Trojaner-Board - Bundespolizei Trojaner sperrt Bildschirm

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Bundespolizei Trojaner sperrt Bildschirm (https://www.trojaner-board.de/122252-bundespolizei-trojaner-sperrt-bildschirm.html)

Bundespolizei Trojaner sperrt Bildschirm

Hallo zusammen,

ich habe mir gestern wohl einen Trojaner eingefangen :-(. Den ich leider nicht mehr so einfach los werde. Kurz nach dem Anmelden unter Windows 7 erscheint ein Bildschrim das ich 100euro bezahlen soll und mich diverser Straftaten schuldig gemacht habe. Alles in einem sehr schlechten Deutsch geschrieben, so dass gleich klar war das es sich um einen Trojaner handel muss.
Ich hab mich bei euch schon schlau gemacht und OTL durchlaufen lassen bzw. ich habe auch MalewareBytes durch laufen lassen.

Wie werde ich das ding wieder los? Ich wäre über eure hilfe echt Dankbar.

Hier ist das OTL file:

Code:

OTL logfile created on: 16.08.2012 15:08:42 - Run 6

OTL by OldTimer - Version 3.2.57.0     Folder = C:\Users\carsten\Desktop

 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,87 Gb Total Physical Memory | 1,95 Gb Available Physical Memory | 67,83% Memory free

5,74 Gb Paging File | 4,92 Gb Available in Paging File | 85,86% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 74,52 Gb Total Space | 4,77 Gb Free Space | 6,40% Space Free | Partition Type: NTFS

Drive D: | 73,06 Gb Total Space | 22,45 Gb Free Space | 30,73% Space Free | Partition Type: NTFS

 

Computer Name: CARSTEN-PC | User Name: carsten | Logged in as Administrator.

Boot Mode: SafeMode with Networking | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.08.16 11:03:18 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\carsten\Desktop\OTL.exe

PRC - [2012.07.03 13:46:42 | 000,973,488 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbam.exe

PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2009.10.24 00:40:16 | 000,046,512 | ---- | M] () -- C:\Programme\OpenAfs\Client\Program\afs_shl_ext_1033.dll

MOD - [2008.03.30 16:22:42 | 000,070,144 | ---- | M] () -- C:\Programme\PSPad editor\PSPadShell.dll

MOD - [2002.05.14 19:22:34 | 000,122,880 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - File not found [Disabled | Stopped] -- C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)

SRV - [2012.07.18 08:25:39 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2012.07.05 18:41:46 | 003,048,136 | ---- | M] (Skype Technologies S.A.) [Auto | Stopped] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)

SRV - [2012.05.08 11:01:59 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2012.05.08 11:01:58 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2012.04.04 07:53:50 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2012.02.29 08:50:48 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2011.11.14 01:03:59 | 001,045,256 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

SRV - [2011.08.07 16:44:54 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)

SRV - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)

SRV - [2010.07.29 07:05:38 | 000,296,808 | ---- | M] (Nuance Communications, Inc.) [Auto | Stopped] -- C:\Programme\Common Files\Nuance\dgnsvc.exe -- (DragonSvc)

SRV - [2010.02.19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Programme\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)

SRV - [2010.01.20 01:53:14 | 000,241,664 | ---- | M] (Tanuki Software, Ltd.) [On_Demand | Stopped] -- C:\Programme\GeoServer 2.0.1\wrapper.exe -- (GeoServer 2.0.1)

SRV - [2009.10.24 00:32:18 | 000,651,184 | ---- | M] (OpenAFS Project) [Auto | Stopped] -- C:\Programme\OpenAfs\Client\Program\afsd_service.exe -- (TransarcAFSDaemon)

SRV - [2009.09.28 15:41:12 | 000,024,645 | ---- | M] (Apache Software Foundation) [Auto | Stopped] -- D:\Programme\QGIS\apache\bin\httpd.exe -- (ApacheOSGeo4WWebServer)

SRV - [2009.09.08 09:48:55 | 000,066,048 | ---- | M] (PostgreSQL Global Development Group) [Auto | Stopped] -- C:\Program Files\PostgreSQL\8.4\bin\pg_ctl.exe -- (postgresql-8.4)

SRV - [2009.07.21 04:04:00 | 000,047,128 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Microsoft SQL Server\100\Shared\sqladhlp.exe -- (MSSQLServerADHelper100)

SRV - [2009.07.14 03:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)

SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)

SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)

SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2009.03.30 04:25:26 | 043,010,392 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe -- (MSSQL$SQLEXPRESS)

SRV - [2009.03.30 04:23:32 | 000,254,808 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe -- (SQLBrowser)

SRV - [2009.03.30 04:23:24 | 000,366,936 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE -- (SQLAgent$SQLEXPRESS)

SRV - [2008.07.10 03:49:44 | 000,098,840 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter)

SRV - [2007.08.24 06:59:20 | 000,068,464 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Microsoft Office\Office12\GrooveAuditService.exe -- (Microsoft Office Groove Audit Service)

SRV - [2007.08.24 03:19:12 | 000,443,776 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv)

SRV - [2007.03.20 17:41:24 | 000,153,792 | ---- | M] (Adobe Systems Incorporated) [Disabled | Stopped] -- C:\Programme\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe -- (Adobe Version Cue CS3)

SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\VBoxNetFlt.sys -- (VBoxNetFlt)

DRV - [2012.08.16 14:46:31 | 000,040,776 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)

DRV - [2012.05.08 11:01:59 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2012.05.08 11:01:59 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2011.12.15 16:00:00 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)

DRV - [2011.11.04 14:42:02 | 000,104,752 | ---- | M] (Oracle Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VBoxNetAdp.sys -- (VBoxNetAdp)

DRV - [2011.08.17 10:56:32 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)

DRV - [2011.08.17 10:56:30 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerflt.sys -- (upperdev)

DRV - [2011.08.17 10:56:26 | 000,023,168 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc)

DRV - [2011.08.17 10:56:22 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd)

DRV - [2010.11.20 14:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)

DRV - [2010.11.20 14:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)

DRV - [2010.11.20 14:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)

DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV - [2010.11.20 11:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)

DRV - [2010.11.20 11:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)

DRV - [2010.11.20 11:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)

DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009.11.22 21:11:11 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot | Stopped] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)

DRV - [2009.09.21 17:58:28 | 001,218,048 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)

DRV - [2009.07.14 01:53:36 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\loop.sys -- (msloop)

DRV - [2009.05.14 09:48:04 | 000,762,232 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\UDXTTM6010.sys -- (UDXTTM6010)

DRV - [2009.03.30 04:09:28 | 000,239,336 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\System32\drivers\RsFx0103.sys -- (RsFx0103)

DRV - [2008.08.28 17:17:38 | 000,131,856 | ---- | M] (Deterministic Networks, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\dne2000.sys -- (DNE)

DRV - [2007.01.18 19:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CVirtA.sys -- (CVirtA)

DRV - [2006.11.14 17:35:20 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)

DRV - [2005.12.22 17:02:22 | 000,051,840 | ---- | M] (REDC) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)

DRV - [2005.11.16 20:28:32 | 000,028,928 | ---- | M] (REDC) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}

IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2776682

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.searchqu.com/413

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 7F A4 FB 08 BF 82 CB 01  [binary data]

IE - HKCU\..\URLSearchHook: {51a86bb3-6602-4c85-92a5-130ee4864f13} - No CLSID value found

IE - HKCU\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}

IE - HKCU\..\SearchScopes\{052A1970-A861-4835-A805-C198CA0EF5D3}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=TRL2&o=15902&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=TW&apn_dtid=YYYYYYYYDE&apn_uid=54FB0585-3FB0-4CBB-AC73-7CE0167B8628&apn_sauid=857E0342-93AA-4641-9B6E-26C66AF693B6

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}

IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2776682

IE - HKCU\..\SearchScopes\{DC52F059-EF38-4ACC-8431-6D5765822AA9}: "URL" = hxxp://www.google.de/search?q={searchTerms}

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultengine: "Ask.com"

FF - prefs.js..browser.search.defaultenginename: "Search Results"

FF - prefs.js..browser.search.defaultthis.engineName: "BrotherSoft Extreme Customized Web Search"

FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2776682&SearchSource=3&q={searchTerms}"

FF - prefs.js..browser.search.order.1: "Search Results"

FF - prefs.js..browser.search.selectedEngine: "Google"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "about:blank"

FF - prefs.js..keyword.URL: "hxxp://dts.search-results.com/sr?src=ffb&appid=0&systemid=413&sr=0&q="

FF - user.js - File not found

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll ()

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.07.18 08:25:40 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.05.14 14:50:33 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2012.06.18 20:49:22 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2012.05.14 14:50:33 | 000,000,000 | ---D | M]

 

[2012.07.02 18:38:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\carsten\AppData\Roaming\mozilla\Extensions

[2010.04.25 08:12:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\carsten\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}

[2010.07.01 08:28:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\carsten\AppData\Roaming\mozilla\Extensions\{ee53ece0-255c-4cc6-8a7e-81a8b6e5ba2c}

[2012.08.04 01:13:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\carsten\AppData\Roaming\mozilla\Firefox\Profiles\fu92pvm9.default\extensions

[2012.08.01 07:40:37 | 000,000,000 | ---D | M] (ColorZilla) -- C:\Users\carsten\AppData\Roaming\mozilla\Firefox\Profiles\fu92pvm9.default\extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326}

[2012.07.02 13:33:42 | 000,000,000 | ---D | M] (WOT) -- C:\Users\carsten\AppData\Roaming\mozilla\Firefox\Profiles\fu92pvm9.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}

[2012.05.18 09:14:41 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\carsten\AppData\Roaming\mozilla\Firefox\Profiles\fu92pvm9.default\extensions\ich@maltegoetz.de

[2011.09.21 09:27:32 | 000,002,396 | ---- | M] () -- C:\Users\carsten\AppData\Roaming\Mozilla\Firefox\Profiles\fu92pvm9.default\searchplugins\askcom.xml

[2012.07.02 18:38:55 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2012.07.20 08:54:10 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

[2012.05.05 12:36:18 | 000,097,315 | ---- | M] () (No name found) -- C:\USERS\CARSTEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FU92PVM9.DEFAULT\EXTENSIONS\{0E10F3D7-07F6-4F12-97B9-9B27E07139A5}.XPI

[2012.05.23 11:34:10 | 000,072,936 | ---- | M] () (No name found) -- C:\USERS\CARSTEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FU92PVM9.DEFAULT\EXTENSIONS\PIXELZOOMER@MATTHIASSCHUETZ.COM.XPI

[2012.07.18 08:25:40 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2012.04.13 21:14:22 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

[2012.06.07 17:40:20 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.06.07 17:40:19 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

[2012.06.07 17:40:19 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml

[2012.06.07 17:40:19 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.06.07 17:40:19 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.06.07 17:40:19 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

 
 ========== Chrome  ==========

 

CHR - homepage: hxxp://www.google.com/

CHR - default_search_provider: Search Results (Enabled)

CHR - default_search_provider: search_url = hxxp://dts.search-results.com/sr?src=crb&appid=0&systemid=413&sr=0&q={searchTerms}

CHR - default_search_provider: suggest_url = 

CHR - homepage: hxxp://www.google.com/

CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\21.0.1180.79\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\21.0.1180.79\pdf.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\21.0.1180.79\gcswf32.dll

CHR - plugin: Shockwave Flash (Disabled) = C:\Users\carsten\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll

CHR - plugin: Skype Toolbars (Enabled) = C:\Users\carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\npSkypeChromePlugin.dll

CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll

CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll

CHR - plugin: Java Deployment Toolkit 6.0.310.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

CHR - plugin: Java(TM) Platform SE 6 U31 (Enabled) = C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll

CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL

CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll

CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll

CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll

CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll

CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll

CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll

CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll

CHR - plugin: DivX Web Player (Enabled) = C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll

CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll

CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll

CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files\Microsoft Silverlight\4.0.60310.0\npctrl.dll

CHR - Extension: YouTube = C:\Users\carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\

CHR - Extension: Google-Suche = C:\Users\carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\

CHR - Extension: Skype Click to Call = C:\Users\carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.1.0.10441_0\

CHR - Extension: Google Mail = C:\Users\carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

 

O1 HOSTS File: ([2010.10.28 20:33:04 | 000,000,844 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 10.254.254.253        AFS

O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll ()

O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\WIA6EB~1\Datamngr\ToolBar\searchqudtx.dll File not found

O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll ()

O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\WIA6EB~1\Datamngr\ToolBar\searchqudtx.dll File not found

O3 - HKLM\..\Toolbar: (TerraTec Home Cinema) - {AD6E6555-FB2C-47D4-8339-3E2965509877} - C:\Programme\TerraTec\TerraTec Home Cinema\ThcDeskBand.dll (TerraTec Electronic GmbH)

O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [AdobeCS5.5ServiceManager] "C:\Program Files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin File not found

O4 - HKLM..\Run: [AdobeCS6ServiceManager] C:\Program Files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [DNS7reminder] D:\Programme\Dragon\Ereg\Ereg.exe (Nuance Communications, Inc.)

O4 - HKLM..\Run: [SwitchBoard] C:\Programme\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [WPDShServiceObj] C:\Users\carsten\AppData\Local\Microsoft\Windows\1915\WPDShServiceObj.exe ()

O4 - HKCU..\Run: [ISUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation)

O4 - HKCU..\Run: [Remote Control Editor] C:\Program Files\Common Files\TerraTec\Remote\TTTvRc.exe (Elgato Systems)

O4 - Startup: C:\Users\carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\carsten\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

O4 - Startup: C:\Users\carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O8 - Extra context menu item: An vorhandenes PDF anfügen - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)

O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 130.149.7.7 193.174.75.142

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{79474E48-9F6B-47B4-9609-0ECAFE1DDA2F}: DhcpNameServer = 130.149.7.7 193.174.75.142

O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - Winlogon\Notify\AfsLogon: DllName - (C:\Program Files\OpenAFS\Client\Program\afslogon.dll) - C:\Programme\OpenAfs\Client\Program\afslogon.dll (OpenAFS Project)

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O33 - MountPoints2\{e88a7161-d79a-11de-899f-002318f1034d}\Shell - "" = AutoRun

O33 - MountPoints2\{e88a7161-d79a-11de-899f-002318f1034d}\Shell\AutoRun\command - "" = G:\SETUP.EXE

O33 - MountPoints2\{e88a7161-d79a-11de-899f-002318f1034d}\Shell\configure\command - "" = G:\SETUP.EXE

O33 - MountPoints2\{e88a7161-d79a-11de-899f-002318f1034d}\Shell\install\command - "" = G:\SETUP.EXE

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.08.16 14:42:26 | 000,000,000 | ---D | C] -- C:\Users\carsten\AppData\Roaming\hellomoto

[2012.08.16 12:13:07 | 000,000,000 | ---D | C] -- C:\Users\carsten\AppData\Roaming\Malwarebytes

[2012.08.16 12:12:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.08.16 12:12:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.08.16 12:12:54 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2012.08.16 12:12:54 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2012.08.16 11:13:35 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Users\carsten\Desktop\OTL.exe

[2012.08.15 16:32:42 | 000,031,584 | ---- | C] (TuneUp Software) -- C:\Windows\System32\TURegOpt.exe

[2012.08.15 16:32:38 | 000,021,344 | ---- | C] (TuneUp Software) -- C:\Windows\System32\authuitu.dll

[2012.08.15 16:31:39 | 000,000,000 | ---D | C] -- C:\ProgramData\TuneUp Software

[2012.08.15 16:31:11 | 000,327,749 | ---- | C] (RealNetworks, Inc.) -- C:\Windows\System32\drvc.dll

[2012.08.15 16:31:06 | 000,000,000 | -HSD | C] -- C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936}

[2012.08.14 16:34:21 | 000,000,000 | ---D | C] -- C:\Users\carsten\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1

[2012.08.14 16:24:49 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Adobe

[2012.08.08 16:28:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

[2012.07.24 16:45:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\sixteen tons entertainment

[2012.07.24 16:36:59 | 000,000,000 | ---D | C] -- C:\Program Files\sixteen tons entertainment

[2012.04.11 19:26:05 | 000,250,544 | ---- | C] (KeyWorks Software) -- C:\Program Files\Common Files\keyhelp.ocx

[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.08.16 14:44:26 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.08.16 14:44:05 | 2309,890,048 | -HS- | M] () -- C:\hiberfil.sys

[2012.08.16 14:41:46 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012.08.16 12:12:55 | 000,001,067 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.08.16 11:12:34 | 000,761,938 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012.08.16 11:12:34 | 000,717,256 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012.08.16 11:12:34 | 000,172,324 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012.08.16 11:12:34 | 000,145,278 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012.08.16 11:06:55 | 000,013,808 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.08.16 11:06:55 | 000,013,808 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.08.16 11:03:18 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\carsten\Desktop\OTL.exe

[2012.08.16 10:17:11 | 000,003,424 | ---- | M] () -- C:\bootsqm.dat

[2012.08.15 16:14:01 | 000,001,100 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012.08.14 22:48:31 | 004,146,600 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2012.08.14 16:22:03 | 000,001,488 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Application Manager.lnk

[2012.08.07 20:43:40 | 000,138,992 | ---- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys

[2012.08.07 20:43:30 | 000,281,152 | ---- | M] () -- C:\Windows\System32\PnkBstrB.xtr

[2012.08.07 20:42:32 | 000,214,504 | ---- | M] () -- C:\Windows\System32\PnkBstrB.ex0

[2012.07.25 09:24:21 | 002,106,067 | ---- | M] () -- C:\Users\carsten\Desktop\Phyto79n09_913.pdf

[2012.07.25 09:17:18 | 001,187,489 | ---- | M] () -- C:\Users\carsten\Desktop\hess-10-277-2006.pdf

[2012.07.18 14:27:21 | 001,232,885 | ---- | M] () -- C:\Users\carsten\Desktop\ISO19115_GermanTranslation_GDIDE.pdf

[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.08.16 12:12:55 | 000,001,067 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.08.16 10:17:11 | 000,003,424 | ---- | C] () -- C:\bootsqm.dat

[2012.08.14 16:29:58 | 000,000,852 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Captivate 6 (32 Bit).lnk

[2012.08.14 16:27:28 | 000,000,852 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Media Encoder CS6.lnk

[2012.08.14 16:25:38 | 000,000,967 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Help.lnk

[2012.08.14 16:24:25 | 000,001,448 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Captivate Reviewer 6.lnk

[2012.08.14 16:24:18 | 000,001,279 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Captivate Quiz Results Analyzer 6.0.lnk

[2012.08.14 16:22:03 | 000,001,500 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Application Manager.lnk

[2012.08.14 16:22:03 | 000,001,488 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Application Manager.lnk

[2012.07.25 09:24:21 | 002,106,067 | ---- | C] () -- C:\Users\carsten\Desktop\Phyto79n09_913.pdf

[2012.07.25 09:17:06 | 001,187,489 | ---- | C] () -- C:\Users\carsten\Desktop\hess-10-277-2006.pdf

[2012.07.18 14:27:21 | 001,232,885 | ---- | C] () -- C:\Users\carsten\Desktop\ISO19115_GermanTranslation_GDIDE.pdf

[2012.07.13 08:39:11 | 000,000,145 | ---- | C] () -- C:\Users\carsten\.java.policy

[2012.04.19 10:05:39 | 000,191,424 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat

[2012.04.10 09:18:43 | 000,000,017 | ---- | C] () -- C:\Users\carsten\AppData\Local\resmon.resmoncfg

[2012.01.16 16:20:20 | 000,180,224 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll

[2011.12.21 14:30:16 | 000,009,216 | ---- | C] () -- C:\Users\carsten\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011.12.19 14:10:57 | 000,002,154 | ---- | C] () -- C:\Users\carsten\AppData\Roaming\SAS7_000.DAT

[2011.12.09 16:31:52 | 000,032,256 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll

[2011.11.25 22:12:49 | 000,017,408 | ---- | C] () -- C:\Users\carsten\AppData\Local\WebpageIcons.db

[2011.11.21 19:02:07 | 000,003,395 | ---- | C] () -- C:\Users\carsten\.ganttproject

[2011.06.08 08:26:30 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe

[2011.05.17 16:42:13 | 000,000,000 | ---- | C] () -- C:\Users\carsten\.octave_hist

[2011.02.22 13:09:54 | 000,000,335 | ---- | C] () -- C:\Users\carsten\AppData\Local\Perfmon.PerfmonCfg

[2011.02.21 12:15:04 | 000,011,192 | ---- | C] () -- C:\Users\carsten\gsview32.ini

[2011.02.21 12:14:15 | 000,000,043 | ---- | C] () -- C:\Windows\gswin32.ini

[2011.02.11 18:40:40 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll

[2010.10.15 14:23:56 | 000,163,840 | ---- | C] () -- C:\Windows\j3dcore-ogl.dll

[2010.10.15 14:23:56 | 000,049,152 | ---- | C] () -- C:\Windows\j3dcore-ogl-chk.dll

[2010.10.15 14:23:56 | 000,040,960 | ---- | C] () -- C:\Windows\j3dcore-ogl-cg.dll

[2010.10.15 14:23:55 | 000,823,296 | ---- | C] () -- C:\Windows\j3dcore-d3d.dll

[2010.08.25 19:30:02 | 000,439,308 | ---- | C] () -- C:\Windows\System32\igcompkrng500.bin

[2010.08.25 19:30:00 | 000,982,240 | ---- | C] () -- C:\Windows\System32\igkrng500.bin

[2010.08.25 19:30:00 | 000,092,356 | ---- | C] () -- C:\Windows\System32\igfcg500m.bin

[2010.08.25 18:57:00 | 000,000,151 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config

[2010.03.09 20:43:37 | 000,000,053 | ---- | C] () -- C:\Users\carsten\DIR.bat

[2010.02.20 09:31:50 | 000,000,016 | ---- | C] () -- C:\Users\carsten\.javafx_ping_sent

[2010.02.20 09:31:48 | 000,000,000 | ---- | C] () -- C:\Users\carsten\.javafx_eula_accepted

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 242 bytes -> C:\ProgramData\TEMP:0FF263E8
 

< End of report >

und hier der code von Maleware:

Code:

Malwarebytes Anti-Malware 1.62.0.1300

www.malwarebytes.org
 

Datenbank Version: v2012.08.16.07
 

Windows 7 Service Pack 1 x86 NTFS (Abgesichertenmodus/Netzwerkfähig)

Internet Explorer 9.0.8112.16421

carsten :: CARSTEN-PC [Administrator]
 

16.08.2012 12:34:42

mbam-log-2012-08-16 (12-34-42).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|H:\|)

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 932855

Laufzeit: 2 Stunde(n), 3 Minute(n), 2 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 6

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\adbbpci20019.mexw32 (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\adbbpci20023.mexw32 (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\encadapci1710.mexw32 (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\carsten\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WM7B7BQZ\WORLD_21_target_5830[1].exe (PUP.Adware.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

D:\Programme\QGIS\apache\bin\ab.exe (Trojan.Swrort) -> Erfolgreich gelöscht und in Quarantäne gestellt.

D:\TU_Bln\qtoctave-0.7.2\octave\libexec\octave\packages\image-1.0.4\i686-pc-msdosmsvc-api-v32\bwfill.oct (Trojan.Dropper) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

und hier noch mal das Extra File von OTL:

Code:

OTL Extras logfile created on: 16.08.2012 15:08:42 - Run 6

OTL by OldTimer - Version 3.2.57.0     Folder = C:\Users\carsten\Desktop

 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,87 Gb Total Physical Memory | 1,95 Gb Available Physical Memory | 67,83% Memory free

5,74 Gb Paging File | 4,92 Gb Available in Paging File | 85,86% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 74,52 Gb Total Space | 4,77 Gb Free Space | 6,40% Space Free | Partition Type: NTFS

Drive D: | 73,06 Gb Total Space | 22,45 Gb Free Space | 30,73% Space Free | Partition Type: NTFS

 

Computer Name: CARSTEN-PC | User Name: carsten | Logged in as Administrator.

Boot Mode: SafeMode with Networking | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

.html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)

https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [Bridge] -- C:\Program Files\Adobe\Adobe Bridge CS5.1\Bridge.exe "%L" (Adobe Systems, Inc.)

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~1\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 
 ========== Authorized Applications List ==========

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{0BE79F6E-4F56-41B7-9326-FD26ED262FC5}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | 

"{151DE165-E3AB-4FAC-9F5C-7731B9ECC84C}" = lport=50901 | protocol=6 | dir=in | name=adobe version cue cs3 server | 

"{245E18C9-6225-4519-AE2E-33FB3F5A1EC6}" = lport=3704 | protocol=6 | dir=in | name=adobe version cue cs3 server | 

"{300723BD-C818-4902-8ED0-3C613997B1FD}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{3641B8E2-69B6-4E15-9A8D-20C52F33A81D}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{38D26CFE-83F0-4B53-B16B-EDFEC6D0E9B9}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 

"{442C8F07-89B5-43AD-9E45-CDEA81E14D0B}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{49C351FB-7765-42A7-BDEE-E37070DCD87F}" = rport=4444 | protocol=6 | dir=out | name=kerberos_kfw_port_4444 | 

"{563F2621-B91F-4C5B-8BB7-65FD24BED993}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{6F6EB06E-99DB-4B92-B4AA-C939990586BD}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{7DEE509A-556B-4C83-A2D9-6A3EC657A149}" = lport=51001 | protocol=6 | dir=in | name=dragon smart phone server | 

"{8766E5D5-5327-4916-8FDB-461471512BC1}" = lport=50900 | protocol=6 | dir=in | name=adobe version cue cs3 server | 

"{92DC0556-CDF0-4B27-9145-FB683EB61E87}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{97D018D5-1821-46F9-A5F8-07E944E34C36}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 

"{9A2E1941-A1C1-43DE-B6B9-95074DA3DE35}" = lport=3703 | protocol=6 | dir=in | name=adobe version cue cs3 server | 

"{9B69D52C-F0FB-4F28-AE21-93D2D4794CCC}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{9C6FACFB-72AE-43A0-BF57-D1E62F506FAB}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{A73D6B29-64FF-47CD-9CA8-39775DE0D8B5}" = rport=10243 | protocol=6 | dir=out | app=system | 

"{A9BD3EE4-2DED-472B-9A3F-BF7ABFBB82A2}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{AA4B8BDE-6CEC-4D72-870E-291D8A22A6CE}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{AAD67BE3-FC69-4BB2-8D9B-8A899A9A8285}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 

"{BB96D5AA-2E4D-48D2-B5BA-F3E7BAC562DA}" = lport=10243 | protocol=6 | dir=in | app=system | 

"{CAFB00AE-44C7-4EC9-AE7B-A333886CF6B6}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 

"{DA7942A1-11F1-4FA5-A2B4-237291479756}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{DDE85C1E-204C-4B36-BEC8-61DE9DBA120E}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{DF55EC12-35EF-4A40-9B18-1764BB0E90C6}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{F5EDAF5E-21BB-4899-9384-770758E509B4}" = lport=7001 | protocol=17 | dir=in | name=afs cachemanager callback (udp) | 

"{FDB51434-56B9-48E0-855B-AD71D632DFF3}" = rport=88 | protocol=6 | dir=out | name=kerberos_kfw_port_88 | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{00073C91-CB7D-4718-A2A9-ABD8677D1579}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{0092D901-B396-4845-93F1-85FB5BD58210}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{010F4EAE-8A0C-478F-A504-21191237A9F0}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{01A44A92-B044-43DA-A9D8-5CA9CDD2A984}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{020A10E8-8BD1-4EB3-895A-82B651B0AD33}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{021A5765-5CE1-4B4B-B20A-77D08FC476A6}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{0291C868-DF80-4E95-B699-73C02191CFA8}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{02F877D3-0F1D-4488-96EC-945285538ED6}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{0321F4C0-1355-4CC0-887C-251F7D2EFBD1}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{03229062-C945-4855-896C-EA5D98F922F6}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{04773E4D-4515-4B65-85EC-1DEE458BD1BC}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{050D4CBB-F878-4971-93FB-6C3C55BCD117}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{0723CDD3-983E-4ADD-9329-9CDD43394E97}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{074992FF-6190-491D-8545-11A9677B81C3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{07A6E725-1967-448A-92DF-3C3EBDC37274}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{07BCADB0-CC55-464E-B7ED-BAD3D72D0E16}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{07BE69AD-A106-4650-AF80-4446230A4696}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{081390A1-E026-45D5-9A9D-F338F0403B67}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{085FB270-C6B7-48D6-A272-80456EA2FEC3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{087AB5AB-9B3A-42E4-8B35-5F45A71D2423}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{0ABD1F7D-FF67-43D6-8456-EA1A29A04024}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{0AC3334D-4C55-410B-A833-DA982081A778}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{0B268931-17F1-4E26-8853-5D6E270F6AE0}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{0B3CA493-7284-4FE3-A94B-CEC2FD5C5437}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{0B7F8802-F03A-4F91-AE4C-7DFD2BD1811E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{0C03610B-CC57-476E-8EC4-ACD68E52C7EE}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{0C2CF6F3-8F71-42C0-8292-39966F9CB161}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{0C56926A-929D-43D1-A2BA-C5EAA57190B1}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{0CB5891F-EA3F-4AFB-BC6D-184C4DCA3AA8}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{0CE7BACF-3B92-4571-B502-4A859F7DD4F2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{0D6EB264-77FF-4F18-8CCD-FC9076ABA95D}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{0E0DCC6C-8A03-405A-B4F4-62849E7930AF}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{0EEF4DDF-A888-4DE4-97C2-02AAAD9D5AC8}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{0F843757-A91B-48C2-BB79-88666BA6A54F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{10491C68-111D-44E5-977A-A7D6678B1D2B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{10523072-916D-42F4-A8EB-F6458D8F3E4E}" = protocol=17 | dir=in | app=c:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe | 

"{10CFB783-8EAC-4E66-AD13-001395D600BF}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{115D747F-303E-4460-B94C-F86E2B5DF72F}" = protocol=17 | dir=in | app=c:\program files\terratec\terratec home cinema\insttool.exe | 

"{116DDB32-39B7-4F73-804B-517FF07A66BE}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{11844E1C-C3AE-4CD1-BE15-78356E9AB0FD}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{1247124D-CD9F-4D56-ABBA-250B8BD4AE1E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{12B05EAA-336E-4656-9995-26246BAAE051}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{13289003-A77F-4DA5-AED2-4B449CADEC57}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{13544916-23D3-46E1-9903-D1DD2AC176A1}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{13735054-5F9C-44AC-AFFA-AF4615A6ECB9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{14AB7120-61F9-4A99-AF95-3820CCAC20B1}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{14DD90F7-462D-4A27-8C7F-545B2F2A32DB}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{14F7955C-21BD-4814-BB72-5669B3C2D286}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{1667F851-E9FD-4001-BEA4-7960A476BDEB}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{178E5891-71FC-4368-B266-087B0E315FF1}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{1861D4AB-9D9B-41D9-8B9E-F5F8F10F2D18}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{18832A63-1EE5-419D-BB59-7EAB49B4D4C9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{19D73ECC-1291-4466-8FD4-FB29C0E8C4E9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{1A302DE2-DC3C-43BF-8589-73209875F53E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{1AB83654-1E17-403C-AA06-44A409A8082C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{1AD71164-B182-4690-8C67-07296DC6EAA2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{1B2DA5CA-BC25-4B40-89FB-655DD7187CB9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{1B3BCC18-DA7A-4076-976D-80B76109D35A}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{1B4EBF40-9223-4CEC-9AF9-4F3A8CE1E1EB}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{1CDAC3B2-B6F3-4581-AFF3-AD34E940697D}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{1CF914B0-9742-4CC7-A4FB-7F881A6B8DD2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{1D01F969-9B7E-4051-B1B7-7648D23168A2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{1D1CC178-CEC6-4D90-B071-9DFE6122AE8F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{1DB6622C-1DEA-4FF8-93F9-D4190B8DAB51}" = protocol=6 | dir=in | app=c:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe | 

"{1EBD00CB-7E1F-4AB5-B55B-0DF826783658}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{1EE50953-0365-477C-A5C1-3D7AE5381BC9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{1F15D247-7104-4EFE-8515-2CF377324214}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 

"{1F54184D-B846-4A3B-94E6-B0395AADECF2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{1FBFDAE6-7A91-4077-AE37-EA3404BAAC6B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{1FD8BFB5-88E8-4D8F-B990-A8CADA1E4AD9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{202F0DB8-CA13-4105-A5A1-8BAC7FE54834}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{205FB509-215B-4C14-B3CF-1C24EADF32AE}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{20CEE26D-4554-4F90-82DD-ED8CC88DF0E4}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{21F74583-576D-4C90-9807-73D3C362DD8D}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{2200187D-5090-419E-BC2C-F6927D1A524C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{2237DD64-B8C8-456C-8E9F-146F462096ED}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{230B01C9-B8AC-43EA-9CAD-291470F5A7B2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{2317AB24-EEBA-4123-BFA3-E09BDD8CDCDC}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{2361B0C8-91F6-44CA-BBC4-F5F538AEBA80}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{2369914C-461E-4BE4-A7C7-75B384021B2B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{237C3E0F-1A60-477B-AF2F-7E992EB06E82}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{2410B495-68D9-453D-9B19-C42033B74F16}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{2459209E-E5EE-4898-BDB5-B7103A2761F2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{24D2438B-3680-4AB8-A014-93AE58B60E13}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{25185F60-5C16-4953-A28E-32933A937DD3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{25823DDE-A1E4-49A7-BEA0-5958E753E92F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{2673FE90-8930-45DD-8FDE-98D03E3D7B48}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{26773089-403B-4752-A79E-8B1F81BF1EFE}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{2729E71D-709E-4012-9A64-005DB1A3E650}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{2753D773-1D7A-48A6-8458-E480CB3459B2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{276CAEBC-CFC8-4C3B-965D-F773DCF4F76B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{28B47848-5C1F-48AC-8BAF-6D439665DBD5}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{29E5F80A-8665-4565-A03B-1352092DA43E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{2A0353BB-B1E8-4B64-AC4A-82761846B7C2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{2B0A8F63-FC23-4006-AD94-ED692A432191}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{2C1F017A-60A4-4F81-90D1-50A7877CDF21}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{2C3DB7AA-FBF3-45D4-A855-4BC97C4BAC78}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{2CF83789-CD77-411F-A1F8-DD61CD510313}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{2D7F1A30-B2EF-40DC-BB40-0E11B1FEBB83}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{2EEFFE62-32B0-40BE-B3C9-944EA735C30B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{2F01FD26-FFA0-4E7F-BFD8-00F920823277}" = protocol=6 | dir=in | app=c:\users\carsten\appdata\roaming\dropbox\bin\dropbox.exe | 

"{2FAADFD7-5E75-4A0C-8DDC-F032802E1426}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{2FEE0222-BFBC-48EE-8CB9-75E9A5792F58}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{30F97E9F-B06F-4111-A845-F521150076DF}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{31271B91-78E0-48AC-9B65-6E32F38EBA12}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{31C758D7-6A42-40EA-A067-B5F3B8A7BC94}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{31E20EED-67D4-4054-83AD-785C690D48BE}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{32C71CB4-D657-4316-A997-4037723E3A93}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{32CF9907-F10D-4721-890A-13C560220131}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{3315086F-71CE-417F-AF14-79F5C3990C20}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{3323C5E7-6A4C-403D-8232-55A218225F5B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{3330BD36-2613-48A0-BFEF-5FEFD47AE917}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{34CA7C9D-28BC-4780-90FD-EDA0A3E10A4F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{34E60564-3FBE-481F-8CE4-C92118BE9E99}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{359EC70F-1376-4B62-AD39-2A4103899262}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{35B1521D-8100-4970-8668-8516403F694C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{3603C07E-0461-418D-BC1D-BC56D5712E2C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{360B8395-5B74-4FAA-A9A4-177AA8D8973A}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{3670A926-794F-447C-8188-6E1CE50072AE}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | 

"{3677190F-3BCC-4028-A616-7BE72B26E2EF}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{36E2DFA7-9CE9-4DEE-9603-D60BA36AE193}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{3793685B-8D5E-4C79-A5B6-AD114E4BCA48}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{379B4A10-93C8-405B-927F-BAC6253AA12B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{39068D82-7566-4D52-B1DC-BE9B669FE19A}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{39258AC0-DA55-4026-A3E8-B733B3B3F8DD}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{397168B6-DEC7-4EEC-AA77-5719C2A4B8ED}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{39DD025E-08DC-4C93-AE77-C74DC430A128}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{3A17C4F3-8AFA-46C0-810A-11B5923442FD}" = dir=in | app=c:\program files\skype\plugin manager\skypepm.exe | 

"{3AE63AE8-B1C1-4AD0-AE0A-2157AD6CE21E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{3AFA0E54-B053-4B48-845D-CA24768B0EB4}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{3B38B1B9-3B4D-456C-AC1A-6280C6F9566C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{3B5446F9-71F3-4105-943B-EECD6467B273}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{3BD78F8B-1A1E-4B18-92B5-65F5D650787E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{3CBF163D-0974-4B1F-AC62-F001D9CC94E9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{3D470704-50A1-4744-8DBD-60512CE4C05B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{3E16B3AC-2AA4-4FAD-BD0E-A4C3790BF4CC}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{3E2DEC77-B42D-4A3E-9B85-0E1B9E3E574A}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{3E32AEFA-4B54-4152-B66C-7F6D704F82BB}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{3E517F24-A348-4D1F-AE58-7B90574A28ED}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{3E8C5827-CCE7-4B72-9C16-189CE04BEE5E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{3E9B5F48-77BD-43A7-9FBD-654669653E3B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{3F6F770E-6FE3-4C91-9467-2488ED51C7BB}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{3FD7A248-D514-47DD-BCF7-DDC1AF43C738}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{409A623A-F283-45B4-896E-383B86730B78}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{41BA679E-6C2B-4822-BB1B-E95188C59F67}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{41C5B88B-D47C-47A8-A9DA-FD2336B776AF}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{41F3A4C0-471E-4C87-8613-88F401809EA7}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{41F81EE7-E735-4428-9B84-FB92E9F6BCCF}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{42E27330-00F3-48F4-8F64-77740C0CD0CA}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{42EBDFF8-5FCA-4A2E-AE85-67FD3470F36F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{4328821A-538B-477C-8522-2D2D2E6A142C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{43631F86-61FA-4B7B-908A-C43E6249FE17}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{436DD3F7-E6CE-4242-9B48-A482F187ACE2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{43E01F85-90DD-41C2-85F8-4867DD93A226}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{441DE15F-3461-4551-AC70-81FD487308DA}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{446E8B02-579F-4B9C-8FD1-C0422195ADC8}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{44EA3D7A-0251-49BC-84B2-82E82C500C9C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{45D3734F-BB4F-4238-A901-F64EEF6B94A5}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{461E6F3A-35DE-4CCB-9482-3800D0984A56}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{465B358D-7912-45AA-9FF3-BAF3DA9E82A3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{4744B642-B6F4-4A85-AE56-6AEAD5CA864B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{474E0FE6-89CC-473E-A164-33C301B51185}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{4769EA4F-7B49-4515-BB2B-91439ABFE9D6}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{47F8C834-528F-4470-8BAF-838D409A5EDE}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{4872B4CE-3475-4CB5-ACED-C56D0CAB1A33}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{490C5671-DADA-45E9-8207-1DED42DCFCD4}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{490E6871-BA5D-4E83-AECF-C1E8656B1F57}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{49D9701B-0B2F-49E1-B73E-A33264DFE27E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{4A3F004D-16E3-406E-A3B4-52CC6D3EBC57}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{4A7D6813-8CED-45FF-8C7D-1A1370EB3722}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{4A95976A-42CF-44C2-B2AE-56C82638CB4F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{4ACD73D1-5A06-4AD8-A93A-E190B66F40ED}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{4BFAFD4A-1DBD-447B-8F6A-C6F25A88A7FF}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{4C8DE3F8-46E8-4339-9929-86C990A2BBBE}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{4CB31B8A-C792-4A62-93BD-525F4E40836F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{4D50B8F7-A66A-4542-A473-3995F0412F85}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{4D9DA9A4-ADAC-49D6-B501-4AEA0D63847D}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{4DF69027-6F42-4EA1-9C27-1F084D2E7C33}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{4FE171AD-1FC1-4304-B2D3-18AF66597163}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{4FF052A5-252A-4E9A-B71E-41F7723258C2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{50212F77-2BA6-4ADB-BA6B-9C7EAFE6F349}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{505C120D-F83B-4A7A-A620-FCC1EDAED385}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{50897EFD-F653-4B1F-9466-192534D641DF}" = protocol=6 | dir=in | app=d:\programme\agrar simulator 2012 demo\farm2012.demo.dll | 

"{50DB2239-5578-4156-9E63-31E8CD2FC8DF}" = protocol=6 | dir=in | app=c:\program files\tilemill\node.exe | 

"{520043C2-5A14-4C2B-9DC8-D8C9D2EF4C56}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{527014CD-D897-4044-8E63-8E34B40A3150}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{52BCB8D2-5DB1-4AAF-8473-B5348D7B2A9E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{52EDDD89-A048-4385-A385-53CD52493EE7}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{53031205-F007-44ED-A5FC-9C26F2C5D718}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{5339AD33-4D03-4033-8ECD-538A8CE426CD}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{533F51CA-A24C-43FE-9E3D-7AB25CB137CB}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{5344A09E-2338-4293-A7F0-56130F0691D5}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{535089C8-3130-41E8-A03D-C3B16324F5E5}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{5371D73C-D28A-413E-92DB-513ED63D1AFB}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{5382A9A6-243F-487B-A5D1-7B4DA93EC3F9}" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe | 

"{539CD4F8-1488-4279-98EC-9F15590C5BCA}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{53D2C861-9A3D-4823-8C71-6319F7D6053B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{549E3BDB-FFDC-40CD-938F-E6D9F5D03275}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{54B30390-0CBC-4AEC-8694-1FAA342202F0}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{552BBDCA-E3F7-429C-A881-DE56199A2AA2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{56A00C8C-5760-49CF-9158-D636B1E3A203}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{56EE5D8E-76B1-4AF5-9B2A-A40DD62334B9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{571EAA3D-4E93-40D0-9CB5-61D99FFB66BE}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{58151BBE-CCB8-4A96-83CA-6B38086F89D3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{58B44053-E567-4845-9345-3AB7D98B5C56}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{59708A9C-01F4-4186-9EC9-11ADE1B51259}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{5C1C5766-7792-4F50-938B-81627F984DD3}" = protocol=17 | dir=in | app=c:\program files\terratec\terratec home cinema\tvtvsetup\tvtv_wizard.exe | 

"{5C4BB9C1-894E-4B24-A2C2-492C6902EC49}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{5CB19829-43CD-4F46-83F5-58529E313C94}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{5D0AFB70-8C74-437A-8D54-7AB48698960B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{5D4DC383-0A73-4038-BCA2-E16ECB290CCB}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{5DDB7D86-0918-4007-9618-7DEA125763BA}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{5F30B2E7-E734-4C95-BF72-27D487303397}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{5FAE6494-76AB-430D-AE50-9828F1E6CC95}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{60370904-EF1D-4F4A-A61F-92D6441060E9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{608CA30D-155C-4BEB-9932-A0A43C24C901}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{60B4D5AA-35AE-4CB0-915F-E43BFEE77F28}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{60E944B1-DFC6-4E92-9BB4-435AAB992C46}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{60EE3022-7335-47BE-A27B-D72B800A2616}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{611AB346-B73E-45D1-ACEA-40C3AE17F0E1}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{61BF681D-38ED-4338-92D1-D2F5DC45BE42}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{61CEABC5-4443-49C8-B313-562A40FB0A94}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{61F23778-D62E-4F75-9D86-88F9B8FFC8F0}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{61FB4293-EEFF-49DB-ABAB-1F9A2349F9B7}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{62B61E0D-71CF-4628-A103-D208B273E8C4}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{6341AD44-229F-45AF-A021-2EE253FEE7D9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{63AFBF14-1F73-4AB0-BEB2-37F4471E44B9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{649D0B3E-AFCB-484D-815C-6AF92C0E611C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{64CAAE2B-59D5-496E-B609-956BFD51424A}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{64D32761-C406-4FF4-9390-16FF060C4494}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{64DAB154-A45B-40B6-A780-8FBA0914C3A9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{654ABEC2-E1EA-48BF-ABEB-9C1BA88FD91E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{65CF868E-AA26-444F-B599-69072034A0E1}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{664B82F7-97E9-4F1B-83D8-DCBCB660578C}" = protocol=17 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe | 

"{66B95A61-45C4-4296-AFFF-1D0F55AF439C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{6739C213-4439-482B-B83F-E8A0E4DCB0BA}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{67A6A76D-B193-4CDC-B5E7-DE0065C1BFA7}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{686D0415-1306-43DE-9631-5429E52C3787}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{688E1341-8345-4292-8EE5-AA1DB8272A35}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{68E1B7B8-197A-44D0-8BFC-45B3683D651C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{695F9CB6-E9AA-4745-83FC-CCA8643555EA}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{69634630-F595-42A7-85D6-12A9F37B7F36}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{69891945-5D99-42A1-BD3F-66F2DE518259}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{6A035B64-930E-44BA-B88C-30D5CD0B2D3B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{6A3139B3-811C-43D4-8373-84E1A4DA8159}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{6A790C29-A9C5-4485-B28E-76F323B76426}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{6B233E9A-94CB-4772-A37E-BAB9761D29EB}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{6B46F3A1-CCEA-4A35-8A88-E14FCA565DCB}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{6BAB76C5-3FE8-42D1-9501-D14846FAC277}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{6BF0B9AE-7278-4633-81C3-D96535F329C8}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{6DE6C455-47F0-42FC-B089-A5374BE5F8B4}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{6EBE9657-68B9-4613-A691-FE04C499EC2F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{6EFD9897-C439-4322-8969-378F54689AB4}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{6F0BE1B6-F3D7-4981-BD39-0857F81AEC43}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{6F13B060-CA86-4BCB-B948-303ED985FA2C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{6F9917C8-3EE9-4374-9A45-9E512E24E85B}" = protocol=6 | dir=in | app=d:\programme\agrar simulator 2012 demo\iupdate.dll | 

"{7006A87A-484C-4300-BF27-073F81CBA153}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{7007FDDC-DDE7-457E-8133-BABD2DF2EE2E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{7014F10A-54B3-4105-934D-44F5C423A4FF}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{70251A2F-ED80-4701-81B2-DAB92D677D42}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{70A9336D-55A7-42AD-8903-F69775095926}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{70D236E8-0BF4-47A7-8D3D-6240F8079005}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{70EA28F2-1185-4519-ADDC-80C36905F8B3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{71061702-D8C3-41D4-A570-59A6337FA9B3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{7181AEA7-744C-47D4-8DDF-8F85046298DA}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{72C26BDE-53D2-48B1-82BA-DFA60AEC03E3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{72FD36B4-B746-497F-8934-DD7B6B22D017}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 

"{731F4CA1-5488-4DE4-85BE-9EC42DDAA351}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{748B5BA6-1A3B-4C54-83FE-4C5DB45395B6}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{749390F0-1FE2-4E3C-A287-4B31276117EB}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{7520FB70-F939-47F2-AC50-7E83BEFF0C7D}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{753077B6-1276-4C3B-9666-74616A8A7226}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{7537F03A-63C5-4982-8928-622825865FF9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{75BE37ED-CB72-4502-9CC6-9106E409F698}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 

"{764D663E-5DFB-496D-B6D0-9CD66E6B3E00}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{7669754B-A8F8-4CFE-BECA-50E7C096FE46}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{769B6010-6C04-4763-B2E4-A688962EFA20}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{76D588D7-5FE3-4A62-BB96-1F6B18FCA52F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{76DEA07D-F931-49A7-8B92-474DBF74FB8B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{77546DB8-5A8C-44E2-B7C0-35A85C33E551}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{781579D4-55C4-4195-AEA2-2A1574254F5E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{7849F325-48A8-4C4C-AF9B-F582D7911624}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{793620DB-10D6-4EF7-8E76-B49E61940688}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{79A70EDE-7E1F-4E45-B823-2544801F511D}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{79E9F88E-6D77-4837-88CB-CC5EBD51EC0A}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{7ABF3803-12EE-4C7C-B317-05A30D3F34FA}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{7B105F02-B9DB-4F17-A256-6D56A4B218F8}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{7B81ED68-AEBE-492C-A1C9-A414ED7DF73F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{7C205968-9A99-4B9B-8159-DD0A08C31D57}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{7C5AE1A4-78C4-40A5-8BEB-FB1CD7995F06}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{7C5F0AE7-3662-48E2-9921-654845252CE7}" = protocol=17 | dir=in | app=d:\programme\agrar simulator 2012 demo\iupdate.dll | 

"{7C63D1A3-E860-4457-83B4-C6C02F9A24AC}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{7CE26A03-2DD2-41F5-9A7B-8AF36C7E6078}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{7D73C0FD-05A5-4F05-BBA9-D42E9A982AAF}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{7E27E977-32CB-452B-8586-49B26EB1E091}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{7E9E400E-D046-49BD-987B-2D42B950C331}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{7EA9475D-4FB9-4408-BA16-752382563B8D}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{7EC659CE-CBE4-447A-932F-B6080D3432F4}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{7F050571-CC9F-4ACE-93DC-B4C874F903B3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{7FA3FBDB-76A4-4094-82E8-452FF6E94F69}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{80D03BBE-8FAE-4171-ACE7-5792CC437ED3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{80F6F979-18E3-4EDE-8E94-C8CC0730461E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{80FEF3B4-BE74-44C7-AFDC-C6C118F2F498}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{811C972C-300C-484A-A02D-DFB2C0F56449}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{81321408-BECA-47F3-9F6C-B2EE7899FA43}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{82AA1CB1-8725-4A9A-99AF-397E6E7D2678}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{82E25A96-47BE-49FF-A408-51704A94B751}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{8306313A-61E6-40B2-902A-0AF4810B7E5E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{832A0991-65AB-44DA-A667-64F04706A749}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{83D38C1F-A648-4559-ADEA-B56E74CD9CD5}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{842C9500-AB43-459F-A127-05C38BA91452}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{842CC579-C48C-40A3-911D-A4911DD8AD32}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{8468C3B4-88A5-4C4B-BA5F-6C29D2437C91}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{84715D86-CA38-4B56-90BA-925940C8E72B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{848FB16E-4695-4EE7-871C-6850C202316E}" = protocol=17 | dir=in | app=c:\program files\terratec\terratec home cinema\cinergydvr.exe | 

"{84C684D2-AD99-478B-AE02-8F4F627C9884}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{852901BE-5A6E-4613-8ED2-5306A34593D2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{85431BB3-1A1F-45F5-8909-A319F5E0106F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{85910296-FC0A-457B-A5FE-F4338B63DAEC}" = protocol=17 | dir=in | app=d:\programme\agrar simulator 2012 demo\farm2012.demo.dll | 

"{85C6E374-7BE7-47FF-A8B9-D6D643BFBB72}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{862B3701-D233-4F54-9746-ABB1F256F873}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{8652564A-B511-421F-9676-A9F2048523CF}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{8706FE45-1226-4B91-92E9-835C7FA4C7B0}" = protocol=6 | dir=in | app=c:\program files\ea games\battlefield 2\bf2.exe | 

"{87528B18-F522-4CB1-94FB-196167F5ABE5}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{88460555-8AF5-4DF0-8864-3CDC9171A79E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{8A7210B5-DB99-49EB-A57C-AE390ECE09E7}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{8A83E129-1306-47E6-B631-55F343126430}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{8BEC4B03-7F1D-4E11-A663-B87BA54CFFFB}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{8C3F6B76-9185-4AB0-A652-6CAD50FC1D37}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{8C6AF04F-ABAE-4180-9AF1-B05B97DB1C9F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{8CBB6326-748A-4443-B023-3268904AA8FF}" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe | 

"{8D1440BA-F35B-41D6-AFA1-453D6E518407}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{8E4B914B-6BD8-4EBA-8835-083664E99BFB}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{8E83E2BC-0973-47FE-96CB-010B0E277249}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{8F34A70E-A79D-4029-9D76-81D324949880}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{8F5DCCC7-E642-49A9-8BBC-B96A0B7477BC}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{8FED866E-AF00-4BCD-AAE0-188D2768D243}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{8FFFBBF4-3E05-4E38-BE6C-51B0685658E4}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{90B04948-CEF3-4F0C-959B-FC510B498D2F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{90C1F016-1F0D-47FC-9EBE-6BC34EC39E50}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{90DC1EAF-8CCE-41B5-AC76-92519EBD8163}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{90E9DA22-89BD-4B5A-9826-1BC7295831C1}" = protocol=17 | dir=in | app=c:\program files\tilemill\node.exe | 

"{911F5402-8DBE-45B0-94B0-FE89C8AC6F87}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{916C5B60-97FD-46FC-9D34-804C6A1CB19F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{91F0F667-B194-4189-BCA4-C945C4AB9AE3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{929496BF-7ECE-4F97-83CC-2862217F501D}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{92F485B2-7583-424A-A85D-FA6B2BA5B256}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{930CF09B-27BC-4000-B503-97082BDC4813}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{93254A05-3C22-4799-9B98-41AF88331326}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{935EBCF1-BCAB-4869-9E91-499FD6C7C080}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{9365BD26-E5CC-48EB-8F62-50056826885B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{93E43897-BD4E-4043-B601-5E7074B04754}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{93F29706-36EE-4588-8E09-22DE6970020D}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{942C49C0-3E39-4943-8CBC-43FB461772A4}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{944157C3-788A-41B0-8907-6384406AE9A3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{9443A748-E3AD-49A0-9DED-268EBCE76C1C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{94819E5E-2FC6-48DD-B32A-C25D0E373BAF}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{94C7452C-1A33-4C09-BFA8-B4A654670EAB}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{950CE195-F88D-4F9C-93BD-0FFFF95C6F07}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{955F6878-B790-45A1-9987-90A34C0B8D31}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{95D14036-F438-462F-8688-F0FAF516DDAE}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{964A1433-6BF3-47CB-A69E-6DAD7BB2B551}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{96C73D7B-F877-42FE-8641-E3C6D869FC31}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{978F3422-FBE5-4C29-99E0-7BDFB7A74425}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{97BB9138-BC83-470A-ADF9-AE76B2D5052D}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{97F7B9FB-0033-4A28-A4A2-5A6E0E86D09F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{990669F6-8074-4671-A33C-1EC4A53B27A7}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{991A3527-F193-43A5-A2B8-090D0D1CC810}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{991C90D0-5097-4F74-B936-6DB60204A9FE}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{99C3F1CD-9B3C-4D94-A324-460F0147AE0F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{9AFE3712-B44C-4BD9-BEE0-D6A413FEB406}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{9B998963-E881-4D6B-ACB7-1422F06350F3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{9D049925-891F-4E24-AD98-83C0D566DE01}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{9D8AE833-F8C9-448A-BDB6-5619A517EE42}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{9D8BBFFB-DBD4-4346-AF9E-A0441D8B8E6A}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{9E6BD770-3DAB-430A-82FA-DBC917262330}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{9E842D83-DD04-4BD2-966B-C9158C911C26}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{9EF7983E-E696-423D-A309-E623121989BC}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{9F7BC82C-132F-4C69-B6E0-8B87FF6CA7B9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{9FE03900-ACD2-4E0C-9583-02948AB0F7A0}" = protocol=17 | dir=in | app=c:\program files\ea games\battlefield 2\bf2.exe | 

"{A021DAAA-BC63-4111-A1F1-3122B450D335}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{A38590B0-C8BD-4103-9777-34B341CF122A}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{A3E2A092-B707-4CAB-9434-3BFC785E9B5D}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{A4BFDE45-7972-4FB3-835B-CE7B58566652}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{A502CE7D-729E-4045-B1B0-54DF6F58E38C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{A51C6024-C936-4284-A5C2-D9AB5D183D02}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{A5A95BC6-EAF4-49BB-BB5C-63A54200F2B3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{A5D05197-9CDC-435E-9012-3CFFF4ADDC8B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{A5E7812F-8312-4A4C-8E2A-F938F420ABF6}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{A6073D44-309E-4B0B-887E-3E230A240FF3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{A666A381-2067-4FB6-AA3D-4A50A27778A3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{A6681566-B2A6-4A0F-A202-62364A562CB5}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{A7C28EBC-0454-4627-BA9A-EA6780BBF95C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{A83C2E13-2086-4E6E-AEC3-F28DEAFDFC62}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{A854C414-B6BE-49D3-BE99-2DE832C011F1}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{A8E6CAB2-4357-47C4-BC59-5898C24D673E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{A920DD06-2BCA-45B0-A995-78DF08EBABAA}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{A92B9E2B-4E17-4B81-98CC-B5AB5C155712}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{AB69D2F1-2399-4F66-BB9C-F93874EE3CB0}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{AB6D86FA-F43E-4830-BC33-B5AC00206191}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{AC32E0D1-C728-407D-8346-095A4D7138A2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{AC8ED734-7D78-48FF-83DB-FA4B86290CBE}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{ACA8391F-AAF5-43AF-AD9B-DA3511F2E0C5}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{ACEFF282-C816-4EE4-8B17-66B83CFDBC95}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{AD4A5D0B-9439-426C-9385-8C8270AF987F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{AD67DEA5-EF6D-47F6-89BE-8CBAD40B1923}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{AD7B1F4C-327A-4657-A360-AFD3F10892FA}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{ADBCAACA-0BA1-4BED-B4D0-9EED617F8C74}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{ADE3776E-C101-40F3-8069-EC639B5840B9}" = protocol=17 | dir=in | app=c:\program files\common files\adobe\adobe version cue cs3\server\bin\versioncuecs3.exe | 

"{AE5C9137-1C91-40E8-8EE3-34E12FF764F3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{AEACC984-8FF0-4E4C-94AC-3E03AA160C92}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{AF1E94EA-CE76-4EE8-A7E9-04086577E159}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{AF351268-665F-4619-99DA-329605D650A9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{B0EB3F6A-F0EB-496C-B475-08CE7A5B4854}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{B11D3D9D-D9F7-4497-AC84-6B6ECD312061}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{B11D4CCD-CFAA-4DE4-9059-9C5A0730C9A1}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{B1AE6A42-F972-448F-A8F4-A27BAB1FB85A}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{B2455D40-B5DD-4013-9A96-9F2F728B9586}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{B32D434F-3AB8-4D24-892D-9299384925D2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{B345B9A6-C423-47DB-912F-CC5DF1C95DCD}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{B358F310-E3BF-480F-9840-8BCCD4BF76AC}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{B498F1C8-7D15-494F-8F1C-35140893E954}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{B4AB60D1-6137-435A-8B55-C36D2FC0DCC2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{B62707DD-D9EB-4914-81EC-040AC84B3B65}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{B702D506-1E89-4B10-812A-F5FF21C8CC5F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{B72F9079-68B1-4A7A-93D5-68FC7FF8D0A5}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{B7786B66-005E-42C2-B89B-1420750CB400}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{B7CB3DC8-3E8C-4A48-9242-E56AF3C414CC}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{B8132370-AE54-4B62-845E-DBA538355FC6}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{B8287072-1B0B-4CB0-90CF-3547687D2D28}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{B85CA89A-67ED-4F03-98B0-DA770B183B6E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{BA992890-57D1-43E9-AD09-1AC0305357CA}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{BB1C035C-CF6C-4444-9A76-C20FA962F78B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{BC29478D-3A20-40D4-8D5B-8F35FC338369}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{BDFFFF7C-F50B-4871-970E-E4BF5B6FBCC9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{BE220CBA-8BEA-483F-BA00-AEF136A47EC8}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{BE578DF8-EE4D-42A9-85D2-989255EC152C}" = protocol=6 | dir=out | app=system | 

"{BEA43256-D9CC-412F-A78B-0A963B49F2F0}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{BF898A4B-B2E5-428A-A2D9-AA1FF62EDE43}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{BFB2FE9A-37F9-4298-BA3F-F09B1E2D17C0}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{C01E85DD-622E-4151-ADBC-839D1D1A0999}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{C0FB9605-8296-4523-9028-CD67DECEBF3C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{C1F22338-F7F6-4F9F-92D3-5B983017BF03}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{C286FB99-E5AA-457D-8B7F-14091D1677B9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{C2A2690F-D193-48B7-9E47-88AFA8B53456}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{C2FC7397-62A7-451A-96A0-B84468EEC733}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{C3457064-B314-4314-8630-F684637E84A5}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{C34C1BD2-C265-4CB4-8F85-BC10A37500A9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{C383271F-9B3D-4C1E-BF29-8FD7637A9C23}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{C3BF26A9-A7F9-4104-9E9F-230990BF31D3}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{C4956C7C-79BC-4769-ADF0-CE27A2380513}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{C52A08BD-E6A0-455A-97DE-018A64D8DAC5}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{C60C30BA-20CA-44BC-878B-EE0AB341453C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{C6188543-144E-4205-B58E-6482887AA9B0}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{C62448B8-AC9A-499B-9A6C-7D2CD58A57ED}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{C627809F-BF7A-456B-9DA0-D366F10A0187}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{C70DBE0C-CCB8-4059-B111-F4446B9EE859}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{C7DDD98F-855C-49E7-83E8-492B52E910A4}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{C8AB0D21-BDBF-4FAE-B873-5E1AAF87CBE3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{C8BD63D8-918B-474A-9521-0DAFB71F7806}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{C965F72B-4B0A-44EB-A0BE-2B037A239904}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{C982AC27-048A-41E9-A0A1-F47CC60BBFB5}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{C9960C75-D52A-4AC4-8AD5-716D5023FFCB}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{CB0E7918-36D9-440D-8654-764F23E71714}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{CB1418EE-98BE-4243-805D-4E1692275947}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{CC29879E-1FBC-4C6C-8770-B2473B833C42}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{CC2E8C81-AF59-4A63-8322-02610CC40862}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{CE14596D-57C6-4E43-804E-35906CD1BFD8}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{CE4B392B-FC82-4626-8A11-140ED34E2862}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{CF371DBD-C72D-47CE-ACDF-5A039FD6FF91}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{CF47A3F1-1704-42D5-941E-2AE6D3F75A97}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{CFA3AE16-F5F0-495C-81DB-1B3EAE08F2ED}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{CFE6B8DF-4C7C-4CAF-8CF5-05F0B5FEC18F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{D05E6BCF-0CC5-4E8D-A760-1F23A062B929}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{D08F5756-186C-4D77-BE02-CC38C91F932F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{D118F5E4-EEE4-4472-B24D-EC90DF6D17C4}" = protocol=17 | dir=in | app=c:\users\carsten\appdata\roaming\dropbox\bin\dropbox.exe | 

"{D1AE0B68-26A4-4B11-BBCF-45F56F75C899}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{D2277F4F-7C56-492B-AE30-4A09D2A4952D}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{D2354D7E-E6C3-4E0C-9D5B-6C69E5261306}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{D2A0D8FA-8A5C-4EC4-B07A-DD7F41EBEEA6}" = protocol=6 | dir=in | app=c:\program files\terratec\terratec home cinema\tvtvsetup\tvtv_wizard.exe | 

"{D2B6D14C-8D5B-42FA-AC55-D995E1A200B4}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{D2F96714-2796-45FD-BC2C-5D9674DC46CC}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{D2FF4E60-3D8E-4646-81BC-E595B328ED35}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{D307F811-EFD2-46C7-8AFE-AE828DEF5946}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{D32FD9FF-7399-4DA1-B5BF-B7BA3D11922A}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{D3D76EB3-FE61-4352-A6E9-6FEE85215BFF}" = protocol=17 | dir=in | app=c:\program files\ea games\battlefield 2\bf2.exe | 

"{D49CE6A2-8F78-4BEB-9D04-D66D33FED8C4}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{D4B5CCE8-76C4-4BAC-AD51-419A622013C3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{D575B8DF-583D-43F5-86CB-EE54DD7DBF42}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{D602B071-08AC-4761-BE17-BB7E6518CA55}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{D62AA31F-D363-43E1-9B3B-18B319D9120D}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{D650673D-B1E5-4B81-83F5-D612452D70E9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{D6EB8EF4-EAB5-4ABC-93B1-FCFC9DD01B71}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{D715B5FB-C23F-478F-9355-EABF2371EEBF}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{D71B2C01-4FBF-47A3-88D2-6EE2E2763A9E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{D7371409-D977-4F6A-97C6-63FF1D9A5E06}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{D871649B-17B3-4789-BA64-CDCEBF6182B4}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{D8A15B93-32F9-46AD-B03F-134ADFE51088}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{D94F1B7F-E185-46E7-AB1B-222F909F7D06}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{D9D5F35B-E2CE-4B30-89CE-8C3889EE6DF2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{DADC8824-DA1B-45BC-A3F2-145B12981B03}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{DAF452D5-1AF2-4CAD-8930-BC847896A286}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{DCB56131-9097-49E4-BA74-BE7AB46854F3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{DD404265-77A1-413E-A282-33F79897B752}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{DE1A144F-C2B0-4D2B-A064-73B3D3047D2B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{DE5AB2B4-0119-4F06-B425-1C0C7CC3EA3E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{DE77DCBE-F7BC-4F5A-86CA-B029496BE220}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{E07A4D98-D3B7-456A-8C8B-5CCC77CAE930}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{E0A0BC2A-CBE6-4181-AFD9-CA94E03D816D}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{E0CA1F3A-F89E-4C2B-A3ED-C0B40607947B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{E12130C0-71AC-475C-9066-4FE255EC673B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{E121B6BE-D61F-4E97-AE6B-1C5C8B1CA5A3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{E1501CE3-4E11-408A-AE53-3539DE1F9D10}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{E1709211-EB32-4C5F-A4F5-CD6F72B710D7}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{E18FE890-5591-4E3E-8053-BF33DFB4BB73}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{E1B0FD9E-4156-42CC-B0E2-D42032FF78B2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{E202D273-EDFE-405F-883B-3BDD30BD7DDA}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{E29FF8FC-E2C8-4ECD-AB3B-0D01D34AA07E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{E2CEA6FE-946C-4FBD-81FE-0130E5190BB5}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{E3425A12-4113-4841-BBCC-D40DD850F42B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{E4181E7F-7E87-4B5A-8047-610195EFBFDB}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{E4A83016-F959-4F62-8C42-88ADFDB622BC}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{E4F4D0EC-CE0B-471E-8E83-EE3F7D3806C4}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{E57C1E32-2FB8-4E97-993B-4EA08DC97C31}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{E58C83DA-486C-4A17-9D4B-E21BC991F58E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{E5935DCC-093D-405A-A076-4BF0503C3E4C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{E5A2575F-DE25-4011-B3B3-6C1C0E39FF2C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{E614A749-876A-4DA8-B26A-C036CF964220}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{E6408CCC-A341-4977-9A79-473F666A91A0}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{E74878DB-6A89-4134-A603-E6A575D19138}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{E774939D-C1C0-4A61-B5FE-43F8C6D91FEE}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{E7EB987F-D943-4664-890D-7115D9BA8F69}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{E8E2019D-145A-4C9C-AA81-279B448672A4}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{E9172935-BF76-4BFB-BCD1-61DECC43CB22}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{E95AE148-AE38-42C3-A546-B53412B45032}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{E9651A9F-9B69-407C-82BC-AA9E66C3A7BF}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{EA0B4F79-BA9B-4F6D-A6BE-2984CC2D9BB2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{EA4A9063-22CA-4801-AD6D-CF166B15DB7E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{EAA7105E-468D-43D7-9E4C-B57E5C7377B3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{EB1EE1F2-D7F7-47FC-AB9F-1BBE3C39173A}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{EB8E4C2A-442A-4099-867E-276E068CA124}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{EBC11C9E-E395-4B3A-A3AB-725FEB56C110}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{EC7C7024-A0B7-40F6-821C-E6F590FEB449}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{ED7A4F5D-4F97-4C88-B28E-B910F29343EC}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{EDB3A2F0-EB07-470C-8E1F-0DD985C3430F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{EE4CBE28-E8D0-4825-891D-767874A0093D}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{EF71F5FB-1266-41A4-B11B-21DE218596B5}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{F093DA13-2B2F-4723-ACCE-B1A7C9348E0A}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{F11C49EB-B3AF-492A-A8E4-E2E11F04E5EA}" = protocol=6 | dir=in | app=c:\program files\terratec\terratec home cinema\insttool.exe | 

"{F42014B8-7603-4C3E-A285-465A6C4ADB88}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{F59C960D-FA62-4A08-8A59-4E84BE93F26F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{F5AF916A-DBA1-4B18-B696-41948FEF2574}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{F5D3089F-1AC5-4CEF-8AE6-A4B4A3DCE589}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{F64062F7-ECEF-4185-B6C0-1C47A27806AC}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{F71F5E17-865F-4033-84DA-3DC92E27B458}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{F8319095-EB26-43BB-8626-E3A98EBDCD3A}" = protocol=6 | dir=in | app=c:\program files\terratec\terratec home cinema\cinergydvr.exe | 

"{F966BB24-4D50-48FA-939E-ED7462AC6226}" = protocol=6 | dir=in | app=c:\program files\common files\adobe\adobe version cue cs3\server\bin\versioncuecs3.exe | 

"{F9DBDF3F-37E5-45CE-9ABA-74AF65B4F57A}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{FA640B5B-1573-4AC7-97B6-039662C93964}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{FA7AF63B-51B0-4C34-8F57-253D52DFA50C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{FA7DBD1B-4C84-4223-B2FE-02917AD0656A}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{FB6A0A89-EF94-45CF-BE64-77877B6A86A6}" = protocol=6 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe | 

"{FBD5194D-C7E3-455A-AC27-8C2FFF866DD8}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{FBD68EF7-A8A2-49DD-9D67-E745C2AE4B60}" = protocol=6 | dir=in | app=c:\program files\ea games\battlefield 2\bf2.exe | 

"{FBEE7D36-103C-45D2-ADD0-9BC7F2E81C03}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{FC6A3A0E-62A7-491F-8AA6-12384F23FA2C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{FD9F1527-FF4C-49C1-8D80-584504595BC6}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{FE0B9D25-F25E-4CB2-A342-025CFD7947A5}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{FE68BC3F-3717-4CEE-A56B-79614F2C497A}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{FE722561-9588-442D-81CD-A9AE63C8F4C8}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 

"{FE93471A-5C3E-4BB0-B324-E49F0481275B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{FF061A5B-4944-43E9-B058-44ADA4259AB9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{FF28B4D3-2E40-42AC-AF13-0E5EDCD18476}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{FFC14A71-2BAA-40A6-9945-D482763B449C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"TCP Query User{0577BA6E-76CC-4656-AF9D-93064F9867B1}C:\program files\matlab\r2009a\bin\win32\matlab.exe" = protocol=6 | dir=in | app=c:\program files\matlab\r2009a\bin\win32\matlab.exe | 

"TCP Query User{0872A3F5-C8B7-4423-9072-BF0A948151BF}C:\program files\trillian\trillian.exe" = protocol=6 | dir=in | app=c:\program files\trillian\trillian.exe | 

"TCP Query User{2AF89F94-B666-4AE9-9C1C-47A1064ED860}C:\users\carsten\downloads\eclipse\eclipse.exe" = protocol=6 | dir=in | app=c:\users\carsten\downloads\eclipse\eclipse.exe | 

"TCP Query User{2E1ADD7B-17C3-4502-AB68-D55BAD188956}C:\program files\trillian\trillian.exe" = protocol=6 | dir=in | app=c:\program files\trillian\trillian.exe | 

"TCP Query User{30AE629D-6004-4FD0-B375-6B025DA846F9}D:\programme\qgis\apache\bin\httpd.exe" = protocol=6 | dir=in | app=d:\programme\qgis\apache\bin\httpd.exe | 

"TCP Query User{346CFAB1-E207-4F8F-BBDA-7AFD110F8CB7}C:\program files\eclipse\eclipse\eclipse.exe" = protocol=6 | dir=in | app=c:\program files\eclipse\eclipse\eclipse.exe | 

"TCP Query User{43D6A2D4-08D0-4FB6-AC9F-625384A59799}C:\program files\maple 13\jre\bin\maple.exe" = protocol=6 | dir=in | app=c:\program files\maple 13\jre\bin\maple.exe | 

"TCP Query User{46CE30E7-496D-4DD4-B7CD-3524549666A7}C:\program files\mozilla firefox\plugin-container.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\plugin-container.exe | 

"TCP Query User{47CC628B-628E-43C6-A026-73F4178D6D29}D:\programme\easyeclipse-for-python-1.3.1\eclipse.exe" = protocol=6 | dir=in | app=d:\programme\easyeclipse-for-python-1.3.1\eclipse.exe | 

"TCP Query User{5F734838-765E-414A-BAC9-2A6828AA574A}C:\windows\system32\dpnsvr.exe" = protocol=6 | dir=in | app=c:\windows\system32\dpnsvr.exe | 

"TCP Query User{7438D4A4-07EB-4916-BAAF-06CDA8699AD4}C:\program files\battlestations midway\battlestationsmidway.exe" = protocol=6 | dir=in | app=c:\program files\battlestations midway\battlestationsmidway.exe | 

"TCP Query User{974BFF2C-0C4A-42AF-AF97-B60003EDFD6E}C:\program files\anno 1701\anno1701.exe" = protocol=6 | dir=in | app=c:\program files\anno 1701\anno1701.exe | 

"TCP Query User{A2664FEC-D325-43C9-98F5-CA90C72A5E09}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 

"TCP Query User{C5678C7E-394F-4AD8-9BF6-C47C5DC068D8}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 

"TCP Query User{DBF37E00-A1F9-4795-86F2-9A18ABB4E1DB}C:\program files\yworks\yed\yed.exe" = protocol=6 | dir=in | app=c:\program files\yworks\yed\yed.exe | 

"TCP Query User{FD22686B-35BE-4E89-AFD9-F223701C6426}C:\users\carsten\appdata\local\temp\cprogram filesopera\operaupgrader.exe" = protocol=6 | dir=in | app=c:\users\carsten\appdata\local\temp\cprogram filesopera\operaupgrader.exe | 

"UDP Query User{1A7628D4-91D9-4782-86D7-40C6691D8FD1}C:\program files\eclipse\eclipse\eclipse.exe" = protocol=17 | dir=in | app=c:\program files\eclipse\eclipse\eclipse.exe | 

"UDP Query User{512FA40B-5427-47AD-897F-49009D56721B}C:\program files\battlestations midway\battlestationsmidway.exe" = protocol=17 | dir=in | app=c:\program files\battlestations midway\battlestationsmidway.exe | 

"UDP Query User{56F2771E-BFEB-49EC-B152-B906BEBE0B72}C:\program files\maple 13\jre\bin\maple.exe" = protocol=17 | dir=in | app=c:\program files\maple 13\jre\bin\maple.exe | 

"UDP Query User{59B7B527-6354-499F-B2EE-BEE88663F46E}C:\users\carsten\appdata\local\temp\cprogram filesopera\operaupgrader.exe" = protocol=17 | dir=in | app=c:\users\carsten\appdata\local\temp\cprogram filesopera\operaupgrader.exe | 

"UDP Query User{65893783-F441-4496-BDAB-0E92552AF65D}C:\program files\trillian\trillian.exe" = protocol=17 | dir=in | app=c:\program files\trillian\trillian.exe | 

"UDP Query User{70A03400-1CF9-40A0-B507-90C101D8E5A2}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 

"UDP Query User{730F95D3-CE77-4BE9-9E33-5579BDCA440A}C:\windows\system32\dpnsvr.exe" = protocol=17 | dir=in | app=c:\windows\system32\dpnsvr.exe | 

"UDP Query User{77214824-C813-44CD-A2C9-C4C844DADFBE}D:\programme\easyeclipse-for-python-1.3.1\eclipse.exe" = protocol=17 | dir=in | app=d:\programme\easyeclipse-for-python-1.3.1\eclipse.exe | 

"UDP Query User{99AD4B4D-B2FD-4206-9D8B-726025AC2621}C:\program files\matlab\r2009a\bin\win32\matlab.exe" = protocol=17 | dir=in | app=c:\program files\matlab\r2009a\bin\win32\matlab.exe | 

"UDP Query User{AE3056C6-768D-4CE0-AAE0-628B12194218}D:\programme\qgis\apache\bin\httpd.exe" = protocol=17 | dir=in | app=d:\programme\qgis\apache\bin\httpd.exe | 

"UDP Query User{C5FB7293-720A-4CD1-8725-61FB48490318}C:\program files\yworks\yed\yed.exe" = protocol=17 | dir=in | app=c:\program files\yworks\yed\yed.exe | 

"UDP Query User{D2A38F17-F958-4567-8BDF-545464A504F7}C:\program files\anno 1701\anno1701.exe" = protocol=17 | dir=in | app=c:\program files\anno 1701\anno1701.exe | 

"UDP Query User{E432F8B8-27BD-4734-BAA6-C87FA52D776E}C:\users\carsten\downloads\eclipse\eclipse.exe" = protocol=17 | dir=in | app=c:\users\carsten\downloads\eclipse\eclipse.exe | 

"UDP Query User{E48C04E2-DCCD-4FF6-BC6E-6E8C5ABB8D7B}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 

"UDP Query User{F3763447-C801-4CEA-BFD0-83846CBA63E8}C:\program files\mozilla firefox\plugin-container.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\plugin-container.exe | 

"UDP Query User{FC0D5E61-58DB-4CEB-9535-8BC110B22C16}C:\program files\trillian\trillian.exe" = protocol=17 | dir=in | app=c:\program files\trillian\trillian.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{00000407-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Premium

"{00F93853-D9D3-4795-A89E-84CCBA0205C9}" = Microsoft IntelliPoint 8.0

"{0125D081-30D0-4A97-82A8-C28D444B6256}" = Microsoft SQL Server Compact 3.5 SP2 DEU

"{0224CACC-994D-45F8-B973-D65056EA9C2F}" = Adobe XMP DVA Panels CS3

"{0327FA9D-975C-448C-A086-577D57BB25B8}" = Adobe Soundbooth CS3 Codecs

"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86

"{03A4C6A1-26E9-4DDB-81D9-B332E5BB10AD}" = Microsoft Sync Framework SDK v1.0 SP1 de

"{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}" = Battlefield 2(TM)

"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4

"{07DB09F4-6C67-1014-9331-B8E5223E6C5D}" = FME Desktop 2012 SP1 (Build 12224 - win32)

"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting

"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86

"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended

"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86

"{0F37D969-1260-419E-B308-EF7D29ABDE20}" = Web Deployment Tool

"{140F65D8-D07A-36CC-91C5-54DEC8140C43}" = Adobe Captivate Reviewer

"{141E87B2-0D67-433D-BE6E-69D0211B20EA}" = Kerberos for Windows

"{14962706-0C85-4135-B7F2-13A519FF3C6B}_is1" = OGG Video Converter v5.42 build 2436

"{150493B7-B59F-C677-F3AD-67C7E97CAAAF}" = Adobe Help Viewer 2

"{15F02176-0D12-4FAF-B2CD-2767C7781427}" = Google SketchUp 8

"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4

"{1803A630-3C38-4D2B-9B9A-0CB37243539C}" = Microsoft ASP.NET MVC 2

"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin

"{193EAFD0-1BAF-4FB4-B18F-79D5D6A4B285}" = Adobe After Effects CS3 Presets

"{1C4551A6-4743-4093-91E4-1477CD655043}" = NVIDIA PhysX

"{1D328E11-3B0C-388C-835D-C9C20E8C7734}" = Microsoft Help Viewer 1.0 Language Pack - DEU

"{1D58229F-C505-45CA-8223-F35F3A34B963}" = Adobe Version Cue CS3 Server

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{20B1B020-DEAE-48D1-9960-D4C3185D758B}" = Phase 5 HTML-Editor

"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31

"{28E82311-8616-11E1-BEB0-B8AC6F97B88E}" = Google Earth

"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3

"{2B6F6771-46DA-4DEB-B738-E809A81B17F7}" = Adobe Setup

"{31C3C6EA-E991-405F-A3AA-2C070CCCC47C}" = Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools - DEU

"{32364CEA-7855-4A3C-B674-53D8E9B97936}" = TuneUp Utilities 2012

"{32A3A4F4-B792-11D6-A78A-00B0D0160160}" = Java(TM) SE Development Kit 6 Update 16

"{32A9C5B3-D166-4C6D-A11E-A54473150000}" = Java 3D 1.5.2

"{33AE9E89-47C9-4A0D-9E9D-BDD6966A3804}" = Microsoft SQL Server 2008 RsFx Driver

"{3BB19A2B-B9C5-3872-8FDF-3047CC9F9841}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x86)

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{40416836-56CC-4C0E-A6AF-5C34BADCE483}" = Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools

"{411E0CC3-587A-468C-B461-95FAFD05E4DE}" = Adobe InDesign CS3

"{4723f199-fa64-4233-8e6e-9fccc95a18ee}" = Python 2.6.5

"{477415F5-93DA-46AA-85C5-640047825995}" = Microsoft SQL Server 2008 Database Engine Shared

"{47C39E4A-28F2-33B1-B9B7-97F24E52D917}" = Microsoft Help Viewer 1.0

"{485ACF57-F364-440A-8496-E1E81C8FA1AA}" = Adobe Premiere Pro CS3 Third Party Content

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4A5A427F-BA39-4BF0-9999-9A47FBE60C9F}" = Visual C++ 9.0 Runtime for Dragon NaturallySpeaking

"{4A6F34E2-09E5-4616-B227-4A26A488A6F9}" = Microsoft SQL Server 2008 Common Files

"{4AA5B8A5-BEEF-4AD8-B11D-4443A042EA4F}" = Adobe Dreamweaver CS3

"{4AF2248C-B3DF-46FB-9596-87F5DB193689}" = Microsoft SQL Server 2008 Browser

"{4F44B5AE-82A6-4A8A-A3E3-E24D489728E3}" = Microsoft SQL Server 2008 Native Client

"{50D4CB89-AF34-4978-96DC-C3034062E901}" = Battlefield 2: Special Forces

"{50F102CA-4BE2-41A9-9810-5BB05EB91B9A}" = Adobe Premiere Pro CS3 Functional Content

"{51722911-C391-4118-97BF-B50100D2AB15}_is1" = Gephi 0.8

"{5242B252-01BB-4F2E-BBF4-5C01BC3B6619}" = Microsoft SQL Server 2008 R2 Data-Tier Application Project

"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3

"{54B2EAD9-A110-43F7-B010-2859A1BD2AFE}" = Adobe Encore CS3

"{58DCEEE5-532E-44F4-B1D7-A146EF9E9FDA}" = Adobe Premiere Pro CS3

"{5A08C9D1-37AD-4A8D-90D3-33F92C578AA5}" = Microsoft SQL Server System CLR Types

"{5aa47dba-b584-4d47-a626-76e53f010201}" = JavaFX(TM) 1.2 SDK

"{5BD39911-A12F-4562-98BA-A6E03E3370B1}" = Microsoft SQL Server 2008 Database Engine Services

"{5E152D08-572A-3375-8FDE-DAD1EFB379BA}" = Microsoft Report Viewer Redistributable 2008

"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053

"{616C6F39-4CE1-3434-A665-2F6A04C09A7F}" = Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools

"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86

"{63B9BAB5-F36A-4A3B-9E5C-68A7F212BFB9}" = TerraTec Home Cinema

"{64665955-E1A1-4A8B-BFFA-673A95318909}" = ArcGIS Desktop 10

"{65FBA21B-7F80-4E4E-B275-0958D2648F94}_is1" = Java-Editor 9.14

"{681F4E9F-34E0-36BD-BF2C-100554E403A5}" = Microsoft Visual F# 2.0 Runtime Language Pack - DEU

"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin

"{6A86554B-8928-30E4-A53C-D7337689134D}" = Microsoft Visual C++ 2010  x86 Runtime - 10.0.30319

"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All

"{6B708481-748A-4EB4-97C1-CD386244FF77}" = Adobe MotionPicture Color Files

"{6BBAA81D-6A7E-43AD-8889-2F002DCAAFDD}" = AHV content for Acrobat and Flash

"{6CDEAD7E-F8D8-37F7-AB6F-1E22716E30F3}" = Microsoft Visual Studio Macro Tools

"{6D172D0A-B9F1-4046-AFAB-8599288545BF}" = Safari

"{6E93D44A-870D-823C-F0B2-09D96E8DE87B}" = Adobe Captivate Reviewer 1.0

"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK

"{729A3000-BC8A-3B74-BA5D-5068FE12D70C}" = Microsoft Visual F# 2.0 Runtime

"{73B5D990-04EA-4751-B10F-5534770B91F2}" = Adobe Color EU Recommended Settings

"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update

"{7ACFB90E-8FD0-4397-AD3A-5195412623A3}" = Adobe Help Viewer CS3

"{7B4D193B-D76D-308B-8B12-5D9BB1CBCE6C}" = Microsoft Visual Basic Power Packs 3.0

"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime

"{7FC7AD70-1DF3-4B84-9AA2-4FB680F45572}_is1" = Hex-Editor MX

"{845A8DB9-8802-4FD3-9FE3-938A6C46A2EC}" = Adobe Video Profiles

"{85262A06-2D8C-4BC1-B6ED-5A705D09CFFC}" = Apache HTTP Server 2.2.15

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8C640345-AF96-4ABA-A697-97D2A0B8C6DB}" = Adobe Flash CS3

"{8D1E61D1-1395-4E97-997F-D002DB3A5074}" = OpenOffice.org 3.2

"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3

"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support

"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007

"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)

"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007

"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)

"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007

"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)

"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007

"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)

"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007

"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)

"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007

"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)

"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007

"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{2AB528A5-BB1B-4EBE-8E51-AD0C4CD33CA9}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{3EC77D26-799B-4CD8-914F-C1565E796173}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)

"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007

"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{430971B1-C31E-45DA-81E0-72C095BAB72C}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)

"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007

"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{58FC5E37-DD28-4D4A-A549-125744C6763C}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)

"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007

"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007

"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{BEE75E01-DD3F-4D5F-B96C-609E6538D419}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)

"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007

"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)

"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007

"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{888B9AC7-8F5C-456B-A27A-157A6C310E52}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)

"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007

"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)

"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007

"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)

"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3

"{91F54E1D-804A-46D8-A56C-53EA9C4B3177}" = Microsoft Silverlight 3 SDK - Deutsch

"{926C96FB-9D0A-4504-8000-C6D3A4A3118E}" = Java DB 10.4.2.1

"{929F5BFC-60F0-34EC-A50B-2001AAC03D56}" = Microsoft Team Foundation Server 2010 Object Model - DEU

"{92C5C058-E941-47C3-B7E8-38A79C605969}" = Microsoft SQL Server 2008 R2 Transact-SQL Language Service

"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86

"{935CD2F3-D5EF-F7DE-1FB7-9BC05B75833A}" = Adobe Captivate Quiz Results Analyzer

"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting

"{951B0F30-9F1A-4BF6-B3DA-99EB0E917B1C}" = FARO LS 1.1.406.58

"{9802B19D-04B3-7D0A-B76B-8B3C2931D8BD}" = Adobe Captivate Quiz Results Analyzer

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9AA2D735-3375-42D4-9A61-3FFEF82599D6}" = Unterstützungsdateien für Microsoft SQL Server 2008-Setup 

"{9C3B8582-A72A-4835-8903-877A834407BB}" = Microsoft SQL Server 2008 R2-Datenebenenanwendungs-Framework

"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3

"{9F21636C-AF0F-11E1-A68F-DB94DA02BCD2}" = Adobe Captivate 6 (32 Bit)

"{A106D33E-6B43-42C0-9BFC-D03303261FA7}" = Microsoft SQL Server 2008 R2 Management Objects

"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps

"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific

"{A6B23EFA-6590-482C-A11F-5ACE1B91F5B9}" = Adobe Soundbooth CS3

"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5

"{A83279FD-CA4B-4206-9535-90974DE76654}" = Apple Application Support

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{AA13414C-F583-4125-B8C9-62912FE27E9E}" = EPD-7.2-2

"{ABBACAD2-4DAF-490E-932B-E330B33FCF98}" = Softi FreeOCR

"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings

"{AC76BA86-1033-F400-7760-000000000003}" = Adobe Acrobat 8 Professional - English, Français, Deutsch

"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch

"{ACE28263-76A4-4BF5-B6F4-8BD719595969}" = Microsoft SQL Server Database Publishing Wizard 1.4

"{AD5BB69E-E6C9-42BE-BC50-76AA550EB37F}" = OpenAFS for Windows

"{AF37176A-78CA-545B-34EF-8B6A21514DD1}" = Adobe Help Manager

"{B001064C-D061-4BAE-9031-416A838D5536}" = Adobe Flash Player 10 ActiveX

"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0

"{B5153233-9AEE-4CD4-9D2C-4FAAC870DBE2}" = Microsoft SQL Server 2008 Database Engine Services

"{B671CBFD-4109-4D35-9252-3062D3CCB7B2}" = Adobe SING CS3

"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call

"{B6D38690-755E-4F40-A35A-23F8BC2B86AC}" = Microsoft_VC90_MFCLOC_x86

"{B73CFB12-C814-4638-AFFD-7E3AAFAF0B4E}" = Adobe BridgeTalk Plugin CS3

"{B7E38540-E355-3503-AFD7-635B2F2F76E1}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974

"{B8B7A4D8-80E1-4DAE-BD33-7FD535BA3931}" = Adobe Encore CS3 Codecs

"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3

"{BC4AE628-81A4-4FC6-863A-7A9BA2E2531F}" = Nokia Connectivity Cable Driver

"{BCEDD813-269C-4D8F-A4BA-01FDC66254D3}" = Adobe Flash Video Encoder

"{BE5F3842-8309-4754-92D5-83E02E6077A3}" = Adobe Extension Manager CS3

"{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2

"{C4901881-CA4A-48BD-BD48-C4CA87C1DD7C}" = Adobe Captivate 4

"{C5BD220A-EFE8-48A5-B70E-9503D535FACE}" = Adobe WAS CS3

"{C8D7A672-F697-4572-AC62-C856053A8DBC}" = Adobe Illustrator CS3

"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack

"{C965F01C-76EA-4BD7-973E-46236AE312D7}" = Sql Server Customer Experience Improvement Program

"{C9D456FD-C25B-49DE-AA71-6B76D6550B23}" = Adobe Fireworks CS3

"{CE026CFE-73FE-4FED-9D5F-2C8D4DB512B0}" = TuneUp Utilities Language Pack (de-DE)

"{CFCB8616-A5D1-4281-80E8-389F685BFAE2}" = Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 DEU

"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack

"{D074DC76-F6C9-440E-A1D0-1DE958417FDB}" = Microsoft SQL Server VSS Writer

"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client

"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86

"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files

"{D3C605D8-3A5E-4BAD-965D-2C61441BF2AC}" = Adobe Photoshop CS3

"{D5A31AB1-345D-47C7-A87B-036A669F6DF1}" = Adobe XMP Panels CS3

"{D6A6CFAD-CD86-482B-90D1-6FCC4E252ACD}" = Microsoft Sync Services for ADO.NET v2.0 SP1 (x86) de

"{D7B96D96-D9F4-40B7-B913-3D50BDD87C6F}" = Suite Shared Configuration CS4

"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86

"{DA896917-C1DA-45B2-B4D2-68162F16C0DD}" = Adobe Creative Suite 3 Master Collection

"{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}" = Adobe Color Common Settings

"{DB0AF767-7CC7-4E4D-B6BE-A200F20A2FB1}" = Microsoft Sync Framework Runtime v1.0 SP1 (x86) de

"{DBE8431C-CF9A-38C3-B42D-28B6FCE1EA3B}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU

"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings

"{DE0A6C3C-81A2-644C-D9E5-7A2E3C744EBC}" = Adobe Captivate - SWF to HTML5 Converter

"{DFFDDCF5-CB32-4354-8823-1B9E68025953}" = Adobe Setup

"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime

"{E4E9CBC9-1CF5-48E3-AF6F-1AB44A856346}" = Microsoft ASP.NET MVC 2 - DEU

"{E59113EB-0285-4BFD-A37A-B79EAC6B8F4B}" = Microsoft SQL Server Compact 3.5 SP1 English

"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3

"{E6FA148F-1E7D-4A42-A9A2-7DFABC2C6A2B}" = SportTracks 2.1

"{E95E230C-0AAA-4221-9AB4-0A2D5BC33F18}" = Gaia 3

"{EA7B3CC4-366D-4CF6-8350-FD7A7034116E}" = Adobe InDesign CS3 Icon Handler

"{EAF7B35C-DCBE-4032-9ABF-C35C43D07124}" = Microsoft Sync Framework Services v1.0 SP1 (x86) de

"{EB0202F7-016A-410C-ADE4-40F848CCC661}" = Adobe After Effects CS3

"{EC66418E-DAA2-36D5-809E-40BEC94E622A}" = Microsoft Visual Studio Macro Tools - DEU Language Pack

"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.8

"{EFFA53BC-8C04-2E21-3D90-A13B1697B0CA}" = Dragon NaturallySpeaking 11

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F3494AB6-6900-41C6-AF57-823626827ED8}" = Microsoft SQL Server 2008 Database Engine Shared

"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"{F9FAC696-2E48-497D-B820-C9A65DA630DF}" = Adobe eLearning Suite 2.5

"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR

"{FF29A7E2-FF40-4D07-B7E4-2093DE59E10A}" = Adobe Color NA Extra Settings

"{FF3E2850-BD2E-4B56-A89D-21E588D518E0}" = Adobe Contribute CS3

"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

"{FF6F95A4-E59B-45C8-BEA8-0BDC8D9CAB51}" = Microsoft SQL Server 2008 Common Files

"Adobe AIR" = Adobe AIR

"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin

"Adobe SVG Viewer" = Adobe SVG Viewer 3.0

"Adobe_1e92effc954e788ad49a56b24f4bcf1" = Adobe Captivate 4

"Adobe_67a7fb1e97aa14ee9ef0950eb6fd757" = Adobe Creative Suite 3 Master Collection hinzufügen oder entfernen

"AdobeCaptivateReviewer2.5.D22673E681B55698FF9C7ED1AC2C76EECFF3CF3F.1" = Adobe Captivate Reviewer

"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.9

"ArcGIS Desktop 10" = ArcGIS Desktop 10

"Avira AntiVir Desktop" = Avira Free Antivirus

"Bytescout Lossless Video Codec_is1" = Bytescout Lossless Video Codec 1.00.187 (FREEWARE)

"BytescoutLosslessCodec" = Bytescout Lossless Codec

"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Help Manager

"CPSWFTOHTMLConverter" = Adobe Captivate - SWF to HTML5 Converter

"Dev-C++" = Dev-C++ 5 beta 9 release (4.9.9.2)

"DivX Setup.divx.com" = DivX-Setup

"ENTERPRISE" = Microsoft Office Enterprise 2007

"Free FLV Converter_is1" = Free FLV Converter V 7.4.0

"FreeCommander_is1" = FreeCommander 2009.02a

"GameSpy Arcade" = GameSpy Arcade

"GanttProject" = GanttProject

"GDAL-py2.6" = Python 2.6 GDAL-1.6.1

"GeoServer 2.0.1" = GeoServer 2.0.1

"Google Chrome" = Google Chrome

"GPL Ghostscript 8.71" = GPL Ghostscript 8.71

"GSview 4.9" = GSview 4.9

"hotpot_is1" = HotPotatoes v 6.3.0.4

"IrfanView" = IrfanView (remove only)

"JGeoPro_is1" = 9.11.24x

"Kalender-Excel_is1" = Kalender-Excel 8.6.1

"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300

"MatlabR2009a" = MATLAB R2009a

"MediaConverter" = MediaConverter 1.2.8

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended

"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack

"Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0

"Microsoft Help Viewer 1.0 Language Pack - DEU" = Microsoft Help Viewer 1.0 Language Pack - DEU

"Microsoft Report Viewer Redistributable 2008" = Microsoft Report Viewer Redistributable 2008

"Microsoft SQL Server 10" = Microsoft SQL Server 2008

"Microsoft SQL Server 10 Release" = Microsoft SQL Server 2008

"Microsoft Team Foundation Server 2010 Object Model - DEU" = Microsoft Team Foundation Server 2010-Objektmodell - DEU

"Microsoft Visual Studio 2010 Tools for Office Runtime (x86)" = Microsoft Visual Studio 2010 Tools for Office Runtime (x86)

"Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU" = Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x86) Language Pack - DEU

"Microsoft Visual Studio Macro Tools" = Microsoft Visual Studio Macro Tools

"Microsoft Visual Studio Macro Tools - DEU Language Pack" = Microsoft Visual Studio Macro Tools - DEU Language Pack

"Miro Video Converter" = Miro Video Converter

"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)

"Mozilla Thunderbird 14.0 (x86 de)" = Mozilla Thunderbird 14.0 (x86 de)

"MozillaMaintenanceService" = Mozilla Maintenance Service

"Next ESA SAR Toolbox 4B-1.0" = Next ESA SAR Toolbox

"numpy-py2.6" = Python 2.6 numpy-1.6.1

"Open Jump (PIROL Edition)" = Open Jump (PIROL Edition)

"OpenCV" = Open Source Computer Vision Library

"OpenJUMP" = OpenJUMP 1.3

"Opera 11.64.1403" = Opera 11.64

"pgJDBC 8.4-701-1" = pgJDBC 8.4-701

"PIL-py2.6" = Python 2.6 PIL-1.1.7

"PostGIS 1.4 for PostgreSQL 8.4" = PostGIS 1.4.0 for PostgreSQL 8.4 (remove only)

"PostgreSQL 8.4" = PostgreSQL 8.4

"PSPad editor_is1" = PSPad editor

"psqlODBC 08.04.0100-1" = psqlODBC 08.04.0100

"QuizResultsAnalyzer.C0CA58D26EB27EF0DDD094CE3C4337F3360F5EE2.1" = Adobe Captivate Quiz Results Analyzer

"QuizResultsAnalyzer1.5.D22673E681B55698FF9C7ED1AC2C76EECFF3CF3F.1" = Adobe Captivate Quiz Results Analyzer

"R for Windows 2.12.0_is1" = R for Windows 2.12.0

"scipy-py2.6" = Python 2.6 scipy-0.10.1

"Synovel Spicebird (0.8)" = Synovel Spicebird (0.8)

"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2

"TeamSpeak 3 Client" = TeamSpeak 3 Client

"TileMill" = TileMill 0.9.0

"Tinn-R_is1" = Tinn-R 2.3.7.1

"Trillian" = Trillian

"VLC media player" = VLC media player 1.0.2

"VP Suite 5.3" = VP Suite 5.3

"Winamp" = Winamp

"WinRAR archiver" = WinRAR archiver

"WinZip" = WinZip

"WirelessMon_is1" = WirelessMon V4.0

"yEd Graph Editor 3.4.2" = yEd Graph Editor 3.4.2

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"Dropbox" = Dropbox

"Game Organizer" = EasyBits GO

"Google Chrome" = Google Chrome

"STANLY Track EDDH" = STANLY Track EDDH

"yEd Graph Editor" = yEd Graph Editor

 
 ========== Last 20 Event Log Errors ==========

 

[ Application Events ]

Error - 15.08.2012 17:54:40 | Computer Name = carsten-PC | Source = AFS Client | ID = 4130

Description = OpenAFS Stopping due to error (afsd_service.c:1276): can't find root

 volume in root cell.

 

Error - 16.08.2012 03:40:08 | Computer Name = carsten-PC | Source = AFS Client | ID = 4130

Description = OpenAFS Stopping due to error (afsd_service.c:1276): can't find root

 volume in root cell.

 

Error - 16.08.2012 03:54:07 | Computer Name = carsten-PC | Source = AFS Client | ID = 4130

Description = OpenAFS Stopping due to error (afsd_service.c:1276): can't find root

 volume in root cell.

 

Error - 16.08.2012 03:56:47 | Computer Name = carsten-PC | Source = AFS Client | ID = 4130

Description = OpenAFS Stopping due to error (afsd_service.c:1276): can't find root

 volume in root cell.

 

Error - 16.08.2012 04:18:35 | Computer Name = carsten-PC | Source = AFS Client | ID = 4130

Description = OpenAFS Stopping due to error (afsd_service.c:1276): can't find root

 volume in root cell.

 

Error - 16.08.2012 04:20:16 | Computer Name = carsten-PC | Source = AFS Client | ID = 4130

Description = OpenAFS Stopping due to error (afsd_service.c:1276): can't find root

 volume in root cell.

 

Error - 16.08.2012 04:59:49 | Computer Name = carsten-PC | Source = AFS Client | ID = 4130

Description = OpenAFS Stopping due to error (afsd_service.c:1276): can't find root

 volume in root cell.

 

Error - 16.08.2012 05:05:09 | Computer Name = carsten-PC | Source = AFS Client | ID = 4130

Description = OpenAFS Stopping due to error (afsd_service.c:1276): can't find root

 volume in root cell.

 

Error - 16.08.2012 05:08:48 | Computer Name = carsten-PC | Source = AFS Client | ID = 4130

Description = OpenAFS Stopping due to error (afsd_service.c:1276): can't find root

 volume in root cell.

 

Error - 16.08.2012 08:42:14 | Computer Name = carsten-PC | Source = AFS Client | ID = 4130

Description = OpenAFS Stopping due to error (afsd_service.c:1276): can't find root

 volume in root cell.

 

[ OSession Events ]

Error - 27.07.2010 08:52:06 | Computer Name = carsten-PC | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 0, Application Name: Microsoft Office Word, Application Version:

 12.0.6211.1000, Microsoft Office Version: 12.0.6215.1000. This session lasted 2055

 seconds with 900 seconds of active time.  This session ended with a crash.

 

Error - 05.07.2012 07:16:18 | Computer Name = carsten-PC | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 0, Application Name: Microsoft Office Word, Application Version:

 12.0.6211.1000, Microsoft Office Version: 12.0.6215.1000. This session lasted 6309

 seconds with 660 seconds of active time.  This session ended with a crash.

 

[ System Events ]

Error - 16.08.2012 09:06:20 | Computer Name = carsten-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der

 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 16.08.2012 09:09:56 | Computer Name = carsten-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der

 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 16.08.2012 09:09:56 | Computer Name = carsten-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der

 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 16.08.2012 09:09:56 | Computer Name = carsten-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der

 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 16.08.2012 09:13:28 | Computer Name = carsten-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der

 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 16.08.2012 09:13:28 | Computer Name = carsten-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der

 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 16.08.2012 09:13:28 | Computer Name = carsten-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der

 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 16.08.2012 09:17:02 | Computer Name = carsten-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der

 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 16.08.2012 09:17:02 | Computer Name = carsten-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der

 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 16.08.2012 09:17:02 | Computer Name = carsten-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der

 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

 

< End of report >

:hallo:

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
Starte die OTL.exe.
Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:

Code:

:OTL

IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} 

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC 

IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}: "URL" = http://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms} 

IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2776682 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.searchqu.com/413 

IE - HKCU\..\URLSearchHook: {51a86bb3-6602-4c85-92a5-130ee4864f13} - No CLSID value found 

IE - HKCU\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} 

IE - HKCU\..\SearchScopes\{052A1970-A861-4835-A805-C198CA0EF5D3}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=TRL2&o=15902&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=TW&apn_dtid=YYYYYYYYDE&apn_uid=54FB0585-3FB0-4CBB-AC73-7CE0167B8628&apn_sauid=857E0342-93AA-4641-9B6E-26C66AF693B6 

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC 

IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}: "URL" = http://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms} 

IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2776682 

IE - HKCU\..\SearchScopes\{DC52F059-EF38-4ACC-8431-6D5765822AA9}: "URL" = http://www.google.de/search?q={searchTerms} 

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 

FF - prefs.js..browser.search.defaultengine: "Ask.com" 

FF - prefs.js..browser.search.defaultenginename: "Search Results" 

FF - prefs.js..browser.search.defaultthis.engineName: "BrotherSoft Extreme Customized Web Search" 

FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2776682&SearchSource=3&q={searchTerms}" 

FF - prefs.js..browser.search.order.1: "Search Results" 

FF - prefs.js..browser.search.selectedEngine: "Google" 

FF - prefs.js..browser.search.useDBForOrder: true 

FF - prefs.js..browser.startup.homepage: "about:blank" 

FF - prefs.js..keyword.URL: "http://dts.search-results.com/sr?src=ffb&appid=0&systemid=413&sr=0&q=" 

FF - user.js - File not found 

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found 

O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\WIA6EB~1\Datamngr\ToolBar\searchqudtx.dll File not found 

O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\WIA6EB~1\Datamngr\ToolBar\searchqudtx.dll File not found 

O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. 

O4 - HKLM..\Run: [AdobeCS5.5ServiceManager] "C:\Program Files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin File not found 

O4 - HKLM..\Run: [WPDShServiceObj] C:\Users\carsten\AppData\Local\Microsoft\Windows\1915\WPDShServiceObj.exe () 

O4 - Startup: C:\Users\carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\carsten\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) 

O4 - Startup: C:\Users\carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) 

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) 

O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) 

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) 

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) 

O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found 

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 

O32 - HKLM CDRom: AutoRun - 1 

O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] 

O33 - MountPoints2\{e88a7161-d79a-11de-899f-002318f1034d}\Shell - "" = AutoRun 

O33 - MountPoints2\{e88a7161-d79a-11de-899f-002318f1034d}\Shell\AutoRun\command - "" = G:\SETUP.EXE 

[2012.08.15 16:31:06 | 000,000,000 | -HSD | C] -- C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936} 
 

[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] 
 

@Alternate Data Stream - 242 bytes -> C:\ProgramData\Temp:0FF263E8 

[2011.09.21 09:27:32 | 000,002,396 | ---- | M] () -- C:\Users\carsten\AppData\Roaming\Mozilla\Firefox\Profiles\fu92pvm9.default\searchplugins\askcom.xml 

[2012.08.16 14:42:26 | 000,000,000 | ---D | C] -- C:\Users\carsten\AppData\Roaming\hellomoto 

[2012.08.16 14:41:46 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job 

[2012.08.15 16:14:01 | 000,001,100 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job 

:Files
 

ipconfig /flushdns /c

:Commands

[purity]

[emptytemp]

Schließe alle Programme.
Klicke auf den Fix Button.
Wenn OTL einen Neustart verlangt, bitte zulassen.
Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

Danke für die Hilfe. In der Zwischen Zeit habe ich mit der Kaspersiky Resuce CD bzw. mit dem speziellen Trojaner Kaspersky Notfall-CD 10 herunterladen Programm enige Trojaner löschen können. hxxp://support.kaspersky.com/de/faq/?qid=207621612 Das klappte alles ohne Problem nach der guten Beschreibung. Jetzt ist auch mein Bildschrim nicht mehr gesperrt. Ich habe danach noch ein paar mal anti-viren- und maleware programme rüber laufen lassen, die bis dato nicht gefunden haben. Kann ich das gegeben Script auch jetzt noch Problem los ausführen lassen um sicher zu gehen das wirklich alles schädliche teile gelöscht werden oder kann es dadurch nun zu problemen mit meinem Betriebssystem kommen?

Vielen Dank für die Hilfe

Fuehre den Fix aus.

Dein System ist weder sauber noch abgesichert.

So hier ist mal das Log-File. Eine kleine frage was genau hat der Code eigentlich so gemacht den ich ausgeführt habe?

Code:

All processes killed

========== OTL ==========

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.

HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!

Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{51a86bb3-6602-4c85-92a5-130ee4864f13} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{51a86bb3-6602-4c85-92a5-130ee4864f13}\ not found.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{052A1970-A861-4835-A805-C198CA0EF5D3}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{052A1970-A861-4835-A805-C198CA0EF5D3}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DC52F059-EF38-4ACC-8431-6D5765822AA9}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DC52F059-EF38-4ACC-8431-6D5765822AA9}\ not found.

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!

Prefs.js: "Ask.com" removed from browser.search.defaultengine

Prefs.js: "Search Results" removed from browser.search.defaultenginename

Prefs.js: "BrotherSoft Extreme Customized Web Search" removed from browser.search.defaultthis.engineName

Prefs.js: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2776682&SearchSource=3&q={searchTerms}" removed from browser.search.defaulturl

Prefs.js: "Search Results" removed from browser.search.order.1

Prefs.js: "Google" removed from browser.search.selectedEngine

Prefs.js: true removed from browser.search.useDBForOrder

Prefs.js: "about:blank" removed from browser.startup.homepage

Prefs.js: "hxxp://dts.search-results.com/sr?src=ffb&appid=0&systemid=413&sr=0&q=" removed from keyword.URL

Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@microsoft.com/GENUINE\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99079a25-328f-4bd4-be04-00955acaa0a7}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}\ deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{99079a25-328f-4bd4-be04-00955acaa0a7} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}\ not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\10 deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeCS5.5ServiceManager deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\WPDShServiceObj not found.

File C:\Users\carsten\AppData\Local\Microsoft\Windows\1915\WPDShServiceObj.exe not found.

C:\Users\carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk moved successfully.

C:\Users\carsten\AppData\Roaming\Dropbox\bin\Dropbox.exe moved successfully.

C:\Users\carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk moved successfully.

C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE moved successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLUA deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\PromptOnSecureDesktop deleted successfully.

Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.

Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.

Registry key HKEY_USERS\.DEFAULT\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.

Registry key HKEY_USERS\S-1-5-21-676213429-3020436486-3576442665-1003\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.

Starting removal of ActiveX control {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ deleted successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ deleted successfully.

Registry key HKEY_USERS\S-1-5-21-676213429-3020436486-3576442665-1003\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ not found.

Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.

Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}

C:\Windows\Downloaded Program Files\gp.inf not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

C:\autoexec.bat moved successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e88a7161-d79a-11de-899f-002318f1034d}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e88a7161-d79a-11de-899f-002318f1034d}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e88a7161-d79a-11de-899f-002318f1034d}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e88a7161-d79a-11de-899f-002318f1034d}\ not found.

File G:\SETUP.EXE not found.

C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936} folder moved successfully.

C:\Windows\System32\ConduitEngine.tmp deleted successfully.

ADS C:\ProgramData\Temp:0FF263E8 deleted successfully.

C:\Users\carsten\AppData\Roaming\Mozilla\Firefox\Profiles\fu92pvm9.default\searchplugins\askcom.xml moved successfully.

C:\Users\carsten\AppData\Roaming\hellomoto folder moved successfully.

C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job moved successfully.

C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job moved successfully.

========== FILES ==========
 < ipconfig /flushdns /c >

Windows-IP-Konfiguration

Der DNS-Aufl”sungscache wurde geleert.

C:\Users\carsten\Desktop\cmd.bat deleted successfully.

C:\Users\carsten\Desktop\cmd.txt deleted successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: carsten

->Temp folder emptied: 6840442607 bytes

->Temporary Internet Files folder emptied: 393575576 bytes

->Java cache emptied: 110919978 bytes

->FireFox cache emptied: 545377113 bytes

->Google Chrome cache emptied: 200401202 bytes

->Apple Safari cache emptied: 2790400 bytes

->Opera cache emptied: 21075115 bytes

->Flash cache emptied: 3148406 bytes

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

->Flash cache emptied: 56475 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

User: Katrin

 

User: postgres

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Public

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 455995665 bytes

RecycleBin emptied: 7045752 bytes

 

Total Files Cleaned = 8.183,00 mb

 

 

OTL by OldTimer - Version 3.2.57.0 log created on 08202012_092718
 

Files\Folders moved on Reboot...
 

PendingFileRenameOperations files...
 

Registry entries deleted on Reboot...

Sehr gut! :daumenhoc

Wie laeuft der Rechner?

1. Schritt

Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktualisiere die Datenbank!
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".

danach:

2. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Search.
Nach Ende des Suchlaufs öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

Hallo t'john,

hier ist mal das Log-file des AdwCleaner:

Code:

# AdwCleaner v1.801 - Logfile created 08/21/2012 at 13:44:53

# Updated 14/08/2012 by Xplode

# Operating system : Windows 7 Professional Service Pack 1 (32 bits)

# User : carsten - CARSTEN-PC

# Boot Mode : Normal

# Running from : C:\Users\carsten\Desktop\adwcleaner.exe

# Option [Search]
 
 

***** [Services] *****
 
 

***** [Files / Folders] *****
 

Folder Found : C:\Users\carsten\AppData\Local\Conduit

Folder Found : C:\Users\carsten\AppData\LocalLow\searchquband

Folder Found : C:\Users\carsten\AppData\Roaming\OpenCandy

Folder Found : C:\Users\carsten\AppData\Roaming\Mozilla\Firefox\Profiles\fu92pvm9.default\Conduit

Folder Found : C:\Users\carsten\AppData\Roaming\Mozilla\Firefox\Profiles\fu92pvm9.default\ConduitCommon

Folder Found : C:\ProgramData\boost_interprocess
 

***** [Registry] *****

[*] Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT2776682

Key Found : HKCU\Software\AppDataLow\Software\searchqutoolbar

Key Found : HKCU\Software\DataMngr

Key Found : HKCU\Software\Headlight

Key Found : HKCU\Software\Softonic

Key Found : HKLM\SOFTWARE\Classes\Conduit.Engine

Key Found : HKLM\SOFTWARE\Conduit

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
 

***** [Registre - GUID] *****
 

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{99079A25-328F-4BD4-BE04-00955ACAA0A7}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{99079A25-328F-4BD4-BE04-00955ACAA0A7}

Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
 

***** [Internet Browsers] *****
 

#NAME?
 

[OK] Registry is clean.
 

#NAME?
 

Profile name : default 

File : C:\Users\carsten\AppData\Roaming\Mozilla\Firefox\Profiles\fu92pvm9.default\prefs.js
 

"Found : user_pref(""CT2776682..clientLogIsEnabled"", true);"

"Found : user_pref(""CT2776682..clientLogServiceUrl"", ""hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]"

"Found : user_pref(""CT2776682..uninstallLogServiceUrl"", ""hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]"

"Found : user_pref(""CT2776682.AboutPrivacyUrl"", ""hxxp://www.conduit.com/privacy/Default.aspx"");"

"Found : user_pref(""CT2776682.BrowserCompStateIsOpen_129453492929819378"", true);"

"Found : user_pref(""CT2776682.BrowserCompStateIsOpen_129512039755754602"", true);"

"Found : user_pref(""CT2776682.CT2776682"", ""CT2776682"");"

"Found : user_pref(""CT2776682.CurrentServerDate"", ""26-6-2011"");"

"Found : user_pref(""CT2776682.DialogsGetterLastCheckTime"", ""Sun Jun 26 2011 12:10:34 GMT+0200"");"

"Found : user_pref(""CT2776682.DownloadReferralCookieData"", """");"

"Found : user_pref(""CT2776682.EMailNotifierPollDate"", ""Sun Jun 26 2011 14:44:50 GMT+0200"");"

"Found : user_pref(""CT2776682.FirstServerDate"", ""20-6-2011"");"

"Found : user_pref(""CT2776682.FirstTime"", true);"

"Found : user_pref(""CT2776682.FirstTimeFF3"", true);"

"Found : user_pref(""CT2776682.FixPageNotFoundErrors"", true);"

"Found : user_pref(""CT2776682.GroupingServerCheckInterval"", 1440);"

"Found : user_pref(""CT2776682.GroupingServiceUrl"", ""hxxp://grouping.services.conduit.com/"");"

"Found : user_pref(""CT2776682.HasUserGlobalKeys"", true);"

"Found : user_pref(""CT2776682.HomePageProtectorEnabled"", true);"

"Found : user_pref(""CT2776682.Initialize"", true);"

"Found : user_pref(""CT2776682.InitializeCommonPrefs"", true);"

"Found : user_pref(""CT2776682.InstallationAndCookieDataSentCount"", 3);"

"Found : user_pref(""CT2776682.InstalledDate"", ""Mon Jun 20 2011 19:14:30 GMT+0200"");"

"Found : user_pref(""CT2776682.InvalidateCache"", false);"

"Found : user_pref(""CT2776682.IsAlertDBUpdated"", true);"

"Found : user_pref(""CT2776682.IsGrouping"", false);"

"Found : user_pref(""CT2776682.IsMulticommunity"", false);"

"Found : user_pref(""CT2776682.IsOpenThankYouPage"", true);"

"Found : user_pref(""CT2776682.IsOpenUninstallPage"", true);"

"Found : user_pref(""CT2776682.LanguagePackReloadIntervalMM"", 1440);"

"Found : user_pref(""CT2776682.LanguagePackServiceUrl"", ""hxxp://translation.users.conduit.com/Translation.ashx[...]"

"Found : user_pref(""CT2776682.LastLogin_3.3.3.2"", ""Sat Jun 25 2011 22:37:39 GMT+0200"");"

"Found : user_pref(""CT2776682.LastLogin_3.5.0.12"", ""Sun Jun 26 2011 12:10:34 GMT+0200"");"

"Found : user_pref(""CT2776682.LatestVersion"", ""3.3.3.2"");"

"Found : user_pref(""CT2776682.MyStuffEnabledAtInstallation"", true);"

"Found : user_pref(""CT2776682.RadioIsPodcast"", false);"

"Found : user_pref(""CT2776682.RadioLastCheckTime"", ""Sun Jun 26 2011 12:10:34 GMT+0200"");"

"Found : user_pref(""CT2776682.RadioLastUpdateIPServer"", ""3"");"

"Found : user_pref(""CT2776682.RadioLastUpdateServer"", ""3"");"

"Found : user_pref(""CT2776682.RadioMediaID"", ""9962"");"

"Found : user_pref(""CT2776682.RadioMediaType"", ""Media Player"");"

"Found : user_pref(""CT2776682.RadioMenuSelectedID"", ""EBRadioMenu_CT27766829962"");"

"Found : user_pref(""CT2776682.RadioShrinkedFromSetup"", false);"

"Found : user_pref(""CT2776682.RadioStationName"", ""California%20Rock"");"

"Found : user_pref(""CT2776682.RadioStationURL"", ""hxxp://feedlive.net/california.asx"");"

"Found : user_pref(""CT2776682.SHRINK_TOOLBAR"", 1);"

"Found : user_pref(""CT2776682.SavedHomepage"", ""chrome://branding/locale/browserconfig.properties"");"

"Found : user_pref(""CT2776682.SearchEngineBeforeUnload"", ""chrome://browser-region/locale/region.properties"");"

"Found : user_pref(""CT2776682.SearchFromAddressBarIsInit"", true);"

"Found : user_pref(""CT2776682.SearchFromAddressBarUrl"", ""hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT277[...]"

"Found : user_pref(""CT2776682.SearchInNewTabEnabled"", true);"

"Found : user_pref(""CT2776682.SearchInNewTabIntervalMM"", 1440);"

"Found : user_pref(""CT2776682.SearchInNewTabLastCheckTime"", ""Sun Jun 26 2011 12:10:35 GMT+0200"");"

"Found : user_pref(""CT2776682.SearchInNewTabServiceUrl"", ""hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]"

"Found : user_pref(""CT2776682.SearchInNewTabUsageUrl"", ""hxxp://Usage.Hosting.conduit-services.com/UsageServic[...]"

"Found : user_pref(""CT2776682.SearchProtectorEnabled"", false);"

"Found : user_pref(""CT2776682.SearchProtectorToolbarDisabled"", false);"

"Found : user_pref(""CT2776682.ServiceMapLastCheckTime"", ""Sun Jun 26 2011 12:10:34 GMT+0200"");"

"Found : user_pref(""CT2776682.SettingsLastCheckTime"", ""Sun Jun 26 2011 14:48:15 GMT+0200"");"

"Found : user_pref(""CT2776682.ThirdPartyComponentsInterval"", 504);"

"Found : user_pref(""CT2776682.ThirdPartyComponentsLastCheck"", ""Mon Jun 20 2011 19:14:08 GMT+0200"");"

"Found : user_pref(""CT2776682.ThirdPartyComponentsLastUpdate"", ""1246786978"");"

"Found : user_pref(""CT2776682.ToolbarShrinkedFromSetup"", false);"

"Found : user_pref(""CT2776682.TrusteLinkUrl"", ""hxxp://trust.conduit.com/CT2776682"");"

"Found : user_pref(""CT2776682.TrustedApiDomains"", ""conduit.com,conduit-hosting.com,conduit-services.com,OurTo[...]"

"Found : user_pref(""CT2776682.UserID"", ""UN65183768113337236"");"

"Found : user_pref(""CT2776682.ValidationData_Search"", 0);"

"Found : user_pref(""CT2776682.ValidationData_Toolbar"", 2);"

"Found : user_pref(""CT2776682.WeatherNetwork"", """");"

"Found : user_pref(""CT2776682.WeatherPollDate"", ""Sun Jun 26 2011 14:40:51 GMT+0200"");"

"Found : user_pref(""CT2776682.WeatherUnit"", ""C"");"

"Found : user_pref(""CT2776682.approveUntrustedApps"", true);"

"Found : user_pref(""CT2776682.backendstorage.2776682a129520874668948567000000paramsgk0"", ""7B22757064617465526[...]"

"Found : user_pref(""CT2776682.backendstorage.rssapp2776682a129520874668948567000000cat0"", ""253542253742253232[...]"

"Found : user_pref(""CT2776682.backendstorage.rssapp2776682a129520874668948567000000embeddedversion"", ""312E312[...]"

"Found : user_pref(""CT2776682.backendstorage.rssapp2776682a129520874668948567000000feedsobj"", ""25374225323263[...]"

"Found : user_pref(""CT2776682.backendstorage.rssapp2776682a129520874668948567000000lastreporttime"", ""31333039[...]"

"Found : user_pref(""CT2776682.backendstorage.rssapp2776682a129520874668948567000000newfeeds"", ""6E657746656564[...]"

"Found : user_pref(""CT2776682.backendstorage.rssapp2776682a129520874668948567000000readitemsarr"", ""2537422532[...]"

"Found : user_pref(""CT2776682.components.1000034"", true);"

"Found : user_pref(""CT2776682.components.1000234"", true);"

"Found : user_pref(""CT2776682.generalConfigFromLogin"", ""{\""SocialDomains\"":\""social.conduit.com;apps.conduit.[...]"

"Found : user_pref(""CT2776682.globalFirstTimeInfoLastCheckTime"", ""Sun Jun 26 2011 12:10:35 GMT+0200"");"

"Found : user_pref(""CT2776682.homepageProtectorEnableByLogin"", true);"

"Found : user_pref(""CT2776682.initDone"", true);"

"Found : user_pref(""CT2776682.isAppTrackingManagerOn"", true);"

"Found : user_pref(""CT2776682.isFirstRadioInstallation"", false);"

"Found : user_pref(""CT2776682.myStuffEnabled"", true);"

"Found : user_pref(""CT2776682.myStuffPublihserMinWidth"", 400);"

"Found : user_pref(""CT2776682.myStuffSearchUrl"", ""hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]"

"Found : user_pref(""CT2776682.myStuffServiceIntervalMM"", 1440);"

"Found : user_pref(""CT2776682.myStuffServiceUrl"", ""hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]"

"Found : user_pref(""CT2776682.oldAppsList"", ""129288498392881552,129288498393350308,111,129512039755754602,129[...]"

"Found : user_pref(""CT2776682.searchProtectorDialogDelayInSec"", 10);"

"Found : user_pref(""CT2776682.searchProtectorEnableByLogin"", true);"

"Found : user_pref(""CT2776682.testingCtid"", """");"

"Found : user_pref(""CT2776682.toolbarAppMetaDataLastCheckTime"", ""Sun Jun 26 2011 12:10:34 GMT+0200"");"

"Found : user_pref(""CT2776682.toolbarContextMenuLastCheckTime"", ""Mon Jun 20 2011 19:14:13 GMT+0200"");"

"Found : user_pref(""CT2776682.usagesFlag"", 2);"

"Found : user_pref(""CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/909619/905414/DE"", ""\""0\"""")[...]"

"Found : user_pref(""CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2776682"", [...]"

"Found : user_pref(""CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]"

"Found : user_pref(""CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]"

"Found : user_pref(""CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]"

"Found : user_pref(""CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]"

"Found : user_pref(""CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg"", ""\[...]"

"Found : user_pref(""CommunityToolbar.ETag.hxxp://dynamicdialogs.engine.conduit-services.com/DLG.pkg?ver=3.3.3[...]"

"Found : user_pref(""CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.3.[...]"

"Found : user_pref(""CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.5.[...]"

"Found : user_pref(""CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2776682"",[...]"

"Found : user_pref(""CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=3/13/20[...]"

"Found : user_pref(""CommunityToolbar.ETag.hxxp://settings.toolbar.search.conduit.com/root/CT2776682/CT2776682[...]"

"Found : user_pref(""CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Mint/equalizer_dea[...]"

"Found : user_pref(""CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Mint/minimize.gif""[...]"

"Found : user_pref(""CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Mint/play.gif"", ""\[...]"

"Found : user_pref(""CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Mint/stop.gif"", ""\[...]"

"Found : user_pref(""CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Mint/vol.gif"", ""\""[...]"

"Found : user_pref(""CommunityToolbar.EngineOwner"", """");"

"Found : user_pref(""CommunityToolbar.EngineOwnerGuid"", ""{51a86bb3-6602-4c85-92a5-130ee4864f13}"");"

"Found : user_pref(""CommunityToolbar.EngineOwnerToolbarId"", ""brothersoft_extreme"");"

"Found : user_pref(""CommunityToolbar.IsEngineShown"", true);"

"Found : user_pref(""CommunityToolbar.IsMyStuffImportedToEngine"", true);"

"Found : user_pref(""CommunityToolbar.LatestLibsPath"", ""file:///C:\\Users\\carsten\\AppData\\Roaming\\Mozilla\[...]"

"Found : user_pref(""CommunityToolbar.LatestToolbarVersionInstalled"", ""3.5.0.12"");"

"Found : user_pref(""CommunityToolbar.OriginalEngineOwner"", ""CT2776682"");"

"Found : user_pref(""CommunityToolbar.OriginalEngineOwnerGuid"", ""{51a86bb3-6602-4c85-92a5-130ee4864f13}"");"

"Found : user_pref(""CommunityToolbar.OriginalEngineOwnerToolbarId"", ""brothersoft_extreme"");"

"Found : user_pref(""CommunityToolbar.SearchFromAddressBarSavedUrl"", """");"

"Found : user_pref(""CommunityToolbar.ToolbarsList"", ""CT2776682"");"

"Found : user_pref(""CommunityToolbar.ToolbarsList2"", ""CT2776682"");"

"Found : user_pref(""CommunityToolbar.alert.alertDialogsGetterLastCheckTime"", ""Mon Jun 20 2011 19:14:14 GMT+02[...]"

"Found : user_pref(""CommunityToolbar.alert.alertEnabled"", true);"

"Found : user_pref(""CommunityToolbar.alert.alertInfoInterval"", 1440);"

"Found : user_pref(""CommunityToolbar.alert.alertInfoLastCheckTime"", ""Wed Jun 22 2011 12:48:04 GMT+0200"");"

"Found : user_pref(""CommunityToolbar.alert.clientsServerUrl"", ""hxxp://alert.client.conduit.com"");"

"Found : user_pref(""CommunityToolbar.alert.locale"", ""en"");"

"Found : user_pref(""CommunityToolbar.alert.loginIntervalMin"", 1440);"

"Found : user_pref(""CommunityToolbar.alert.loginLastCheckTime"", ""Sat Jun 25 2011 10:08:37 GMT+0200"");"

"Found : user_pref(""CommunityToolbar.alert.loginLastUpdateTime"", ""1305622559"");"

"Found : user_pref(""CommunityToolbar.alert.messageShowTimeSec"", 20);"

"Found : user_pref(""CommunityToolbar.alert.servicesServerUrl"", ""hxxp://alert.services.conduit.com"");"

"Found : user_pref(""CommunityToolbar.alert.showTrayIcon"", false);"

"Found : user_pref(""CommunityToolbar.alert.userCloseIntervalMin"", 300);"

"Found : user_pref(""CommunityToolbar.alert.userId"", ""139d80af-bde5-4d68-992f-928b84384b57"");"

"Found : user_pref(""CommunityToolbar.globalUserId"", ""6012f355-28d8-440d-bc2b-f9c4a3df57af"");"

"Found : user_pref(""CommunityToolbar.isAlertUrlAddedToFeedItemTable"", true);"

"Found : user_pref(""CommunityToolbar.isClickActionAddedToFeedItemTable"", true);"

"Found : user_pref(""CommunityToolbar.keywordURLSelectedCTID"", ""CT2776682"");"

"Found : user_pref(""CommunityToolbar.killedEngine"", true);"

"Found : user_pref(""CommunityToolbar.notifications.alertDialogsGetterLastCheckTime"", ""Sun Jun 26 2011 12:10:3[...]"

"Found : user_pref(""CommunityToolbar.notifications.alertEnabled"", true);"

"Found : user_pref(""CommunityToolbar.notifications.clientsServerUrl"", ""hxxp://alert.client.conduit.com"");"

"Found : user_pref(""CommunityToolbar.notifications.locale"", ""en"");"

"Found : user_pref(""CommunityToolbar.notifications.loginIntervalMin"", 1440);"

"Found : user_pref(""CommunityToolbar.notifications.loginLastCheckTime"", ""Sun Jun 26 2011 12:10:35 GMT+0200"");"

"Found : user_pref(""CommunityToolbar.notifications.loginLastUpdateTime"", ""1305622559"");"

"Found : user_pref(""CommunityToolbar.notifications.messageShowTimeSec"", 20);"

"Found : user_pref(""CommunityToolbar.notifications.servicesServerUrl"", ""hxxp://alert.services.conduit.com"");"

"Found : user_pref(""CommunityToolbar.notifications.showTrayIcon"", false);"

"Found : user_pref(""CommunityToolbar.notifications.userCloseIntervalMin"", 300);"

"Found : user_pref(""CommunityToolbar.notifications.userId"", ""8ae005b1-5a00-44be-8741-46e65778213c"");"

"Found : user_pref(""CommunityToolbar.undefined"", """");"
 

#NAME?
 

File : C:\Users\carsten\AppData\Local\Google\Chrome\User Data\Default\Preferences
 

"Found :       ""name"": ""Search Results"","

"Found :       ""search_url"": ""hxxp://dts.search-results.com/sr?src=crb&appid=0&systemid=413&sr=0&q={searchTer[...]"
 

#NAME?
 

File : C:\Users\carsten\AppData\Roaming\Opera\Opera\operaprefs.ini
 

Found : Home URL=hxxp://www.searchqu.com/413
 

*************************
 

AdwCleaner[R1].txt - [16011 octets] - [21/08/2012 13:44:54]
 

########## EOF - C:\AdwCleaner[R1].txt - [16140 octets] ##########

Besten Gruß

Carsten

Bitte das Malwarebytes Logfile posten!
(Reiter Logberichte)

und Hier das Log File von Malewarebytes:

Code:

Malwarebytes Anti-Malware 1.62.0.1300

www.malwarebytes.org
 

Datenbank Version: v2012.08.21.07
 

Windows 7 Service Pack 1 x86 NTFS

Internet Explorer 9.0.8112.16421

carsten :: CARSTEN-PC [Administrator]
 

21.08.2012 13:50:36

mbam-log-2012-08-21 (13-50-36).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 910079

Laufzeit: 3 Stunde(n), 3 Minute(n), 54 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

MFG

der Carsten

Sehr gut! :daumenhoc

Schließe alle offenen Programme und Browser.
Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Delete.
Bestätige jeweils mit Ok.
Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

danach:

Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html

Hier erstmal das Protokoll von adwcleaner:

Code:

# AdwCleaner v1.801 - Logfile created 08/22/2012 at 09:22:09

# Updated 14/08/2012 by Xplode

# Operating system : Windows 7 Professional Service Pack 1 (32 bits)

# User : carsten - CARSTEN-PC

# Boot Mode : Normal

# Running from : C:\Users\carsten\Desktop\adwcleaner.exe

# Option [Delete]
 
 

***** [Services] *****
 
 

***** [Files / Folders] *****
 

Folder Deleted : C:\Users\carsten\AppData\Local\Conduit

Folder Deleted : C:\Users\carsten\AppData\LocalLow\searchquband

Folder Deleted : C:\Users\carsten\AppData\Roaming\OpenCandy

Folder Deleted : C:\Users\carsten\AppData\Roaming\Mozilla\Firefox\Profiles\fu92pvm9.default\Conduit

Folder Deleted : C:\Users\carsten\AppData\Roaming\Mozilla\Firefox\Profiles\fu92pvm9.default\ConduitCommon

Folder Deleted : C:\ProgramData\boost_interprocess
 

***** [Registry] *****

[*] Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2776682

Key Deleted : HKCU\Software\AppDataLow\Software\searchqutoolbar

Key Deleted : HKCU\Software\DataMngr

Key Deleted : HKCU\Software\Headlight

Key Deleted : HKCU\Software\Softonic

Key Deleted : HKLM\SOFTWARE\Classes\Conduit.Engine

Key Deleted : HKLM\SOFTWARE\Conduit

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
 

***** [Registre - GUID] *****
 

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{99079A25-328F-4BD4-BE04-00955ACAA0A7}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{99079A25-328F-4BD4-BE04-00955ACAA0A7}

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
 

***** [Internet Browsers] *****
 

#NAME?
 

[OK] Registry is clean.
 

#NAME?
 

Profile name : default 

File : C:\Users\carsten\AppData\Roaming\Mozilla\Firefox\Profiles\fu92pvm9.default\prefs.js
 

Deleted : user_pref("CT2776682..clientLogIsEnabled", true);

Deleted : user_pref("CT2776682..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]

Deleted : user_pref("CT2776682..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]

Deleted : user_pref("CT2776682.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");

Deleted : user_pref("CT2776682.BrowserCompStateIsOpen_129453492929819378", true);

Deleted : user_pref("CT2776682.BrowserCompStateIsOpen_129512039755754602", true);

Deleted : user_pref("CT2776682.CT2776682", "CT2776682");

Deleted : user_pref("CT2776682.CurrentServerDate", "26-6-2011");

Deleted : user_pref("CT2776682.DialogsGetterLastCheckTime", "Sun Jun 26 2011 12:10:34 GMT+0200");

Deleted : user_pref("CT2776682.DownloadReferralCookieData", "");

Deleted : user_pref("CT2776682.EMailNotifierPollDate", "Sun Jun 26 2011 14:44:50 GMT+0200");

Deleted : user_pref("CT2776682.FirstServerDate", "20-6-2011");

Deleted : user_pref("CT2776682.FirstTime", true);

Deleted : user_pref("CT2776682.FirstTimeFF3", true);

Deleted : user_pref("CT2776682.FixPageNotFoundErrors", true);

Deleted : user_pref("CT2776682.GroupingServerCheckInterval", 1440);

Deleted : user_pref("CT2776682.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");

Deleted : user_pref("CT2776682.HasUserGlobalKeys", true);

Deleted : user_pref("CT2776682.HomePageProtectorEnabled", true);

Deleted : user_pref("CT2776682.Initialize", true);

Deleted : user_pref("CT2776682.InitializeCommonPrefs", true);

Deleted : user_pref("CT2776682.InstallationAndCookieDataSentCount", 3);

Deleted : user_pref("CT2776682.InstalledDate", "Mon Jun 20 2011 19:14:30 GMT+0200");

Deleted : user_pref("CT2776682.InvalidateCache", false);

Deleted : user_pref("CT2776682.IsAlertDBUpdated", true);

Deleted : user_pref("CT2776682.IsGrouping", false);

Deleted : user_pref("CT2776682.IsMulticommunity", false);

Deleted : user_pref("CT2776682.IsOpenThankYouPage", true);

Deleted : user_pref("CT2776682.IsOpenUninstallPage", true);

Deleted : user_pref("CT2776682.LanguagePackReloadIntervalMM", 1440);

Deleted : user_pref("CT2776682.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]

Deleted : user_pref("CT2776682.LastLogin_3.3.3.2", "Sat Jun 25 2011 22:37:39 GMT+0200");

Deleted : user_pref("CT2776682.LastLogin_3.5.0.12", "Sun Jun 26 2011 12:10:34 GMT+0200");

Deleted : user_pref("CT2776682.LatestVersion", "3.3.3.2");

Deleted : user_pref("CT2776682.MyStuffEnabledAtInstallation", true);

Deleted : user_pref("CT2776682.RadioIsPodcast", false);

Deleted : user_pref("CT2776682.RadioLastCheckTime", "Sun Jun 26 2011 12:10:34 GMT+0200");

Deleted : user_pref("CT2776682.RadioLastUpdateIPServer", "3");

Deleted : user_pref("CT2776682.RadioLastUpdateServer", "3");

Deleted : user_pref("CT2776682.RadioMediaID", "9962");

Deleted : user_pref("CT2776682.RadioMediaType", "Media Player");

Deleted : user_pref("CT2776682.RadioMenuSelectedID", "EBRadioMenu_CT27766829962");

Deleted : user_pref("CT2776682.RadioShrinkedFromSetup", false);

Deleted : user_pref("CT2776682.RadioStationName", "California%20Rock");

Deleted : user_pref("CT2776682.RadioStationURL", "hxxp://feedlive.net/california.asx");

Deleted : user_pref("CT2776682.SHRINK_TOOLBAR", 1);

Deleted : user_pref("CT2776682.SavedHomepage", "chrome://branding/locale/browserconfig.properties");

Deleted : user_pref("CT2776682.SearchEngineBeforeUnload", "chrome://browser-region/locale/region.properties");

Deleted : user_pref("CT2776682.SearchFromAddressBarIsInit", true);

Deleted : user_pref("CT2776682.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT277[...]

Deleted : user_pref("CT2776682.SearchInNewTabEnabled", true);

Deleted : user_pref("CT2776682.SearchInNewTabIntervalMM", 1440);

Deleted : user_pref("CT2776682.SearchInNewTabLastCheckTime", "Sun Jun 26 2011 12:10:35 GMT+0200");

Deleted : user_pref("CT2776682.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]

Deleted : user_pref("CT2776682.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageServic[...]

Deleted : user_pref("CT2776682.SearchProtectorEnabled", false);

Deleted : user_pref("CT2776682.SearchProtectorToolbarDisabled", false);

Deleted : user_pref("CT2776682.ServiceMapLastCheckTime", "Sun Jun 26 2011 12:10:34 GMT+0200");

Deleted : user_pref("CT2776682.SettingsLastCheckTime", "Sun Jun 26 2011 14:48:15 GMT+0200");

Deleted : user_pref("CT2776682.ThirdPartyComponentsInterval", 504);

Deleted : user_pref("CT2776682.ThirdPartyComponentsLastCheck", "Mon Jun 20 2011 19:14:08 GMT+0200");

Deleted : user_pref("CT2776682.ThirdPartyComponentsLastUpdate", "1246786978");

Deleted : user_pref("CT2776682.ToolbarShrinkedFromSetup", false);

Deleted : user_pref("CT2776682.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2776682");

Deleted : user_pref("CT2776682.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,OurTo[...]

Deleted : user_pref("CT2776682.UserID", "UN65183768113337236");

Deleted : user_pref("CT2776682.ValidationData_Search", 0);

Deleted : user_pref("CT2776682.ValidationData_Toolbar", 2);

Deleted : user_pref("CT2776682.WeatherNetwork", "");

Deleted : user_pref("CT2776682.WeatherPollDate", "Sun Jun 26 2011 14:40:51 GMT+0200");

Deleted : user_pref("CT2776682.WeatherUnit", "C");

Deleted : user_pref("CT2776682.approveUntrustedApps", true);

Deleted : user_pref("CT2776682.backendstorage.2776682a129520874668948567000000paramsgk0", "7B22757064617465526[...]

Deleted : user_pref("CT2776682.backendstorage.rssapp2776682a129520874668948567000000cat0", "253542253742253232[...]

Deleted : user_pref("CT2776682.backendstorage.rssapp2776682a129520874668948567000000embeddedversion", "312E312[...]

Deleted : user_pref("CT2776682.backendstorage.rssapp2776682a129520874668948567000000feedsobj", "25374225323263[...]

Deleted : user_pref("CT2776682.backendstorage.rssapp2776682a129520874668948567000000lastreporttime", "31333039[...]

Deleted : user_pref("CT2776682.backendstorage.rssapp2776682a129520874668948567000000newfeeds", "6E657746656564[...]

Deleted : user_pref("CT2776682.backendstorage.rssapp2776682a129520874668948567000000readitemsarr", "2537422532[...]

Deleted : user_pref("CT2776682.components.1000034", true);

Deleted : user_pref("CT2776682.components.1000234", true);

Deleted : user_pref("CT2776682.generalConfigFromLogin", "{\"SocialDomains\":\"social.conduit.com;apps.conduit.[...]

Deleted : user_pref("CT2776682.globalFirstTimeInfoLastCheckTime", "Sun Jun 26 2011 12:10:35 GMT+0200");

Deleted : user_pref("CT2776682.homepageProtectorEnableByLogin", true);

Deleted : user_pref("CT2776682.initDone", true);

Deleted : user_pref("CT2776682.isAppTrackingManagerOn", true);

Deleted : user_pref("CT2776682.isFirstRadioInstallation", false);

Deleted : user_pref("CT2776682.myStuffEnabled", true);

Deleted : user_pref("CT2776682.myStuffPublihserMinWidth", 400);

Deleted : user_pref("CT2776682.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]

Deleted : user_pref("CT2776682.myStuffServiceIntervalMM", 1440);

Deleted : user_pref("CT2776682.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]

Deleted : user_pref("CT2776682.oldAppsList", "129288498392881552,129288498393350308,111,129512039755754602,129[...]

Deleted : user_pref("CT2776682.searchProtectorDialogDelayInSec", 10);

Deleted : user_pref("CT2776682.searchProtectorEnableByLogin", true);

Deleted : user_pref("CT2776682.testingCtid", "");

Deleted : user_pref("CT2776682.toolbarAppMetaDataLastCheckTime", "Sun Jun 26 2011 12:10:34 GMT+0200");

Deleted : user_pref("CT2776682.toolbarContextMenuLastCheckTime", "Mon Jun 20 2011 19:14:13 GMT+0200");

Deleted : user_pref("CT2776682.usagesFlag", 2);

Deleted : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/909619/905414/DE", "\"0\"")[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2776682", [...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.engine.conduit-services.com/DLG.pkg?ver=3.3.3[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.3.[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.5.[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2776682",[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=3/13/20[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.search.conduit.com/root/CT2776682/CT2776682[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Mint/equalizer_dea[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Mint/minimize.gif"[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Mint/play.gif", "\[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Mint/stop.gif", "\[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Mint/vol.gif", "\"[...]

Deleted : user_pref("CommunityToolbar.EngineOwner", "");

Deleted : user_pref("CommunityToolbar.EngineOwnerGuid", "{51a86bb3-6602-4c85-92a5-130ee4864f13}");

Deleted : user_pref("CommunityToolbar.EngineOwnerToolbarId", "brothersoft_extreme");

Deleted : user_pref("CommunityToolbar.IsEngineShown", true);

Deleted : user_pref("CommunityToolbar.IsMyStuffImportedToEngine", true);

Deleted : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\carsten\\AppData\\Roaming\\Mozilla\[...]

Deleted : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.5.0.12");

Deleted : user_pref("CommunityToolbar.OriginalEngineOwner", "CT2776682");

Deleted : user_pref("CommunityToolbar.OriginalEngineOwnerGuid", "{51a86bb3-6602-4c85-92a5-130ee4864f13}");

Deleted : user_pref("CommunityToolbar.OriginalEngineOwnerToolbarId", "brothersoft_extreme");

Deleted : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "");

Deleted : user_pref("CommunityToolbar.ToolbarsList", "CT2776682");

Deleted : user_pref("CommunityToolbar.ToolbarsList2", "CT2776682");

Deleted : user_pref("CommunityToolbar.alert.alertDialogsGetterLastCheckTime", "Mon Jun 20 2011 19:14:14 GMT+02[...]

Deleted : user_pref("CommunityToolbar.alert.alertEnabled", true);

Deleted : user_pref("CommunityToolbar.alert.alertInfoInterval", 1440);

Deleted : user_pref("CommunityToolbar.alert.alertInfoLastCheckTime", "Wed Jun 22 2011 12:48:04 GMT+0200");

Deleted : user_pref("CommunityToolbar.alert.clientsServerUrl", "hxxp://alert.client.conduit.com");

Deleted : user_pref("CommunityToolbar.alert.locale", "en");

Deleted : user_pref("CommunityToolbar.alert.loginIntervalMin", 1440);

Deleted : user_pref("CommunityToolbar.alert.loginLastCheckTime", "Sat Jun 25 2011 10:08:37 GMT+0200");

Deleted : user_pref("CommunityToolbar.alert.loginLastUpdateTime", "1305622559");

Deleted : user_pref("CommunityToolbar.alert.messageShowTimeSec", 20);

Deleted : user_pref("CommunityToolbar.alert.servicesServerUrl", "hxxp://alert.services.conduit.com");

Deleted : user_pref("CommunityToolbar.alert.showTrayIcon", false);

Deleted : user_pref("CommunityToolbar.alert.userCloseIntervalMin", 300);

Deleted : user_pref("CommunityToolbar.alert.userId", "139d80af-bde5-4d68-992f-928b84384b57");

Deleted : user_pref("CommunityToolbar.globalUserId", "6012f355-28d8-440d-bc2b-f9c4a3df57af");

Deleted : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);

Deleted : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);

Deleted : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2776682");

Deleted : user_pref("CommunityToolbar.killedEngine", true);

Deleted : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Sun Jun 26 2011 12:10:3[...]

Deleted : user_pref("CommunityToolbar.notifications.alertEnabled", true);

Deleted : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com");

Deleted : user_pref("CommunityToolbar.notifications.locale", "en");

Deleted : user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440);

Deleted : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Sun Jun 26 2011 12:10:35 GMT+0200");

Deleted : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1305622559");

Deleted : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20);

Deleted : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com");

Deleted : user_pref("CommunityToolbar.notifications.showTrayIcon", false);

Deleted : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300);

Deleted : user_pref("CommunityToolbar.notifications.userId", "8ae005b1-5a00-44be-8741-46e65778213c");

Deleted : user_pref("CommunityToolbar.undefined", "");
 

#NAME?
 

File : C:\Users\carsten\AppData\Local\Google\Chrome\User Data\Default\Preferences
 

Deleted :       "name": "Search Results",

Deleted :       "search_url": "hxxp://dts.search-results.com/sr?src=crb&appid=0&systemid=413&sr=0&q={searchTer[...]
 

#NAME?
 

File : C:\Users\carsten\AppData\Roaming\Opera\Opera\operaprefs.ini
 

Deleted : Home URL=hxxp://www.searchqu.com/413
 

*************************
 

AdwCleaner[R1].txt - [16142 octets] - [21/08/2012 13:44:54]

AdwCleaner[S1].txt - [16442 octets] - [22/08/2012 09:22:09]
 

########## EOF - C:\AdwCleaner[S1].txt - [16571 octets] ##########

Rest folgt später

MFG

Carsten

so und jetzt das Protokoll von Emsisoft:

Code:

Emsisoft Anti-Malware - Version 6.6

Letztes Update: 22.08.2012 09:42:32
 

Scan Einstellungen:
 

Scan Methode: Detail Scan

Objekte: Rootkits, Speicher, Traces, C:\, D:\

Archiv Scan: An

ADS Scan: An
 

Scan Beginn:        22.08.2012 09:43:14
 

c:\program files\gamespy arcade         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\cstrike\frontline         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\halflife         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\halflife\action         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\cstrike         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\halflife\frontline         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\halflife\gearbox         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\halflife\tfc         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\aq2         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\battle         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\chaosdm         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\duel         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\freeze         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\gloom         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\gxmod         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\halflife\firearms         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\jail         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\kots         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\lfiredm         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\lithium2         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\lmctf         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\pball         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\q2comp         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\halflife\cstrike         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\ra2         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\requiem         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\sconfig         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\tourney         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\wf         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\wod         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake3         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake3\alliance         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake3\beryllium         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake3\excessive         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake3\instagib         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake3\jailbreak         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake3\matchmod         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake3\osp         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake3\q3comp         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake3\q3f         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake3\q3ut2         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake3\requiem         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake3\rocketarena3         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake3\wfa         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\tribes         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\tribes\arena         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\tribes\ch         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\tribes\ctf         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\tribes\ctfb         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\tribes\ctfplus         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\tribes\dd         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\holywars         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\tribes\duel         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\tribes\fr         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\tribes\mt         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\tribes\open cal         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\tribes\rpg         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\tribes\tac         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\ut         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\ut\excessive         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\ut\rocketarena         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\ut\swat         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\images         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\tribes\dm         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\images\portraits         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\profiles         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\profiles\(default)         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\services         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\services\_common         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\services\_demospy         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\services\_fplanet         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\services\_gnews         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\services\_gspyder         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\services\_news         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\services\_support         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\skins         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\skins\(default3)         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\sounds         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\sounds\(default)         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\sounds\classic         gefunden: Trace.File.gamespy arcade!E1

c:\users\carsten\appdata\roaming\microsoft\windows\start menu\programs\gamespy arcade         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\images\icons         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\addins         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\qpong         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\dat.bmp         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\arcres.dll         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\4dca9208.dat         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\def_banner.gif         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\def_banner.html         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\def_bannerbg.jpg         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\def_loading.gif         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\def_logo.jpg         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\aphex.exe         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\def_news.html         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\fpupdate.exe         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\gamespy arcade - debug.lnk         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\gamespy arcade help.url         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\gamespy arcade website.url         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\gamespy arcade.lnk         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\gamespy.com gaming's homepage.url         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\gsapak.exe         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\gslan.dll         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\gsws.dll         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\install.log         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\pw32.dll         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\readme.html         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\register gamespy arcade.url         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\rptcrash.exe         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\services\_news\rsrc.dir         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\services\_news\service_tab.psd         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\services\_news\service_tab+.tga         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\services\_support\rsrc.dir         gefunden: Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\services\_support\service_tab.psd         gefunden: Trace.File.gamespy arcade!E1

Value: hkey_current_user\software\gamespy\gamespy arcade --> instdir         gefunden: Trace.Registry.gamespy arcade!E1

Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\gamespy arcade --> uninstallstring         gefunden: Trace.Registry.gamespy arcade!E1

c:\program files\gamespy arcade\ws_default.html         gefunden: Trace.File.gamespy arcade!E1

Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\gamespy arcade --> displayname         gefunden: Trace.Registry.gamespy arcade!E1

C:\Users\carsten\workspace\HelloWorld\Debug\HelloWorld.exe         gefunden: Trojan.Win32.Menti!E2

C:\Users\carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CodeBlocks\test.exe         gefunden: Trojan.Win32.Webprefix!E2

C:\Program Files\OpenCV2.1\CMakeFiles\CompilerIdCXX\a.exe         gefunden: Trojan-Spy.Win32.Small!E2

C:\Program Files\OpenCV2.1\CMakeFiles\CompilerIdC\a.exe         gefunden: Trojan-Spy.Win32.Small!E2

C:\Program Files\OpenCV\CMakeFiles\CompilerIdCXX\a.exe         gefunden: Trojan-Spy.Win32.Small!E2

C:\Program Files\OpenCV\CMakeFiles\CompilerIdC\a.exe         gefunden: Trojan-Spy.Win32.Small!E2

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\adcbdas16jrexp.mexw32         gefunden: Trojan.Win32.Agent!E2

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\adkmdas1800hr.mexw32         gefunden: Trojan.Win32.Agent!E2

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\adbbpci20098.mexw32         gefunden: Trojan.Win32.Agent!E2

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\adgesada1.mexw32         gefunden: Trojan.Win32.Agent!E2

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\adrtddm6420.mexw32         gefunden: Trojan.Win32.Agent!E2

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\adrtddm6430.mexw32         gefunden: Trojan.Win32.Agent!E2

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\dabbpci20003.mexw32         gefunden: Trojan.Win32.Agent!E2

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\dicbpdiso16.mexw32         gefunden: Trojan.Win32.Agent!E2

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\docbpdiso16.mexw32         gefunden: Trojan.Win32.Agent!E2

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\donipctio10.mexw32         gefunden: Trojan.Win32.Agent!E2

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\encadpa1700.mexw32         gefunden: Trojan.Win32.Agent!E2

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\rs232_send.mexw32         gefunden: Trojan.Win32.Agent!E2

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\rs232_sendrec.mexw32         gefunden: Trojan.Win32.Agent!E2

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\scblock.mexw32         gefunden: Trojan.Win32.Agent!E2

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\xpcregstack.mexw32         gefunden: Trojan.Win32.Agent!E2

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\rs232_rec.mexw32         gefunden: Trojan.Win32.Agent.BNWVMWL!E1
 

Gescannt        1145340

Gefunden        141
 

Scan Ende:        22.08.2012 14:28:58

Scan Zeit:        4:45:44
 

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\rs232_rec.mexw32        Quarantäne Trojan.Win32.Agent.BNWVMWL!E1

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\adcbdas16jrexp.mexw32        Quarantäne Trojan.Win32.Agent!E2

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\adkmdas1800hr.mexw32        Quarantäne Trojan.Win32.Agent!E2

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\adbbpci20098.mexw32        Quarantäne Trojan.Win32.Agent!E2

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\adgesada1.mexw32        Quarantäne Trojan.Win32.Agent!E2

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\adrtddm6420.mexw32        Quarantäne Trojan.Win32.Agent!E2

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\adrtddm6430.mexw32        Quarantäne Trojan.Win32.Agent!E2

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\dabbpci20003.mexw32        Quarantäne Trojan.Win32.Agent!E2

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\dicbpdiso16.mexw32        Quarantäne Trojan.Win32.Agent!E2

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\docbpdiso16.mexw32        Quarantäne Trojan.Win32.Agent!E2

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\donipctio10.mexw32        Quarantäne Trojan.Win32.Agent!E2

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\encadpa1700.mexw32        Quarantäne Trojan.Win32.Agent!E2

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\rs232_send.mexw32        Quarantäne Trojan.Win32.Agent!E2

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\rs232_sendrec.mexw32        Quarantäne Trojan.Win32.Agent!E2

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\scblock.mexw32        Quarantäne Trojan.Win32.Agent!E2

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\xpcregstack.mexw32        Quarantäne Trojan.Win32.Agent!E2

C:\Program Files\OpenCV2.1\CMakeFiles\CompilerIdCXX\a.exe        Quarantäne Trojan-Spy.Win32.Small!E2

C:\Program Files\OpenCV2.1\CMakeFiles\CompilerIdC\a.exe        Quarantäne Trojan-Spy.Win32.Small!E2

C:\Program Files\OpenCV\CMakeFiles\CompilerIdCXX\a.exe        Quarantäne Trojan-Spy.Win32.Small!E2

C:\Program Files\OpenCV\CMakeFiles\CompilerIdC\a.exe        Quarantäne Trojan-Spy.Win32.Small!E2

C:\Users\carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CodeBlocks\test.exe        Quarantäne Trojan.Win32.Webprefix!E2

C:\Users\carsten\workspace\HelloWorld\Debug\HelloWorld.exe        Quarantäne Trojan.Win32.Menti!E2

Value: hkey_current_user\software\gamespy\gamespy arcade --> instdir        Quarantäne Trace.Registry.gamespy arcade!E1

Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\gamespy arcade --> uninstallstring        Quarantäne Trace.Registry.gamespy arcade!E1

Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\gamespy arcade --> displayname        Quarantäne Trace.Registry.gamespy arcade!E1

c:\program files\gamespy arcade        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\cstrike\frontline        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\halflife        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\halflife\action        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\cstrike        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\halflife\frontline        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\halflife\gearbox        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\halflife\tfc        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\aq2        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\battle        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\chaosdm        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\duel        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\freeze        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\gloom        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\gxmod        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\halflife\firearms        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\jail        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\kots        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\lfiredm        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\lithium2        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\lmctf        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\pball        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\q2comp        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\halflife\cstrike        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\ra2        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\requiem        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\sconfig        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\tourney        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\wf        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\wod        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake3        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake3\alliance        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake3\beryllium        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake3\excessive        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake3\instagib        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake3\jailbreak        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake3\matchmod        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake3\osp        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake3\q3comp        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake3\q3f        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake3\q3ut2        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake3\requiem        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake3\rocketarena3        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake3\wfa        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\tribes        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\tribes\arena        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\tribes\ch        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\tribes\ctf        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\tribes\ctfb        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\tribes\ctfplus        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\tribes\dd        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\holywars        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\tribes\duel        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\tribes\fr        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\tribes\mt        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\tribes\open cal        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\tribes\rpg        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\tribes\tac        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\ut        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\ut\excessive        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\ut\rocketarena        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\ut\swat        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\images        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\tribes\dm        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\images\portraits        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\profiles        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\profiles\(default)        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\services        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\services\_common        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\services\_demospy        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\services\_fplanet        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\services\_gnews        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\services\_gspyder        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\services\_news        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\services\_support        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\skins        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\skins\(default3)        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\sounds        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\sounds\(default)        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\sounds\classic        Quarantäne Trace.File.gamespy arcade!E1

c:\users\carsten\appdata\roaming\microsoft\windows\start menu\programs\gamespy arcade        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\images\icons        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\addins        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\custom\quake2\qpong        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\dat.bmp        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\arcres.dll        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\4dca9208.dat        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\def_banner.gif        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\def_banner.html        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\def_bannerbg.jpg        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\def_loading.gif        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\def_logo.jpg        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\aphex.exe        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\def_news.html        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\fpupdate.exe        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\gamespy arcade - debug.lnk        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\gamespy arcade help.url        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\gamespy arcade website.url        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\gamespy arcade.lnk        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\gamespy.com gaming's homepage.url        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\gsapak.exe        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\gslan.dll        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\gsws.dll        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\install.log        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\pw32.dll        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\readme.html        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\register gamespy arcade.url        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\rptcrash.exe        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\services\_news\rsrc.dir        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\services\_news\service_tab.psd        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\services\_news\service_tab+.tga        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\services\_support\rsrc.dir        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\services\_support\service_tab.psd        Quarantäne Trace.File.gamespy arcade!E1

c:\program files\gamespy arcade\ws_default.html        Quarantäne Trace.File.gamespy arcade!E1
 

Quarantäne        141

MFG Carsten

Sehr gut! :daumenhoc

Deinstalliere:
Emsisoft Anti-Malware

ESET Online Scanner

Vorbereitung

Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an.
Bitte während des Online-Scans Anti-Virus-Programm und Firewall deaktivieren.
Vista/Win7-User: Bitte den Browser unbedingt als Administrator starten.

Los geht's

Lade und starte Eset Smartinstaller
Haken setzen bei YES, I accept the Terms of Use.
Klick auf Start.
Haken setzen bei Remove found threads und Scan archives.
Klick auf Start.
Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Finish drücken.
Browser schließen.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (manchmal auch C:\Programme\Eset\log.txt) suchen und mit Deinem Editor öffnen.
Logfile hier posten.
Deinstallation: Systemsteuerung => Software => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Und hier das Log File von Eset:

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=f994b6908cb966448d807891dababaa7

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-08-23 03:10:35

# local_time=2012-08-23 05:10:35 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=1792 16777215 100 0 16936872 16936872 0 0

# compatibility_mode=5893 16776573 100 94 305 97341066 0 0

# compatibility_mode=8192 67108863 100 0 107 107 0 0

# scanned=906047

# found=3

# cleaned=3

# scan_time=24760

C:\Program Files\SearchCore for Browsers\SearchCore for Browsers\IEBHO.dll        a variant of Win32/Toolbar.SearchSuite application (cleaned by deleting - quarantined)        00000000000000000000000000000000        C

G:\Backup_BIGUSB\Backup_BIGUSB_2012_01_13\BIG_USB\USB_backup_10_01_2012\SoftonicDownloader_fuer_audio-video-converter.exe        Win32/SoftonicDownloader application (cleaned by deleting - quarantined)        00000000000000000000000000000000        C

G:\Backup_BIGUSB\Backup_BIGUSB_2012_01_16\SoftonicDownloader_fuer_audio-video-converter.exe        Win32/SoftonicDownloader application (cleaned by deleting - quarantined)        00000000000000000000000000000000        C

MFG

carsten

Java aktualisieren

Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.

Downloade dir bitte die neueste Java-Version von hier
Speichere die jxpiinstall.exe
Schließe alle laufenden Programme. Speziell deinen Browser.
Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 6 ) herunter laden.
Wenn die Installation beendet wurde
Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.

Nach dem Neustart

Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
Klicke auf Dateien löschen....
Gehe sicher das überall ein Hacken gesetzt ist und klicke OK.
Klicke erneut OK.

Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html

Danach poste (kopieren und einfuegen) mir, was du hier angezeigt bekommst: PluginCheck

So hier ist hoffentlich mein letzter Post :-)

Code:

PluginCheck
 

Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen.

Überprüft wird: Browser, Flash, Java und Adobe Reader Version.
 

    Firefox 14.0.1 ist aktuell
 

    Flash (11,4,402,265) ist aktuell.
 

    Java (1,7,0,6) ist aktuell.
 

    Adobe Reader 10,1,4,38 ist aktuell.

wo finde ich denn den Abschnitt :

"Haken setzen bei: Anwendungen und Applets und Verfolgungs- und Protokolldateien => OK"

aus dem Java Updata? das hab ich nicht gefunden.

Sehr gut! :daumenhoc

damit bist Du sauber und entlassen! :)

adwCleaner entfernen

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Uninstall.
Bestätige mit Ja.

Tool-Bereinigung mit OTL

Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.

Bitte lade Dir (falls noch nicht vorhanden) OTL von OldTimer herunter.
Speichere es auf Deinem Desktop.
Doppelklick auf OTL.exe um das Programm auszuführen.
Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
Klicke auf den Button "Bereinigung"
OTL fragt eventuell nach einem Neustart.
Sollte es dies tun, so lasse dies bitte zu.

Anmerkung: Nach dem Neustart werden OTL und andere Helferprogramme, die Du im Laufe der Bereinigung heruntergeladen hast, nicht mehr vorhanden sein. Sie wurden entfernt. Es ist daher Ok, wenn diese Programme nicht mehr vorhanden sind. Sollten noch welche übrig geblieben sein, lösche sie manuell.

Zurücksetzen der Sicherheitszonen

Lasse die Sicherheitszonen wieder zurücksetzen, da diese manipuliert wurden um den Browser für weitere Angriffe zu öffnen.
Gehe dabei so vor: http://www.trojaner-board.de/111805-...ecksetzen.html

Systemwiederherstellungen leeren

Damit der Rechner nicht mit einer infizierten Systemwiederherstellung erneut infiziert werden kann, muessen wir diese leeren. Dazu schalten wir sie einmal aus und dann wieder ein:
Systemwiederherstellung deaktivieren Tutorial fuer Windows XP, Windows Vista, Windows 7
Danach wieder aktivieren.

Aufräumen mit CCleaner

Lasse mit CCleaner (Download) (Anleitung) Fehler in der

Registry beheben (mehrmals, solange bis keine Fehler mehr gefunden werden) und
temporäre Dateien löschen.

Lektuere zum abarbeiten:
http://www.trojaner-board.de/90880-d...tallation.html
http://www.trojaner-board.de/105213-...tellungen.html
PluginCheck
http://www.trojaner-board.de/96344-a...-rechners.html
Secunia Online Software Inspector
http://www.trojaner-board.de/71715-k...iendungen.html
http://www.trojaner-board.de/83238-a...sschalten.html
PC wird immer langsamer - was tun?