: 127.0.0.1 hl2rcv.adobe.com

O1 - Hosts: 127.0.0.1 adobeereg.com

O1 - Hosts: 127.0.0.1 activate.adobe.com

O1 - Hosts: 127.0.0.1 practivate.adobe.com

O1 - Hosts: 127.0.0.1 ereg.adobe.com

O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com

O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com

O1 - Hosts: 127.0.0.1 wip3.adobe.com

O1 - Hosts: 71 more lines...

O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)

O4 - Startup: C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\root\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O8:64bit: - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~4\OFFICE11\EXCEL.EXE/3000 File not found

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~4\OFFICE11\EXCEL.EXE/3000 File not found

O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~4\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{08919409-BD53-45DF-9C95-D85C9EFC28AB}: DhcpNameServer = 10.0.0.251

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E24524DA-5C8B-4F33-B120-2AFF70937A27}: DhcpNameServer = 192.168.0.1

O18:64bit: - Protocol\Handler\livecall - No CLSID value found

O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found

O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found

O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found

O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found

O18:64bit: - Protocol\Handler\msnim - No CLSID value found

O18:64bit: - Protocol\Handler\mso-offdap - No CLSID value found

O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found

O18:64bit: - Protocol\Handler\wlpg - No CLSID value found

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation)

O18:64bit: - Protocol\Filter\text/xml - No CLSID value found

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [1999.03.29 11:08:26 | 000,000,059 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.04.29 12:37:14 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{CF4EFFF4-EB6A-46D8-B84D-90667EBB767B}

[2012.04.29 12:37:02 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{AC5FB105-EB17-40E4-A360-5DACD7FB0324}

[2012.04.27 12:48:31 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Roaming\SUPERAntiSpyware.com

[2012.04.27 12:48:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware

[2012.04.27 12:48:00 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com

[2012.04.27 12:48:00 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware

[2012.04.27 12:41:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service

[2012.04.27 12:41:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla

[2012.04.27 12:38:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java

[2012.04.27 12:38:01 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe

[2012.04.27 12:38:01 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe

[2012.04.27 12:38:01 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe

[2012.04.27 12:18:44 | 000,000,000 | ---D | C] -- C:\_OTL

[2012.04.27 12:13:59 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{5AE62460-87BC-4011-81A2-4624221D93F7}

[2012.04.27 12:13:46 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{D2057F9A-ABDD-4695-BD59-CBA5DC480BF7}

[2012.04.25 22:41:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2012.04.25 22:41:32 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2012.04.25 14:25:59 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\root\Desktop\OTL.exe

[2012.04.25 14:25:39 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Roaming\Malwarebytes

[2012.04.25 14:25:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.04.25 14:25:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.04.25 14:25:32 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2012.04.25 14:25:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2012.04.25 14:16:50 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{035134A5-A0B2-479D-89F2-B1E5A1ADBE30}

[2012.04.25 14:16:35 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{CAC69907-3A00-43AD-8EEC-A1E07521716E}

[2012.04.25 03:33:07 | 000,607,260 | R--- | C] (Swearware) -- C:\Users\root\Desktop\dds.com

[2012.04.24 22:32:52 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{D546F820-8632-4634-9956-B02040D1223E}

[2012.04.24 22:32:37 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{CB236D45-C01D-4890-98DB-BA622212BB08}

[2012.04.24 15:57:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy

[2012.04.24 15:57:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy

[2012.04.24 15:57:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy

[2012.04.24 10:22:01 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{D84C651E-7537-4B62-9404-A48193E4B140}

[2012.04.24 10:21:48 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{AEAF2710-E68C-414C-9CE3-72D1AFF72495}

[2012.04.23 15:36:55 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{97D509BF-BC73-4B7E-BA86-DED3646E83CC}

[2012.04.23 15:36:44 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{812137DC-6764-4E1A-84B5-256AA4899DFB}

[2012.04.22 22:18:53 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{699AF856-CF22-4C88-BE66-D5689CFF4B79}

[2012.04.22 22:18:39 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{0DD3229E-C1C7-4F38-8640-C4641B083BFA}

[2012.04.21 14:01:36 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{64C3BDBF-96D3-453D-A43C-66CEC34F6D55}

[2012.04.21 14:01:24 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{DAADE23A-9465-43DB-9FB2-6415B8CCD480}

[2012.04.20 13:14:38 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{A8E29C21-03AA-40BC-8D27-70BD2B603A81}

[2012.04.20 13:14:25 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{CF6A3FEA-C191-40DD-99FC-07E28CCBDF66}

[2012.04.19 13:00:56 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{255F667A-760C-4D28-BCB1-D3482792D1D9}

[2012.04.19 13:00:44 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{2683821E-44B3-4DDE-9626-A408BDB4F2AA}

[2012.04.18 13:19:14 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{5FC16F10-D4FD-4C9C-8441-3713B990D70B}

[2012.04.18 13:19:02 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{27B62D37-A2C6-4245-B99F-55EFEF6FA001}

[2012.04.17 22:38:17 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{DFF3EAEA-76BC-4BBE-9EF5-CB44D59D504A}

[2012.04.17 22:38:03 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{DED27DD7-10B0-46D3-B703-571EFE02E89C}

[2012.04.17 02:24:53 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{5E263728-2DCD-4F39-B121-13450CD06BF6}

[2012.04.17 02:24:40 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{F68EF18A-1786-4A1B-8F7C-1CE726E1ADB5}

[2012.04.16 21:42:23 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games

[2012.04.16 21:39:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hasbro Interactive

[2012.04.16 21:38:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\RollerCoaster Tycoon

[2012.04.16 14:24:08 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{56E5BB74-F5F4-4A26-93F4-C32873FC7F75}

[2012.04.16 14:23:56 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{A312426D-D715-4C1E-9E27-FC865273E3D9}

[2012.04.15 21:42:01 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{6998F806-9FD7-4674-9AE8-116BF84C89CA}

[2012.04.15 21:41:49 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{E0FFB1DC-7ADC-47EB-8488-2C7D86EBC04B}

[2012.04.15 09:41:22 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{92393733-7951-4EB7-B976-125085B6F05F}

[2012.04.15 09:41:10 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{CABD6F6D-6750-4C2A-BAFA-9985BEB4A9BD}

[2012.04.14 10:55:01 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{7A88A106-5BE5-4801-AB21-D847BC190018}

[2012.04.14 10:54:48 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{35F07620-729D-4D27-B27C-5C0A97356923}

[2012.04.13 13:39:54 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{E1EAE3E6-2C9E-4BFA-BB84-64125063B625}

[2012.04.13 13:39:42 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{EF3E3249-8E1D-4600-A43C-4411FDC710D6}

[2012.04.13 01:39:17 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{BFCC8632-4913-4962-8B0D-743A9CB87585}

[2012.04.13 01:39:06 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{72F55DFF-1534-40CE-9E7E-704AACD7664F}

[2012.04.12 13:38:39 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{9BFF59F9-DEDE-46C9-BE48-22D26035B1A9}

[2012.04.12 13:38:27 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{D08AD9F3-FC8F-4BB8-856A-1DA40B63D5AC}

[2012.04.12 00:01:20 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{E132AA4E-3F17-4481-85FF-1D928A32ED45}

[2012.04.12 00:01:09 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{3B89BC6F-2310-4880-89BE-E99AF94C610E}

[2012.04.11 12:05:08 | 000,023,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\fs_rec.sys

[2012.04.11 12:05:07 | 000,081,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\imagehlp.dll

[2012.04.11 12:05:05 | 000,220,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll

[2012.04.11 12:04:15 | 000,702,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll

[2012.04.11 12:04:15 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll

[2012.04.11 12:04:15 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll

[2012.04.11 12:04:15 | 000,097,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll

[2012.04.11 12:04:15 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll

[2012.04.11 12:04:14 | 000,134,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll

[2012.04.11 12:04:14 | 000,132,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll

[2012.04.11 12:00:41 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{ABCDE5C6-A954-4754-865D-1798EAFEF337}

[2012.04.11 12:00:30 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{B058776E-AB98-44DF-AB91-22BDC5108AB7}

[2012.04.10 23:50:51 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{8D64CC9C-3BF1-4435-B049-3FB233CE39E2}

[2012.04.10 23:50:40 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{2AD19311-810A-4877-A591-CC02FDB0130C}

[2012.04.10 14:53:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator

[2012.04.10 14:53:48 | 000,662,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSCOMCT2.OCX

[2012.04.10 14:53:48 | 000,137,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSMAPI32.OCX

[2012.04.10 14:53:47 | 000,158,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSCMCDE.DLL

[2012.04.10 14:53:47 | 000,125,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\VB6DE.DLL

[2012.04.10 14:53:47 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSCC2DE.DLL

[2012.04.10 14:53:47 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSMPIDE.DLL

[2012.04.10 14:53:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PDFCreator

[2012.04.10 11:50:09 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{11A1AD9C-CCF8-44E2-ADF8-33A9667AB8AD}

[2012.04.10 11:49:53 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{17526836-10EB-4492-B947-8C738AF26783}

[2012.04.09 21:11:06 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{4D82EB78-AAF3-495C-8E00-146C20A44C91}

[2012.04.09 21:10:52 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{63AE9AC7-5334-48D0-9D34-02F30E92BA35}

[2012.04.09 19:24:12 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{A5680200-7412-470F-8E4F-3286002A0EA5}

[2012.04.08 00:03:02 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{1603A2DB-3F90-469B-8A7E-144C7611F61C}

[2012.04.08 00:02:51 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{C05C8D5B-2DA6-445E-AA68-225E0B28D788}

[2012.04.07 12:02:24 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{BDE4F3D2-DCD7-47EA-BF5F-6ABD8F8468EB}

[2012.04.07 12:02:11 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{DEF5A259-970D-4555-BB03-F9183665DDF2}

[2012.04.06 14:35:22 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{F601858D-D1B0-4498-9403-61E147844776}

[2012.04.06 14:35:10 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{044DCF49-0339-45FA-A2A5-7AF11423C643}

[2012.04.06 14:33:29 | 000,000,000 | ---D | C] -- C:\Windows\de

[2012.04.06 12:12:13 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{0F8E1860-5186-49E2-A7BE-4AC960FD6B92}

[2012.04.06 12:11:55 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{9EDB7E06-B9CB-4565-80B0-3A4555674749}

[2012.04.05 16:45:26 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{29849DA7-5857-45EE-BBC3-9AAEC33E5B27}

[2012.04.05 16:45:14 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{20F4D7ED-786A-4869-BE8B-8FF486112B86}

[2012.04.05 12:05:28 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{5B6F809F-EEED-40C6-AD5A-4145C48D8B70}

[2012.04.04 18:51:41 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{E6E21A35-CFB2-4D3B-B47B-AD6E8CB7472F}

[2012.04.03 09:55:08 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{853C748A-CD87-4925-A7D7-F8BEE7858D4E}

[2012.04.02 18:22:06 | 000,418,464 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe

[2012.04.02 13:53:05 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{7F7AD920-FF5D-4058-9038-7B81AE21E3E7}

[2012.04.01 19:13:53 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{4B40C212-BFE6-4AA2-8BA0-411D6912EFE8}

[2012.03.31 19:31:52 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{E2B404C0-C27C-4A77-B40E-10F6DCBC985F}

[2012.03.30 19:43:38 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\{B158D144-6F96-4333-82C6-4778D3178B2A}

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.04.29 12:42:44 | 000,017,136 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.04.29 12:42:44 | 000,017,136 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.04.29 12:34:59 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.04.29 12:34:32 | 3220,529,152 | -HS- | M] () -- C:\hiberfil.sys

[2012.04.28 00:59:12 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.04.27 17:18:32 | 001,704,878 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.04.27 17:18:32 | 000,735,654 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.04.27 17:18:32 | 000,683,876 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.04.27 17:18:32 | 000,158,636 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.04.27 17:18:32 | 000,129,762 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.04.27 12:46:42 | 000,251,344 | ---- | M] () -- C:\Users\root\Desktop\cc_20120427_124625.reg

[2012.04.27 12:37:51 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\deployJava1.dll

[2012.04.27 12:37:51 | 000,157,472 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe

[2012.04.27 12:37:51 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe

[2012.04.27 12:37:51 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe

[2012.04.27 12:16:50 | 000,032,760 | ---- | M] () -- C:\Users\root\Desktop\logs-post1.zip

[2012.04.25 23:14:01 | 000,000,600 | ---- | M] () -- C:\Users\root\AppData\Roaming\winscp.rnd

[2012.04.25 14:26:01 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\root\Desktop\OTL.exe

[2012.04.25 03:44:13 | 000,010,001 | ---- | M] () -- C:\Users\root\Desktop\Attach.zip

[2012.04.25 03:33:22 | 000,607,260 | R--- | M] (Swearware) -- C:\Users\root\Desktop\dds.com

[2012.04.25 03:24:06 | 000,000,020 | ---- | M] () -- C:\Users\root\defogger_reenable

[2012.04.25 03:23:35 | 000,050,477 | ---- | M] () -- C:\Users\root\Desktop\Defogger.exe

[2012.04.17 23:50:43 | 000,001,048 | ---- | M] () -- C:\Users\root\Desktop\RollerCoaster Tycoon.lnk

[2012.04.17 11:47:13 | 000,418,464 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe

[2012.04.17 11:47:13 | 000,070,304 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

[2012.04.10 12:19:12 | 001,724,354 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2012.04.04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2012.04.02 20:11:35 | 000,002,095 | ---- | M] () -- C:\Users\Public\Desktop\Nokia Suite.lnk

 
 ========== Files Created - No Company Name ==========

 

[2012.04.27 12:46:32 | 000,251,344 | ---- | C] () -- C:\Users\root\Desktop\cc_20120427_124625.reg

[2012.04.27 12:16:50 | 000,032,760 | ---- | C] () -- C:\Users\root\Desktop\logs-post1.zip

[2012.04.25 03:44:13 | 000,010,001 | ---- | C] () -- C:\Users\root\Desktop\Attach.zip

[2012.04.25 03:24:06 | 000,000,020 | ---- | C] () -- C:\Users\root\defogger_reenable

[2012.04.25 03:23:30 | 000,050,477 | ---- | C] () -- C:\Users\root\Desktop\Defogger.exe

[2012.04.17 23:50:43 | 000,001,048 | ---- | C] () -- C:\Users\root\Desktop\RollerCoaster Tycoon.lnk

[2012.04.16 21:39:19 | 000,045,568 | ---- | C] () -- C:\Windows\UniFish3.exe

[2012.04.02 18:22:07 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.01.23 17:55:55 | 000,000,021 | ---- | C] () -- C:\Windows\SurCode.INI

[2011.11.18 21:19:37 | 000,073,216 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll

[2011.10.18 22:53:58 | 000,004,096 | -H-- | C] () -- C:\Users\root\AppData\Local\keyfile3.drm

[2011.03.15 00:51:29 | 000,000,035 | ---- | C] () -- C:\Windows\A6W.INI

[2011.03.15 00:51:19 | 000,000,116 | ---- | C] () -- C:\Windows\bfe_prog.ini

[2011.01.27 09:43:10 | 000,000,038 | -HS- | C] () -- C:\Windows\camcodec100.ini

[2011.01.27 09:43:10 | 000,000,028 | -HS- | C] () -- C:\Windows\lagarith.ini

[2011.01.08 22:45:19 | 000,000,015 | ---- | C] () -- C:\Windows\SysWow64\gwSettings.dat

[2010.06.16 00:28:54 | 000,002,857 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat

 
 ========== LOP Check ==========

 

[2012.01.17 14:59:27 | 000,000,000 | ---D | M] -- C:\Users\root\AppData\Roaming\Arduino

[2012.02.21 21:15:37 | 000,000,000 | ---D | M] -- C:\Users\root\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant

[2012.04.27 12:44:19 | 000,000,000 | ---D | M] -- C:\Users\root\AppData\Roaming\DAEMON Tools Lite

[2012.04.29 12:37:04 | 000,000,000 | ---D | M] -- C:\Users\root\AppData\Roaming\Dropbox

[2012.03.25 23:52:29 | 000,000,000 | ---D | M] -- C:\Users\root\AppData\Roaming\IrfanView

[2010.01.08 00:52:57 | 000,000,000 | ---D | M] -- C:\Users\root\AppData\Roaming\Jürgen Treml

[2012.04.21 15:13:29 | 000,000,000 | ---D | M] -- C:\Users\root\AppData\Roaming\MediaMonkey

[2011.05.08 00:12:18 | 000,000,000 | ---D | M] -- C:\Users\root\AppData\Roaming\Mobile Atlas Creator

[2010.09.17 00:33:04 | 000,000,000 | ---D | M] -- C:\Users\root\AppData\Roaming\Need for Speed World

[2012.04.13 00:36:45 | 000,000,000 | ---D | M] -- C:\Users\root\AppData\Roaming\Nokia

[2011.04.21 01:36:53 | 000,000,000 | ---D | M] -- C:\Users\root\AppData\Roaming\Nokia Ovi Suite

[2011.11.11 16:33:21 | 000,000,000 | ---D | M] -- C:\Users\root\AppData\Roaming\Nokia Suite

[2012.01.23 17:55:55 | 000,000,000 | ---D | M] -- C:\Users\root\AppData\Roaming\PACE Anti-Piracy

[2011.01.04 20:33:55 | 000,000,000 | ---D | M] -- C:\Users\root\AppData\Roaming\PC Suite

[2012.01.22 18:16:25 | 000,000,000 | ---D | M] -- C:\Users\root\AppData\Roaming\SoundSpectrum

[2011.02.18 21:01:25 | 000,000,000 | ---D | M] -- C:\Users\root\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1

[2011.11.18 21:18:07 | 000,000,000 | ---D | M] -- C:\Users\root\AppData\Roaming\Stereoscopic Player

[2011.10.25 21:08:25 | 000,000,000 | ---D | M] -- C:\Users\root\AppData\Roaming\TeamViewer

[2010.01.07 05:23:27 | 000,000,000 | ---D | M] -- C:\Users\root\AppData\Roaming\Tunngle

[2012.03.28 11:14:40 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 
 

< End of report >

Code:

OTL Extras logfile created on: 29.04.2012 12:42:25 - Run 2

OTL by OldTimer - Version 3.2.42.0     Folder = C:\Users\root\Desktop

64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7601.17514)

Locale: 00000c07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy

 

4,00 Gb Total Physical Memory | 2,04 Gb Available Physical Memory | 51,10% Memory free

4,19 Gb Paging File | 1,92 Gb Available in Paging File | 45,86% Paging File free

Paging file location(s): c:\pagefile.sys 200 25000 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 199,90 Gb Total Space | 63,17 Gb Free Space | 31,60% Space Free | Partition Type: NTFS

Drive D: | 50,00 Gb Total Space | 20,54 Gb Free Space | 41,08% Space Free | Partition Type: NTFS

Drive E: | 1397,26 Gb Total Space | 172,11 Gb Free Space | 12,32% Space Free | Partition Type: NTFS

Drive F: | 81,51 Gb Total Space | 61,51 Gb Free Space | 75,47% Space Free | Partition Type: NTFS

Drive G: | 3,60 Gb Total Space | 3,60 Gb Free Space | 100,00% Space Free | Partition Type: FAT32

Drive H: | 3,72 Gb Total Space | 3,48 Gb Free Space | 93,45% Space Free | Partition Type: FAT32

Drive M: | 200,00 Gb Total Space | 45,02 Gb Free Space | 22,51% Space Free | Partition Type: NTFS

Drive V: | 300,00 Gb Total Space | 80,35 Gb Free Space | 26,78% Space Free | Partition Type: NTFS

Drive X: | 193,35 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS

 

Computer Name: OKEANOS | User Name: root | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5.1\Bridge.exe "%L" (Adobe Systems, Inc.)

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [MediaMonkey.1Play] -- "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" "%1" (Ventis Media Inc.)

Directory [MediaMonkey.2PlayNext] -- "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" /NEXT "%1" (Ventis Media Inc.)

Directory [MediaMonkey.3Enqueue] -- "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" /ADD "%1" (Ventis Media Inc.)

Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5.1\Bridge.exe "%L" (Adobe Systems, Inc.)

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [MediaMonkey.1Play] -- "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" "%1" (Ventis Media Inc.)

Directory [MediaMonkey.2PlayNext] -- "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" /NEXT "%1" (Ventis Media Inc.)

Directory [MediaMonkey.3Enqueue] -- "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" /ADD "%1" (Ventis Media Inc.)

Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 
 ========== Authorized Applications List ==========

 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack

"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector

"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)

"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"{0F37D969-1260-419E-B308-EF7D29ABDE20}" = Web Deployment Tool

"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant

"{1C7C8AAF-A16D-32E8-89E5-F6D165DE0BCE}" = Microsoft Visual C++ 2010  x64 Runtime - 10.0.40219

"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64

"{32508A23-C9EA-4D29-83CA-97A42A13701E}" = Microsoft Sync Framework Services v1.0 (x64)

"{34BD24DF-3B6F-8661-D4F0-0EBCACA2C834}" = ccc-utility64

"{3C983A67-DFB2-3D3D-AD9E-CA1A5A09FD18}" = Microsoft Visual Studio 2010 Express Prerequisites x64 - DEU

"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64

"{4B0748C5-2E63-B954-8C3F-71918C599800}" = WMV9/VC-1 Video Playback

"{4D668D4F-FAA2-4726-834C-31F4614F312E}" = MSVC80_x64_v2

"{53D7A054-4598-4947-A159-E8FCC77720AB}" = Microsoft Sync Framework Runtime v1.0 (x64)

"{59996900-0E6C-45B7-8C39-C64CB98462E4}" = Microsoft Web Platform Installer 2.0

"{680EDA59-9266-44B4-949E-0C24F65DFF82}" = Microsoft_VC100_CRT_SP1_x64

"{68660049-8D48-427C-9FF7-139D8340CDC0}" = MSVC80_x64

"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64

"{8E16BB50-E49A-3647-BD4D-4D150DCCBFAE}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU

"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended

"{8FCBB6DA-069C-8D08-DD99-F0881B9EECC3}" = AMD Drag and Drop Transcoding

"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64

"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting

"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64

"{AB071C8B-873C-459F-ACA9-9EBE03C3E89B}" = MSVC90_x64

"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)

"{B25BFFC9-FF51-44F2-9E46-4D93849C836F}" = SyncToy 2.0 (x64)

"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053

"{C214301F-F5D7-36D9-B3A2-1467C5586495}" = Microsoft Help Viewer 1.1 Language Pack - DEU

"{C3600AE6-93A0-3DB7-B7AA-45BD58F133B5}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64)

"{C3EAE456-7E7A-451F-80EF-F34C7A13C558}" = Microsoft SQL Server Compact 3.5 SP2 x64 DEU

"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64

"{CACBDC26-D504-49ED-3FEC-0CDDB3700240}" = ATI Catalyst Install Manager

"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware

"{DD7327D2-EC4B-4BA7-9A58-4EF457F2E9F9}" = ActivePerl 5.12.2 Build 1203 (64-bit)

"{E5748D30-7E6D-3A8E-BFE6-C1D02C6DDABB}" = Microsoft Help Viewer 1.1

"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile

"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit

"CCleaner" = CCleaner

"E8A6D621B6D3FC5D43C68C549D959DE76EEF5D84" = Windows-Treiberpaket - Nokia Modem  (06/01/2009 4.1)

"F779F5541ABD99C95C03B0FD5E3C058B22DA0FF7" = Windows-Treiberpaket - Nokia Modem  (06/01/2009 7.01.0.3)

"FCEC33AD40CEA5E0FC4CEE6E42041A0DA189652D" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)

"MatlabR2009b" = MATLAB R2009b

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended

"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack

"Microsoft Help Viewer 1.1" = Microsoft Help Viewer 1.1

"Microsoft Help Viewer 1.1 Language Pack - DEU" = Microsoft Help Viewer 1.1 Language Pack - DEU

"Microsoft Visual Studio 2010 Tools for Office Runtime (x64)" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64)

"Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU" = Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU

"WinRAR archiver" = WinRAR

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator

"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

"{0125D081-30D0-4A97-82A8-C28D444B6256}" = Microsoft SQL Server Compact 3.5 SP2 DEU

"{024521CF-C07E-4F8E-8481-0D75695E03AF}" = PxMergeModule

"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86

"{0497EAED-70DA-4BBE-BEB3-AF77FD8788EA}" = Adobe Premiere Pro CS5.5

"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3

"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting

"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86

"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer

"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86

"{1803A630-3C38-4D2B-9B9A-0CB37243539C}" = Microsoft ASP.NET MVC 2

"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin

"{19B98EFB-9493-4651-96DD-A6768A5024E3}_is1" = DfontSplitter 0.3.1

"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger

"{1D58229F-C505-45CA-8223-F35F3A34B963}" = Adobe Version Cue CS3 Server

"{1DE1B0F3-5897-4C66-BA18-F8A9E95FAE5C}" = ccc-core-static

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions

"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86

"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31

"{27B6D024-FD7E-4A88-BC17-5AFBE33EC072}" = Microsoft F# Runtime for Silverlight 4

"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3

"{2CE77981-14DE-4773-8106-27C9C964720C}" = Microsoft ASP.NET MVC 2 - VWD Express 2010 Tools - DEU

"{2F8B731A-5F2D-3EA8-8B25-C3E5E43F4BDB}" = Microsoft Visual C++  Compilers 2010 Standard - enu - x86

"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery

"{3521BDBD-D453-5D9F-AA55-44B75D214629}" = Adobe Community Help

"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack

"{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729

"{3D39E775-DDDA-4327-B747-0BDC5F191331}" = Nokia PC Suite

"{411E0CC3-587A-468C-B461-95FAFD05E4DE}" = Adobe InDesign CS3

"{4393DE35-AD67-4F37-95E4-30F06EA0FDB2}" = Adobe Creative Suite 3 Design Premium

"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4AA5B8A5-BEEF-4AD8-B11D-4443A042EA4F}" = Adobe Dreamweaver CS3

"{4AA68A73-DB9C-439D-9481-981C82BD008B}" = Nokia Connectivity Cable Driver

"{4D481F91-44BA-F0FE-CD07-8B3429A2A821}" = Catalyst Control Center Graphics Previews Common

"{4D568C38-0552-4CDD-A643-01FAFA2957EF}" = Nokia Software Updater

"{4E33D05D-76CF-5D3C-4D5D-7727530FA161}" = Adobe Content Viewer

"{531E1936-95AC-4F7D-8071-BBE9502C670B}" = Stereoscopic Player

"{543A0462-62A8-59CA-8EA7-B2173DA96DAC}" = CCC Help English

"{5449FB4F-1802-4D5B-A6D8-087DB1142147}" = Realtek HDMI Audio Driver for ATI

"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3

"{5518E08A-2053-4A3E-85B2-F912D4666C9F}" = Adobe Setup

"{558358E5-E4F3-4374-BA1D-26FF39EF87D9}" = Microsoft Silverlight Tools for Visual Studio 2010

"{5809A31C-32FB-35CA-E1D2-0B898119E15F}" = Catalyst Control Center InstallProxy

"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync

"{587178E7-B1DF-494E-9838-FA4DD36E873C}" = ASUSUpdate

"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth

"{5AB7D739-1735-3A9E-BE73-C43507CB4E6F}" = Microsoft Visual Studio 2010 Service Pack 1

"{5BDFAB82-060E-438B-AB4F-A2331B2294C0}" = Microsoft ASP.NET MVC 2 - VWD Express 2010 Tools

"{5D9ED403-94DE-3BA0-B1D6-71F4BDA412E6}" = Microsoft Visual C++ 2010  x86 Runtime - 10.0.40219

"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053

"{5FD88490-011C-4DF1-B886-F298D955171B}" = MySQL Connector Net 5.2.5

"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM

"{616C6F39-4CE1-3434-A665-2F6A04C09A7F}" = Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools

"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86

"{638AA518-6A32-33CC-B88F-BCD20B2DCF2E}" = Microsoft Visual Web Developer 2010 Express - DEU

"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE

"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin

"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All

"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729

"{6B708481-748A-4EB4-97C1-CD386244FF77}" = Adobe MotionPicture Color Files

"{6BBAA81D-6A7E-43AD-8889-2F002DCAAFDD}" = AHV content for Acrobat and Flash

"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2

"{6F868980-FF49-011B-2C95-409F199B9C19}" = Catalyst Control Center Graphics Previews Vista

"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK

"{73B5D990-04EA-4751-B10F-5534770B91F2}" = Adobe Color EU Recommended Settings

"{76387E5D-852F-4F86-9928-0781C60C51EC}" = FSX Google Earth Tracker

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{7B2CC3DF-64FA-44AE-8F57-B0F915147E4F}_is1" = Need For Speed™ World

"{7D606567-5047-451A-B49E-29FCB6012B4E}" = Microsoft Flight Simulator X: Acceleration

"{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3

"{803910CC-3A39-45E3-A594-0D5512A60A86}" = Microsoft Silverlight 4 SDK - Deutsch

"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable

"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform

"{857CC5F0-040E-1016-A173-D55ADD80C260}" = Adobe InDesign CS5.5

"{85DF6786-66AA-42EE-8616-AE456B07BD99}" = Microsoft Flight Simulator SimConnect Client v10.0.61242.0

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8C640345-AF96-4ABA-A697-97D2A0B8C6DB}" = Adobe Flash CS3

"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3

"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT

"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support

"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system

"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In

"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3

"{91110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003

"{91F54E1D-804A-46D8-A56C-53EA9C4B3177}" = Microsoft Silverlight 3 SDK - Deutsch

"{92D1CEBC-7C72-4ECF-BFC6-C131EF3FE6A7}" = Nokia Suite

"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86

"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker

"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting

"{969E11AA-8F3A-F162-1A5A-0965E216B6CE}" = Adobe Download Assistant

"{96F9B265-1367-4E1A-B8B9-F8530EF3AA62}" = Add or Remove Adobe Premiere Pro CS5

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3

"{A2AA4204-C05A-4013-888A-AD153139297F}" = PC Connectivity Solution

"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps

"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific

"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5

"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common

"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5

"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings

"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.0) - Deutsch

"{ACE28263-76A4-4BF5-B6F4-8BD719595969}" = Microsoft SQL Server Database Publishing Wizard 1.4

"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86

"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie

"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0

"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy

"{B671CBFD-4109-4D35-9252-3062D3CCB7B2}" = Adobe SING CS3

"{B6C2D454-38CA-464F-B552-E47F8AE9B637}" = Nokia Symbian3 SDK v0.9_2 (C:\Nokia\devices\Nokia_Symbian3_SDK_v0.9_2)

"{B6D38690-755E-4F40-A35A-23F8BC2B86AC}" = Microsoft_VC90_MFCLOC_x86

"{B73CFB12-C814-4638-AFFD-7E3AAFAF0B4E}" = Adobe BridgeTalk Plugin CS3

"{B7E38540-E355-3503-AFD7-635B2F2F76E1}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974

"{B93DCF58-AA57-41EC-8D69-B05C66C6312D}_is1" = v2011.build.44

"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3

"{BC4F8E84-5E29-49EC-B4E7-E6F9CB50986C}" = Adobe Flash Player 9 ActiveX

"{BCEDD813-269C-4D8F-A4BA-01FDC66254D3}" = Adobe Flash Video Encoder

"{BE5F3842-8309-4754-92D5-83E02E6077A3}" = Adobe Extension Manager CS3

"{C28DD992-5B7B-D195-6841-4EC57DF512BD}" = Adobe Story

"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common

"{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2

"{C5BD220A-EFE8-48A5-B70E-9503D535FACE}" = Adobe WAS CS3

"{C668416A-9213-4058-B7F2-01A42D85559D}" = Microsoft SQL Server System CLR Types

"{C8D7A672-F697-4572-AC62-C856053A8DBC}" = Adobe Illustrator CS3

"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform

"{CFCB8616-A5D1-4281-80E8-389F685BFAE2}" = Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 DEU

"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack

"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client

"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86

"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files

"{D3C605D8-3A5E-4BAD-965D-2C61441BF2AC}" = Adobe Photoshop CS3

"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform

"{D81641E8-ABF1-3D07-803B-60E8FC619368}" = Microsoft Visual C# 2010 Express - DEU

"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86

"{D9E6001A-5DC3-4620-AF7A-80B6CD48645D}" = WCF RIA Services V1.0 SP1

"{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}" = Adobe Color Common Settings

"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings

"{DDA34038-89BD-4804-B0B8-DC48D5DFB463}" = Catalyst Control Center - Branding

"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player

"{DEEB5FE3-40F5-3C5B-8F85-5306EF3C08F4}" = Microsoft Visual C++ 2010 Express - DEU

"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10

"{E3B64CC5-C011-40C0-92BC-7316CD5E5688}" = Microsoft_VC100_CRT_SP1_x86

"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker

"{E4E9CBC9-1CF5-48E3-AF6F-1AB44A856346}" = Microsoft ASP.NET MVC 2 - DEU

"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger

"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3

"{E9089B6A-1FDE-47F3-8D29-175F5B7A0722}" = Microsoft SQL Server 2008 R2 Management Objects

"{EA7B3CC4-366D-4CF6-8350-FD7A7034116E}" = Adobe InDesign CS3 Icon Handler

"{EF32F291-8B08-43EF-8BAA-58B9F8C9540F}" = aerosoft's - Lukla X - Mount Everest

"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F232C87C-6E92-4775-8210-DFE90B7777D9}" = CyberLink PowerDVD 11

"{F535B2CF-C9BB-4162-B03A-02D6971F32CC}" = Microsoft Flight Simulator X

"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials

"{FD60FCEB-234F-4D1E-8E80-DA0DA166B0F7}" = Nokia Symbian3 SDK v0.9

"{FE0646A7-19D0-41B4-A2BB-2C35D644270D}" = Windows Live OneCare safety scanner

"{FF29A7E2-FF40-4D07-B7E4-2093DE59E10A}" = Adobe Color NA Extra Settings

"5513-1208-7298-9440" = JDownloader 0.9

"Adobe AIR" = Adobe AIR

"Adobe Shockwave Player" = Adobe Shockwave Player 11.6

"Adobe_061850775b1c6d22bf2a145678e05e0" = Adobe Creative Suite 3 Design Premium hinzufügen oder entfernen

"AMIP" = AMIP (remove only)

"AMIPConfigurator" = AMIPConfigurator (remove only)

"ANA 2.52 32-Bit für Windows 95 und NT 4.0" = ANA 2.52 32-Bit für Windows 95 und NT 4.0

"Avira AntiVir Desktop" = Avira Free Antivirus

"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help

"com.adobe.AdobeStory.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Story

"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player

"com.adobe.dmp.contentviewer" = Adobe Content Viewer

"com.adobe.downloadassistant.AdobeDownloadAssistant" = Adobe Download Assistant

"CSL Arm Toolchain (arm-symbianelf)_is1" = CSL ARM Toolchain (arm-symbianelf) 2005-Q1C

"DivX Setup.divx.com" = DivX-Setup

"EVEREST Ultimate Edition_is1" = EVEREST Ultimate Edition v5.02

"ffdshow_is1" = ffdshow v1.1.3892 [2011-06-20]

"FlightSim_{7D606567-5047-451A-B49E-29FCB6012B4E}" = Microsoft Flight Simulator X: Acceleration

"G-Force" = G-Force

"InstallShield_{F232C87C-6E92-4775-8210-DFE90B7777D9}" = CyberLink PowerDVD 11

"InstallShield_{F535B2CF-C9BB-4162-B03A-02D6971F32CC}" = Microsoft Flight Simulator X

"IrfanView" = IrfanView (remove only)

"LinuxLive USB Creator" = LinuxLive USB Creator

"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400

"MediaMonkey_is1" = MediaMonkey 4.0

"Microsoft Visual C# 2010 Express - DEU" = Microsoft Visual C# 2010 Express - DEU

"Microsoft Visual C++ 2010 Express - DEU" = Microsoft Visual C++ 2010 Express - DEU

"Microsoft Visual Studio 2010 Service Pack 1" = Microsoft Visual Studio 2010 Service Pack 1

"Microsoft Visual Web Developer 2010 Express - DEU" = Microsoft Visual Web Developer 2010 Express - DEU

"Mozilla Firefox 12.0 (x86 de)" = Mozilla Firefox 12.0 (x86 de)

"MozillaMaintenanceService" = Mozilla Maintenance Service

"Nmap" = Nmap 5.21

"Nokia PC Suite" = Nokia PC Suite

"Nokia Suite" = Nokia Suite

"NSS" = NSS (remove only)

"OpenAL" = OpenAL

"OpenVPN" = OpenVPN 2.2.0

"Regelungstechnik" = Regelungstechnik

"RollerCoaster Tycoon Setup" = Roll

"RTMshadow_{7D606567-5047-451A-B49E-29FCB6012B4E}" = Flight Simulator X

"SP1shadow_{7D606567-5047-451A-B49E-29FCB6012B4E}" = Flight Simulator X Service Pack 1

"SpeedFan" = SpeedFan (remove only)

"SUPER ©" = SUPER © Version 2010.bld.37 (Jan 2, 2010)

"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2

"TeamViewer 6" = TeamViewer 6

"TileProxy" = The TileProxy Project for Microsoft FSX/2004/2002

"Tunngle beta_is1" = Tunngle beta

"vis_MojoMaster.dllWinamp" = Mojo Master Winamp Visualizer for Winamp (remove only)

"VLC media player" = VLC media player 2.0.1

"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner

"WinLiveSuite" = Windows Live Essentials

"WinPcapInst" = WinPcap 4.1.1

"winscp3_is1" = WinSCP 4.3.6

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"Dropbox" = Dropbox

"Qt SDK" = Qt SDK

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 29.04.2012 06:37:04 | Computer Name = Okeanos | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 29.04.2012 06:37:04 | Computer Name = Okeanos | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 29.04.2012 06:37:04 | Computer Name = Okeanos | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 29.04.2012 06:37:04 | Computer Name = Okeanos | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 29.04.2012 06:37:04 | Computer Name = Okeanos | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 29.04.2012 06:37:04 | Computer Name = Okeanos | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 29.04.2012 06:37:04 | Computer Name = Okeanos | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 29.04.2012 06:37:04 | Computer Name = Okeanos | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 29.04.2012 06:37:04 | Computer Name = Okeanos | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 29.04.2012 06:38:45 | Computer Name = Okeanos | Source = SideBySide | ID = 16842832

Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Program Files

 (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe". Fehler in  Manifest- oder

 Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche Komponentenversion

 steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.  In Konflikt

 stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente

 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

[ System Events ]

Error - 27.04.2012 06:50:45 | Computer Name = Okeanos | Source = Service Control Manager | ID = 7009

Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst

 Windows Search erreicht.

 

Error - 27.04.2012 06:50:45 | Computer Name = Okeanos | Source = Service Control Manager | ID = 7000

Description = Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht

 gestartet:   %%1053

 

Error - 27.04.2012 06:50:50 | Computer Name = Okeanos | Source = Service Control Manager | ID = 7009

Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst

 Windows Search erreicht.

 

Error - 27.04.2012 06:50:50 | Computer Name = Okeanos | Source = Service Control Manager | ID = 7000

Description = Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht

 gestartet:   %%1053

 

Error - 27.04.2012 06:50:51 | Computer Name = Okeanos | Source = Service Control Manager | ID = 7009

Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst

 Windows Search erreicht.

 

Error - 27.04.2012 06:50:51 | Computer Name = Okeanos | Source = Service Control Manager | ID = 7000

Description = Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht

 gestartet:   %%1053

 

Error - 27.04.2012 10:30:40 | Computer Name = Okeanos | Source = volsnap | ID = 393252

Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher

 nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

 

Error - 27.04.2012 11:17:03 | Computer Name = Okeanos | Source = Disk | ID = 262155

Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.

 

Error - 27.04.2012 11:17:04 | Computer Name = Okeanos | Source = Disk | ID = 262155

Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.

 

Error - 27.04.2012 11:17:05 | Computer Name = Okeanos | Source = Disk | ID = 262155

Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.

 

 

< End of report >

Können die gefundenen Trojaner für einen Keylogger o.ä. verantwortlich sein? Gibt es Anzeichen, dass mein System davon infiziert ist oder "schlummerten" die nur in den exe Dateien?

Ich habe mittlerweile meinen GMX-Account wieder frei geschaltet (ca. 5 € fürs Telefonat :dummguck: ) und mich nur von der Linux Testkiste aus eingeloggt. Zum konstruktiver arbeiten sowie Filme schauen etc. brauch ich aber Win 7 ...