Trojaner-Board - jet another: mystart.incredibar.com

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - jet another: mystart.incredibar.com - Windows 7 64bit (https://www.trojaner-board.de/119137-jet-another-mystart-incredibar-com-windows-7-64bit.html)

jet another: mystart.incredibar.com - Windows 7 64bit

Hallo zusammen,

scheinbar bin ich nicht der einzige der sich die incredibar eingefangen hat.
Ich vermute durch ein update des PDFCreators. Also vermeintlich seriös...

Ich hatte versucht allein klar zu kommen.
- Incredibar deinstalliert
- In Firefox Startseite und newtab-Seite auf about:home geändert.
- incredibar Einträge aus der prefs.js gelöscht

Newtab ist nach Neustart wieder mystart.incredibar.com
Also habe ich da wohl etwas übersehen.

Defrogger und OTL sind abgearbeitet.

Danke im voraus.

Extra.txt wurde wohl nicht abgelegt.

OTL.txt anbei.

Code:

OTL logfile created on: 10.07.2012 23:14:22 - Run 3

OTL by OldTimer - Version 3.2.53.1     Folder = C:\Users\X.XXXXXX\Desktop\trojaner-board

64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

4,00 Gb Total Physical Memory | 2,47 Gb Available Physical Memory | 61,69% Memory free

7,99 Gb Paging File | 6,34 Gb Available in Paging File | 79,33% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 199,90 Gb Total Space | 28,52 Gb Free Space | 14,27% Space Free | Partition Type: NTFS

Drive D: | 98,09 Gb Total Space | 34,05 Gb Free Space | 34,72% Space Free | Partition Type: NTFS

 

Computer Name: XPS1530 | User Name: X.XXXXXX | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.07.10 00:08:00 | 000,050,477 | ---- | M] () -- C:\Users\X.XXXXXX\Desktop\trojaner-board\Defogger.exe

PRC - [2012.07.07 06:59:00 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\X.XXXXXX\Desktop\trojaner-board\OTL.exe

PRC - [2012.07.06 00:52:32 | 000,935,008 | ---- | M] () -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe

PRC - [2012.07.04 17:25:54 | 005,160,568 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2012\avgidsagent.exe

PRC - [2012.07.02 12:33:28 | 002,673,064 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe

PRC - [2012.06.27 09:25:06 | 001,326,176 | ---- | M] (Secunia) -- C:\Program Files (x86)\Secunia\PSI\psia.exe

PRC - [2012.06.27 09:25:04 | 000,681,056 | ---- | M] (Secunia) -- C:\Program Files (x86)\Secunia\PSI\sua.exe

PRC - [2012.06.27 09:25:04 | 000,572,000 | ---- | M] (Secunia) -- C:\Program Files (x86)\Secunia\PSI\psi_tray.exe

PRC - [2012.06.19 17:32:30 | 003,048,136 | ---- | M] (Skype Technologies S.A.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe

PRC - [2012.05.30 03:18:06 | 000,021,432 | ---- | M] () -- C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

PRC - [2012.05.30 03:17:54 | 003,521,464 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe

PRC - [2012.04.05 05:12:34 | 002,587,008 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2012\avgtray.exe

PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

PRC - [2012.03.01 02:02:00 | 002,348,352 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

PRC - [2012.02.29 14:26:46 | 000,382,272 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

PRC - [2012.02.14 04:53:38 | 000,193,288 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe

PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2011.10.21 16:23:42 | 000,196,176 | ---- | M] (Microsoft Corporation.) -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE

PRC - [2011.10.13 18:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE

PRC - [2010.11.23 18:49:24 | 001,540,096 | ---- | M] (Nokia) -- C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer.exe

PRC - [2009.09.19 09:59:16 | 000,984,048 | ---- | M] () -- C:\Program Files (x86)\GnuPT\WPT\WinPT.exe

PRC - [2009.07.20 05:00:00 | 000,077,824 | ---- | M] () -- C:\Programme\Logitech\SetPoint\x86\SetPoint32.exe

PRC - [2009.07.01 18:54:04 | 000,013,600 | ---- | M] (Broadcom Corporation.) -- C:\Programme\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe

PRC - [2007.07.24 19:02:44 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe

PRC - [2007.07.24 19:02:42 | 000,174,616 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe

PRC - [2007.05.09 18:01:00 | 000,036,864 | ---- | M] (Creative Technology Ltd.) -- C:\Windows\OEM02Mon.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2012.07.10 00:08:00 | 000,050,477 | ---- | M] () -- C:\Users\X.XXXXXX\Desktop\trojaner-board\Defogger.exe

MOD - [2012.06.17 21:00:55 | 018,019,840 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\d239f585ee55f833dbe21e897e1265ac\PresentationFramework.ni.dll

MOD - [2012.06.17 21:00:17 | 011,522,048 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\b7de318e9fd1ef519ca6c1f3b5dba8e0\PresentationCore.ni.dll

MOD - [2012.06.17 21:00:08 | 013,198,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\00a4922fbf869a79c043b665035516b6\System.Windows.Forms.ni.dll

MOD - [2012.06.17 21:00:00 | 003,881,984 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\a6e37a05b8d0cedbc5c3ea266ae3fc31\WindowsBase.ni.dll

MOD - [2012.06.17 20:59:55 | 001,666,048 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\4230ed1c7990e4ee8352baf67a2a85fa\System.Drawing.ni.dll

MOD - [2012.06.04 21:51:38 | 000,115,137 | ---- | M] () -- C:\Users\X.XXXXXX\AppData\Local\Temp\26b4a1dd-e07b-48af-be4e-9642b273284b\CliSecureRT.dll

MOD - [2012.05.30 03:18:06 | 000,021,432 | ---- | M] () -- C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

MOD - [2012.05.13 09:15:52 | 001,218,560 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\d0e1cdaff8f9055187f8e7b52c060dff\System.Management.ni.dll

MOD - [2012.05.13 09:13:43 | 000,762,880 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\31fab24c51c0cfe8b8115f24545f169f\System.Runtime.Remoting.ni.dll

MOD - [2012.05.13 09:13:31 | 001,782,272 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\b68bee05c7e518172982cc92059c3315\System.Xaml.ni.dll

MOD - [2012.05.13 09:08:22 | 000,595,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\608d29d7cc89f3a9a195c91354561915\PresentationFramework.Aero.ni.dll

MOD - [2012.05.13 09:04:31 | 000,982,528 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\a84262e1224189f93e10cd3c403a9527\System.Configuration.ni.dll

MOD - [2012.05.13 09:04:27 | 007,069,184 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\09bd2126bba2ab4f29ed52afde1470d7\System.Core.ni.dll

MOD - [2012.05.13 09:04:19 | 005,617,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\9abe44a0f82070ead5f1256683a4d25a\System.Xml.ni.dll

MOD - [2012.05.13 09:04:13 | 009,092,096 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\a6be120e49f895ef6b00e9918402395b\System.ni.dll

MOD - [2012.05.13 09:04:05 | 014,414,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\c1af4ec9a36f671617a8ecaec00373f4\mscorlib.ni.dll

MOD - [2009.09.19 09:59:16 | 000,984,048 | ---- | M] () -- C:\Program Files (x86)\GnuPT\WPT\WinPT.exe

MOD - [2009.09.19 09:56:00 | 000,425,525 | ---- | M] () -- C:\Program Files (x86)\GnuPT\WPT\PTD.dll

MOD - [2009.07.20 05:00:00 | 000,077,824 | ---- | M] () -- C:\Programme\Logitech\SetPoint\x86\SetPoint32.exe

MOD - [2008.11.29 15:00:08 | 000,042,496 | ---- | M] () -- C:\Program Files (x86)\GnuPT\WPT\libgpg-error-0.dll

MOD - [2007.03.10 09:20:00 | 000,098,304 | ---- | M] () -- C:\Program Files (x86)\GnuPT\WPT\libgpgme-11.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - [2010.11.20 15:25:18 | 000,049,664 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\snmp.exe -- (SNMP)

SRV:64bit: - [2009.07.14 03:41:10 | 000,035,328 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\iprip.dll -- (iprip)

SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)

SRV:64bit: - [2007.09.20 15:31:22 | 000,086,016 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_295b5b4710f6d77b\AESTSr64.exe -- (AESTFilters)

SRV - [2012.07.06 00:52:32 | 000,935,008 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe -- (vToolbarUpdater11.2.0)

SRV - [2012.07.04 17:25:54 | 005,160,568 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2012\avgidsagent.exe -- (AVGIDSAgent)

SRV - [2012.07.02 12:33:28 | 002,673,064 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe -- (TeamViewer7)

SRV - [2012.06.27 09:25:06 | 001,326,176 | ---- | M] (Secunia) [Auto | Running] -- C:\Program Files (x86)\Secunia\PSI\psia.exe -- (Secunia PSI Agent)

SRV - [2012.06.27 09:25:04 | 000,681,056 | ---- | M] (Secunia) [Auto | Running] -- C:\Program Files (x86)\Secunia\PSI\sua.exe -- (Secunia Update Agent)

SRV - [2012.06.23 14:08:16 | 000,257,224 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2012.06.19 17:32:30 | 003,048,136 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)

SRV - [2012.06.17 20:42:14 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2012.03.01 02:02:00 | 002,348,352 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)

SRV - [2012.02.29 14:26:46 | 000,382,272 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)

SRV - [2012.02.15 14:30:18 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2012.02.14 04:53:38 | 000,193,288 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe -- (avgwd)

SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2011.10.21 16:23:42 | 000,196,176 | ---- | M] (Microsoft Corporation.) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)

SRV - [2011.10.13 18:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (BBUpdate)

SRV - [2010.12.08 15:31:06 | 000,628,736 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)

SRV - [2010.11.20 14:17:42 | 000,047,616 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\snmp.exe -- (SNMP)

SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2009.11.13 00:04:55 | 000,655,624 | ---- | M] (Acresso Software Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

SRV - [2009.11.13 00:02:51 | 001,038,088 | ---- | M] (Acresso Software Inc.) [Disabled | Stopped] -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe -- (FLEXnet Licensing Service 64)

SRV - [2009.07.20 13:36:14 | 000,160,784 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)

SRV - [2009.07.01 18:54:02 | 000,864,032 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Programme\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)

SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

SRV - [2009.06.09 16:11:14 | 000,155,648 | ---- | M] (Stardock Corporation) [On_Demand | Stopped] -- C:\Programme\Dell\DellDock\DockLogin.exe -- (DockLoginService)

SRV - [2007.09.20 15:31:22 | 000,086,016 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_295b5b4710f6d77b\AESTSr64.exe -- (AESTFilters)

SRV - [2007.07.24 19:02:44 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)

SRV - [2007.05.31 18:11:54 | 000,443,784 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)

SRV - [2007.05.31 18:11:46 | 000,225,672 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2012.05.21 04:09:00 | 000,203,320 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudmdm.sys -- (ssudmdm) SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.)

DRV:64bit: - [2012.05.21 04:09:00 | 000,099,384 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudbus.sys -- (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.)

DRV:64bit: - [2012.04.19 04:50:26 | 000,028,480 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\avgidsha.sys -- (AVGIDSHA)

DRV:64bit: - [2012.04.04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)

DRV:64bit: - [2012.03.19 05:17:26 | 000,383,808 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtdia.sys -- (Avgtdia)

DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2012.02.22 05:25:32 | 000,289,872 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgldx64.sys -- (Avgldx64)

DRV:64bit: - [2012.02.03 12:29:44 | 000,029,576 | ---- | M] (Kawai Musical Instruments Mfg. Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Kp362.sys -- (kwusbmidi)

DRV:64bit: - [2012.01.31 04:46:48 | 000,036,944 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgrkx64.sys -- (Avgrkx64)

DRV:64bit: - [2011.12.23 13:32:14 | 000,047,696 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\avgmfx64.sys -- (Avgmfx64)

DRV:64bit: - [2011.12.23 13:32:04 | 000,029,776 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\avgidsfiltera.sys -- (AVGIDSFilter)

DRV:64bit: - [2011.12.23 13:31:58 | 000,124,496 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\avgidsdrivera.sys -- (AVGIDSDriver)

DRV:64bit: - [2011.12.16 16:20:10 | 000,017,976 | ---- | M] (Secunia) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\psi_mf.sys -- (PSI)

DRV:64bit: - [2011.12.06 23:50:24 | 000,053,312 | ---- | M] (microOLAP Technologies LTD) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pssdk42.sys -- (PSSDK42)

DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2011.01.19 03:28:56 | 008,080,384 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NETwNs64.sys -- (NETwNs64) ___ Intel(R)

DRV:64bit: - [2011.01.15 18:21:04 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone)

DRV:64bit: - [2010.11.20 15:34:02 | 000,360,832 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vpcvmm.sys -- (vpcvmm)

DRV:64bit: - [2010.11.20 15:34:02 | 000,194,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vpchbus.sys -- (vpcbus)

DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010.11.20 13:35:32 | 000,095,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vpcusb.sys -- (vpcusb)

DRV:64bit: - [2010.11.20 13:35:20 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vpcnfltr.sys -- (vpcnfltr)

DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2010.11.20 11:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)

DRV:64bit: - [2010.10.07 05:11:52 | 007,533,568 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETwLv64.sys -- (NETwLv64)     Intel(R)

DRV:64bit: - [2010.08.12 06:07:46 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)

DRV:64bit: - [2010.07.30 15:18:04 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser_lowerfltjx64.sys -- (UsbserFilt)

DRV:64bit: - [2010.07.30 15:18:02 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys -- (upperdev)

DRV:64bit: - [2010.07.30 15:18:00 | 000,026,624 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ccdcmbox64.sys -- (nmwcdc)

DRV:64bit: - [2010.07.30 15:17:56 | 000,019,456 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ccdcmbx64.sys -- (nmwcd)

DRV:64bit: - [2010.02.18 19:13:24 | 000,086,584 | ---- | M] (Adobe Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\adfs.sys -- (adfs)

DRV:64bit: - [2009.10.29 01:20:20 | 000,030,208 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\AegisP.sys -- (AegisP) AEGIS Protocol (IEEE 802.1x)

DRV:64bit: - [2009.09.28 10:22:00 | 000,395,264 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7)

DRV:64bit: - [2009.07.24 02:11:08 | 000,063,504 | ---- | M] (UPEK Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tcusb.sys -- (TcUsb)

DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.07.14 02:09:50 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usb8023x.sys -- (usb_rndisx)

DRV:64bit: - [2009.07.13 17:36:22 | 000,253,488 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Apfiltr.sys -- (ApfiltrService)

DRV:64bit: - [2009.07.02 22:26:34 | 000,132,648 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt)

DRV:64bit: - [2009.07.02 22:26:34 | 000,098,344 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio)

DRV:64bit: - [2009.07.02 22:26:34 | 000,035,104 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap)

DRV:64bit: - [2009.07.02 22:26:34 | 000,021,160 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid)

DRV:64bit: - [2009.06.17 18:54:30 | 000,057,872 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt)

DRV:64bit: - [2009.06.17 18:54:22 | 000,055,312 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)

DRV:64bit: - [2009.06.17 18:54:14 | 000,013,328 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidEqd.sys -- (LHidEqd)

DRV:64bit: - [2009.06.17 18:54:06 | 000,074,256 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LEqdUsb.sys -- (LEqdUsb)

DRV:64bit: - [2009.06.10 22:35:28 | 005,434,368 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netw5v64.sys -- (netw5v64) Intel(R)

DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2008.08.28 12:44:42 | 000,025,600 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys -- (pccsmcfd)

DRV:64bit: - [2008.02.21 11:24:20 | 000,062,976 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rimmpx64.sys -- (rimmptsk)

DRV:64bit: - [2008.02.15 19:27:02 | 000,393,216 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA)

DRV:64bit: - [2007.10.10 18:03:00 | 000,266,624 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\OEM02Dev.sys -- (OEM02Dev)

DRV:64bit: - [2007.09.26 09:19:00 | 003,196,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NETw4v64.sys -- (NETw4v64) Intel(R)

DRV:64bit: - [2007.07.27 20:45:52 | 000,057,856 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rixdpx64.sys -- (rismxdp)

DRV:64bit: - [2007.07.26 21:33:54 | 000,055,296 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rimspx64.sys -- (rimsptsk)

DRV:64bit: - [2007.04.25 13:18:12 | 000,537,368 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)

DRV:64bit: - [2007.03.05 11:55:48 | 000,012,288 | ---- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\OEM02Vfx.sys -- (OEM02Vfx)

DRV - [2010.02.18 19:13:24 | 000,086,584 | ---- | M] (Adobe Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysWow64\drivers\adfs.sys -- (adfs)

DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\S-1-5-21-4135602353-3033774650-4224148770-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKU\S-1-5-21-4135602353-3033774650-4224148770-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKU\S-1-5-21-4135602353-3033774650-4224148770-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 3A 4A 2E 16 8D 9E CB 01  [binary data]

IE - HKU\S-1-5-21-4135602353-3033774650-4224148770-1001\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\S-1-5-21-4135602353-3033774650-4224148770-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKU\S-1-5-21-4135602353-3033774650-4224148770-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "MyStart Search"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "about:home"

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3

FF - prefs.js..extensions.enabledItems: {ba243cb0-b824-4a26-9418-73ee795d9b9d}:1.0.4

FF - prefs.js..extensions.enabledItems: en-GB@dictionaries.addons.mozilla.org:1.19.1

FF - prefs.js..extensions.enabledItems: checkplaces@andyhalford.com:2.4.5

FF - prefs.js..extensions.enabledItems: {45d8ff86-d909-11db-9705-005056c00008}:1.0.5

FF - prefs.js..extensions.enabledItems: de-DE@dictionaries.addons.mozilla.org:2.0.2

FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.8

FF - prefs.js..extensions.enabledItems: {c50ca3c4-5656-43c2-a061-13e717f73fc8}:4.0.1

FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.4.51

FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.1

FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.071303000004

FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.0.9.9

FF - prefs.js..extensions.enabledItems: maps@ovi.com:2.3.37.3

FF - prefs.js..extensions.enabledItems: {B17C1C5A-04B1-11DB-9804-B622A1EF5492}:1.2.1

FF - prefs.js..extensions.enabledItems: {340c2bbc-ce74-4362-90b5-7c26312808ef}:1.7

FF - prefs.js..extensions.enabledItems: {f65bf62a-5ffc-4317-9612-38907a779583}:1.3.0

FF - prefs.js..extensions.enabledItems: de_DE@dicts.j3e.de:20101229

FF - prefs.js..extensions.enabledItems: ietab@ip.cn:1.95.20100933

FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906

FF - prefs.js..extensions.enabledItems: firefox@ghostery.com:2.5.2

FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:2.0.2

FF - prefs.js..extensions.enabledItems: bkmrksync@nokia.com:1.0.0.736

FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.2.8.4

FF - prefs.js..extensions.enabledItems: contacts@labs.mozilla.com:0.3.2

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24

FF - prefs.js..extensions.enabledItems: {29852C08-1E91-4889-A6BF-C77F91D6A8F3}:1.8.71

FF - prefs.js..network.proxy.http: "192.168.10.1"

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_262.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_33: C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)

FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll ()

FF - HKLM\Software\MozillaPlugins\@canon.com/MycameraPlugin: C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll File not found

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_33: C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player:  File not found

FF - HKCU\Software\MozillaPlugins\@sun.com/npsopluginmi;version=1.0: C:\Program Files (x86)\LibreOffice 3\program File not found

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\bkmrksync@nokia.com: C:\Program Files (x86)\Nokia\Nokia PC Suite 7\bkmrksync\

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files (x86)\AVG\AVG2012\Firefox4\ [2012.07.06 00:52:49 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{F53C93F1-07D5-430c-86D4-C9531B27DFAF}: C:\Program Files (x86)\AVG\AVG2012\Firefox\DoNotTrack\ [2012.07.03 20:08:09 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.06.17 20:42:15 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.06.23 14:02:34 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.05.22 00:09:09 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2012.05.22 00:09:09 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2011.02.06 13:56:52 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\avgthb@avg.com: C:\Program Files (x86)\AVG\AVG2012\Thunderbird\ [2012.01.04 10:51:33 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.06.17 20:42:15 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.06.23 14:02:34 | 000,000,000 | ---D | M]

 

[2009.12.10 20:35:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\X.XXXXXX\AppData\Roaming\mozilla\Extensions

[2009.12.10 20:35:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\X.XXXXXX\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}

[2012.07.05 23:08:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\X.XXXXXX\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\extensions

[2011.12.29 12:56:47 | 000,000,000 | ---D | M] ("infoRSS") -- C:\Users\X.XXXXXX\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\extensions\{f65bf62a-5ffc-4317-9612-38907a779583}

[2012.05.23 00:13:04 | 000,000,000 | ---D | M] ("FRITZ!Box AddOn") -- C:\Users\X.XXXXXX\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\extensions\fb_add_on@avm.de

[2011.12.13 18:10:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\X.XXXXXX\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\ReadItLater\RIL_assets\extensions.libreoffice.org

[2011.12.13 18:10:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\X.XXXXXX\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\ReadItLater\RIL_assets\extensions.libreoffice.org\++resource++jquery-ui-themes

[2011.12.13 18:10:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\X.XXXXXX\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\ReadItLater\RIL_assets\extensions.libreoffice.org\extension-center

[2011.12.13 18:10:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\X.XXXXXX\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\ReadItLater\RIL_assets\extensions.libreoffice.org\portal_css

[2011.12.13 18:10:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\X.XXXXXX\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\ReadItLater\RIL_assets\extensions.libreoffice.org\portal_kss

[2011.12.13 18:10:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\X.XXXXXX\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\ReadItLater\RIL_assets\extensions.libreoffice.org\extension-center\addpics

[2011.12.13 18:10:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\X.XXXXXX\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\ReadItLater\RIL_assets\extensions.libreoffice.org\extension-center\chemistry

[2011.12.13 18:10:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\X.XXXXXX\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\ReadItLater\RIL_assets\extensions.libreoffice.org\extension-center\copy-only-visible-cells

[2011.12.13 18:10:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\X.XXXXXX\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\ReadItLater\RIL_assets\extensions.libreoffice.org\extension-center\export-as-images

[2011.12.13 18:10:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\X.XXXXXX\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\ReadItLater\RIL_assets\extensions.libreoffice.org\extension-center\fixed-values-for-calc

[2011.12.13 18:10:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\X.XXXXXX\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\ReadItLater\RIL_assets\extensions.libreoffice.org\extension-center\gallery-of-danger-signs

[2011.12.13 18:10:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\X.XXXXXX\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\ReadItLater\RIL_assets\extensions.libreoffice.org\extension-center\improved-trend-lines

[2011.12.13 18:10:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\X.XXXXXX\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\ReadItLater\RIL_assets\extensions.libreoffice.org\extension-center\magenta-lorem-ipsum-generator

[2011.12.13 18:10:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\X.XXXXXX\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\ReadItLater\RIL_assets\extensions.libreoffice.org\extension-center\texmaths-1

[2011.12.05 21:17:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\X.XXXXXX\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\ReadItLater\RIL_assets\images.netzwelt.de\extensions

[2009.09.27 09:06:17 | 000,000,885 | ---- | M] () -- C:\Users\X.XXXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\yjff8k19.default\searchplugins\00de-community.xml

[2012.07.05 23:09:31 | 000,000,853 | ---- | M] () -- C:\Users\X.XXXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\yjff8k19.default\searchplugins\11-suche.xml

[2009.09.27 22:16:29 | 000,002,172 | ---- | M] () -- C:\Users\X.XXXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\yjff8k19.default\searchplugins\bing.xml

[2009.09.27 22:16:52 | 000,002,758 | ---- | M] () -- C:\Users\X.XXXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\yjff8k19.default\searchplugins\cuil.xml

[2012.07.05 23:09:32 | 000,002,209 | ---- | M] () -- C:\Users\X.XXXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\yjff8k19.default\searchplugins\englische-ergebnisse.xml

[2012.07.03 20:23:33 | 000,001,485 | ---- | M] () -- C:\Users\X.XXXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\yjff8k19.default\searchplugins\geo-ip-tool.xml

[2012.07.05 23:09:31 | 000,010,506 | ---- | M] () -- C:\Users\X.XXXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\yjff8k19.default\searchplugins\gmx-suche.xml

[2012.07.05 23:09:31 | 000,002,368 | ---- | M] () -- C:\Users\X.XXXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\yjff8k19.default\searchplugins\lastminute.xml

[2009.09.27 22:17:39 | 000,001,699 | ---- | M] () -- C:\Users\X.XXXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\yjff8k19.default\searchplugins\metager.xml

[2012.07.05 23:09:30 | 000,005,489 | ---- | M] () -- C:\Users\X.XXXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\yjff8k19.default\searchplugins\webde-suche.xml

[2010.08.15 00:59:33 | 000,001,196 | ---- | M] () -- C:\Users\X.XXXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\yjff8k19.default\searchplugins\winamp-search.xml

[2012.06.23 14:02:36 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions

[2012.07.07 12:39:39 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

[2012.06.23 14:02:37 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}

[2012.07.03 20:08:09 | 000,000,000 | ---D | M] (AVG Do Not Track) -- C:\PROGRAM FILES (X86)\AVG\AVG2012\FIREFOX\DONOTTRACK

[2011.12.29 12:56:39 | 000,060,243 | ---- | M] () (No name found) -- C:\USERS\X.XXXXXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YJFF8K19.DEFAULT\EXTENSIONS\{45D8FF86-D909-11DB-9705-005056C00008}.XPI

[2012.07.05 23:08:24 | 000,525,327 | ---- | M] () (No name found) -- C:\USERS\X.XXXXXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YJFF8K19.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI

[2011.12.29 12:56:40 | 000,089,442 | ---- | M] () (No name found) -- C:\USERS\X.XXXXXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YJFF8K19.DEFAULT\EXTENSIONS\{B17C1C5A-04B1-11DB-9804-B622A1EF5492}.XPI

[2012.02.21 22:59:39 | 000,709,293 | ---- | M] () (No name found) -- C:\USERS\X.XXXXXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YJFF8K19.DEFAULT\EXTENSIONS\{DDC359D1-844A-42A7-9AA1-88A850A938A8}.XPI

[2011.12.29 12:56:38 | 000,079,365 | ---- | M] () (No name found) -- C:\USERS\X.XXXXXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YJFF8K19.DEFAULT\EXTENSIONS\ANTICONTAINER@DOWNTHEMALL.NET.XPI

[2012.01.08 19:00:55 | 000,195,719 | ---- | M] () (No name found) -- C:\USERS\X.XXXXXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YJFF8K19.DEFAULT\EXTENSIONS\ISREADITLATER@IDEASHOWER.COM.XPI

[2012.07.05 23:08:24 | 000,578,962 | ---- | M] () (No name found) -- C:\USERS\X.XXXXXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YJFF8K19.DEFAULT\EXTENSIONS\TOOLBAR@WEB.DE.XPI

[2012.06.17 20:42:15 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2011.09.23 03:52:52 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2011.09.23 03:46:24 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2011.09.23 03:52:52 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2011.09.23 03:52:52 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2011.09.23 03:52:52 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2011.09.23 03:52:52 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2:64bit: - BHO: (AVG Do Not Track) - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files (x86)\AVG\AVG2012\avgdtiea.dll (AVG Technologies CZ, s.r.o.)

O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll File not found

O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll (AVG Technologies CZ, s.r.o.)

O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (AVG Do Not Track) - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files (x86)\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.)

O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll File not found

O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll File not found

O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll File not found

O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.)

O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\Windows\SysNative\LogiLDA.dll (Logitech, Inc.)

O4:64bit: - HKLM..\Run: [PSQLLauncher] C:\Program Files\Protector Suite\launcher.exe (UPEK Inc.)

O4:64bit: - HKLM..\Run: [SigmatelSysTrayApp] C:\Programme\SigmaTel\C-Major Audio\WDM\sttray64.exe (IDT, Inc.)

O4:64bit: - HKLM..\Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation)

O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)

O4 - HKLM..\Run: [DELL Webcam Manager] C:\Program Files (x86)\Dell\Dell Webcam Manager\DellWMgr.exe (Creative Technology Ltd.)

O4 - HKLM..\Run: [dellsupportcenter] "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter File not found

O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()

O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [NokiaMServer] C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer.exe (Nokia)

O4 - HKLM..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe (Creative Technology Ltd.)

O4 - HKLM..\Run: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe" File not found

O4 - HKLM..\Run: [WinampAgent] "C:\Program Files (x86)\Winamp\winampa.exe" File not found

O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-21-4135602353-3033774650-4224148770-1001..\Run: []  File not found

O4 - HKU\S-1-5-21-4135602353-3033774650-4224148770-1001..\Run: [KiesHelper] C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe /s File not found

O4 - HKU\S-1-5-21-4135602353-3033774650-4224148770-1001..\Run: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()

O4 - HKU\S-1-5-21-4135602353-3033774650-4224148770-1028..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-21-4135602353-3033774650-4224148770-1028..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - Startup: C:\Users\X.XXXXXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Privacy Tray.lnk = C:\Program Files (x86)\GnuPT\WPT\WinPT.exe ()

O4 - Startup: C:\Users\X.XXXXXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Task-Manager.lnk = C:\Windows\SysWOW64\taskmgr.exe (Microsoft Corporation)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun =  [binary data]

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun =  [binary data]

O7 - HKU\S-1-5-21-4135602353-3033774650-4224148770-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-4135602353-3033774650-4224148770-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2

O7 - HKU\S-1-5-21-4135602353-3033774650-4224148770-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1

O8:64bit: - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()

O8:64bit: - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()

O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9:64bit: - Extra Button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files (x86)\AVG\AVG2012\avgdtiea.dll (AVG Technologies CZ, s.r.o.)

O9:64bit: - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)

O9 - Extra Button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files (x86)\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.)

O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra Button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra 'Tools' menuitem : Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O15 - HKU\S-1-5-21-4135602353-3033774650-4224148770-1001\..Trusted Domains: fritz.box ([]* in Lokales Intranet)

O15 - HKU\S-1-5-21-4135602353-3033774650-4224148770-1001\..Trusted Ranges: Range1 ([*] in Lokales Intranet)

O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)

O16:64bit: - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)

O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)

O16 - DPF: {362C56AA-6E4F-40C7-A0B5-85501DBDAD77} hxxp://i.dell.com/images/global/js/scanner/SysProExe.cab (Scanner.SysScanner)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)

O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2C25B7AC-AA05-4999-A68C-4FBEE180C8BB}: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{502004D4-5173-41D5-97CB-7F0A05316CAD}: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5AEE75FC-1A02-476A-9CB2-7CA63376DEEB}: NameServer = 0.0.0.0

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{68B8DA9B-BF22-418A-81D0-8AD5B0AF66DD}: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FE5D6DC5-D44C-41E5-9028-F4B2466E4408}: DhcpNameServer = 192.168.42.129

O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgppa.dll (AVG Technologies CZ, s.r.o.)

O18:64bit: - Protocol\Handler\livecall - No CLSID value found

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found

O18:64bit: - Protocol\Handler\msnim - No CLSID value found

O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found

O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found

O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: GinaDLL - (vrlogon.dll) -  File not found

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Programme\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)

O20:64bit: - Winlogon\Notify\psfus: DllName - (C:\Program Files\Protector Suite\psqlpwd.dll) - C:\Programme\Protector Suite\psqlpwd.dll (UPEK Inc.)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O34 - HKLM BootExecute: (C:\PROGRA~2\AVG\AVG2012\avgrsa.exe /sync /restart)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.07.10 22:33:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET

[2012.07.10 00:10:07 | 000,000,000 | ---D | C] -- C:\Users\X.XXXXXX\Desktop\trojaner-board

[2012.07.09 23:45:41 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG Secure Search

[2012.07.09 23:29:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator

[2012.07.09 23:29:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PDFCreator

[2012.07.07 07:37:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Emsisoft Anti-Malware

[2012.07.07 07:37:28 | 000,000,000 | ---D | C] -- C:\Users\X.XXXXXX\Documents\Anti-Malware

[2012.07.06 00:52:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\AVG Secure Search

[2012.07.06 00:44:58 | 000,000,000 | ---D | C] -- C:\Users\X.XXXXXX\Documents\Canon Utilities

[2012.07.05 23:48:35 | 000,095,232 | ---- | C] (pdfforge GbR) -- C:\Windows\SysNative\pdfcmon.dll

[2012.07.05 23:47:52 | 000,000,000 | ---D | C] -- C:\Users\X.XXXXXX\AppData\Roaming\Malwarebytes

[2012.07.05 23:47:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.07.05 23:47:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.07.05 23:47:29 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2012.07.05 23:47:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2012.07.05 22:03:06 | 000,000,000 | ---D | C] -- C:\Users\X.XXXXXX\temp

[2012.07.05 22:02:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TeamViewer

[2012.07.05 21:41:07 | 000,000,000 | ---D | C] -- C:\Users\X.XXXXXX\AppData\Local\3CX VoIP Phone

[2012.07.05 21:40:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\3CXPhone

[2012.07.05 21:40:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\3CX Phone

[2012.07.04 00:33:55 | 000,000,000 | ---D | C] -- C:\Users\X.XXXXXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Miranda IM

[2012.07.03 20:08:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG

[2012.07.02 23:59:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Premium

[2012.07.02 23:57:55 | 000,000,000 | ---D | C] -- C:\ProgramData\InstallMate

[2012.06.23 18:21:11 | 000,000,000 | ---D | C] -- C:\Users\X.XXXXXX\AppData\Local\Macromedia

[4 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.07.10 23:50:57 | 000,013,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.07.10 23:50:57 | 000,013,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.07.10 23:41:03 | 000,001,114 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012.07.10 23:11:01 | 000,000,000 | ---- | M] () -- C:\Users\X.XXXXXX\defogger_reenable

[2012.07.10 23:10:11 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012.07.10 23:02:01 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.07.10 22:58:51 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.07.10 22:58:35 | 3219,701,760 | -HS- | M] () -- C:\hiberfil.sys

[2012.07.10 21:28:56 | 002,966,256 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2012.07.10 20:17:43 | 101,338,631 | ---- | M] () -- C:\Windows\SysNative\drivers\AVG\incavi.avm

[2012.07.09 23:29:53 | 000,001,164 | ---- | M] () -- C:\Users\Public\Desktop\PDFArchitect.lnk

[2012.07.09 23:29:53 | 000,000,995 | ---- | M] () -- C:\Users\Public\Desktop\PDFCreator.lnk

[2012.07.09 22:20:25 | 000,023,552 | ---- | M] () -- C:\Users\X.XXXXXX\AppData\Local\WebpageIcons.db

[2012.07.07 11:55:25 | 000,000,033 | ---- | M] () -- C:\ProgramData\{081230F8-EA50-42A9-983C-D22ABC2EED3B}.ini

[2012.07.06 00:52:49 | 000,000,941 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2012.lnk

[2012.07.05 23:47:42 | 000,001,073 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.07.05 23:16:37 | 000,064,939 | ---- | M] () -- C:\Users\X.XXXXXX\Documents\ts3_clientui-win64-1329301801-2012-07-05 23_16_35.365848.dmp

[2012.07.05 22:02:50 | 000,001,126 | ---- | M] () -- C:\Users\Public\Desktop\TeamViewer 7.lnk

[2012.07.04 00:33:56 | 000,000,990 | ---- | M] () -- C:\Users\X.XXXXXX\Desktop\Miranda IM.lnk

[2012.07.02 23:59:03 | 000,000,454 | ---- | M] () -- C:\user.js

[2012.07.01 07:50:59 | 000,001,070 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk

[2012.06.15 06:51:42 | 000,095,232 | ---- | M] (pdfforge GbR) -- C:\Windows\SysNative\pdfcmon.dll

[2012.06.13 19:27:17 | 001,301,408 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.06.13 19:27:17 | 000,818,282 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.06.13 19:27:17 | 000,340,854 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.06.13 19:27:17 | 000,295,150 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.06.13 19:27:17 | 000,005,726 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.06.11 18:38:58 | 000,158,387 | ---- | M] () -- C:\Windows\SysNative\drivers\AVG\iavichjg.avm

[4 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.07.10 23:11:01 | 000,000,000 | ---- | C] () -- C:\Users\X.XXXXXX\defogger_reenable

[2012.07.09 23:29:53 | 000,001,164 | ---- | C] () -- C:\Users\Public\Desktop\PDFArchitect.lnk

[2012.07.09 23:29:53 | 000,000,995 | ---- | C] () -- C:\Users\Public\Desktop\PDFCreator.lnk

[2012.07.07 11:55:25 | 000,000,033 | ---- | C] () -- C:\ProgramData\{081230F8-EA50-42A9-983C-D22ABC2EED3B}.ini

[2012.07.05 23:47:42 | 000,001,073 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.07.05 23:16:35 | 000,064,939 | ---- | C] () -- C:\Users\X.XXXXXX\Documents\ts3_clientui-win64-1329301801-2012-07-05 23_16_35.365848.dmp

[2012.07.05 22:02:50 | 000,001,138 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 7.lnk

[2012.07.05 22:02:50 | 000,001,126 | ---- | C] () -- C:\Users\Public\Desktop\TeamViewer 7.lnk

[2012.07.04 00:33:56 | 000,000,990 | ---- | C] () -- C:\Users\X.XXXXXX\Desktop\Miranda IM.lnk

[2012.07.02 23:59:02 | 000,000,454 | ---- | C] () -- C:\user.js

[2012.07.01 07:50:59 | 000,001,070 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk

[2012.07.01 07:50:58 | 000,001,033 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk

[2012.06.17 22:16:25 | 000,002,075 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop Lightroom 4.1 64-Bit.lnk

[2012.06.10 17:55:53 | 000,000,680 | RHS- | C] () -- C:\Users\X.XXXXXX\ntuser.pol

[2012.03.11 18:01:14 | 000,000,247 | ---- | C] () -- C:\Users\X.XXXXXX\FFDSettings.bin

[2012.02.29 14:26:56 | 000,416,064 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe

[2011.12.29 11:19:10 | 000,066,856 | ---- | C] () -- C:\Windows\SysWow64\SynTPEnhPS.dll

[2011.12.23 21:58:28 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe

[2011.12.23 21:58:24 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll

[2011.12.23 21:58:24 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll

[2011.12.23 21:58:24 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll

[2011.12.23 21:58:24 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll

[2011.05.06 17:36:28 | 000,007,278 | ---- | C] () -- C:\Users\X.XXXXXX\AppData\Roaming\.freeciv-client-rc-2.2

[2010.03.29 22:53:27 | 000,008,192 | ---- | C] () -- C:\Users\X.XXXXXX\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010.03.27 13:23:59 | 000,000,096 | ---- | C] () -- C:\Users\X.XXXXXX\AppData\Local\fusioncache.dat

[2010.02.24 20:50:22 | 000,023,552 | ---- | C] () -- C:\Users\X.XXXXXX\AppData\Local\WebpageIcons.db

[2009.11.13 00:07:37 | 000,000,590 | ---- | C] () -- C:\Users\X.XXXXXX\AppData\Roaming\wklnhst.dat

[2009.11.10 23:41:47 | 000,017,760 | ---- | C] () -- C:\Users\X.XXXXXX\AppData\Roaming\UserTile.png

 
 ========== LOP Check ==========

 

[2011.05.06 20:27:56 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\.freeciv

[2010.03.03 23:16:08 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\Autodesk

[2012.01.01 14:53:39 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\AVG

[2012.01.04 10:53:35 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\AVG2012

[2012.07.07 07:27:37 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\Azureus

[2010.03.22 23:03:24 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\BonkEnc

[2012.03.23 23:36:54 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\Canneverbe Limited

[2011.07.04 01:00:44 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\Canon

[2010.12.04 20:26:24 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\EAC

[2012.07.07 07:27:31 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\FileZilla

[2012.05.21 07:50:37 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\foobar2000

[2009.11.01 22:16:56 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\FreeCDRipper

[2011.12.20 03:10:51 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\FRITZ!

[2011.12.20 01:33:45 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\FRITZ!fax für FRITZ!Box

[2012.07.08 09:11:28 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\gnupg

[2010.07.08 20:26:45 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\gtk-2.0

[2010.04.06 23:04:14 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\ID3 renamer

[2010.11.07 18:57:08 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\IrfanView

[2012.03.23 22:43:01 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\JAM Software

[2012.03.11 18:47:57 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\KastorAllVideoDownloader

[2010.07.08 19:56:49 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\korAccount

[2009.10.29 01:25:54 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\Leadertech

[2011.02.08 23:25:22 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\LibreOffice

[2012.07.07 07:27:31 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\Miranda

[2011.02.15 23:10:54 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\mresreg

[2010.08.07 13:45:42 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\Nokia

[2010.03.29 22:52:20 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\Nokia Ovi Suite

[2010.07.01 21:28:41 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\Notepad++

[2009.10.29 22:59:34 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\PC Suite

[2011.05.27 18:08:57 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\PCDr

[2009.11.02 22:59:20 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\Protector Suite

[2010.12.01 23:24:21 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\Raptr

[2012.01.25 21:42:16 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\Samsung

[2011.12.07 00:30:20 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\Shareaza

[2011.12.29 11:36:29 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\Synaptics

[2012.07.05 22:47:54 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\TeamViewer

[2012.06.04 23:22:51 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\Temp

[2010.06.29 22:22:56 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\Template

[2012.06.28 00:57:47 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\Thunderbird

[2009.10.29 01:06:49 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\TMP

[2012.07.05 23:17:29 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\TS3Client

[2010.03.27 13:27:51 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\Turbine

[2010.10.01 23:18:12 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1

[2012.01.21 02:27:18 | 000,000,000 | ---D | M] -- C:\Users\X.XXXXXX\AppData\Roaming\WinBatch

[2012.04.01 10:57:59 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 16 bytes -> C:\Users\X.XXXXXX\Downloads:Shareaza.GUID

@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:0B4227B4

 

< End of report >

Moin,

kann man OTL per Kommando anweisen die Extras.txt anzulegen?

Danke.

adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Search.
Nach Ende des Suchlaufs öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

Hallo,

ich war ein paar Tage unterwegs.

Hier der Scan von AdwCleaner.

Code:

# AdwCleaner v1.702 - Logfile created 07/17/2012 at 20:07:35

# Updated 13/07/2012 by Xplode

# Operating system : Windows 7 Professional Service Pack 1 (64 bits)

# User : x.xxxxxx - XPS1530

# Running from : C:\Users\x.xxxxxx\Desktop\adwcleaner.exe

# Option [Search]
 
 

***** [Services] *****
 
 

***** [Files / Folders] *****
 

Folder Found : C:\ProgramData\AVG Secure Search

Folder Found : C:\ProgramData\InstallMate

Folder Found : C:\Program Files (x86)\Common Files\AVG Secure Search
 

***** [Registry] *****
 
 

***** [Registre - GUID] *****
 
 

***** [Internet Browsers] *****
 

-\\ Internet Explorer v9.0.8112.16421
 

[OK] Registry is clean.
 

-\\ Mozilla Firefox v13.0.1 (de)
 

Profile name : default 

File : C:\Users\x.xxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\yjff8k19.default\prefs.js
 

Found : user_pref("browser.search.defaultenginename", "MyStart Search");
 

*************************
 

AdwCleaner[R1].txt - [927 octets] - [17/07/2012 20:07:35]
 

########## EOF - C:\AdwCleaner[R1].txt - [1054 octets] ##########

Da hier noch eine Antwort ausblieb, hatte ich mich selbst beschäftigt.
War auch eine Art Stressbewältigung.

Nach mehreren Anläufen die incredibar Einträge aus der prefs.js manuell zu löschen scheine ich zumindest den Aufruf erwischt zu haben.
Der Kern vom Mistding wird aber noch da sein.

Bei der incredibar war der Schlüssel 6R8xO4BuQ6, der hat mich zu den angehängten Zeilen user_pref("{336D0C35... geführt.
Nach löschen aller Einträge mit incredibar, 6R8xO4BuQ6 und user_pref("{336D0C35 nervt die Werbung vorerst nicht mehr.

Die pref.js vom 2012-07-05 und von heute liegen bei.

adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen

Schließe alle offenen Programme und Browser.
Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Delete.
Bestätige jeweils mit Ok.
Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

gemacht:

Code:

# AdwCleaner v1.702 - Logfile created 07/18/2012 at 20:40:16

# Updated 13/07/2012 by Xplode

# Operating system : Windows 7 Professional Service Pack 1 (64 bits)

# User : x.xxxxxx - XPS1530

# Running from : C:\Users\x.xxxxxx\Desktop\adwcleaner.exe

# Option [Delete]
 
 

***** [Services] *****
 
 

***** [Files / Folders] *****
 

Folder Deleted : C:\ProgramData\AVG Secure Search

Folder Deleted : C:\ProgramData\InstallMate

Folder Deleted : C:\Program Files (x86)\Common Files\AVG Secure Search
 

***** [Registry] *****
 
 

***** [Registre - GUID] *****
 
 

***** [Internet Browsers] *****
 

-\\ Internet Explorer v9.0.8112.16421
 

[OK] Registry is clean.
 

-\\ Mozilla Firefox v14.0.1 (de)
 

Profile name : default 

File : C:\Users\x.xxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\yjff8k19.default\prefs.js
 

Deleted : user_pref("browser.search.defaultenginename", "MyStart Search");
 

*************************
 

AdwCleaner[R1].txt - [1055 octets] - [17/07/2012 20:07:35]

AdwCleaner[S1].txt - [995 octets] - [18/07/2012 20:40:16]
 

########## EOF - C:\AdwCleaner[S1].txt - [1122 octets] ##########

Prost, :kaffee:

Bitte nunroutinemäßig einen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Die Funde mit Malwarebytes bitte alle entfernen, sodass sie in der Quarantäne von Malwarebytes aufgehoben werden! NICHTS voreilig aus der Quarantäne entfernen!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

Wieder zuhause.

Code:

Malwarebytes Anti-Malware 1.62.0.1300

www.malwarebytes.org
 

Datenbank Version: v2012.08.01.04
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

B.Jensen :: XPS1530 [Administrator]
 

01.08.2012 15:14:19

mbam-log-2012-08-01 (15-14-19).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM | P2P

Deaktivierte Suchlaufeinstellungen: 

Durchsuchte Objekte: 753151

Laufzeit: 3 Stunde(n), 57 Minute(n), 37 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Eset läuft gerade.

Und nun eset

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=a90e51b9e4015f499cbc27e48b3a7dd1

# end=finished

# remove_checked=false

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-08-02 10:27:13

# local_time=2012-08-02 12:27:13 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=1024 16777215 100 0 18227804 18227804 0 0

# compatibility_mode=5893 16776574 100 94 18227675 95521069 0 0

# compatibility_mode=8192 67108863 100 0 167 167 0 0

# scanned=520120

# found=0

# cleaned=0

# scan_time=12014

Hatte vergessen Archive anzuklicken.

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=a90e51b9e4015f499cbc27e48b3a7dd1

# end=finished

# remove_checked=false

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-08-02 10:27:13

# local_time=2012-08-02 12:27:13 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=1024 16777215 100 0 18227804 18227804 0 0

# compatibility_mode=5893 16776574 100 94 18227675 95521069 0 0

# compatibility_mode=8192 67108863 100 0 167 167 0 0

# scanned=520120

# found=0

# cleaned=0

# scan_time=12014

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=a90e51b9e4015f499cbc27e48b3a7dd1

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-08-02 05:37:35

# local_time=2012-08-02 07:37:35 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=1024 16777215 100 0 18247071 18247071 0 0

# compatibility_mode=5893 16776574 100 94 18246942 95540336 0 0

# compatibility_mode=8192 67108863 100 0 19434 19434 0 0

# scanned=520186

# found=5

# cleaned=0

# scan_time=18569

C:\ProgramData\Win7codecs\{1FDFDF6A-AFBD-41F6-82E6-266AF57F12AB}\Win7codecs.msi        Win32/Packed.Autoit.C.Gen application (unable to clean)        00000000000000000000000000000000        I

C:\ProgramData\Win7codecs\{3C32D47E-419E-48B9-8D9F-F9C489A2D299}\Win7codecs.msi        Win32/Packed.Autoit.E.Gen application (unable to clean)        00000000000000000000000000000000        I

C:\Users\All Users\Win7codecs\{1FDFDF6A-AFBD-41F6-82E6-266AF57F12AB}\Win7codecs.msi        Win32/Packed.Autoit.C.Gen application (unable to clean)        00000000000000000000000000000000        I

C:\Users\All Users\Win7codecs\{3C32D47E-419E-48B9-8D9F-F9C489A2D299}\Win7codecs.msi        Win32/Packed.Autoit.E.Gen application (unable to clean)        00000000000000000000000000000000        I

C:\Users\B.Jensen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KMVSTOZS\PDFCreator_Stub_5874[1].exe        Win32/InstallMonetizer.AB application (unable to clean)        00000000000000000000000000000000        I

Hätte da mal drei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?
3.) Das incredizeugs bzw die Toolbar/Weiterleitung ist nun weg?

Zitat:

Zitat von cosinus (Beitrag 882130)

Hätte da mal drei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?

Seit meiner Aktion (Eintrag 17.07) nervt die incredibar nicht mehr.
Ich habe damit zwar scheinbar den Aufruf verhindert, aber nichts von der Platte gelöscht.

Habe das jetzt ein paar Tage mit ff und ie probiert.
Nichts auffälliges gesehen.

Zitat:

Zitat von cosinus (Beitrag 882130)

2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

Nichts auffälliges.

Zitat:

Zitat von cosinus (Beitrag 882130)

3.) Das incredizeugs bzw die Toolbar/Weiterleitung ist nun weg?

Wie oben beschrieben, kein Aufruf.
Manuell hatte ich nichts von der Platte gelöscht, in den logs der tools sehe ich auch keinen Treffer.

ciou

Ok, wollte nur sichergehen mit dieser Zusammenfassung, die hilft mir auch immer bei der Vielzahl an den offenen Themen hier sauber zu arbeiten :)

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

ok.

Code:

OTL Extras logfile created on: 15.08.2012 22:08:25 - Run 1

OTL by OldTimer - Version 3.2.57.0     Folder = C:\Users\X.XXXXXX\Desktop

64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

4,00 Gb Total Physical Memory | 2,39 Gb Available Physical Memory | 59,75% Memory free

7,99 Gb Paging File | 6,26 Gb Available in Paging File | 78,36% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 199,90 Gb Total Space | 48,72 Gb Free Space | 24,37% Space Free | Partition Type: NTFS

Drive D: | 98,09 Gb Total Space | 31,58 Gb Free Space | 32,20% Space Free | Partition Type: NTFS

Drive E: | 4,32 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS

Drive F: | 122,41 Mb Total Space | 122,41 Mb Free Space | 100,00% Space Free | Partition Type: FAT

 

Computer Name: XPS1530 | User Name: X.XXXXXX | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.html[@ = ChromeHTML] -- Reg Error: Key error. File not found

.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

 

[HKEY_USERS\S-1-5-21-4135602353-3033774650-4224148770-1001\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

http [open] -- Reg Error: Key error.

https [open] -- Reg Error: Key error.

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [Browse with &IrfanView] -- "C:\Program Files (x86)\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [Digital Photo Professional] -- C:\Program Files (x86)\Canon\Digital Photo Professional\DPPViewer.exe /path "%1" (CANON INC.)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

http [open] -- Reg Error: Key error.

https [open] -- Reg Error: Key error.

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [Browse with &IrfanView] -- "C:\Program Files (x86)\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [Digital Photo Professional] -- C:\Program Files (x86)\Canon\Digital Photo Professional\DPPViewer.exe /path "%1" (CANON INC.)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 
 ========== Authorized Applications List ==========

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{02BF44B7-C471-43CF-966E-0C3346682169}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{0D237997-891F-4003-8875-CF7ABAEFB5E0}" = rport=445 | protocol=6 | dir=out | app=system | 

"{1A2D9634-FCA1-458E-9CF8-75164007B3BA}" = lport=137 | protocol=17 | dir=in | app=system | 

"{1FE2F3E9-27FF-48C9-8B1D-39B0730B85E5}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{2E88DE0E-3AF6-490F-B7F8-A625625CC19A}" = rport=139 | protocol=6 | dir=out | app=system | 

"{36FD48BB-49D8-411B-A747-DE86F156F771}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{375862BA-3916-4137-BD01-599A08D157BF}" = lport=5353 | protocol=6 | dir=in | name=adobe csi cs4 | 

"{42CC4B8C-A191-414B-A23B-E02489EB53CA}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface | 

"{4A4FE00B-DD57-47F3-B786-4A378771A9AB}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 

"{4BB42832-606A-4DB8-9F12-53180601A88F}" = lport=49162 | protocol=6 | dir=in | name=akamai netsession interface | 

"{5BA1D830-A218-45F4-B8C4-2CB1086F8BFC}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface | 

"{64976238-1961-4E48-9924-83136725B93A}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{6E4CBAC0-4EC6-4F05-9AA8-E7FE76A590A2}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{7485721F-096A-4F7E-96F6-F3898B7C8910}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{8668F898-0750-4A8D-837B-F79AC60BCB69}" = rport=137 | protocol=17 | dir=out | app=system | 

"{8733769D-4642-4865-8867-EB22134A4549}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{887DA91F-ED73-4F47-BB5E-1EB7C3124255}" = lport=10243 | protocol=6 | dir=in | app=system | 

"{9AD2C4EF-B8FC-45B3-9989-ECFF6D870230}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 

"{B6AA4C5C-74CF-4D08-8830-1EA0938D53F9}" = rport=10243 | protocol=6 | dir=out | app=system | 

"{D10DC77E-05F3-488B-8540-33A833B6992C}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 

"{D2E5B61A-D0CF-482B-899C-3952AB5C7879}" = rport=138 | protocol=17 | dir=out | app=system | 

"{D6A728C3-D2B3-4E49-A747-7AC14154FEF4}" = lport=138 | protocol=17 | dir=in | app=system | 

"{D928ED12-CE17-49BD-BE06-A8A3FB6A0434}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{DAC2EB63-3A72-480E-8C9D-D881DE87D4FE}" = lport=139 | protocol=6 | dir=in | app=system | 

"{E26BC708-CF0E-4AC2-B5CD-EDA03B9A5BB3}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{E60DC24A-B54B-49F0-B1BD-A36F4EE85598}" = lport=50377 | protocol=6 | dir=in | name=akamai netsession interface | 

"{E6130CF5-F610-40DC-B504-0C8636DB8507}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{E6AE4D87-C6CA-4733-B46E-A537F6645DC1}" = lport=445 | protocol=6 | dir=in | app=system | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{026400AC-D8A1-46DF-AD52-A471B3FA778D}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 

"{02E391E0-A981-4B68-A45F-AE470CB4FA99}" = protocol=17 | dir=in | app=c:\program files (x86)\turbine\ddo unlimited\dndclient.exe | 

"{04373D16-816F-47E8-9E6C-298E093B897B}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{127F0B85-5FD5-41EF-B50F-3E1CC6E0DCEB}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{1338970B-A999-4D5D-B2B8-860455FE65CB}" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 

"{16D381EC-5B25-461E-8144-70BF323BDFED}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 

"{1B7B09A6-D775-4EAD-ADBD-74AD8B428A5B}" = protocol=17 | dir=in | app=c:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe | 

"{1C206A3A-627E-4528-A065-9D14CCCEA8BF}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 

"{26B7FEF9-3F85-4BCE-A651-F5E1B0AAC6C9}" = protocol=17 | dir=in | app=c:\windows\syswow64\muzapp.exe | 

"{2E4DDAE6-F973-4C3A-B9B1-61E7CE6DD0D3}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer.exe | 

"{2F64133C-1A06-446C-A614-C718B9462685}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{323CF96C-E4A5-46E7-8BC5-A54439EC2448}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{3645D245-2B8E-4D65-B276-562A295BE546}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 

"{38450CCD-5564-46ED-A5EE-601B3130D401}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 

"{38633D2F-E3A1-42E6-B91C-E962E94EF64C}" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe | 

"{3988E992-E30A-4BC0-973D-34C3A4598075}" = dir=in | app=c:\program files (x86)\nokia\nokia ovi suite\nokiaovisuite.exe | 

"{3BB4D599-579A-4749-BE60-999C98CC5456}" = protocol=17 | dir=in | app=c:\program files (x86)\gnucash\bin\gnucash-bin.exe | 

"{3C1E48B8-A2B7-4912-91D6-DAAA9B961A1D}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2012\avgdiagex.exe | 

"{3E3F71EF-00D4-40E0-8FB8-DF7C86230EE7}" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe | 

"{4891A0C3-99A3-40DD-BBA5-06E90B817DD4}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 

"{4C489181-136B-45AE-A8C1-5511FC2F6F44}" = protocol=17 | dir=in | app=c:\program files (x86)\soldnersecretwars\game\bin\soeldnersecretwars.exe | 

"{52C547A7-5A36-4B9F-99AE-2DEA10C47EE9}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{56DAE9B4-0F64-44A0-89B9-DBD9481848E6}" = dir=in | app=c:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe | 

"{57230DF4-7484-4595-B094-31F1CB493772}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | 

"{574F350D-12A9-444B-A602-0198239D7CB7}" = protocol=6 | dir=in | app=c:\program files (x86)\turbine\ddo unlimited\dndclient.exe | 

"{58874358-9A68-4A64-AFB2-C7B5BDCAE5E5}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2012\avgmfapx.exe | 

"{5B4EA206-AA5E-45FD-BE2A-5FB29F3B69F9}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{5CB2EBF7-F894-45E9-A3E8-B9B8B47386A2}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer.exe | 

"{608A11DE-0EA7-46CA-867A-9315B28DEF66}" = dir=in | app=c:\program files (x86)\nokia\nokia ovi suite\nokiaovisuite.exe | 

"{63FF6870-464C-472A-9CD8-6241CEF4E791}" = protocol=6 | dir=in | app=c:\program files (x86)\fritz!\frifax32.exe | 

"{64FB26F3-811C-4150-BF06-845177DC7AD3}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 

"{656073B8-85B9-4206-B9EC-48FB8E64387E}" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 

"{66A61F6D-8267-4A77-ACB2-84C8DAAA6DFB}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{68B7B736-9F81-45E8-A3DE-CAAD7A8FE957}" = protocol=6 | dir=in | app=c:\program files (x86)\gnucash\bin\gconfd-2.exe | 

"{6982530D-C84B-4B97-9A26-8DC7D9D2EDC1}" = dir=in | app=c:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe | 

"{6C1468C7-7A1B-494A-AB55-14173CCD7CCF}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 

"{6D8932F8-314E-4EBF-A97A-6E8E45D4AFCF}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 

"{6EDC841F-4639-4C66-80B8-670C2061DA58}" = protocol=17 | dir=in | app=c:\program files (x86)\common files\adobe\cs4servicemanager\cs4servicemanager.exe | 

"{6F6069CF-1060-49BC-A18A-B9BEF047291A}" = protocol=6 | dir=in | app=c:\windows\syswow64\muzapp.exe | 

"{6FBAFA53-1DD0-4C0C-BA58-27E2FD3D018D}" = protocol=6 | dir=in | app=c:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe | 

"{6FFBD746-6135-42FA-A34A-8D15DB619F8F}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{735D9126-99A1-4A13-A9BD-DAC41AD5115F}" = protocol=6 | dir=in | app=c:\program files\teamspeak 3 client\ts3client_win64.exe | 

"{76C0B071-FBD1-47B1-AADF-89849A6D2227}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 

"{77945DC9-2064-4E23-8FBF-43E20844A5BE}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 

"{794804E2-66DE-498F-9B50-5C29448A83C1}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 

"{799653BB-DC4B-4743-8232-7C4BC6F87A38}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{7A74394A-378D-4BBD-BC54-C2F974BB0689}" = dir=in | app=c:\program files (x86)\nokia\nokia ovi suite\nokiaovisuite.exe | 

"{7AB69097-E55F-4FC8-BCD6-B27954113A19}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{7CCA89E2-C508-44D7-B636-17D7EB840A5E}" = protocol=17 | dir=in | app=c:\program files (x86)\soldnersecretwars\portal\jwdcom.exe | 

"{87A160C5-A3AE-4137-82B2-94A4A57CDAB5}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer_service.exe | 

"{8818F559-B9E4-4B27-93C9-D7A75A013135}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2012\avgnsa.exe | 

"{8964D649-D92F-4DDF-92BE-920BF50EA85B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{8BC966DE-CCBF-4DE7-BF31-DD1B4F57D345}" = protocol=17 | dir=in | app=c:\program files (x86)\fritz!\frifax32.exe | 

"{98F6E0AA-91C5-47CB-A90C-FD32EFDCEBF2}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 

"{9CBF207E-032C-4B97-B2B4-39BEC841D56B}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 

"{A130C3F1-187A-4E31-8C44-9C4CFEFB037E}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 

"{A26647EF-4EFB-49E1-B4A3-1803E4F80ECE}" = dir=in | app=c:\program files (x86)\windows live\messenger\wlcsdk.exe | 

"{A8707973-F06A-4F75-822F-1C09DC638DEE}" = dir=in | app=c:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe | 

"{AE8EE92A-C873-4F08-AB87-F30966019E06}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 

"{AFC684EF-4C39-463F-9500-A04D8FBD2D39}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2012\avgemca.exe | 

"{B40F086E-3668-487B-B6DC-96E13C3221F5}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{B9F89067-851A-4404-9D12-111716884DD9}" = protocol=6 | dir=in | app=c:\program files (x86)\soldnersecretwars\portal\jwdcom.exe | 

"{BA3A85C5-A203-49B4-8FBF-E6C6FDFAE7D7}" = protocol=6 | dir=in | app=c:\program files (x86)\soldnersecretwars\game\bin\soeldnersecretwars.exe | 

"{C18EB065-952A-48CD-95DA-E9B4C66ADDC4}" = dir=in | app=c:\program files (x86)\nokia\nokia ovi suite\nokiaovisuite.exe | 

"{C6CD2EB4-D368-4484-A4CE-60DE3C882616}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{C9C3C818-5AEC-4F38-9D43-6C1FE791F22F}" = protocol=6 | dir=in | app=c:\program files (x86)\gnucash\bin\gnucash-bin.exe | 

"{CA523B4C-12F4-47C4-8AC0-6191237407E4}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2012\avgmfapx.exe | 

"{D241988C-94C1-4B2E-86A6-5D51A848C528}" = protocol=6 | dir=in | app=c:\program files (x86)\common files\adobe\cs4servicemanager\cs4servicemanager.exe | 

"{DF45D2FE-7DDB-416F-BC01-37F1C5AE642E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{E0605B2B-79A8-44B5-BE3E-4DDE64FA0561}" = protocol=17 | dir=in | app=c:\program files\teamspeak 3 client\ts3client_win64.exe | 

"{E1F42146-DBCB-4B89-99CA-58E4A442C0C4}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{E28AF501-B107-4FEA-A06D-5FEBE444744D}" = protocol=6 | dir=out | app=system | 

"{E2A5DF3C-0AC8-4228-A5CF-34C2CD2CE328}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2012\avgemca.exe | 

"{E4481BF4-5058-418A-9BB8-AAD7E6C4B547}" = protocol=17 | dir=in | app=c:\program files (x86)\gnucash\bin\gconfd-2.exe | 

"{E4ACFB16-6445-4699-BDD3-A47719968ADC}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 

"{E5F37EA8-B062-4AB3-AD83-E657E9611018}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2012\avgdiagex.exe | 

"{E735E3DA-CBB6-4250-9979-D0EB32C88990}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 

"{E82400CE-7310-479A-9F29-1983E31CDC14}" = dir=in | app=c:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe | 

"{E85AE919-0697-4DA9-BF06-560016C7BF5C}" = dir=in | app=c:\program files (x86)\3cxphone\3cxphone.exe | 

"{EDC04590-B312-4AD3-93DC-DFB556B20693}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer_service.exe | 

"{EE033CF4-35DF-415C-970D-FE4C797E21F7}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 

"{EFB3248E-3045-4A9F-B132-9061D214B30D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{F1AA1547-E16B-4407-9B22-A8B07E29FEAC}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2012\avgnsa.exe | 

"{F5E0368B-67BA-4491-9E49-0BE96AF5F42E}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{FD196540-44E7-4AE0-9E56-584ADC0C042E}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | 

"TCP Query User{0801F6E1-43D0-4E0F-9E0E-C028D5F83AB2}C:\program files (x86)\nokia\nokia software updater\nsu_ui_client.exe" = protocol=6 | dir=in | app=c:\program files (x86)\nokia\nokia software updater\nsu_ui_client.exe | 

"TCP Query User{11821547-774E-4DDB-AE32-181D41CEE100}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 

"TCP Query User{249AB1E5-E2DA-4AC7-87EE-C94007240E0C}F:\zzz_sort\ddi_cb.exe" = protocol=6 | dir=in | app=f:\zzz_sort\ddi_cb.exe | 

"TCP Query User{29B83DDA-7C94-483E-9107-1D069DC5C6FF}C:\program files (x86)\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe | 

"TCP Query User{3AB2103C-0291-450F-A915-8E003A63F51C}C:\program files (x86)\nokia\nokia ovi suite\nokiaovisuite.exe" = protocol=6 | dir=in | app=c:\program files (x86)\nokia\nokia ovi suite\nokiaovisuite.exe | 

"TCP Query User{3E3DA791-596F-4798-BA7D-6757A52AFE86}C:\program files (x86)\miranda im\miranda32.exe" = protocol=6 | dir=in | app=c:\program files (x86)\miranda im\miranda32.exe | 

"TCP Query User{4683C973-58E0-438E-8C3E-E5C00D4D581E}C:\program files (x86)\turbine\ddo unlimited\dndclient.exe" = protocol=6 | dir=in | app=c:\program files (x86)\turbine\ddo unlimited\dndclient.exe | 

"TCP Query User{47A5C3E6-2E65-4D54-95E6-CB6B50380FCA}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe | 

"TCP Query User{6C1E2420-89E0-4D4F-BB02-B57DCEEC59AC}C:\program files (x86)\fritz!\frifax32.exe" = protocol=6 | dir=in | app=c:\program files (x86)\fritz!\frifax32.exe | 

"TCP Query User{71F619F4-3F14-433A-8C62-71036AA99962}C:\apps\emule_flux\emule.exe" = protocol=6 | dir=in | app=c:\apps\emule_flux\emule.exe | 

"TCP Query User{83C3C7AC-CB6A-4C6A-901A-2283206EA91E}C:\program files (x86)\freeciv-2.2.5-gtk2\freeciv-server.exe" = protocol=6 | dir=in | app=c:\program files (x86)\freeciv-2.2.5-gtk2\freeciv-server.exe | 

"TCP Query User{CEB5E63F-9A07-4C80-81AD-848E430C5042}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 

"UDP Query User{147300CC-E551-44C9-BAAD-2C71FE298353}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe | 

"UDP Query User{1C338CB7-DA3A-4151-81C5-46F79D109239}C:\program files (x86)\turbine\ddo unlimited\dndclient.exe" = protocol=17 | dir=in | app=c:\program files (x86)\turbine\ddo unlimited\dndclient.exe | 

"UDP Query User{49556CD0-4FDC-492C-8CF4-C724714730EC}C:\program files (x86)\nokia\nokia software updater\nsu_ui_client.exe" = protocol=17 | dir=in | app=c:\program files (x86)\nokia\nokia software updater\nsu_ui_client.exe | 

"UDP Query User{7C1184E8-B36F-4684-810C-6EE231177BA6}C:\program files (x86)\miranda im\miranda32.exe" = protocol=17 | dir=in | app=c:\program files (x86)\miranda im\miranda32.exe | 

"UDP Query User{861460E7-B901-40DD-9E87-A0B19325B3FC}C:\program files (x86)\nokia\nokia ovi suite\nokiaovisuite.exe" = protocol=17 | dir=in | app=c:\program files (x86)\nokia\nokia ovi suite\nokiaovisuite.exe | 

"UDP Query User{8C2B5601-8E41-4021-BE93-536AD033AE97}C:\program files (x86)\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe | 

"UDP Query User{ADAE01E7-EE99-46D9-BAAC-E6245C814FE5}F:\zzz_sort\ddi_cb.exe" = protocol=17 | dir=in | app=f:\zzz_sort\ddi_cb.exe | 

"UDP Query User{AE40F4FD-822F-4EC2-B934-6AD600E6E667}C:\apps\emule_flux\emule.exe" = protocol=17 | dir=in | app=c:\apps\emule_flux\emule.exe | 

"UDP Query User{E569167D-8DDB-4905-BC9C-2A85000EE31C}C:\program files (x86)\freeciv-2.2.5-gtk2\freeciv-server.exe" = protocol=17 | dir=in | app=c:\program files (x86)\freeciv-2.2.5-gtk2\freeciv-server.exe | 

"UDP Query User{EAE74747-776B-4ED1-9A81-9E3BA8033AC6}C:\program files (x86)\fritz!\frifax32.exe" = protocol=17 | dir=in | app=c:\program files (x86)\fritz!\frifax32.exe | 

"UDP Query User{EC8D9E4D-9703-4E94-993C-90479A25E7D3}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 

"UDP Query User{F19DEF59-D667-499F-A501-80B3664320F4}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0611B3CC-B5DB-4B93-ACE4-97B8F938E6B7}" = 64 Bit HP CIO Components Installer

"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)

"{0C826C5B-B131-423A-A229-C71B3CACCD6A}" = CDDRV_Installer

"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"{1374CC63-B520-4f3f-98E8-E9020BF01CFF}" = Windows XP Mode

"{23170F69-40C1-2702-0465-000001000000}" = 7-Zip 4.65 (x64 edition)

"{26A24AE4-039D-4CA4-87B4-2F86416033FF}" = Java(TM) 6 Update 33 (64-bit)

"{26A24AE4-039D-4CA4-87B4-2F86417005FF}" = Java(TM) 7 Update 5 (64-bit)

"{295CFB7C-A57E-4313-93E7-68E7CE1D0332}" = Adobe WinSoft Linguistics Plugin x64

"{2D74E972-5A85-44DC-9193-8A302BA8C181}" = Photoshop Camera Raw_x64

"{2F01EBAF-CA43-417B-A494-76E753F8200D}" = TouchChip USB Driver 2.18

"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022

"{361A49FA-59B3-49FB-8C3E-08AF3EA5791A}" = Application Verifier (x64)

"{3C8159DD-1890-4625-A5B2-E3D8D78D4486}" = AVG 2012

"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148

"{4D668D4F-FAA2-4726-834C-31F4614F312E}" = MSVC80_x64_v2

"{4FFA2088-8317-3B14-93CD-4C699DB37843}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729

"{5254156F-AA77-499A-B7C1-D5581D44E788}" = Marvell Miniport Driver

"{5563A0F6-CF81-451E-87AD-A50075BCA9B7}" = QuickSet

"{57019733-78E6-43DE-8E6D-55349F0FDE6F}" = inSSIDer 2.0

"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

"{626672CD-BFCF-49A9-AEFE-AB0FED3BFC5B}" = Windows Mobile-Gerätecenter

"{6631325A-9B1B-4EE7-8E64-8CC4A6F10643}" = Adobe Fonts All x64

"{68660049-8D48-427C-9FF7-139D8340CDC0}" = MSVC80_x64

"{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}" = Microsoft Visual C++ 2005 Redistributable (x64)

"{7F2E5C3B-DBDF-469D-AD8D-F686D3B71176}" = Debugging Tools for Windows (x64)

"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570

"{8875A1C0-6308-4790-8CF6-D34E89880052}" = Adobe Linguistics CS4 x64

"{887797BF-37A5-4199-B0C9-0D38D6196E9A}" = Adobe Anchor Service x64 CS4

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8C8D673B-20FB-43E6-BCB7-9B3F78F2E762}" = Adobe Type Support x64 CS4

"{8DAA31EB-6830-4006-A99F-4DF8AB24714F}" = Adobe CSI CS4 x64

"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager

"{90BA8112-80B3-4617-A3C1-BD2771B60F74}" = Adobe CMaps x64 CS4

"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting

"{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}" = WIDCOMM Bluetooth Software

"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver

"{A108BD40-0A8C-4385-8874-74C4B6086CC3}" = AVG 2012

"{A3454894-144A-4D80-B605-C128FE0D7329}" = Adobe Drive CS4 x64

"{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175

"{AB071C8B-873C-459F-ACA9-9EBE03C3E89B}" = MSVC90_x64

"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 296.10

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 296.10

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 296.10

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.0213

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.7.11

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components

"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053

"{C73A3942-84C8-4597-9F9B-EE227DCBA758}" = Dell Dock

"{CB974C3D-D101-4411-8F54-DCDC58DED815}" = Protector Suite 2009

"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones

"{D40172D6-CE2D-4B72-BF5F-26A04A900B7B}" = Adobe Photoshop CS4 (64 Bit)

"{DFFABE78-8173-4E97-9C5C-22FB26192FC5}" = Adobe PDF Library Files x64 CS4

"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148

"{F3F18612-7B5D-4C05-86C9-AB50F6F71727}" = KhalInstallWrapper

"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile

"{F7ADB493-B913-4D61-9A63-DA736C20C3F2}" = Adobe Photoshop Lightroom 4.1 64-bit

"6DA48AFDE796708D5A4C9121A83E7617A63A9A15" = Windows-Treiberpaket - Nokia Modem  (10/07/2010 4.6)

"A9A49C1D75CF72E725210A23AFFF679CBEE4A1E7" = Windows-Treiberpaket - KAWAI USB MIDI (12/20/2011 2.0.7600.16385)

"AVG" = AVG 2012

"CPUID HWMonitor_is1" = CPUID HWMonitor 1.19

"Creative OEM002" = Laptop Integrated Webcam Driver (1.04.01.1011)  

"E5372C32E8562C76C24DBA6525002B1031495F34" = Windows-Treiberpaket - Nokia Modem  (06/09/2010 7.01.0.8)

"EA1C8ECD4E416637C38F0079F98C8C7B0A112265" = Windows-Treiberpaket - Intel (NETwLv64) net  (10/07/2010 13.4.0.139)

"EF16709DD2C1C00190D1433E735F9F703EA529B9" = Windows-Treiberpaket - Intel (NETwNs64) net  (01/19/2011 13.5.0.6)

"FCEC33AD40CEA5E0FC4CEE6E42041A0DA189652D" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"Recuva" = Recuva

"TeamSpeak 3 Client" = TeamSpeak 3 Client

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator

"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

"{011BB39D-116F-408C-AB90-B590665B125A}" = 3CXPhone

"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4

"{054EFA56-2AC1-48F4-A883-0AB89874B972}" = Adobe Extension Manager CS4

"{08600005-5228-4BF6-845E-E9A957AFDCB4}" = OviMPlatform

"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Creator Data

"{09760D42-E223-42AD-8C3E-55B47D0DDAC3}" = Roxio Creator DE

"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler

"{098A2A49-7CF3-4F08-A38D-FB879117152A}" = Adobe Color NA Extra Settings CS4

"{0D6013AB-A0C7-41DC-973C-E93129C9A29F}" = Adobe Color JA Extra Settings CS4

"{0D67A4E4-5BE0-4C9A-8AD8-AB552B433F23}" = Adobe Setup

"{0DC0E85F-36E4-463B-B3EA-4CD8ED2222A1}" = Adobe Color EU Recommended Settings CS4

"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime

"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4

"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4

"{16E16F01-2E2D-4248-A42F-76261C147B6C}" = Adobe Drive CS4

"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Creator Tools

"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool

"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86

"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT

"{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java(TM) 6 Update 33

"{26A24AE4-039D-4CA4-87B4-2F83217005FF}" = Java(TM) 7 Update 5

"{27CC6AB1-E72B-4179-AF1A-EAE507EBAF51}_is1" = ConvertHelper 2.2

"{28191B83-1D60-44B6-9B08-E854EF6632D5}" = Ovi Desktop Sync Engine

"{2934DCB0-F8EE-11E0-A4A5-B8AC6F97B88E}" = Google Earth Plug-in

"{2CE84D03-DD6B-4518-B052-BA60EDACF72D}" = LibreOffice 3.6 Help Pack (German)

"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager

"{342D4AD7-EC4C-4EC8-AEA6-E70F5905A490}" = SQL Server System CLR Types

"{3516C69A-024D-42A8-B948-FFAA7B9CC49A}" = Windows SideShow Managed Runtime 1.0

"{3553E875-F00E-4031-BDEC-75FB1DFEB093}" = Nokia Ovi Suite Software Updater

"{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}" = PDF Settings CS4

"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works

"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4

"{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729

"{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}" = Adobe Color - Photoshop Specific CS4

"{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}" = Adobe WinSoft Linguistics Plugin

"{3FC42713-B6E7-49AA-A553-A224FE9828A8}" = Nokia Ovi Suite

"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker

"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger

"{4216D328-0FE8-48B8-85B8-BD300E6F080F}" = Nokia Connectivity Cable Driver

"{45D4F727-43B5-49CD-B474-B9866A8F4FB8}" = Nokia Map Loader

"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension

"{4D568C38-0552-4CDD-A643-01FAFA2957EF}" = Nokia Software Updater

"{4E5459A7-20FC-44D6-8832-80AE5A8D2B47}_is1" = GnuPT Version 4.3.0

"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent

"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml

"{59F6A514-9813-47A3-948C-8A155460CC2A}" = RICOH R5C83x/84x Media Driver Ver.3.53.02

"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053

"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call

"{626C034B-50B8-47BD-AF93-EEFD0FA78FF4}" = Character Builder

"{63C24A08-70F3-4C8E-B9FB-9F21A903801D}" = Adobe Color Video Profiles CS CS4

"{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}" = Adobe Photoshop CS4 Support

"{65CB4C08-C47B-4A7E-A6A4-50C06ADA5FC6}" = Adobe AIR

"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3

"{6753B40C-0FBD-3BED-8A9D-0ACAC2DCD85D}" = Microsoft Document Explorer 2008

"{67F0E67A-8E93-4C2C-B29D-47C48262738A}" = Adobe Device Central CS4

"{68243FF8-83CA-466B-B2B8-9F99DA5479C4}" = AdobeColorCommonSetCMYK

"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin

"{6AB6CBD4-ED44-4EAA-8496-228395B1C1D0}" = gs_x86

"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Creator Audio

"{74E2CD0C-D4A2-11D3-95A6-0000E86CFDE5}" = SSH Secure Shell

"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update

"{7B63B2922B174135AFC0E1377DD81EC2}" = 

"{7D27AC27-37F4-4A30-A1FC-53D22549F468}_is1" = Söldner Secret Wars Language Pack German Version 1.0

"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP

"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4

"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4

"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4

"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)

"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System

"{931AB7EA-3656-4BB7-864D-022B09E3DD67}" = Adobe Linguistics CS4

"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4

"{95120000-003F-0407-0000-0000000FF1CE}" = Microsoft Office Excel Viewer

"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio

"{A498D9EB-927B-459B-85D6-DD6EF8C2C564}" = erLT

"{A83279FD-CA4B-4206-9535-90974DE76654}" = Apple Application Support

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{AC2C1BDB-1E91-4F94-B99C-E716FE2E9C75}_is1" = MinGW-Get version 0.1-alpha-5

"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch

"{AC76BA86-7AD7-2447-0000-900000000003}" = Chinese Simplified Fonts Support For Adobe Reader 9

"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9

"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86

"{AFD5A54E-E9A1-413D-8AA2-C9EDB6782400}" = LibreOffice 3.6

"{B0970E8B-EEBA-4989-B8E2-8FC741AC93C8}" = Silicon Laboratories CP210x VCP Drivers for Windows 2000/XP/2003 Server/Vista

"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect

"{B4089055-D468-45A4-A6BA-5A138DD715FC}" = Bing Bar

"{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494}" = Adobe Photoshop CS4

"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Creator Copy

"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call

"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module

"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)

"{C41B742E-1655-4678-A059-2791B543B225}" = Silicon Laboratories CP210x VCP Drivers for Windows XP/2003 Server/Vista/7

"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail

"{C4E2A4A7-B623-40CB-8EEA-72F577E49D56}" = Vampire - The Masquerade Bloodlines

"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4

"{C5AC39F1-001D-4338-84C6-35109525588A}" = TweetDeck

"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1

"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw

"{D4AEC53C-1720-41D9-B6D7-6A60DE62D444}" = PC Connectivity Solution

"{DA909E62-3B45-4BA1-8B58-FCAEBA4BCEC9}" = NVIDIA PhysX

"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer

"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update

"{E4848436-0345-47E2-B648-8B522FCDA623}" = Adobe Photoshop CS4

"{E4DA04B6-3EC4-4DFD-A14E-44959EF36D5B}" = Feedanzeige für Windows SideShow

"{E503B4BF-F7BB-3D5F-8BC8-F694B1CFF942}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218

"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform

"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Creator DE

"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.8

"{EFE3D683-903C-4B58-AB8F-C68C69F33758}" = System Requirements Lab for Intel

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard

"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help

"{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}" = Logitech SetPoint

"{F38FD0E4-B991-462B-873D-F2115EADD093}" = Nokia PC Suite

"{F3AF62F5-665E-4B3E-8899-5C46D1793391}_is1" = Söldner Secret Wars - Community Edition Version 33900

"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4

"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials

"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4

"{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}" = Visual Studio 2008 x64 Redistributables

"{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}" = Adobe Fonts All

"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

"15b35190-c6f9-11d9-9669-0800200c9a66_is1" = Dungeons & Dragons Online ®:  Eberron Unlimited ™ v01.13.01.801

"Adobe AIR" = Adobe AIR

"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin

"Adobe_faf656ef605427ee2f42989c3ad31b8" = Adobe Photoshop CS4

"Advanced Audio FX Engine" = Advanced Audio FX Engine

"Advanced Video FX Engine" = Advanced Video FX Engine

"Anti-Twin 2010-06-10 22.18.06" = Anti-Twin (Installation 10.06.2010)

"AVMFBox" = AVM FRITZ!Box Dokumentation

"CameraWindowDC" = Canon Utilities CameraWindow DC

"CameraWindowLauncher" = Canon Utilities CameraWindow

"CANON iMAGE GATEWAY Task" = CANON iMAGE GATEWAY Task for ZoomBrowser EX

"Canon MOV Decoder" = Canon MOV Decoder

"Canon MOV Encoder" = Canon MOV Encoder

"Canon RAW Codec" = Canon RAW Codec

"Dell Dock" = Dell Dock

"Dell Webcam Center" = Dell Webcam Center

"Dell Webcam Manager" = Dell Webcam Manager

"DivX Setup.divx.com" = DivX-Setup

"DPP" = Canon Utilities Digital Photo Professional 3.10

"EncFlac" = EncFlac 1.1.2

"EncVorbis" = EncVorbis 1.1

"EOS Utility" = Canon Utilities EOS Utility

"EOS Video Snapshot Task" = Canon Utilities EOS Video Snapshot Task for ZoomBrowser EX

"ESET Online Scanner" = ESET Online Scanner v3

"Exact Audio Copy" = Exact Audio Copy 1.0beta1

"FileZilla Client" = FileZilla Client 3.5.3

"FLAC" = FLAC 1.2.1b (remove only)

"foobar2000" = foobar2000 v1.1

"Freeciv-2.2.5-gtk2" = Freeciv 2.2.5 (GTK+ client)

"FRITZ! 2.0" = AVM FRITZ!fax für FRITZ!Box

"GnuCash_is1" = GnuCash 2.2.9

"InFlac" = InFlac 1.1.1

"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies

"InstallShield_{C4E2A4A7-B623-40CB-8EEA-72F577E49D56}" = Vampire - The Masquerade Bloodlines

"IrfanView" = IrfanView (remove only)

"JDownloader" = JDownloader

"Kastor - All Video Downloader_is1" = Kastor - All Video Downloader V 3.3

"LOGO!Soft Comfort V7.0 " = LOGO!Soft Comfort V7.0 

"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300

"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1

"Microsoft Document Explorer 2008" = Microsoft Document Explorer 2008

"MinGW" = MinGW 5.1.6

"Miranda IM" = Miranda IM 0.10.0

"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)

"Mozilla Thunderbird 14.0 (x86 de)" = Mozilla Thunderbird 14.0 (x86 de)

"MozillaMaintenanceService" = Mozilla Maintenance Service

"MyCamera" = Canon Utilities MyCamera

"MyCamera Download Plugin" = CANON iMAGE GATEWAY MyCamera Download Plugin

"Nokia Maps Updater_is1" = Nokia Maps Updater 1.0.12

"Nokia Ovi Suite" = Nokia Ovi Suite

"Nokia PC Suite" = Nokia PC Suite

"Notepad++" = Notepad++

"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver

"OpenAL" = OpenAL

"PhotoStitch" = Canon Utilities PhotoStitch

"Picture Style Editor" = Canon Utilities Picture Style Editor

"Secunia PSI" = Secunia PSI (3.0.0.2004)

"SLABCOMM&10C4&EA60" = Silicon Laboratories CP210x USB to UART Bridge (Driver Removal)

"SR4CharGen" = SR4CharGen 0.4.0.0

"SystemRequirementsLab" = System Requirements Lab

"TeamViewer 7" = TeamViewer 7

"TIPP10_is1" = TIPP10 Version 2.0.3

"TreeSize Free_is1" = TreeSize Free V2.7

"VLC media player" = VLC media player 2.0.2

"WFTK" = Canon Utilities WFT-E1/E2/E3/E4 Utility

"WinLiveSuite_Wave3" = Windows Live Essentials

"X3-Reunion2.0.02DE_is1" = X3: Reunion v2.0.02

"Zattoo4" = Zattoo4 4.0.5

"ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility

 
 ========== HKEY_USERS Uninstall List ==========

 

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

 
 ========== HKEY_USERS Uninstall List ==========

 

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

 
 ========== HKEY_USERS Uninstall List ==========

 

[HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

 
 ========== HKEY_USERS Uninstall List ==========

 

[HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

 
 ========== HKEY_USERS Uninstall List ==========

 

[HKEY_USERS\S-1-5-21-4135602353-3033774650-4224148770-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"bd4d3a0508d364f5" = Dell Driver Download Manager

"MyFreeCodec" = MyFreeCodec

"Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player

"WinDirStat" = WinDirStat 1.1.2

 
 ========== Last 20 Event Log Errors ==========

 

[ Application Events ]

Error - 02.08.2012 08:27:04 | Computer Name = XPS1530 | Source = SideBySide | ID = 16842832

Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\X.XXXXXX\Desktop\trojaner\esetsmartinstaller_enu.exe".

 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche

 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.

In

 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente

 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

Error - 02.08.2012 08:27:05 | Computer Name = XPS1530 | Source = SideBySide | ID = 16842832

Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\X.XXXXXX\Desktop\trojaner\esetsmartinstaller_enu.exe".

 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche

 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.

In

 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente

 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

Error - 02.08.2012 08:27:07 | Computer Name = XPS1530 | Source = SideBySide | ID = 16842832

Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\X.XXXXXX\Desktop\trojaner\esetsmartinstaller_enu.exe".

 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche

 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.

In

 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente

 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

Error - 10.08.2012 08:12:34 | Computer Name = XPS1530 | Source = Application Hang | ID = 1002

Description = Programm thunderbird.exe, Version 14.0.0.4577 kann nicht mehr unter

 Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf 

in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem

 zu suchen.    Prozess-ID: d84    Startzeit: 01cd76e33cf51c23    Endzeit: 25    Anwendungspfad: 

C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe    Berichts-ID: 962cf706-e2e4-11e1-8929-001f3ad66066
 

 

Error - 10.08.2012 09:19:58 | Computer Name = XPS1530 | Source = Microsoft-Windows-LoadPerf | ID = 3012

Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung

 werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter

 ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste

 DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich

 und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

 

Error - 10.08.2012 09:19:58 | Computer Name = XPS1530 | Source = Microsoft-Windows-LoadPerf | ID = 3012

Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung

 werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter

 ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste

 DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich

 und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

 

Error - 10.08.2012 09:19:58 | Computer Name = XPS1530 | Source = Microsoft-Windows-LoadPerf | ID = 3011

Description = Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren

 für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

 

Error - 10.08.2012 13:47:30 | Computer Name = XPS1530 | Source = SideBySide | ID = 16842832

Description = Fehler beim Generieren des Aktivierungskontexts für "c:\program files

 (x86)\ESET\eset online scanner\ESETSmartInstaller.exe". Fehler in  Manifest- oder

 Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche Komponentenversion

 steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.  In Konflikt

 stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente

 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

Error - 15.08.2012 15:39:11 | Computer Name = XPS1530 | Source = SideBySide | ID = 16842832

Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\X.XXXXXX\Desktop\trojaner\esetsmartinstaller_enu.exe".

 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche

 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.

In

 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente

 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

Error - 15.08.2012 16:20:09 | Computer Name = XPS1530 | Source = SideBySide | ID = 16842832

Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\X.XXXXXX\Desktop\trojaner\esetsmartinstaller_enu.exe".

 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche

 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.

In

 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente

 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

[ Media Center Events ]

Error - 30.12.2009 12:48:16 | Computer Name = XPS1530 | Source = MCUpdate | ID = 0

Description = 17:48:15 - Fehler beim Herstellen der Internetverbindung.  17:48:15 

-     Serververbindung konnte nicht hergestellt werden..  

 

[ System Events ]

Error - 08.08.2012 16:28:04 | Computer Name = XPS1530 | Source = cdrom | ID = 262151

Description = Fehlerhafter Block bei Gerät \Device\CdRom0.

 

Error - 08.08.2012 16:28:12 | Computer Name = XPS1530 | Source = cdrom | ID = 262151

Description = Fehlerhafter Block bei Gerät \Device\CdRom0.

 

Error - 08.08.2012 16:28:27 | Computer Name = XPS1530 | Source = cdrom | ID = 262151

Description = Fehlerhafter Block bei Gerät \Device\CdRom0.

 

Error - 08.08.2012 16:28:35 | Computer Name = XPS1530 | Source = cdrom | ID = 262151

Description = Fehlerhafter Block bei Gerät \Device\CdRom0.

 

Error - 10.08.2012 06:25:57 | Computer Name = XPS1530 | Source = SNMP | ID = 16713180

Description = Beim Zugreifen auf den Registrierungsschlüssel SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration

 ist ein Fehler aufgetreten.

 

Error - 11.08.2012 01:55:10 | Computer Name = XPS1530 | Source = SNMP | ID = 16713180

Description = Beim Zugreifen auf den Registrierungsschlüssel SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration

 ist ein Fehler aufgetreten.

 

Error - 11.08.2012 02:00:02 | Computer Name = XPS1530 | Source = Service Control Manager | ID = 7022

Description = Der Dienst "Windows Search" wurde nicht richtig gestartet.

 

Error - 12.08.2012 02:58:40 | Computer Name = XPS1530 | Source = SNMP | ID = 16713180

Description = Beim Zugreifen auf den Registrierungsschlüssel SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration

 ist ein Fehler aufgetreten.

 

Error - 15.08.2012 15:29:42 | Computer Name = XPS1530 | Source = SNMP | ID = 16713180

Description = Beim Zugreifen auf den Registrierungsschlüssel SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration

 ist ein Fehler aufgetreten.

 

Error - 15.08.2012 15:36:04 | Computer Name = XPS1530 | Source = Service Control Manager | ID = 7022

Description = Der Dienst "Windows Update" wurde nicht richtig gestartet.

 

 

< End of report >

Das sind nur die extras, wo ist das andere Log?

Sorry.

Code:

OTL logfile created on: 15.08.2012 22:08:25 - Run 1

OTL by OldTimer - Version 3.2.57.0     Folder = C:\Users\x.xxxxxx\Desktop

64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

4,00 Gb Total Physical Memory | 2,39 Gb Available Physical Memory | 59,75% Memory free

7,99 Gb Paging File | 6,26 Gb Available in Paging File | 78,36% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 199,90 Gb Total Space | 48,72 Gb Free Space | 24,37% Space Free | Partition Type: NTFS

Drive D: | 98,09 Gb Total Space | 31,58 Gb Free Space | 32,20% Space Free | Partition Type: NTFS

Drive E: | 4,32 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS

Drive F: | 122,41 Mb Total Space | 122,41 Mb Free Space | 100,00% Space Free | Partition Type: FAT

 

Computer Name: XPS1530 | User Name: x.xxxxxx | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.08.15 21:38:14 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\x.xxxxxx\Desktop\OTL.exe

PRC - [2012.07.05 18:41:46 | 003,048,136 | ---- | M] (Skype Technologies S.A.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe

PRC - [2012.07.04 17:25:54 | 005,160,568 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2012\avgidsagent.exe

PRC - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

PRC - [2012.07.02 12:33:28 | 002,673,064 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe

PRC - [2012.06.27 09:25:06 | 001,326,176 | ---- | M] (Secunia) -- C:\Program Files (x86)\Secunia\PSI\psia.exe

PRC - [2012.06.27 09:25:04 | 000,572,000 | ---- | M] (Secunia) -- C:\Program Files (x86)\Secunia\PSI\psi_tray.exe

PRC - [2012.05.30 03:18:06 | 000,021,432 | ---- | M] () -- C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

PRC - [2012.05.30 03:17:54 | 003,521,464 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe

PRC - [2012.04.05 05:12:34 | 002,587,008 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2012\avgtray.exe

PRC - [2012.03.01 02:02:00 | 002,348,352 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

PRC - [2012.02.29 14:26:46 | 000,382,272 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

PRC - [2012.02.14 04:53:38 | 000,193,288 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe

PRC - [2011.10.13 18:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE

PRC - [2010.11.23 18:49:24 | 001,540,096 | ---- | M] (Nokia) -- C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer.exe

PRC - [2009.09.19 09:59:16 | 000,984,048 | ---- | M] () -- C:\Program Files (x86)\GnuPT\WPT\WinPT.exe

PRC - [2009.07.20 05:00:00 | 000,077,824 | ---- | M] () -- C:\Programme\Logitech\SetPoint\x86\SetPoint32.exe

PRC - [2009.07.01 18:54:04 | 000,013,600 | ---- | M] (Broadcom Corporation.) -- C:\Programme\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe

PRC - [2007.07.24 19:02:44 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe

PRC - [2007.07.24 19:02:42 | 000,174,616 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe

PRC - [2007.05.09 18:01:00 | 000,036,864 | ---- | M] (Creative Technology Ltd.) -- C:\Windows\OEM02Mon.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2012.06.17 21:00:55 | 018,019,840 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\d239f585ee55f833dbe21e897e1265ac\PresentationFramework.ni.dll

MOD - [2012.06.17 21:00:17 | 011,522,048 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\b7de318e9fd1ef519ca6c1f3b5dba8e0\PresentationCore.ni.dll

MOD - [2012.06.17 21:00:08 | 013,198,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\00a4922fbf869a79c043b665035516b6\System.Windows.Forms.ni.dll

MOD - [2012.06.17 21:00:00 | 003,881,984 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\a6e37a05b8d0cedbc5c3ea266ae3fc31\WindowsBase.ni.dll

MOD - [2012.06.17 20:59:55 | 001,666,048 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\4230ed1c7990e4ee8352baf67a2a85fa\System.Drawing.ni.dll

MOD - [2012.06.04 21:51:38 | 000,115,137 | ---- | M] () -- C:\Users\x.xxxxxx\AppData\Local\Temp\26b4a1dd-e07b-48af-be4e-9642b273284b\CliSecureRT.dll

MOD - [2012.05.30 03:18:06 | 000,021,432 | ---- | M] () -- C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

MOD - [2012.05.13 09:15:52 | 001,218,560 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\d0e1cdaff8f9055187f8e7b52c060dff\System.Management.ni.dll

MOD - [2012.05.13 09:13:43 | 000,762,880 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\31fab24c51c0cfe8b8115f24545f169f\System.Runtime.Remoting.ni.dll

MOD - [2012.05.13 09:13:31 | 001,782,272 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\b68bee05c7e518172982cc92059c3315\System.Xaml.ni.dll

MOD - [2012.05.13 09:08:22 | 000,595,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\608d29d7cc89f3a9a195c91354561915\PresentationFramework.Aero.ni.dll

MOD - [2012.05.13 09:04:31 | 000,982,528 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\a84262e1224189f93e10cd3c403a9527\System.Configuration.ni.dll

MOD - [2012.05.13 09:04:27 | 007,069,184 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\09bd2126bba2ab4f29ed52afde1470d7\System.Core.ni.dll

MOD - [2012.05.13 09:04:19 | 005,617,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\9abe44a0f82070ead5f1256683a4d25a\System.Xml.ni.dll

MOD - [2012.05.13 09:04:13 | 009,092,096 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\a6be120e49f895ef6b00e9918402395b\System.ni.dll

MOD - [2012.05.13 09:04:05 | 014,414,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\c1af4ec9a36f671617a8ecaec00373f4\mscorlib.ni.dll

MOD - [2012.01.08 15:41:12 | 000,093,696 | ---- | M] () -- C:\Program Files (x86)\FileZilla FTP Client\fzshellext.dll

MOD - [2009.09.19 09:59:16 | 000,984,048 | ---- | M] () -- C:\Program Files (x86)\GnuPT\WPT\WinPT.exe

MOD - [2009.09.19 09:56:00 | 000,425,525 | ---- | M] () -- C:\Program Files (x86)\GnuPT\WPT\PTD.dll

MOD - [2009.07.20 05:00:00 | 000,077,824 | ---- | M] () -- C:\Programme\Logitech\SetPoint\x86\SetPoint32.exe

MOD - [2008.11.29 15:00:08 | 000,042,496 | ---- | M] () -- C:\Program Files (x86)\GnuPT\WPT\libgpg-error-0.dll

MOD - [2007.03.10 09:20:00 | 000,098,304 | ---- | M] () -- C:\Program Files (x86)\GnuPT\WPT\libgpgme-11.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - [2010.11.20 15:25:18 | 000,049,664 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\snmp.exe -- (SNMP)

SRV:64bit: - [2009.07.14 03:41:10 | 000,035,328 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\iprip.dll -- (iprip)

SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)

SRV:64bit: - [2007.09.20 15:31:22 | 000,086,016 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_295b5b4710f6d77b\AESTSr64.exe -- (AESTFilters)

SRV - [2012.08.15 22:02:27 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2012.07.18 20:37:12 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2012.07.05 18:41:46 | 003,048,136 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)

SRV - [2012.07.04 17:25:54 | 005,160,568 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2012\avgidsagent.exe -- (AVGIDSAgent)

SRV - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2012.07.02 12:33:28 | 002,673,064 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe -- (TeamViewer7)

SRV - [2012.06.27 09:25:06 | 001,326,176 | ---- | M] (Secunia) [Auto | Running] -- C:\Program Files (x86)\Secunia\PSI\psia.exe -- (Secunia PSI Agent)

SRV - [2012.06.27 09:25:04 | 000,681,056 | ---- | M] (Secunia) [Auto | Stopped] -- C:\Program Files (x86)\Secunia\PSI\sua.exe -- (Secunia Update Agent)

SRV - [2012.03.01 02:02:00 | 002,348,352 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)

SRV - [2012.02.29 14:26:46 | 000,382,272 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)

SRV - [2012.02.15 14:30:18 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2012.02.14 04:53:38 | 000,193,288 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe -- (avgwd)

SRV - [2011.10.21 16:23:42 | 000,196,176 | ---- | M] (Microsoft Corporation.) [Auto | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)

SRV - [2011.10.13 18:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (BBUpdate)

SRV - [2010.12.08 15:31:06 | 000,628,736 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)

SRV - [2010.11.20 14:17:42 | 000,047,616 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\snmp.exe -- (SNMP)

SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2009.11.13 00:04:55 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

SRV - [2009.11.13 00:02:51 | 001,038,088 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe -- (FLEXnet Licensing Service 64)

SRV - [2009.07.20 13:36:14 | 000,160,784 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)

SRV - [2009.07.01 18:54:02 | 000,864,032 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Programme\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)

SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

SRV - [2009.06.09 16:11:14 | 000,155,648 | ---- | M] (Stardock Corporation) [On_Demand | Stopped] -- C:\Programme\Dell\DellDock\DockLogin.exe -- (DockLoginService)

SRV - [2007.09.20 15:31:22 | 000,086,016 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_295b5b4710f6d77b\AESTSr64.exe -- (AESTFilters)

SRV - [2007.07.24 19:02:44 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON)

SRV - [2007.05.31 18:11:54 | 000,443,784 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)

SRV - [2007.05.31 18:11:46 | 000,225,672 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)

DRV:64bit: - [2012.05.21 04:09:00 | 000,203,320 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudmdm.sys -- (ssudmdm)

DRV:64bit: - [2012.05.21 04:09:00 | 000,099,384 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudbus.sys -- (dg_ssudbus)

DRV:64bit: - [2012.04.19 04:50:26 | 000,028,480 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\avgidsha.sys -- (AVGIDSHA)

DRV:64bit: - [2012.03.19 05:17:26 | 000,383,808 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtdia.sys -- (Avgtdia)

DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2012.02.22 05:25:32 | 000,289,872 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgldx64.sys -- (Avgldx64)

DRV:64bit: - [2012.02.03 12:29:44 | 000,029,576 | ---- | M] (Kawai Musical Instruments Mfg. Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Kp362.sys -- (kwusbmidi)

DRV:64bit: - [2012.01.31 04:46:48 | 000,036,944 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgrkx64.sys -- (Avgrkx64)

DRV:64bit: - [2011.12.23 13:32:14 | 000,047,696 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\avgmfx64.sys -- (Avgmfx64)

DRV:64bit: - [2011.12.23 13:32:04 | 000,029,776 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\avgidsfiltera.sys -- (AVGIDSFilter)

DRV:64bit: - [2011.12.23 13:31:58 | 000,124,496 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\avgidsdrivera.sys -- (AVGIDSDriver)

DRV:64bit: - [2011.12.16 16:20:10 | 000,017,976 | ---- | M] (Secunia) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\psi_mf.sys -- (PSI)

DRV:64bit: - [2011.12.06 23:50:24 | 000,053,312 | ---- | M] (microOLAP Technologies LTD) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pssdk42.sys -- (PSSDK42)

DRV:64bit: - [2011.09.21 10:25:54 | 000,021,992 | ---- | M] (CPUID) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\cpuz135_x64.sys -- (cpuz135)

DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2011.01.19 03:28:56 | 008,080,384 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NETwNs64.sys -- (NETwNs64)

DRV:64bit: - [2011.01.15 18:21:04 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone)

DRV:64bit: - [2010.11.20 15:34:02 | 000,360,832 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vpcvmm.sys -- (vpcvmm)

DRV:64bit: - [2010.11.20 15:34:02 | 000,194,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vpchbus.sys -- (vpcbus)

DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010.11.20 13:35:32 | 000,095,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vpcusb.sys -- (vpcusb)

DRV:64bit: - [2010.11.20 13:35:20 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vpcnfltr.sys -- (vpcnfltr)

DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2010.11.20 11:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)

DRV:64bit: - [2010.10.07 05:11:52 | 007,533,568 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETwLv64.sys -- (NETwLv64)

DRV:64bit: - [2010.08.12 06:07:46 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)

DRV:64bit: - [2010.07.30 15:18:04 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser_lowerfltjx64.sys -- (UsbserFilt)

DRV:64bit: - [2010.07.30 15:18:02 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys -- (upperdev)

DRV:64bit: - [2010.07.30 15:18:00 | 000,026,624 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ccdcmbox64.sys -- (nmwcdc)

DRV:64bit: - [2010.07.30 15:17:56 | 000,019,456 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ccdcmbx64.sys -- (nmwcd)

DRV:64bit: - [2010.02.18 19:13:24 | 000,086,584 | ---- | M] (Adobe Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\adfs.sys -- (adfs)

DRV:64bit: - [2009.10.29 01:20:20 | 000,030,208 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\AegisP.sys -- (AegisP)

DRV:64bit: - [2009.09.28 10:22:00 | 000,395,264 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7)

DRV:64bit: - [2009.07.24 02:11:08 | 000,063,504 | ---- | M] (UPEK Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tcusb.sys -- (TcUsb)

DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.07.14 02:09:50 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usb8023x.sys -- (usb_rndisx)

DRV:64bit: - [2009.07.13 17:36:22 | 000,253,488 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Apfiltr.sys -- (ApfiltrService)

DRV:64bit: - [2009.07.02 22:26:34 | 000,132,648 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt)

DRV:64bit: - [2009.07.02 22:26:34 | 000,098,344 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio)

DRV:64bit: - [2009.07.02 22:26:34 | 000,035,104 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap)

DRV:64bit: - [2009.07.02 22:26:34 | 000,021,160 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid)

DRV:64bit: - [2009.06.17 18:54:30 | 000,057,872 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt)

DRV:64bit: - [2009.06.17 18:54:22 | 000,055,312 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)

DRV:64bit: - [2009.06.17 18:54:14 | 000,013,328 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidEqd.sys -- (LHidEqd)

DRV:64bit: - [2009.06.17 18:54:06 | 000,074,256 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LEqdUsb.sys -- (LEqdUsb)

DRV:64bit: - [2009.06.10 22:35:28 | 005,434,368 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netw5v64.sys -- (netw5v64)

DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2008.08.28 12:44:42 | 000,025,600 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys -- (pccsmcfd)

DRV:64bit: - [2008.02.21 11:24:20 | 000,062,976 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rimmpx64.sys -- (rimmptsk)

DRV:64bit: - [2008.02.15 19:27:02 | 000,393,216 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA)

DRV:64bit: - [2007.10.10 18:03:00 | 000,266,624 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\OEM02Dev.sys -- (OEM02Dev)

DRV:64bit: - [2007.09.26 09:19:00 | 003,196,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NETw4v64.sys -- (NETw4v64)

DRV:64bit: - [2007.07.27 20:45:52 | 000,057,856 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rixdpx64.sys -- (rismxdp)

DRV:64bit: - [2007.07.26 21:33:54 | 000,055,296 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rimspx64.sys -- (rimsptsk)

DRV:64bit: - [2007.04.25 13:18:12 | 000,537,368 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)

DRV:64bit: - [2007.03.05 11:55:48 | 000,012,288 | ---- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\OEM02Vfx.sys -- (OEM02Vfx)

DRV - [2010.02.18 19:13:24 | 000,086,584 | ---- | M] (Adobe Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysWow64\drivers\adfs.sys -- (adfs)

DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\S-1-5-21-4135602353-3033774650-4224148770-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKU\S-1-5-21-4135602353-3033774650-4224148770-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKU\S-1-5-21-4135602353-3033774650-4224148770-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 3A 4A 2E 16 8D 9E CB 01  [binary data]

IE - HKU\S-1-5-21-4135602353-3033774650-4224148770-1001\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\S-1-5-21-4135602353-3033774650-4224148770-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKU\S-1-5-21-4135602353-3033774650-4224148770-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "about:home"

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3

FF - prefs.js..extensions.enabledItems: {ba243cb0-b824-4a26-9418-73ee795d9b9d}:1.0.4

FF - prefs.js..extensions.enabledItems: en-GB@dictionaries.addons.mozilla.org:1.19.1

FF - prefs.js..extensions.enabledItems: checkplaces@andyhalford.com:2.4.5

FF - prefs.js..extensions.enabledItems: {45d8ff86-d909-11db-9705-005056c00008}:1.0.5

FF - prefs.js..extensions.enabledItems: de-DE@dictionaries.addons.mozilla.org:2.0.2

FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.8

FF - prefs.js..extensions.enabledItems: {c50ca3c4-5656-43c2-a061-13e717f73fc8}:4.0.1

FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.4.51

FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.1

FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.071303000004

FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.0.9.9

FF - prefs.js..extensions.enabledItems: maps@ovi.com:2.3.37.3

FF - prefs.js..extensions.enabledItems: {B17C1C5A-04B1-11DB-9804-B622A1EF5492}:1.2.1

FF - prefs.js..extensions.enabledItems: {340c2bbc-ce74-4362-90b5-7c26312808ef}:1.7

FF - prefs.js..extensions.enabledItems: {f65bf62a-5ffc-4317-9612-38907a779583}:1.3.0

FF - prefs.js..extensions.enabledItems: de_DE@dicts.j3e.de:20101229

FF - prefs.js..extensions.enabledItems: ietab@ip.cn:1.95.20100933

FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906

FF - prefs.js..extensions.enabledItems: firefox@ghostery.com:2.5.2

FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:2.0.2

FF - prefs.js..extensions.enabledItems: bkmrksync@nokia.com:1.0.0.736

FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.2.8.4

FF - prefs.js..extensions.enabledItems: contacts@labs.mozilla.com:0.3.2

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24

FF - prefs.js..extensions.enabledItems: {29852C08-1E91-4889-A6BF-C77F91D6A8F3}:1.8.71

FF - prefs.js..network.proxy.http: "192.168.10.1"

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_270.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.0: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.0: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)

FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_270.dll ()

FF - HKLM\Software\MozillaPlugins\@canon.com/MycameraPlugin: C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll File not found

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.0: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.0: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player:  File not found

FF - HKCU\Software\MozillaPlugins\@sun.com/npsopluginmi;version=1.0: C:\Program Files (x86)\LibreOffice 3\program File not found

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\bkmrksync@nokia.com: C:\Program Files (x86)\Nokia\Nokia PC Suite 7\bkmrksync\

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files (x86)\AVG\AVG2012\Firefox4\ [2012.07.17 19:30:14 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{F53C93F1-07D5-430c-86D4-C9531B27DFAF}: C:\Program Files (x86)\AVG\AVG2012\Firefox\DoNotTrack\ [2012.07.03 20:08:09 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.18 20:37:14 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.08.15 21:37:53 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.05.22 00:09:09 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2012.08.15 21:37:53 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2011.02.06 13:56:52 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\avgthb@avg.com: C:\Program Files (x86)\AVG\AVG2012\Thunderbird\ [2012.01.04 10:51:33 | 000,000,000 | ---D | M]

 

[2009.12.10 20:35:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\x.xxxxxx\AppData\Roaming\mozilla\Extensions

[2009.12.10 20:35:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\x.xxxxxx\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}

[2012.08.10 12:33:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\x.xxxxxx\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\extensions

[2011.12.29 12:56:47 | 000,000,000 | ---D | M] ("infoRSS") -- C:\Users\x.xxxxxx\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\extensions\{f65bf62a-5ffc-4317-9612-38907a779583}

[2012.05.23 00:13:04 | 000,000,000 | ---D | M] ("FRITZ!Box AddOn") -- C:\Users\x.xxxxxx\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\extensions\fb_add_on@avm.de

[2012.08.10 12:33:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\x.xxxxxx\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\extensions\trash

[2011.12.13 18:10:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\x.xxxxxx\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\ReadItLater\RIL_assets\extensions.libreoffice.org

[2011.12.13 18:10:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\x.xxxxxx\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\ReadItLater\RIL_assets\extensions.libreoffice.org\++resource++jquery-ui-themes

[2011.12.13 18:10:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\x.xxxxxx\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\ReadItLater\RIL_assets\extensions.libreoffice.org\extension-center

[2011.12.13 18:10:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\x.xxxxxx\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\ReadItLater\RIL_assets\extensions.libreoffice.org\portal_css

[2011.12.13 18:10:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\x.xxxxxx\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\ReadItLater\RIL_assets\extensions.libreoffice.org\portal_kss

[2011.12.13 18:10:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\x.xxxxxx\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\ReadItLater\RIL_assets\extensions.libreoffice.org\extension-center\addpics

[2011.12.13 18:10:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\x.xxxxxx\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\ReadItLater\RIL_assets\extensions.libreoffice.org\extension-center\chemistry

[2011.12.13 18:10:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\x.xxxxxx\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\ReadItLater\RIL_assets\extensions.libreoffice.org\extension-center\copy-only-visible-cells

[2011.12.13 18:10:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\x.xxxxxx\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\ReadItLater\RIL_assets\extensions.libreoffice.org\extension-center\export-as-images

[2011.12.13 18:10:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\x.xxxxxx\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\ReadItLater\RIL_assets\extensions.libreoffice.org\extension-center\fixed-values-for-calc

[2011.12.13 18:10:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\x.xxxxxx\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\ReadItLater\RIL_assets\extensions.libreoffice.org\extension-center\gallery-of-danger-signs

[2011.12.13 18:10:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\x.xxxxxx\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\ReadItLater\RIL_assets\extensions.libreoffice.org\extension-center\improved-trend-lines

[2011.12.13 18:10:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\x.xxxxxx\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\ReadItLater\RIL_assets\extensions.libreoffice.org\extension-center\magenta-lorem-ipsum-generator

[2011.12.13 18:10:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\x.xxxxxx\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\ReadItLater\RIL_assets\extensions.libreoffice.org\extension-center\texmaths-1

[2011.12.05 21:17:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\x.xxxxxx\AppData\Roaming\mozilla\Firefox\Profiles\yjff8k19.default\ReadItLater\RIL_assets\images.netzwelt.de\extensions

[2009.09.27 09:06:17 | 000,000,885 | ---- | M] () -- C:\Users\x.xxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\yjff8k19.default\searchplugins\00de-community.xml

[2012.08.08 13:29:25 | 000,000,853 | ---- | M] () -- C:\Users\x.xxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\yjff8k19.default\searchplugins\11-suche.xml

[2009.09.27 22:16:29 | 000,002,172 | ---- | M] () -- C:\Users\x.xxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\yjff8k19.default\searchplugins\bing.xml

[2009.09.27 22:16:52 | 000,002,758 | ---- | M] () -- C:\Users\x.xxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\yjff8k19.default\searchplugins\cuil.xml

[2012.08.08 13:29:26 | 000,002,209 | ---- | M] () -- C:\Users\x.xxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\yjff8k19.default\searchplugins\englische-ergebnisse.xml

[2012.08.08 13:00:32 | 000,001,485 | ---- | M] () -- C:\Users\x.xxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\yjff8k19.default\searchplugins\geo-ip-tool.xml

[2012.08.08 13:29:25 | 000,010,506 | ---- | M] () -- C:\Users\x.xxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\yjff8k19.default\searchplugins\gmx-suche.xml

[2012.08.08 13:29:25 | 000,002,368 | ---- | M] () -- C:\Users\x.xxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\yjff8k19.default\searchplugins\lastminute.xml

[2009.09.27 22:17:39 | 000,001,699 | ---- | M] () -- C:\Users\x.xxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\yjff8k19.default\searchplugins\metager.xml

[2012.08.08 13:29:25 | 000,005,489 | ---- | M] () -- C:\Users\x.xxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\yjff8k19.default\searchplugins\webde-suche.xml

[2010.08.15 00:59:33 | 000,001,196 | ---- | M] () -- C:\Users\x.xxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\yjff8k19.default\searchplugins\winamp-search.xml

[2012.06.23 14:02:36 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions

[2012.07.22 08:53:16 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

[2012.06.23 14:02:37 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}

[2012.07.03 20:08:09 | 000,000,000 | ---D | M] (AVG Do Not Track) -- C:\PROGRAM FILES (X86)\AVG\AVG2012\FIREFOX\DONOTTRACK

[2011.12.29 12:56:39 | 000,060,243 | ---- | M] () (No name found) -- C:\USERS\x.xxxxxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YJFF8K19.DEFAULT\EXTENSIONS\{45D8FF86-D909-11DB-9705-005056C00008}.XPI

[2012.07.30 23:21:02 | 000,526,190 | ---- | M] () (No name found) -- C:\USERS\x.xxxxxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YJFF8K19.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI

[2011.12.29 12:56:40 | 000,089,442 | ---- | M] () (No name found) -- C:\USERS\x.xxxxxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YJFF8K19.DEFAULT\EXTENSIONS\{B17C1C5A-04B1-11DB-9804-B622A1EF5492}.XPI

[2012.02.21 22:59:39 | 000,709,293 | ---- | M] () (No name found) -- C:\USERS\x.xxxxxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YJFF8K19.DEFAULT\EXTENSIONS\{DDC359D1-844A-42A7-9AA1-88A850A938A8}.XPI

[2011.12.29 12:56:38 | 000,079,365 | ---- | M] () (No name found) -- C:\USERS\x.xxxxxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YJFF8K19.DEFAULT\EXTENSIONS\ANTICONTAINER@DOWNTHEMALL.NET.XPI

[2012.07.13 15:56:07 | 000,223,394 | ---- | M] () (No name found) -- C:\USERS\x.xxxxxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YJFF8K19.DEFAULT\EXTENSIONS\ISREADITLATER@IDEASHOWER.COM.XPI

[2012.08.08 13:29:20 | 000,525,702 | ---- | M] () (No name found) -- C:\USERS\x.xxxxxx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YJFF8K19.DEFAULT\EXTENSIONS\TOOLBAR@WEB.DE.XPI

[2012.07.18 20:37:14 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2011.09.23 03:52:52 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2011.09.23 03:46:24 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2011.09.23 03:52:52 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2011.09.23 03:52:52 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2011.09.23 03:52:52 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2011.09.23 03:52:52 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2:64bit: - BHO: (AVG Do Not Track) - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files (x86)\AVG\AVG2012\avgdtiea.dll (AVG Technologies CZ, s.r.o.)

O2:64bit: - BHO: (no name) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No CLSID value found.

O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll (AVG Technologies CZ, s.r.o.)

O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)

O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O2 - BHO: (AVG Do Not Track) - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files (x86)\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.)

O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

O2 - BHO: (no name) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - No CLSID value found.

O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O3:64bit: - HKLM\..\Toolbar: (no name) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No CLSID value found.

O3 - HKLM\..\Toolbar: (no name) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - No CLSID value found.

O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.)

O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\Windows\SysNative\LogiLDA.dll (Logitech, Inc.)

O4:64bit: - HKLM..\Run: [PSQLLauncher] C:\Program Files\Protector Suite\launcher.exe (UPEK Inc.)

O4:64bit: - HKLM..\Run: [SigmatelSysTrayApp] C:\Programme\SigmaTel\C-Major Audio\WDM\sttray64.exe (IDT, Inc.)

O4:64bit: - HKLM..\Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation)

O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)

O4 - HKLM..\Run: [DELL Webcam Manager] C:\Program Files (x86)\Dell\Dell Webcam Manager\DellWMgr.exe (Creative Technology Ltd.)

O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()

O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [NokiaMServer] C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer.exe (Nokia)

O4 - HKLM..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe (Creative Technology Ltd.)

O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-21-4135602353-3033774650-4224148770-1001..\Run: []  File not found

O4 - HKU\S-1-5-21-4135602353-3033774650-4224148770-1001..\Run: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()

O4 - HKU\S-1-5-21-4135602353-3033774650-4224148770-1028..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-21-4135602353-3033774650-4224148770-1028..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - Startup: C:\Users\x.xxxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Privacy Tray.lnk = C:\Program Files (x86)\GnuPT\WPT\WinPT.exe ()

O4 - Startup: C:\Users\x.xxxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Task-Manager.lnk = C:\Windows\SysWOW64\taskmgr.exe (Microsoft Corporation)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun =  [binary data]

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun =  [binary data]

O7 - HKU\S-1-5-21-4135602353-3033774650-4224148770-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-4135602353-3033774650-4224148770-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2

O7 - HKU\S-1-5-21-4135602353-3033774650-4224148770-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1

O8:64bit: - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()

O8:64bit: - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()

O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9:64bit: - Extra Button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files (x86)\AVG\AVG2012\avgdtiea.dll (AVG Technologies CZ, s.r.o.)

O9:64bit: - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)

O9 - Extra Button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files (x86)\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.)

O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra Button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra 'Tools' menuitem : Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O15 - HKU\S-1-5-21-4135602353-3033774650-4224148770-1001\..Trusted Domains: fritz.box ([]* in Lokales Intranet)

O15 - HKU\S-1-5-21-4135602353-3033774650-4224148770-1001\..Trusted Ranges: Range1 ([*] in Lokales Intranet)

O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 10.5.0)

O16:64bit: - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)

O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 10.5.0)

O16 - DPF: {362C56AA-6E4F-40C7-A0B5-85501DBDAD77} hxxp://i.dell.com/images/global/js/scanner/SysProExe.cab (Scanner.SysScanner)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 10.5.0)

O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 10.5.0)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{502004D4-5173-41D5-97CB-7F0A05316CAD}: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5AEE75FC-1A02-476A-9CB2-7CA63376DEEB}: NameServer = 0.0.0.0

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{68B8DA9B-BF22-418A-81D0-8AD5B0AF66DD}: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FE5D6DC5-D44C-41E5-9028-F4B2466E4408}: DhcpNameServer = 192.168.42.129

O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgppa.dll (AVG Technologies CZ, s.r.o.)

O18:64bit: - Protocol\Handler\livecall - No CLSID value found

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found

O18:64bit: - Protocol\Handler\msnim - No CLSID value found

O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found

O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found

O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: GinaDLL - (vrlogon.dll) -  File not found

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Programme\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)

O20:64bit: - Winlogon\Notify\psfus: DllName - (C:\Program Files\Protector Suite\psqlpwd.dll) - C:\Programme\Protector Suite\psqlpwd.dll (UPEK Inc.)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2005.10.06 06:12:54 | 000,000,037 | R--- | M] () - E:\Autorun.inf -- [ CDFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O34 - HKLM BootExecute: (C:\PROGRA~2\AVG\AVG2012\avgrsa.exe /sync /restart)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 

NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

 

MsConfig:64bit - State: "bootini" - Reg Error: Key error.

MsConfig:64bit - State: "services" - Reg Error: Key error.

MsConfig:64bit - State: "startup" - Reg Error: Key error.

 

SafeBootMin:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

SafeBootMin:64bit: Base - Driver Group

SafeBootMin:64bit: Boot Bus Extender - Driver Group

SafeBootMin:64bit: Boot file system - Driver Group

SafeBootMin:64bit: File system - Driver Group

SafeBootMin:64bit: Filter - Driver Group

SafeBootMin:64bit: HelpSvc - Service

SafeBootMin:64bit: PCI Configuration - Driver Group

SafeBootMin:64bit: PNP Filter - Driver Group

SafeBootMin:64bit: Primary disk - Driver Group

SafeBootMin:64bit: sacsvr - Service

SafeBootMin:64bit: SCSI Class - Driver Group

SafeBootMin:64bit: System Bus Extender - Driver Group

SafeBootMin:64bit: vmms - Service

SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vmms - Service

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

SafeBootNet:64bit: Base - Driver Group

SafeBootNet:64bit: Boot Bus Extender - Driver Group

SafeBootNet:64bit: Boot file system - Driver Group

SafeBootNet:64bit: File system - Driver Group

SafeBootNet:64bit: Filter - Driver Group

SafeBootNet:64bit: HelpSvc - Service

SafeBootNet:64bit: Messenger - Service

SafeBootNet:64bit: NDIS Wrapper - Driver Group

SafeBootNet:64bit: NetBIOSGroup - Driver Group

SafeBootNet:64bit: NetDDEGroup - Driver Group

SafeBootNet:64bit: Network - Driver Group

SafeBootNet:64bit: NetworkProvider - Driver Group

SafeBootNet:64bit: PCI Configuration - Driver Group

SafeBootNet:64bit: PNP Filter - Driver Group

SafeBootNet:64bit: PNP_TDI - Driver Group

SafeBootNet:64bit: Primary disk - Driver Group

SafeBootNet:64bit: rdsessmgr - Service

SafeBootNet:64bit: sacsvr - Service

SafeBootNet:64bit: SCSI Class - Driver Group

SafeBootNet:64bit: Streams Drivers - Driver Group

SafeBootNet:64bit: System Bus Extender - Driver Group

SafeBootNet:64bit: TDI - Driver Group

SafeBootNet:64bit: vmms - Service

SafeBootNet:64bit: WudfUsbccidDriver - Driver

SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vmms - Service

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX:64bit: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX:64bit: {0D407D7A-FEBB-C48A-028C-212DA9EDAA54} - Microsoft Windows Media Player 12.0

ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX:64bit: {4A835694-E0C6-4993-ADA9-08E48370EA96} - Themes Setup

ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX:64bit: {53EDDC9D-A746-31A8-21C4-348AA0974A1C} - Internet Explorer

ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX:64bit: {AAADD50E-495F-F7C6-2646-062F9B2CE929} - Java (Sun)

ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX:64bit: {D06CA67C-3A37-2823-AB45-209CDEA0F383} - Microsoft Windows Media Player 12.0

ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework

ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)

ActiveX: {42CCD705-4612-9CAE-2A09-D5E01EF1F135} - Themes Setup

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework

ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player

ActiveX: {DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D} - Microsoft .NET Framework 1.1 Security Update (KB953297)

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

Drivers32: vidc.DIVX - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)

Drivers32: vidc.yv12 - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.08.15 21:38:08 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Users\x.xxxxxx\Desktop\OTL.exe

[2012.08.08 13:58:22 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice 3.6

[2012.08.08 13:56:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LibreOffice 3.6

[2012.08.02 11:37:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator

[2012.08.02 11:37:20 | 000,095,744 | ---- | C] (pdfforge GbR) -- C:\Windows\SysNative\pdfcmon.dll

[2012.08.02 11:37:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PDFCreator

[2012.08.02 09:04:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET

[2012.08.01 15:06:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.08.01 15:06:54 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2012.08.01 15:06:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2012.07.31 00:20:34 | 000,000,000 | ---D | C] -- C:\Users\x.xxxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Miranda IM

[2012.07.21 11:04:39 | 000,021,992 | ---- | C] (CPUID) -- C:\Windows\SysNative\drivers\cpuz135_x64.sys

[2012.07.21 11:04:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CPUID

[2012.07.21 11:04:39 | 000,000,000 | ---D | C] -- C:\Program Files\CPUID

[2012.07.21 10:43:11 | 000,000,000 | ---D | C] -- C:\Users\x.xxxxxx\Documents\Egosoft

[2012.07.21 10:24:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\X3 Reunion

[2012.07.21 10:13:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\EGOSOFT

[2012.07.18 22:06:17 | 000,000,000 | ---D | C] -- C:\Users\x.xxxxxx\AppData\Roaming\pdfforge

[2012.07.17 19:30:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG

[4 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.08.15 22:02:29 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.08.15 21:46:02 | 000,001,114 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012.08.15 21:45:17 | 000,013,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.08.15 21:45:17 | 000,013,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.08.15 21:39:40 | 000,023,552 | ---- | M] () -- C:\Users\x.xxxxxx\AppData\Local\WebpageIcons.db

[2012.08.15 21:38:14 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\x.xxxxxx\Desktop\OTL.exe

[2012.08.15 21:34:15 | 103,866,570 | ---- | M] () -- C:\Windows\SysNative\drivers\AVG\incavi.avm

[2012.08.15 21:30:03 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012.08.15 21:29:34 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.08.15 21:29:13 | 3219,701,760 | -HS- | M] () -- C:\hiberfil.sys

[2012.08.10 15:20:01 | 001,368,152 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.08.10 15:20:01 | 000,838,362 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.08.10 15:20:01 | 000,362,414 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.08.10 15:20:01 | 000,314,462 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.08.10 15:20:01 | 000,005,472 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.08.05 20:52:08 | 002,966,256 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2012.08.02 11:37:26 | 000,001,164 | ---- | M] () -- C:\Users\Public\Desktop\PDFArchitect.lnk

[2012.08.02 11:37:26 | 000,000,995 | ---- | M] () -- C:\Users\Public\Desktop\PDFCreator.lnk

[2012.07.31 00:20:35 | 000,000,990 | ---- | M] () -- C:\Users\x.xxxxxx\Desktop\Miranda IM.lnk

[2012.07.22 21:44:40 | 001,086,612 | ---- | M] () -- C:\Users\x.xxxxxx\Desktop\x3map.jpg

[2012.07.22 11:20:29 | 000,029,157 | ---- | M] () -- C:\Users\x.xxxxxx\Desktop\x3raketen.pdf

[2012.07.22 10:46:46 | 000,164,646 | ---- | M] () -- C:\Users\x.xxxxxx\Desktop\Schiffseigenschaften.pdf

[2012.07.21 10:24:37 | 000,051,269 | ---- | M] () -- C:\Windows\unins000.dat

[2012.07.21 10:13:06 | 000,681,980 | ---- | M] () -- C:\Windows\unins000.exe

[2012.07.17 19:30:14 | 000,000,941 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2012.lnk

[4 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.08.02 11:37:26 | 000,001,164 | ---- | C] () -- C:\Users\Public\Desktop\PDFArchitect.lnk

[2012.08.02 11:37:26 | 000,000,995 | ---- | C] () -- C:\Users\Public\Desktop\PDFCreator.lnk

[2012.07.22 21:44:38 | 001,086,612 | ---- | C] () -- C:\Users\x.xxxxxx\Desktop\x3map.jpg

[2012.07.22 11:20:29 | 000,029,157 | ---- | C] () -- C:\Users\x.xxxxxx\Desktop\x3raketen.pdf

[2012.07.22 10:46:46 | 000,164,646 | ---- | C] () -- C:\Users\x.xxxxxx\Desktop\Schiffseigenschaften.pdf

[2012.07.21 10:13:22 | 000,681,980 | ---- | C] () -- C:\Windows\unins000.exe

[2012.07.21 10:13:21 | 000,051,269 | ---- | C] () -- C:\Windows\unins000.dat

[2012.07.11 00:27:29 | 000,007,596 | ---- | C] () -- C:\Users\x.xxxxxx\AppData\Local\Resmon.ResmonCfg

[2012.07.07 11:55:25 | 000,000,033 | ---- | C] () -- C:\ProgramData\{081230F8-EA50-42A9-983C-D22ABC2EED3B}.ini

[2012.06.10 17:55:53 | 000,000,680 | RHS- | C] () -- C:\Users\x.xxxxxx\ntuser.pol

[2012.03.11 18:01:14 | 000,000,247 | ---- | C] () -- C:\Users\x.xxxxxx\FFDSettings.bin

[2012.02.29 14:26:56 | 000,416,064 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe

[2011.12.29 11:19:10 | 000,066,856 | ---- | C] () -- C:\Windows\SysWow64\SynTPEnhPS.dll

[2011.12.23 21:58:28 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe

[2011.12.23 21:58:24 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll

[2011.12.23 21:58:24 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll

[2011.12.23 21:58:24 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll

[2011.12.23 21:58:24 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll

[2011.05.06 17:36:28 | 000,007,278 | ---- | C] () -- C:\Users\x.xxxxxx\AppData\Roaming\.freeciv-client-rc-2.2

[2010.03.29 22:53:27 | 000,008,192 | ---- | C] () -- C:\Users\x.xxxxxx\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010.03.27 13:23:59 | 000,000,096 | ---- | C] () -- C:\Users\x.xxxxxx\AppData\Local\fusioncache.dat

[2010.02.24 20:50:22 | 000,023,552 | ---- | C] () -- C:\Users\x.xxxxxx\AppData\Local\WebpageIcons.db

[2009.11.13 00:07:37 | 000,000,590 | ---- | C] () -- C:\Users\x.xxxxxx\AppData\Roaming\wklnhst.dat

[2009.11.10 23:41:47 | 000,017,760 | ---- | C] () -- C:\Users\x.xxxxxx\AppData\Roaming\UserTile.png

 
 ========== LOP Check ==========

 

[2011.05.06 20:27:56 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\.freeciv

[2010.03.03 23:16:08 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Autodesk

[2012.01.01 14:53:39 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\AVG

[2012.01.04 10:53:35 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\AVG2012

[2012.07.07 07:27:37 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Azureus

[2010.03.22 23:03:24 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\BonkEnc

[2012.03.23 23:36:54 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Canneverbe Limited

[2011.07.04 01:00:44 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Canon

[2010.12.04 20:26:24 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\EAC

[2012.07.07 07:27:31 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\FileZilla

[2012.08.10 17:25:19 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\foobar2000

[2009.11.01 22:16:56 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\FreeCDRipper

[2011.12.20 03:10:51 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\FRITZ!

[2011.12.20 01:33:45 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\FRITZ!fax für FRITZ!Box

[2012.07.08 09:11:28 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\gnupg

[2010.07.08 20:26:45 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\gtk-2.0

[2010.04.06 23:04:14 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\ID3 renamer

[2010.11.07 18:57:08 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\IrfanView

[2012.03.23 22:43:01 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\JAM Software

[2012.03.11 18:47:57 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\KastorAllVideoDownloader

[2010.07.08 19:56:49 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\korAccount

[2009.10.29 01:25:54 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Leadertech

[2011.02.08 23:25:22 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\LibreOffice

[2012.07.07 07:27:31 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Miranda

[2011.02.15 23:10:54 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\mresreg

[2010.08.07 13:45:42 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Nokia

[2010.03.29 22:52:20 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Nokia Ovi Suite

[2012.07.15 15:06:35 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Notepad++

[2009.10.29 22:59:34 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\PC Suite

[2011.05.27 18:08:57 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\PCDr

[2012.08.02 11:37:23 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\pdfforge

[2009.11.02 22:59:20 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Protector Suite

[2010.12.01 23:24:21 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Raptr

[2012.01.25 21:42:16 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Samsung

[2011.12.07 00:30:20 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Shareaza

[2011.12.29 11:36:29 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Synaptics

[2012.07.05 22:47:54 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\TeamViewer

[2012.06.04 23:22:51 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Temp

[2010.06.29 22:22:56 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Template

[2012.06.28 00:57:47 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Thunderbird

[2009.10.29 01:06:49 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\TMP

[2012.07.13 19:24:21 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\TS3Client

[2010.03.27 13:27:51 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Turbine

[2010.10.01 23:18:12 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1

[2012.01.21 02:27:18 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\WinBatch

[2012.04.01 10:57:59 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2011.05.06 20:27:56 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\.freeciv

[2010.12.04 20:28:23 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\AccurateRip

[2012.03.14 00:19:08 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Adobe

[2011.11.15 23:15:21 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Apple Computer

[2010.03.03 23:16:08 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Autodesk

[2012.01.01 14:53:39 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\AVG

[2012.01.04 10:53:35 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\AVG2012

[2012.07.07 07:27:37 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Azureus

[2010.03.22 23:03:24 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\BonkEnc

[2012.03.23 23:36:54 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Canneverbe Limited

[2011.07.04 01:00:44 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Canon

[2009.11.03 00:14:20 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Creative

[2009.10.29 01:53:11 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Dell

[2010.09.03 20:10:39 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\DivX

[2009.11.05 23:42:31 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Download Manager

[2010.12.04 20:26:24 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\EAC

[2012.07.07 07:27:31 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\FileZilla

[2012.08.10 17:25:19 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\foobar2000

[2009.11.01 22:16:56 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\FreeCDRipper

[2011.12.20 03:10:51 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\FRITZ!

[2011.12.20 01:33:45 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\FRITZ!fax für FRITZ!Box

[2012.07.08 09:11:28 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\gnupg

[2010.07.08 20:26:45 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\gtk-2.0

[2010.04.06 23:04:14 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\ID3 renamer

[2009.10.29 00:38:31 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Identities

[2009.10.29 01:04:01 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\InstallShield

[2011.12.29 12:02:12 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Intel

[2010.11.07 18:57:08 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\IrfanView

[2012.03.23 22:43:01 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\JAM Software

[2012.03.11 18:47:57 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\KastorAllVideoDownloader

[2010.07.08 19:56:49 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\korAccount

[2009.10.29 01:25:54 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Leadertech

[2011.02.08 23:25:22 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\LibreOffice

[2009.10.29 01:26:02 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Logitech

[2009.10.29 01:12:20 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Macromedia

[2012.07.05 23:47:52 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Malwarebytes

[2009.07.14 20:18:34 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Media Center Programs

[2011.02.19 20:02:30 | 000,000,000 | --SD | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Microsoft

[2012.07.07 07:27:31 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Miranda

[2012.07.07 22:22:18 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Mozilla

[2011.02.15 23:10:54 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\mresreg

[2012.03.21 22:44:50 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Nero

[2010.08.07 13:45:42 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Nokia

[2010.03.29 22:52:20 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Nokia Ovi Suite

[2012.07.15 15:06:35 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Notepad++

[2012.03.15 03:07:34 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\NVIDIA

[2009.10.29 22:59:34 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\PC Suite

[2011.05.27 18:08:57 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\PCDr

[2012.08.02 11:37:23 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\pdfforge

[2009.11.02 22:59:20 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Protector Suite

[2010.12.01 23:24:21 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Raptr

[2009.12.16 21:16:18 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Real

[2009.11.03 00:42:59 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Reallusion

[2009.12.30 16:02:29 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Roxio

[2012.01.25 21:42:16 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Samsung

[2011.12.07 00:30:20 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Shareaza

[2012.07.07 07:27:31 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Skype

[2011.12.26 11:51:40 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\skypePM

[2011.12.29 11:36:29 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Synaptics

[2009.10.29 20:08:30 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Talkback

[2012.07.05 22:47:54 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\TeamViewer

[2012.06.04 23:22:51 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Temp

[2010.06.29 22:22:56 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Template

[2012.06.28 00:57:47 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Thunderbird

[2009.10.29 01:06:49 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\TMP

[2012.07.13 19:24:21 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\TS3Client

[2010.03.27 13:27:51 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\Turbine

[2010.10.01 23:18:12 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1

[2012.07.13 20:17:44 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\vlc

[2011.12.27 18:55:41 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\VMware

[2012.01.21 02:27:18 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\WinBatch

[2010.12.27 17:19:35 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\WinRAR

[2011.07.04 00:56:53 | 000,000,000 | ---D | M] -- C:\Users\x.xxxxxx\AppData\Roaming\ZoomBrowser EX

 
 < %APPDATA%\*.exe /s >

[2010.12.01 23:22:45 | 000,310,208 | ---- | M] (Georgia Institute of Technology) -- C:\Users\x.xxxxxx\AppData\Roaming\Azureus\plugins\mlab\ShaperProbeC.exe

[2011.11.16 22:42:15 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\x.xxxxxx\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe

[2011.12.03 15:21:28 | 000,045,126 | R--- | M] () -- C:\Users\x.xxxxxx\AppData\Roaming\Microsoft\Installer\{57019733-78E6-43DE-8E6D-55349F0FDE6F}\_25838CCE72A1AC2ABE5D8D.exe

[2011.12.03 15:21:28 | 000,045,126 | R--- | M] () -- C:\Users\x.xxxxxx\AppData\Roaming\Microsoft\Installer\{57019733-78E6-43DE-8E6D-55349F0FDE6F}\_6FEFF9B68218417F98F549.exe

[2011.12.03 15:21:28 | 000,045,126 | R--- | M] () -- C:\Users\x.xxxxxx\AppData\Roaming\Microsoft\Installer\{57019733-78E6-43DE-8E6D-55349F0FDE6F}\_B959C1FE92F059D1BDE1B4.exe

[2012.01.11 19:41:49 | 000,576,536 | R--- | M] () -- C:\Users\x.xxxxxx\AppData\Roaming\Microsoft\Installer\{C5AC39F1-001D-4338-84C6-35109525588A}\TweetDeck.exe

[2011.03.23 22:33:57 | 000,188,152 | ---- | M] () -- C:\Users\x.xxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\yjff8k19.default\FlashGot.exe

[2009.12.17 17:16:58 | 061,789,728 | ---- | M] () -- C:\Users\x.xxxxxx\AppData\Roaming\Nokia\Ovi Suite\Software Updater\NokiaOviSuite2Installer.exe

[2011.05.27 18:08:56 | 054,781,576 | ---- | M] (Dell Inc) -- C:\Users\x.xxxxxx\AppData\Roaming\PCDr\Update\Binaries\full_dsc_5830_10_64_01.exe

[2010.10.12 13:36:00 | 000,016,976 | ---- | M] (PC-Doctor, Inc.) -- C:\Users\x.xxxxxx\AppData\Roaming\PCDr\Update\Rules\1df3dbad-12bd-470e-b6dd-8cfcd8c8666d\DellSignedAppUpdaterRules\AddCertificate.exe

[2010.10.12 13:36:00 | 000,016,976 | ---- | M] (PC-Doctor, Inc.) -- C:\Users\x.xxxxxx\AppData\Roaming\PCDr\Update\Rules\1f9c7f89-7041-4eb5-bd8d-a79932dbb44a\DellSignedAppUpdaterRules\AddCertificate.exe

[2010.10.12 13:36:00 | 000,016,976 | ---- | M] (PC-Doctor, Inc.) -- C:\Users\x.xxxxxx\AppData\Roaming\PCDr\Update\Rules\379ed644-f650-407a-b187-40af1a1c0ca7\DellSignedAppUpdaterRules\AddCertificate.exe

[2010.10.12 13:36:00 | 000,016,976 | ---- | M] (PC-Doctor, Inc.) -- C:\Users\x.xxxxxx\AppData\Roaming\PCDr\Update\Rules\3fb794ed-36c2-46dd-a70b-1153da5d959a\DellSignedAppUpdaterRules\AddCertificate.exe

[2010.10.12 13:36:00 | 000,016,976 | ---- | M] (PC-Doctor, Inc.) -- C:\Users\x.xxxxxx\AppData\Roaming\PCDr\Update\Rules\40700060-0cb5-48c8-b415-4ebae8559590\DellSignedAppUpdaterRules\AddCertificate.exe

[2010.10.12 13:36:00 | 000,016,976 | ---- | M] (PC-Doctor, Inc.) -- C:\Users\x.xxxxxx\AppData\Roaming\PCDr\Update\Rules\561cb399-2aa6-4190-8d94-2e86e6cd45da\DellSignedAppUpdaterRules\AddCertificate.exe

[2010.10.12 13:36:00 | 000,016,976 | ---- | M] (PC-Doctor, Inc.) -- C:\Users\x.xxxxxx\AppData\Roaming\PCDr\Update\Rules\7db9ebbe-35e8-4d85-8133-0442c9c3b526\DellSignedAppUpdaterRules\AddCertificate.exe

[2010.10.12 13:36:00 | 000,016,976 | ---- | M] (PC-Doctor, Inc.) -- C:\Users\x.xxxxxx\AppData\Roaming\PCDr\Update\Rules\a34159f6-98b9-4f57-babd-c3f83a11b6c5\DellSignedAppUpdaterRules\AddCertificate.exe

[2010.10.12 13:36:00 | 000,016,976 | ---- | M] (PC-Doctor, Inc.) -- C:\Users\x.xxxxxx\AppData\Roaming\PCDr\Update\Rules\a8416f43-1dfa-496e-82e9-dc5da1028eb1\DellSignedAppUpdaterRules\AddCertificate.exe

[2010.10.12 13:36:00 | 000,016,976 | ---- | M] (PC-Doctor, Inc.) -- C:\Users\x.xxxxxx\AppData\Roaming\PCDr\Update\Rules\b28f2fd1-316a-4890-a1cc-718e56ba0245\DellSignedAppUpdaterRules\AddCertificate.exe

[2010.10.12 13:36:00 | 000,016,976 | ---- | M] (PC-Doctor, Inc.) -- C:\Users\x.xxxxxx\AppData\Roaming\PCDr\Update\Rules\cee2e63a-fb42-4fe6-a730-6b5418c91a15\DellSignedAppUpdaterRules\AddCertificate.exe

[2010.10.12 13:36:00 | 000,016,976 | ---- | M] (PC-Doctor, Inc.) -- C:\Users\x.xxxxxx\AppData\Roaming\PCDr\Update\Rules\f073f133-5945-4550-87bd-4b88fa6ea3be\DellSignedAppUpdaterRules\AddCertificate.exe

[2012.03.05 07:10:48 | 000,106,408 | ---- | M] () -- C:\Users\x.xxxxxx\AppData\Roaming\Samsung\Kies\FirmwareUpdateTemp\AGENT\AgentInstaller.exe

[2012.03.05 07:10:48 | 000,101,288 | ---- | M] () -- C:\Users\x.xxxxxx\AppData\Roaming\Samsung\Kies\FirmwareUpdateTemp\AGENT\AgentUpdate.exe

[2012.03.05 07:10:48 | 000,021,416 | ---- | M] () -- C:\Users\x.xxxxxx\AppData\Roaming\Samsung\Kies\FirmwareUpdateTemp\AGENT\KiesPDLR.exe

[2012.04.04 07:05:14 | 000,954,256 | ---- | M] (Samsung) -- C:\Users\x.xxxxxx\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\Kies.exe

[2012.04.04 07:05:18 | 000,278,928 | ---- | M] () -- C:\Users\x.xxxxxx\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\KiesDriverInstaller.exe

[2012.03.29 07:13:22 | 000,309,760 | ---- | M] (Samsung) -- C:\Users\x.xxxxxx\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\KiesLogger.exe

[2012.04.04 07:05:16 | 003,521,424 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Users\x.xxxxxx\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\KiesTrayAgent.exe

[2011.12.23 21:59:48 | 000,140,800 | ---- | M] (Mobileleader Co., Ltd.) -- C:\Users\x.xxxxxx\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\External\DeviceModules\ConnectionManager.exe

[2012.03.29 07:11:58 | 000,297,984 | ---- | M] (Mobileleader Co., Ltd.) -- C:\Users\x.xxxxxx\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\External\DeviceModules\DeviceDataService.exe

[2012.03.29 07:12:02 | 000,694,784 | ---- | M] (Mobileleader Co., Ltd.) -- C:\Users\x.xxxxxx\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\External\DeviceModules\DeviceManager.exe

[2012.04.04 07:05:20 | 000,067,472 | ---- | M] (Samsung) -- C:\Users\x.xxxxxx\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\External\DeviceModules\Kies_Tutorial.exe

[2012.03.29 07:11:38 | 000,106,920 | ---- | M] () -- C:\Users\x.xxxxxx\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\External\FirmwareUpdate\AgentInstaller.exe

[2012.03.29 07:11:38 | 000,101,288 | ---- | M] () -- C:\Users\x.xxxxxx\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\External\FirmwareUpdate\AgentUpdate.exe

[2012.04.04 07:05:26 | 000,183,696 | ---- | M] () -- C:\Users\x.xxxxxx\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\External\FirmwareUpdate\BinaryLoaderMgr.exe

[2012.04.04 07:05:28 | 000,021,392 | ---- | M] () -- C:\Users\x.xxxxxx\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\External\FirmwareUpdate\KiesPDLR.exe

[2012.04.04 07:05:30 | 003,570,312 | ---- | M] (Freeware) -- C:\Users\x.xxxxxx\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\External\MediaModules\MyFreeCodecPack.exe

[2012.03.29 07:10:58 | 024,161,656 | ---- | M] (SAMSUNG Electronics Co., Ltd.) -- C:\Users\x.xxxxxx\AppData\Roaming\Samsung\Kies\UpdateTemp\backup\USB Driver\SAMSUNG_USB_Driver_for_Mobile_Phones.exe

[2012.04.04 07:05:32 | 000,371,088 | ---- | M] (ml) -- C:\Users\x.xxxxxx\AppData\Roaming\Samsung\Kies\UpdateTemp\Temp\Kies.Update.exe

[2012.05.30 03:18:10 | 000,371,128 | ---- | M] (ml) -- C:\Users\x.xxxxxx\AppData\Roaming\Samsung\Kies\UpdateTemp\Updater\Kies.Update.exe

[2007.09.18 10:22:00 | 016,049,556 | ---- | M] (Marvell                                                     ) -- C:\Users\x.xxxxxx\AppData\Roaming\TMP\SetupYukonWin_516N.exe

 
 < %SYSTEMDRIVE%\*.exe >

 
 < MD5 for: AGP440.SYS  >

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys

[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys

[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll

[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll

 
 < MD5 for: IASTOR.SYS  >

[2007.04.25 13:17:36 | 000,277,784 | ---- | M] (Intel Corporation) MD5=5DF93509037399B53D3ECAA8A67B6C58 -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\driver\iaStor.sys

[2007.04.25 13:18:12 | 000,537,368 | ---- | M] (Intel Corporation) MD5=6E9BEDAEFA5A3F86CECF40F4963F3021 -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys

[2007.04.25 13:18:12 | 000,537,368 | ---- | M] (Intel Corporation) MD5=6E9BEDAEFA5A3F86CECF40F4963F3021 -- C:\Windows\SysNative\drivers\iaStor.sys

[2007.04.25 13:18:12 | 000,537,368 | ---- | M] (Intel Corporation) MD5=6E9BEDAEFA5A3F86CECF40F4963F3021 -- C:\Windows\SysNative\DriverStore\FileRepository\iaahci.inf_amd64_neutral_9b7f21209ab560c7\iaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys

[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys

[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys

[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys

[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys

[2011.03.11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys

[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll

[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll

[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll

[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll

[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll

[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys

[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys

[2011.03.11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys

[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys

[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys

[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys

[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll

[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll

[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll

[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll

[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll

[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll

[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll

[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll

[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll

[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll

[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe

[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe

[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe

[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe

[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe

[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe

[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe

[2012.07.03 13:46:42 | 000,217,672 | ---- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2009.10.28 09:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe

[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys

[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 16 bytes -> C:\Users\x.xxxxxx\Downloads:Shareaza.GUID

@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:0B4227B4
 

< End of report >

Ist das rein zufällig ein Büro-PC?

Es ist rein zufällig mein privater Laptop.