Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk) (https://www.trojaner-board.de/125459-trojaner-wurm-malware-static-ip-clients-your-server-de-ip-rackcentre-redstation-net-uk.html)

meric 10.10.2012 16:23
Trojaner, Wurm, Malware? (static.IP.clients.your-server.de, IP.rackcentre.redstation.net.uk)
 
Hallo zusammen,

ich bräuchte dringend Hilfe bzgl. der im Titel genannten Hosts.

Ich habe heute eine E-Mail von Twitter erhalten, dass mein Account wohl kompromittiert und deshalb vorsorglich das Passwort geändert wurde.
Und tatsächlich hat jemand in meinem Namen Links zu chinesischen Malware-Seiten gepostet (Hab den Eintrag leider nicht notiert, bevor ich ihn gelöscht habe).

Gestern ist mir allerdings schon aufgefallen, dass meine Internetverbindung sporadisch langsam ist und habe deshalb mal nach auffälligen Verbindungen geschaut.
Dabei sind mir die o.g. Hosts aufgefallen, zu denen mein Computer (svchost.exe (NetworkService)) ab und zu Daten mit ziemlich genau 50000 Byte/s sendet.

Daraufhin habe ich einen kompletten Virusscan mit Avast durchgeführt, der aber nichts gefunden hat. Ebenso habe ich Hijackthis, OTL, OSAM, Mbam und aswMBR ausgeführt. Keines der Programme hat irgendetwas entdeckt.

Trotzdem sendet mein Computer immer noch Daten an diese Hosts (mehr an den *.your-server.de-Host).

Ich habe jetzt beide Einträge in der hosts-Datei blockiert. Allerdings weiß ich nun immer noch nicht, was genau die Ursache dafür ist :confused:

Vielleicht habt jemand von euch eine Ahnung?

kira 10.10.2012 16:26
Hallo und Herzlich Willkommen! :)

Bevor wir unsere Zusammenarbeit beginnen, [Bitte Vollständig lesen]:
Zitat:
  • "Fernbehandlungen/Fernhilfe" und die damit verbundenen Haftungsrisken:
    - da die Fehlerprüfung und Handlung werden über große Entfernungen durchgeführt, besteht keine Haftung unsererseits für die daraus entstehenden Folgen.
    - also, jede Haftung für die daraus entstandene Schäden wird ausgeschlossen, ANWEISUNGEN UND DEREN BEFOLGUNG, ERFOLGT AUF DEINE EIGENE VERANTWORTUNG!
  • Charakteristische Merkmale/Profilinformationen:
    - aus der verwendeten Loglisten oder Logdateien - wie z.B. deinen Realnamen, Seriennummer in Programm etc)- kannst Du durch [X] oder Sternchen (*) ersetzen
  • Die Systemprüfung und Bereinigung:
    - kann einige Zeit in Anspruch nehmen (je nach Art der Infektion), kann aber sogar so stark kompromittiert sein, so dass eine wirkungsvolle technische Säuberung ist nicht mehr möglich bzw Du es neu installieren musst
  • Ich empfehle Dir die Anweisungen erst einmal komplett durchzulesen, bevor du es anwendest, weil wenn du etwas falsch machst, kann es wirklich gefährlich werden. Wenn du meinen Anweisungen Schritt für Schritt folgst, kann eigentlich nichts schief gehen.
  • Innerhalb der Betreuungszeit:
    - ohne Abspräche bitte nicht auf eigene Faust handeln!- bei Problemen nachfragen.
  • Die Reihenfolge:
    - genau so wie beschrieben bitte einhalten, nicht selbst die Reihenfolge wählen!
  • GECRACKTE SOFTWARE werden hier nicht geduldet!!!!
  • Ansonsten unsere Forumsregeln:
    - Bitte erst lesen, dann posten!-> Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten?
  • Alle Logfile mit einem vBCode Tag eingefügen, das bietet hier eine gute Übersicht, erleichtert mir die Arbeit! Falls das Logfile zu groß, teile es in mehrere Teile auf.

Sobald Du diesen Einführungstext gelesen hast, kannst Du beginnen:)
► Hilfeleistung - geplante Vorgehensweise:
  • Problemsuche
  • Problembeseitigung/Systembereinigung
  • Verwendete Programme deinstallieren/entfernen
  • Thema abschließen: Tipps zur Computersicherheit

Für Vista und Win7:
Wichtig: Alle Befehle bitte als Administrator ausführen! rechte Maustaste auf die Eingabeaufforderung und "als Administrator ausführen" auswählen
Auf der angewählten Anwendung einen Rechtsklick (rechte Maustaste) und "Als Administrator ausführen" wählen!

1.
Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Mache Häckchen bei LOP- und Purity-Prüfung
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt - OTL.txt und Extras.txt
  • Poste die Logfiles in Code-Tags hier in den Thread.

2.
Um festzustellen, ob veraltete oder schädliche Software unter Programme installiert sind, ich würde gerne noch all deine installierten Programme sehen:
  • Download den CCleaner herunter
  • Software-Lizenzvereinbarung lesen, falls irgendeine Toolbar angeboten wird, bitte abwählen!-> starten -> Falls nötig, auf "Deutsch" einstellen.
  • starten-> klick auf `Extras` (um auf deinem System installierte Software zu anzeigen)-> dann auf `Als Textdatei speichern...`
  • ein Textdatei wird automatisch erstellt, poste auch dieses Logfile (also die Liste alle installierten Programme...eine Textdatei)

3.
Lade dir von hier -> HijackThis herunter
Keine offenen Fenster, solang bis HijackThis läuft!!-> HijackThis starten-> "Do a system scan and save a logfile" klicken (kurz warten) -> das erhaltene Logfile "markieren" -> "kopieren"-> hier in deinem Thread (rechte Maustaste) "einfügen"
► Vista und Win7 - Rechtsklick auf HijackThis-> "Als administrator ausführen" wählen...

Zitat:
Damit dein Thread übersichtlicher und schön lesbar bleibt, am besten nutze den Code-Tags für deinen Post:
→ vor dein Log schreibst Du (also am Anfang des Logfiles):[code]
hier kommt dein Logfile rein - z.B OTL-Logfile o. sonstiges
→ dahinter - also am Ende der Logdatei: [/code]
gruß
kira

meric 10.10.2012 16:49
Edit:
Mir ist gerade bei einem Blick in die Windows-Ereignisanzeige aufgefallen, dass ich seit dem 09.10. Fehlermeldungen von den Diensten Remotedesktop-Dienst, NLA (Network Location Awareness), Arbeitsstationsdienst, DNS-Client und Kryptografiedienste im Protokoll habe. Diese Fehlermeldungen kamen ziemlich genau zu dem Zeitpunkt, an denen ich die Netzwerkverbindung getrennt habe.
Kann es vielleicht sein, dass jemand eine Remoteverbindung zu meinem Rechner aufbaut?

----------------

Okay, ich hoffe, ich habe alles richtig gemacht:

OTL-Logfile:
Code:
OTL logfile created on: 10.10.2012 16:53:44 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\meric\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 1,85 Gb Available Physical Memory | 46,27% Memory free
6,00 Gb Paging File | 3,77 Gb Available in Paging File | 62,91% Paging File free
Paging file location(s): d:\pagefile.sys 2048 2048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 40,43 Gb Total Space | 0,63 Gb Free Space | 1,55% Space Free | Partition Type: NTFS
Drive D: | 425,33 Gb Total Space | 30,41 Gb Free Space | 7,15% Space Free | Partition Type: NTFS
Drive E: | 149,04 Gb Total Space | 4,55 Gb Free Space | 3,05% Space Free | Partition Type: NTFS
Drive F: | 3,85 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: CHOSENONE | User Name: meric | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\meric\Desktop\OTL.exe (OldTimer Tools)
PRC - D:\Programme\Opera\opera.exe (Opera Software)
PRC - D:\Programme\avast Antivirus\AvastUI.exe (AVAST Software)
PRC - D:\Programme\avast Antivirus\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - D:\Programme\Microsoft Office\Office12\OUTLOOK.EXE (Microsoft Corporation)
PRC - D:\Programme\DynDNS Updater\DynUpSvc.exe (Dyn, Inc.)
PRC - D:\Programme\DynDNS Updater\DynTray.exe (Dyn, Inc.)
PRC - D:\Programme\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG)
PRC - C:\Windows\SysWOW64\CTxfispi.exe (Creative Technology Ltd)
PRC - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
PRC - C:\Program Files (x86)\Common Files\Realtime Soft\RTSHookInterop\x32\RTSHookInterop.exe (Realtime Soft Ltd)
PRC - C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe (Creative Technology Ltd.)
 
 
========== Modules (No Company Name) ==========
 
MOD - D:\Programme\Opera\gstreamer\plugins\gstoggdec.dll ()
MOD - D:\Programme\Opera\gstreamer\plugins\gstwebmdec.dll ()
MOD - D:\Programme\Opera\gstreamer\plugins\gstffmpegcolorspace.dll ()
MOD - D:\Programme\Opera\gstreamer\plugins\gstwavparse.dll ()
MOD - D:\Programme\Opera\gstreamer\plugins\gstdirectsound.dll ()
MOD - D:\Programme\Opera\gstreamer\plugins\gstdecodebin2.dll ()
MOD - D:\Programme\Opera\gstreamer\plugins\gstautodetect.dll ()
MOD - D:\Programme\Opera\gstreamer\plugins\gstwaveform.dll ()
MOD - D:\Programme\Opera\gstreamer\plugins\gsttypefindfunctions.dll ()
MOD - D:\Programme\Opera\gstreamer\gstreamer.dll ()
MOD - D:\Programme\Opera\gstreamer\plugins\gstcoreplugins.dll ()
MOD - D:\Programme\Opera\gstreamer\plugins\gstaudioresample.dll ()
MOD - D:\Programme\Opera\gstreamer\plugins\gstaudioconvert.dll ()
MOD - D:\Programme\avast Antivirus\aswOtl.dll ()
MOD - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL ()
MOD - D:\Programme\Microsoft Office\Office12\ADDINS\UmOutlookAddin.dll ()
MOD - C:\Windows\SysWOW64\APOMngr.DLL ()
MOD - D:\Programme\Samsung\Samsung PC Studio 7\PCSCM_Samsung.dll ()
MOD - D:\Programme\Microsoft Office\Office12\ADDINS\ColleagueImport.dll ()
MOD - C:\Windows\SysWOW64\CmdRtr.DLL ()
MOD - D:\Programme\Samsung\Samsung PC Studio 7\PhoneBrowser.dll ()
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (Hamachi2Svc) -- D:\Programme\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
SRV - (avast! Antivirus) -- D:\Programme\avast Antivirus\AvastSvc.exe (AVAST Software)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (HiPatchService) -- D:\Spiele\Hi-Rez Studios\HiPatchService.exe (Hi-Rez Studios)
SRV - (SkypeUpdate) -- D:\Programme\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (npggsvc) -- C:\Windows\SysWOW64\GameMon.des (INCA Internet Co., Ltd.)
SRV - (wampmysqld) -- c:\wamp\bin\mysql\mysql5.5.20\bin\mysqld.exe ()
SRV - (Giraffic) -- C:\Program Files (x86)\Giraffic\Veoh_GirafficWatchdog.exe (Giraffic)
SRV - (Dyn Updater) -- D:\Programme\DynDNS Updater\DynUpSvc.exe (Dyn, Inc.)
SRV - (Creative Audio Engine Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs)
SRV - (Creative ALchemy AL6 Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe (Creative Labs)
SRV - (LBTServ) -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (wampapache) -- c:\wamp\bin\apache\Apache2.2.21\bin\httpd.exe (Apache Software Foundation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (CTAudSvcService) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (ServiceLayer) -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (dg_ssudbus) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (ssudmdm) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (aswSnx) -- C:\Windows\SysNative\drivers\aswSnx.sys (AVAST Software)
DRV:64bit: - (aswSP) -- C:\Windows\SysNative\drivers\aswSP.sys (AVAST Software)
DRV:64bit: - (aswTdi) -- C:\Windows\SysNative\drivers\aswTdi.sys (AVAST Software)
DRV:64bit: - (aswMonFlt) -- C:\Windows\SysNative\drivers\aswMonFlt.sys (AVAST Software)
DRV:64bit: - (aswRdr) -- C:\Windows\SysNative\drivers\aswRdr2.sys (AVAST Software)
DRV:64bit: - (aswFsBlk) -- C:\Windows\SysNative\drivers\aswFsBlk.sys (AVAST Software)
DRV:64bit: - (EuMusDesignVirtualAudioCableWdm) -- C:\Windows\SysNative\drivers\vrtaucbl.sys (Eugene V. Muzychenko)
DRV:64bit: - (aswKbd) -- C:\Windows\SysNative\drivers\aswKbd.sys (AVAST Software)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (usbfilter) -- C:\Windows\SysNative\drivers\usbfilter.sys (Advanced Micro Devices)
DRV:64bit: - (amd_xata) -- C:\Windows\SysNative\drivers\amd_xata.sys (Advanced Micro Devices)
DRV:64bit: - (amd_sata) -- C:\Windows\SysNative\drivers\amd_sata.sys (Advanced Micro Devices)
DRV:64bit: - (LMouFilt) -- C:\Windows\SysNative\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV:64bit: - (LHidFilt) -- C:\Windows\SysNative\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV:64bit: - (taphss) -- C:\Windows\SysNative\drivers\taphss.sys (AnchorFree Inc)
DRV:64bit: - (ssadmdm) -- C:\Windows\SysNative\drivers\ssadmdm.sys (MCCI Corporation)
DRV:64bit: - (ssadbus) -- C:\Windows\SysNative\drivers\ssadbus.sys (MCCI Corporation)
DRV:64bit: - (ssadmdfl) -- C:\Windows\SysNative\drivers\ssadmdfl.sys (MCCI Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (LGBusEnum) -- C:\Windows\SysNative\drivers\LGBusEnum.sys (Logitech Inc.)
DRV:64bit: - (LGVirHid) -- C:\Windows\SysNative\drivers\LGVirHid.sys (Logitech Inc.)
DRV:64bit: - (VClone) -- C:\Windows\SysNative\drivers\VClone.sys (Elaborate Bytes AG)
DRV:64bit: - (sscemdm) -- C:\Windows\SysNative\drivers\sscemdm.sys (MCCI Corporation)
DRV:64bit: - (ssceserd) -- C:\Windows\SysNative\drivers\ssceserd.sys (MCCI Corporation)
DRV:64bit: - (sscebus) -- C:\Windows\SysNative\drivers\sscebus.sys (MCCI Corporation)
DRV:64bit: - (androidusb) -- C:\Windows\SysNative\drivers\ssadadb.sys (Google Inc)
DRV:64bit: - (sscemdfl) -- C:\Windows\SysNative\drivers\sscemdfl.sys (MCCI Corporation)
DRV:64bit: - (ElbyCDIO) -- C:\Windows\SysNative\drivers\ElbyCDIO.sys (Elaborate Bytes AG)
DRV:64bit: - (vpcvmm) -- C:\Windows\SysNative\drivers\vpcvmm.sys (Microsoft Corporation)
DRV:64bit: - (vpcbus) -- C:\Windows\SysNative\drivers\vpchbus.sys (Microsoft Corporation)
DRV:64bit: - (vpcusb) -- C:\Windows\SysNative\drivers\vpcusb.sys (Microsoft Corporation)
DRV:64bit: - (vpcuxd) -- C:\Windows\SysNative\drivers\vpcuxd.sys (Microsoft Corporation)
DRV:64bit: - (vpcnfltr) -- C:\Windows\SysNative\drivers\vpcnfltr.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (ha20x22k) -- C:\Windows\SysNative\drivers\ha20x22k.sys (Creative Technology Ltd)
DRV:64bit: - (ha20x2k) -- C:\Windows\SysNative\drivers\ha20x2k.sys (Creative Technology Ltd)
DRV:64bit: - (emupia) -- C:\Windows\SysNative\drivers\emupia2k.sys (Creative Technology Ltd)
DRV:64bit: - (ctsfm2k) -- C:\Windows\SysNative\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV:64bit: - (ctprxy2k) -- C:\Windows\SysNative\drivers\ctprxy2k.sys (Creative Technology Ltd)
DRV:64bit: - (ossrv) -- C:\Windows\SysNative\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV:64bit: - (ctaud2k) -- C:\Windows\SysNative\drivers\ctaud2k.sys (Creative Technology Ltd)
DRV:64bit: - (ctac32k) -- C:\Windows\SysNative\drivers\ctac32k.sys (Creative Technology Ltd)
DRV:64bit: - (CTEXFIFX.SYS) -- C:\Windows\SysNative\drivers\CTEXFIFX.sys (Creative Technology Ltd.)
DRV:64bit: - (CTEXFIFX) -- C:\Windows\SysNative\drivers\CTEXFIFX.sys (Creative Technology Ltd.)
DRV:64bit: - (CTHWIUT.SYS) -- C:\Windows\SysNative\drivers\CTHWIUT.sys (Creative Technology Ltd.)
DRV:64bit: - (CTHWIUT) -- C:\Windows\SysNative\drivers\CTHWIUT.sys (Creative Technology Ltd.)
DRV:64bit: - (CT20XUT.SYS) -- C:\Windows\SysNative\drivers\CT20XUT.sys (Creative Technology Ltd.)
DRV:64bit: - (CT20XUT) -- C:\Windows\SysNative\drivers\CT20XUT.sys (Creative Technology Ltd.)
DRV:64bit: - (AtiPcie) -- C:\Windows\SysNative\drivers\AtiPcie64.sys (Advanced Micro Devices Inc.)
DRV:64bit: - (Revoflt) -- C:\Windows\SysNative\drivers\revoflt.sys (VS Revo Group)
DRV:64bit: - (lowcdc) -- C:\Windows\SysNative\drivers\lowcdc.sys (hxxp://www.recursion.jp/avrcdc/)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (StillCam) -- C:\Windows\SysNative\drivers\serscan.sys (Microsoft Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (grmnusb) -- C:\Windows\SysNative\drivers\grmnusb.sys (GARMIN Corp.)
DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek Corporation                                            )
DRV:64bit: - (VCSVADHWSer) -- C:\Windows\SysNative\drivers\vcsvad.sys (Avnex)
DRV:64bit: - (pccsmcfd) -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys (Nokia)
DRV:64bit: - (nmwcdsax64) -- C:\Windows\SysNative\drivers\nmwcdsax64.sys (Nokia)
DRV:64bit: - (nmwcdsacjx64) -- C:\Windows\SysNative\drivers\nmwcdsacjx64.sys (Nokia)
DRV:64bit: - (nmwcdsacx64) -- C:\Windows\SysNative\drivers\nmwcdsacx64.sys (Nokia)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (UltraMonUtility) -- C:\Program Files (x86)\Common Files\Realtime Soft\UltraMonMirrorDrv\x64\UltraMonUtility.sys (Realtime Soft Ltd)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 51 07 D0 4F 35 A4 CD 01  [binary data]
IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\..\SearchScopes\{3D336522-0C99-4412-B500-3472495092DA}: "URL" = hxxp://www.google.de/search?q={searchTerms}
IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "chrome://speeddial/content/speeddial.xul"
FF - prefs.js..extensions.enabledAddons: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E}:3.0.1
FF - prefs.js..extensions.enabledAddons: {8b86149f-01fb-4842-9dd8-4d7eb02fd055}:0.22.1
FF - prefs.js..extensions.enabledAddons: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.10
FF - prefs.js..extensions.enabledAddons: {dc572301-7619-498c-a57d-39143191b318}:0.4.0.3
FF - prefs.js..extensions.enabledAddons: ich@maltegoetz.de:1.4.3
FF - prefs.js..extensions.enabledAddons: yetanothersmoothscrolling@kataho:3.0.24
FF - prefs.js..extensions.enabledAddons: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:1.3
FF - prefs.js..extensions.enabledAddons: {64161300-e22b-11db-8314-0800200c9a66}:0.9.6.10
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_287.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1165635.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.0: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=0.80.0: C:\Program Files (x86)\Battlelog Web Plugins\0.80.0\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@garmin.com/GpsControl: C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: D:\Programme\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: D:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\meric\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\meric\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\meric\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011.08.05 04:20:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: D:\Programme\avast Antivirus\WebRep\FF [2012.09.07 06:02:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Components: D:\Programme\Mozilla Firefox 4\components [2012.09.07 19:37:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Plugins: D:\Programme\Mozilla Firefox 4\plugins [2012.09.07 19:37:15 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: D:\Programme\Mozilla Firefox 4\components [2012.09.07 19:37:21 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: D:\Programme\Mozilla Firefox 4\plugins [2012.09.07 19:37:15 | 000,000,000 | ---D | M]
 
[2011.02.19 06:14:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\Extensions
[2012.10.10 14:30:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions
[2011.08.26 14:05:17 | 000,000,000 | ---D | M] (Garmin Communicator) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2011.06.29 22:54:50 | 000,000,000 | ---D | M] (All-in-One Gestures) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\{8b86149f-01fb-4842-9dd8-4d7eb02fd055}
[2012.09.16 02:47:33 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012.10.02 23:00:12 | 000,000,000 | ---D | M] (FoxyProxy Standard) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\foxyproxy-basic@eric.h.jung
[2012.09.15 12:21:45 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\ich@maltegoetz.de
[2012.02.23 17:04:32 | 000,164,722 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\compatibility@addons.mozilla.org.xpi
[2012.10.10 04:24:53 | 001,626,141 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\firebug@software.joehewitt.com.xpi
[2012.09.15 12:21:45 | 000,066,522 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\yetanothersmoothscrolling@kataho.xpi
[2012.10.10 14:30:49 | 000,281,285 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{64161300-e22b-11db-8314-0800200c9a66}.xpi
[2012.10.10 04:24:51 | 000,529,404 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2012.09.05 13:40:27 | 001,268,546 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}.xpi
[2012.07.25 05:41:33 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2011.11.05 14:28:38 | 000,434,392 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi
[2012.07.21 13:05:28 | 000,702,524 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi
[2012.09.13 01:44:36 | 000,698,867 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi
[2012.10.03 12:46:51 | 000,257,937 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: chrome://speeddial/content/speeddial.xul
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\meric\AppData\Local\Google\Chrome\Application\17.0.963.78\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.240.7 (Enabled) = D:\Programme\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U24 (Enabled) = D:\Programme\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = D:\Programme\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\np-mswmp.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\meric\AppData\Local\Google\Chrome\Application\17.0.963.78\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\meric\AppData\Local\Google\Chrome\Application\17.0.963.78\pdf.dll
CHR - plugin: Google Talk Plugin (Enabled) = C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: Garmin Communicator Plug-In (Enabled) = C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
CHR - plugin: Windows Activation Technologies (Enabled) = C:\Windows\system32\Wat\npWatWeb.dll
CHR - plugin: Picasa (Enabled) = D:\Programme\Google\Picasa3\npPicasa3.dll
CHR - plugin: iTunes Application Detector (Enabled) = D:\Programme\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: TooManyTabs f\u00FCr Chrome = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\amigcgbheognjmfkaieeeadojiibgbdp\1.9.1_0\
CHR - Extension: TooManyTabs f\u00FCr Chrome = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\amigcgbheognjmfkaieeeadojiibgbdp\1.9.2_0\
CHR - Extension: Turn Off the Lights = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfbmjmiodbnnpllbbbfblcplfjjepjdn\2.0.0.81_0\
CHR - Extension: GCVote = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\boingbkmoapffongfpcancmephhnmehp\2.4.5_0\
CHR - Extension: GCVote = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\boingbkmoapffongfpcancmephhnmehp\2.4.5_0\~
CHR - Extension: SmoothScroll = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\cccpiddacjljmfbbgeimpelpndgpoknn\1.0.6_0\
CHR - Extension: Adblock Plus f\u00FCr Google Chrome\u2122 (Beta) = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.1.3_0\
CHR - Extension: Session Buddy = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\edacconmaakjimmfgnblocblbcdcpbko\2.1.2_0\
CHR - Extension: Direkt Werbung auf YouTube = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\epbmnbdplhcomkedpjfceakddnbgfjmf\1.199_0\
CHR - Extension: Direkt Werbung auf YouTube = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\epbmnbdplhcomkedpjfceakddnbgfjmf\1.52_0\
CHR - Extension: AdBlock = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.33_0\
CHR - Extension: avast! WebRep = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\
CHR - Extension: Speed Dial 2 = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpfpebmajhhopeonhlcgidhclcccjcik\1.6.0.8_0\
CHR - Extension: Smooth Gestures = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfkgmnnajiljnolcgolmmgnecgldgeld\0.15.4.13_0\
CHR - Extension: GC little helper = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\nagohipignfajbmgdcedbnmafoebnnjg\1.0_0\
CHR - Extension: New Tabs Always Last = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\nldmhfnlbkkdhboedalogjpeedjbmjgi\0.1_0\
CHR - Extension: Mehr Leistung und Videoformate f\u00FCr dein HTML5 \u003Cvideo\u003E = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.126_0\
 
O1 HOSTS File: ([2012.10.10 15:46:01 | 000,002,688 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 clients.your-server.de
O1 - Hosts: 127.0.0.1 your-server.de
O1 - Hosts: 127.0.0.1 rackcentre.redstation.net.uk
O1 - Hosts: 127.0.0.1 redstation.net.uk
O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - D:\Programme\avast Antivirus\aswWebRepIE64.dll (AVAST Software)
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\avast Antivirus\aswWebRepIE.dll (AVAST Software)
O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - D:\Programme\avast Antivirus\aswWebRepIE64.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\avast Antivirus\aswWebRepIE.dll (AVAST Software)
O4:64bit: - HKLM..\Run: [EvtMgr6] D:\Programme\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [Launch LCore] C:\Program Files\Logitech Gaming Software\LCore.exe (Logitech Inc.)
O4 - HKLM..\Run: [avast] D:\Programme\avast Antivirus\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] D:\Programme\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [Module Loader] C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [VirtualCloneDrive] D:\Programme\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG)
O4 - HKU\.DEFAULT..\Run: [Samsung.PCSync] D:\Programme\Samsung\Samsung PC Studio 7\PcSync2.exe (Time Information Services Ltd.)
O4 - HKU\S-1-5-18..\Run: [Samsung.PCSync] D:\Programme\Samsung\Samsung PC Studio 7\PcSync2.exe (Time Information Services Ltd.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] D:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\meric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\launch.jnlp ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1
O8:64bit: - Extra context menu item: add to &BOM - D:\\PROGRA~1\\BIET-O~1\\\\AddToBOM.hta ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: add to &BOM - D:\\PROGRA~1\\BIET-O~1\\\\AddToBOM.hta ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKU\.DEFAULT\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: sony.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: sony.com ([]* in Trusted sites)
O15 - HKU\S-1-5-19\..Trusted Domains: clonewarsadventures.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: freerealms.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: soe.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: sony.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: clonewarsadventures.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: freerealms.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: soe.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: sony.com ([]* in )
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15114/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7261E20A-4D13-42CD-AACA-ADDBC90946B2}: NameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\gopher - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\AutorunsDisabled: DllName - (Reg Error: Value error.) - Reg Error: Value error. File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{374c1187-4813-11e1-9fcd-00241ddbd724}\Shell - "" = AutoRun
O33 - MountPoints2\{374c1187-4813-11e1-9fcd-00241ddbd724}\Shell\AutoRun\command - "" = H:\iStudio.exe
O33 - MountPoints2\{f79fdbda-579f-11e0-857b-a96a988e982a}\Shell - "" = AutoRun
O33 - MountPoints2\{f79fdbda-579f-11e0-857b-a96a988e982a}\Shell\AutoRun\command - "" = G:\start.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.10.10 16:53:00 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\meric\Desktop\OTL.exe
[2012.10.10 16:33:54 | 000,000,000 | ---D | C] -- C:\Users\meric\Desktop\OSAM
[2012.10.10 16:13:14 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Users\meric\Desktop\aswMBR.exe
[2012.10.10 16:01:56 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Roaming\Malwarebytes
[2012.10.10 16:01:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.10.10 16:01:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.10.10 16:01:41 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.10.10 15:20:59 | 000,000,000 | ---D | C] -- C:\Users\meric\Desktop\backups
[2012.10.10 15:01:33 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\meric\Desktop\HijackThis.exe
[2012.10.10 14:46:18 | 000,424,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll
[2012.10.10 14:46:17 | 001,162,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll
[2012.10.10 14:46:17 | 000,338,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\conhost.exe
[2012.10.10 14:46:17 | 000,215,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll
[2012.10.10 14:46:14 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll
[2012.10.10 14:46:13 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe
[2012.10.10 14:46:13 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll
[2012.10.10 14:46:13 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll
[2012.10.10 14:46:12 | 000,362,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll
[2012.10.10 14:46:12 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll
[2012.10.10 14:46:12 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe
[2012.10.10 14:46:12 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll
[2012.10.10 14:46:12 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2012.10.10 14:46:12 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2012.10.10 14:46:12 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012.10.10 14:46:11 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2012.10.10 14:46:10 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2012.10.10 14:46:09 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2012.10.10 14:46:09 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2012.10.10 14:46:08 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2012.10.10 14:46:08 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2012.10.10 14:46:07 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2012.10.10 14:46:07 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2012.10.10 14:46:07 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2012.10.10 14:46:07 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2012.10.10 14:46:07 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2012.10.10 14:46:07 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2012.10.10 14:46:06 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2012.10.10 14:46:06 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2012.10.10 14:46:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2012.10.10 14:46:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2012.10.10 14:46:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2012.10.10 14:46:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2012.10.10 14:46:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2012.10.10 14:46:05 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe
[2012.10.10 14:45:24 | 001,464,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll
[2012.10.10 14:45:23 | 000,140,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll
[2012.10.10 14:45:01 | 000,220,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll
[2012.10.10 14:44:21 | 005,559,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2012.10.10 14:44:20 | 003,914,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2012.10.10 14:44:19 | 003,968,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2012.10.07 04:57:11 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Local\SCE
[2012.10.07 04:57:11 | 000,000,000 | ---D | C] -- C:\Crash
[2012.10.05 17:44:27 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Logishrd
[2012.10.03 16:44:17 | 000,000,000 | ---D | C] -- C:\ProgramData\MAGIX
[2012.10.03 16:44:16 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Local\Xara
[2012.10.03 16:44:16 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Roaming\MAGIX
[2012.10.03 16:43:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Xara
[2012.10.03 16:43:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xara
[2012.09.29 15:31:59 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Local\Solid State Networks
[2012.09.29 15:31:52 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Meteor Entertainment
[2012.09.27 00:02:30 | 000,000,000 | ---D | C] -- C:\Windows\rescache
[2012.09.26 11:14:27 | 000,245,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\OxpsConverter.exe
[2012.09.22 11:51:09 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012.09.22 11:51:09 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012.09.22 11:51:08 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012.09.22 11:51:08 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012.09.22 11:51:08 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2012.09.22 11:51:08 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2012.09.22 11:51:07 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2012.09.22 11:51:07 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012.09.22 11:51:07 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012.09.22 11:51:07 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012.09.22 11:51:06 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2012.09.22 11:51:06 | 000,729,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2012.09.22 11:51:04 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2012.09.22 11:51:04 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012.09.22 11:51:04 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2012.09.19 10:02:08 | 000,102,368 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudbus.sys
[2012.09.19 10:02:06 | 000,203,104 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudmdm.sys
[2012.09.15 03:50:21 | 000,000,000 | --SD | C] -- C:\Users\meric\Documents\Eigene Datenquellen
[2012.09.12 12:44:00 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\RNDISMP.sys
[2012.09.12 12:43:59 | 000,574,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10level9.dll
[2012.09.12 12:43:58 | 000,376,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\netio.sys
[2012.09.12 12:43:58 | 000,288,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\FWPKCLNT.SYS
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.10.10 16:53:01 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\meric\Desktop\OTL.exe
[2012.10.10 16:13:21 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Users\meric\Desktop\aswMBR.exe
[2012.10.10 16:12:58 | 000,007,624 | ---- | M] () -- C:\Users\meric\AppData\Local\Resmon.ResmonCfg
[2012.10.10 16:06:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.10.10 16:02:47 | 000,646,577 | ---- | M] () -- C:\Users\meric\Desktop\svchost.exe_redstation.net.uk.png
[2012.10.10 15:03:31 | 000,013,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.10.10 15:03:31 | 000,013,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.10.10 15:01:34 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\meric\Desktop\HijackThis.exe
[2012.10.10 14:56:58 | 000,000,306 | ---- | M] () -- C:\Windows\tasks\GlaryInitialize.job
[2012.10.10 14:55:12 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.10.10 14:55:00 | 3220,037,632 | -HS- | M] () -- C:\hiberfil.sys
[2012.10.10 14:54:26 | 000,062,308 | ---- | M] () -- C:\Windows\SysNative\BMXStateBkp-{00000002-00000000-00000000-00001102-0000000B-00411102}.rfx
[2012.10.10 14:54:26 | 000,062,308 | ---- | M] () -- C:\Windows\SysNative\BMXState-{00000002-00000000-00000000-00001102-0000000B-00411102}.rfx
[2012.10.10 14:54:26 | 000,000,820 | ---- | M] () -- C:\Windows\SysNative\DVCState-{00000002-00000000-00000000-00001102-0000000B-00411102}.rfx
[2012.10.10 03:29:07 | 000,281,120 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2012.10.10 03:29:07 | 000,281,120 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012.10.10 01:34:04 | 000,281,120 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0
[2012.10.09 18:10:11 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
[2012.10.09 17:14:28 | 000,696,760 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012.10.09 17:14:28 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012.10.08 09:04:12 | 000,053,095 | ---- | M] () -- C:\Users\meric\Desktop\Hochschulsport - Anmeldebestätigung.pdf
[2012.10.07 04:56:54 | 000,000,707 | ---- | M] () -- C:\Users\meric\Desktop\PlanetSide 2 Beta.lnk
[2012.10.05 17:45:08 | 000,018,960 | ---- | M] (Logitech, Inc.) -- C:\Windows\SysNative\drivers\LNonPnP.sys
[2012.10.05 14:01:11 | 004,977,352 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.10.03 17:07:09 | 000,010,387 | ---- | M] () -- C:\Users\meric\Desktop\sdfsdf.png
[2012.10.01 23:26:20 | 001,517,344 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.10.01 23:26:20 | 000,653,918 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.10.01 23:26:20 | 000,614,770 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.10.01 23:26:20 | 000,129,718 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.10.01 23:26:20 | 000,106,012 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.10.01 21:13:21 | 001,594,114 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.10.01 21:13:08 | 000,265,598 | ---- | M] () -- C:\Users\meric\Desktop\dotnetfx_cleanup_tool.zip
[2012.09.26 18:33:12 | 000,617,992 | ---- | M] () -- C:\Users\meric\Desktop\parken.jpg
[2012.09.25 16:47:17 | 000,000,248 | ---- | M] () -- C:\Users\meric\Desktop\dbscheme.ase
[2012.09.24 23:15:52 | 000,176,169 | ---- | M] () -- C:\Users\meric\Desktop\gangnamstyle.mp3
[2012.09.19 10:02:08 | 000,102,368 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudbus.sys
[2012.09.19 10:02:06 | 000,203,104 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudmdm.sys
[2012.09.10 17:47:29 | 000,000,852 | ---- | M] () -- C:\Users\meric\Desktop\DayZ Commander.lnk
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.10.10 16:02:46 | 000,646,577 | ---- | C] () -- C:\Users\meric\Desktop\svchost.exe_redstation.net.uk.png
[2012.10.08 09:04:11 | 000,053,095 | ---- | C] () -- C:\Users\meric\Desktop\Hochschulsport - Anmeldebestätigung.pdf
[2012.10.07 04:56:54 | 000,000,707 | ---- | C] () -- C:\Users\meric\Desktop\PlanetSide 2 Beta.lnk
[2012.10.07 04:56:54 | 000,000,707 | ---- | C] () -- C:\Users\meric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PlanetSide 2 Beta.lnk
[2012.10.03 17:05:26 | 000,010,387 | ---- | C] () -- C:\Users\meric\Desktop\sdfsdf.png
[2012.10.01 21:13:24 | 000,265,598 | ---- | C] () -- C:\Users\meric\Desktop\dotnetfx_cleanup_tool.zip
[2012.09.29 16:22:19 | 001,594,114 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.09.26 18:33:09 | 000,617,992 | ---- | C] () -- C:\Users\meric\Desktop\parken.jpg
[2012.09.25 16:47:16 | 000,000,248 | ---- | C] () -- C:\Users\meric\Desktop\dbscheme.ase
[2012.09.24 23:15:51 | 000,176,169 | ---- | C] () -- C:\Users\meric\Desktop\gangnamstyle.mp3
[2012.05.29 19:59:33 | 000,003,193 | ---- | C] () -- C:\Users\meric\.TransferManager.db
[2012.05.14 04:45:43 | 000,000,703 | ---- | C] () -- C:\Windows\NewsRover.INI
[2012.03.26 01:16:02 | 000,645,632 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2012.03.26 01:16:02 | 000,240,640 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2012.03.03 16:30:28 | 000,577,536 | ---- | C] () -- C:\Windows\SysWow64\ChilkatCsv.dll
[2012.02.29 18:14:42 | 000,000,060 | ---- | C] () -- C:\Windows\picture2avi.ini
[2011.10.15 15:41:55 | 000,002,560 | ---- | C] () -- C:\Windows\SysWow64\CTXFIGER.DLL
[2011.10.15 14:24:42 | 000,164,864 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2011.10.15 14:24:42 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2011.09.28 18:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011.09.22 12:29:58 | 000,321,856 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2011.09.19 09:07:46 | 000,015,360 | ---- | C] () -- C:\Windows\SysWow64\bdmjpeg.dll
[2011.09.19 09:07:32 | 000,058,368 | ---- | C] () -- C:\Windows\SysWow64\bdmpegv.dll
[2011.09.16 11:54:48 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2011.09.16 11:54:44 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2011.09.16 11:54:44 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2011.09.16 11:54:44 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2011.09.16 11:54:44 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2011.09.14 11:36:30 | 000,000,184 | ---- | C] () -- C:\Users\meric\AppData\Roaming\3a99ed39.dat
[2011.05.12 01:10:29 | 000,000,600 | ---- | C] () -- C:\Users\meric\AppData\Roaming\winscp.rnd
[2011.04.22 01:53:09 | 000,010,240 | ---- | C] () -- C:\Users\meric\qlgt.db
[2011.04.17 18:34:36 | 000,000,132 | ---- | C] () -- C:\Users\meric\AppData\Roaming\Adobe GIF Format CS5 Prefs
[2011.04.16 16:16:51 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll
[2011.04.03 20:23:51 | 000,015,873 | ---- | C] () -- C:\Windows\SysWow64\Inetde.dll
[2011.03.10 22:53:14 | 000,000,600 | ---- | C] () -- C:\Users\meric\AppData\Local\PUTTY.RND
[2011.03.05 00:41:26 | 000,007,624 | ---- | C] () -- C:\Users\meric\AppData\Local\Resmon.ResmonCfg
[2011.02.25 07:51:49 | 000,000,132 | ---- | C] () -- C:\Users\meric\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2011.02.19 19:30:01 | 000,281,120 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011.02.19 19:30:00 | 000,837,192 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe
[2011.02.19 19:30:00 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 05:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2011.11.22 23:53:29 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft
[2011.11.22 23:47:21 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft - 1.0 aktuell
[2011.03.04 13:23:26 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft - john smith texture pack v7
[2011.03.04 13:22:58 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft - misa's texture pack
[2012.09.24 23:28:07 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Audacity
[2011.05.04 21:05:29 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Avnex
[2012.04.28 05:12:56 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\BANDISOFT
[2011.10.20 05:29:38 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Beat Hazard
[2011.04.13 03:07:11 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Bridge!
[2011.03.02 21:12:17 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Canon
[2011.04.15 21:18:40 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2011.02.19 18:04:10 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\DAEMON Tools Lite
[2012.03.03 21:42:36 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\EurekaLog
[2012.06.27 14:44:30 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\FileZilla
[2011.08.21 15:46:14 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\flightgear.org
[2011.02.26 21:08:06 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GARMIN
[2012.03.03 16:51:09 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GeoSetter
[2011.02.21 19:32:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GetRight
[2011.08.15 02:12:07 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GlarySoft
[2012.05.17 19:30:34 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GrabIt
[2012.07.17 17:53:03 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\gslist
[2011.12.27 20:46:27 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Highresolution Enterprises
[2012.05.29 13:49:48 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\ijjigame
[2011.02.23 18:24:43 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\ImgBurn
[2011.04.14 01:02:14 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\JAM Software
[2011.09.22 13:04:12 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\JOSM
[2011.02.19 05:17:20 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Leadertech
[2012.07.13 21:51:22 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\LolClient
[2012.06.04 00:45:51 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\LolClient2
[2012.10.03 16:44:17 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\MAGIX
[2011.04.15 02:06:11 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\mirkes.de
[2011.02.20 07:14:12 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Mp3tag
[2011.03.12 16:55:07 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\net.tw.Boks.7C34F9BA9FAD6689FAABBE85F1F5B46BA5A32DE5.1
[2011.02.20 02:07:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Notepad++
[2011.06.05 16:36:43 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\OpenOffice.org
[2011.02.26 20:56:52 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Opera
[2011.04.15 20:58:26 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\PACE Anti-Piracy
[2011.03.18 19:27:45 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\PC Suite
[2011.02.24 18:28:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\POV-Ray
[2011.11.20 03:52:57 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\pymclevel
[2011.10.20 21:30:41 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Samsung
[2012.07.17 03:41:36 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\six-updater
[2012.07.17 02:38:53 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\six-zsync
[2012.07.16 00:15:08 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\SplitMediaLabs
[2012.06.02 14:43:42 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Spotify
[2011.02.23 16:52:00 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2011.08.21 15:45:04 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Subversion
[2011.08.03 23:55:14 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\System
[2012.06.03 21:03:45 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\TeamViewer
[2012.07.10 13:32:48 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Temp
[2012.05.17 19:14:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Thunderbird
[2011.08.11 02:27:43 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Tropico 4 Demo
[2012.06.29 19:17:56 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\ts3overlay
[2011.10.07 23:33:58 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Unity
[2011.08.15 02:26:04 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\uTorrent
[2012.04.30 15:42:37 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Wireshark
[2011.10.19 18:15:14 | 000,000,000 | -HSD | M] -- C:\Users\meric\AppData\Roaming\wyUpdate AU
[2012.01.19 23:25:41 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\XMedia Recode
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 1225 bytes -> C:\Users\meric\AppData\Local\1vCCkxoreGSr:LmKM0wxK1yKopb7y44SV8UUG
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:5F64C164
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:9D1B94FD

< End of report >
Installierte Software:
Code:
7-Zip 9.20 (x64 edition)        Igor Pavlov        15.09.2011        4,53MB        9.20.00.0
ABC Amber Nokia Converter                23.05.2012               
Adobe AIR        Adobe Systems Incorporated        02.12.2011                3.1.0.4880
Adobe Community Help        Adobe Systems Incorporated        22.02.2011                3.0.0.400
Adobe Creative Suite 5 Master Collection        Adobe Systems Incorporated        22.02.2011        8,46GB        5.0
Adobe Flash Media Live Encoder 3.2        Adobe Systems Incorporated        16.08.2011        14,0MB        3.2.0
Adobe Flash Player 11 ActiveX        Adobe Systems Incorporated        09.10.2012        6,00MB        11.4.402.287
Adobe Flash Player 11 Plugin        Adobe Systems Incorporated        09.10.2012        6,00MB        11.4.402.287
Adobe Media Player        Adobe Systems Incorporated        22.02.2011                1.8
Adobe Reader X (10.1.4) - Deutsch        Adobe Systems Incorporated        24.08.2012        169MB        10.1.4
Adobe Shockwave Player 11.6        Adobe Systems, Inc.        27.07.2012                11.6.5.635
AMD Catalyst Install Manager        Advanced Micro Devices, Inc.        03.03.2012        26,2MB        3.0.859.0
Apple Application Support        Apple Inc.        08.08.2011        60,1MB        2.0.1
Apple Mobile Device Support        Apple Inc.        20.02.2011        22,3MB        3.3.1.3
Apple Software Update        Apple Inc.        08.08.2011        2,38MB        2.1.3.127
ArmA 2 Uninstall                16.07.2012               
ARMA 2: Operation Arrowhead        Bohemia Interactive        16.07.2012               
Audacity 2.0        Audacity Team        09.08.2012        42,8MB       
Audiosurf        All of Nothing        21.10.2011        204MB        33
AutoHotkey 1.0.48.05        Chris Mallett        15.04.2011                1.0.48.05
avast! Free Antivirus        AVAST Software        07.09.2012                7.0.1466.0
bada SDK 2.0.5        Samsung Electronics Co., Ltd.        09.06.2012                2.0.5
Bandicam        Bandisoft.com        28.04.2012               
Bandisoft MPEG-1 Decoder                28.04.2012               
Battlelog Web Plugins        EA Digital Illusions CE AB        29.09.2011                0.80.0
BattlEye for OA Uninstall                21.07.2012               
Biet-O-Matic v2.14.8        BOM Development Team        03.04.2011                Biet-O-Matic v2.14.8
Boks        UNKNOWN        12.03.2011                0.5.8
Canon IJ Network Scan Utility                23.02.2011               
Canon IJ Network Tool                23.02.2011               
Canon MP Navigator EX 2.0                23.02.2011               
Canon MP620 series MP Drivers                23.02.2011               
CCleaner        Piriform        24.09.2012                3.23
Creative Audio-Systemsteuerung        Creative Technology Limited        15.10.2011                3.00
Creative Software AutoUpdate        Creative Technology Limited        15.10.2011                1.40
Creative Sound Blaster Properties x64 Edition        Creative Technology Limited        15.10.2011                1.02
DayZ Commander        Dotjosh Open Source        17.07.2012        2,86MB        1.09.39
Deus Ex - Human Revolution version 1.0        Square Enix        31.08.2011                1.0
DivX-Setup        DivX, LLC        05.08.2011                2.6.0.34
Driver Sweeper Version 3.2.0        Phyxion.net        15.10.2011        13,0MB        3.2.0
DTS Connect Pack        Creative Technology Limited        15.10.2011                1.00
Dyn Updater        Dyn, Inc.        18.11.2011                4.1.10
EOSInfo        astrojargon.net        22.05.2011        1,66MB        0.2.0
ESN Sonar        ESN Social Software AB        29.09.2011                0.70.0
FastStone Image Viewer 4.3        FastStone Soft        23.02.2011                4.3
FileZilla Client 3.4.0                07.10.2012                3.4.0
Fraps (remove only)                16.03.2011               
FWTools 2.4.7                22.04.2011               
Garmin Communicator Plugin        Garmin Ltd or its subsidiaries        24.03.2011        11,6MB        2.9.3
Garmin MapSource        Garmin Ltd or its subsidiaries        23.02.2011        59,4MB        6.16.3
Garmin USB Drivers        Garmin Ltd or its subsidiaries        25.10.2011        121KB        2.3.0.0
GeoSetter 3.4.16        Friedemann Schmidt        18.12.2011        28,1MB       
Glary Utilities 2.38.0.1288        Glarysoft Ltd        22.10.2011        22,1MB        2.38.0.1288
Google Chrome        Google Inc.        15.06.2011                17.0.963.78
Google Earth        Google        17.11.2011        92,7MB        6.1.0.5001
Google Talk Plugin        Google        17.01.2012        18,9MB        2.6.1.5251
GPS-Track-Analyse.NET 6.0                15.07.2011        6,72MB       
GrabIt 1.7.2 Beta 6 (build 1008)        Ilan Shemes        12.05.2012        7,38MB       
GSAK 8.1.0.10 (Final)        CWE computer services        03.03.2012        42,1MB       
Hawken        Meteor Entertainment        07.10.2012        1,34GB       
Hi-Rez Studios Authenticate and Update Service        Hi-Rez Studios        15.07.2012                3.0.0.0
ImageShack Uploader 2.2.0        ImageShack Corp.        28.06.2011        26,3MB        2.2.0
ImgBurn        LIGHTNING UK!        24.08.2012                2.5.7.0
Internet-TV für Windows Media Center        Microsoft Corporation        14.03.2011        13,6MB        4.2.2.0
iTunes        Apple Inc.        20.02.2011        145MB        10.1.2.17
iTunes Library Updater        N/A        21.02.2011        1,86MB        1.2.2
Java(TM) 6 Update 31        Oracle        20.02.2012        97,2MB        6.0.310
Java(TM) 6 Update 31 (64-bit)        Oracle        20.02.2012        91,8MB        6.0.310
JDownloader        AppWork UG (haftungsbeschränkt)        24.02.2011               
JOSM 4399        The OpenStreetMap developer community, hxxp://www.openstreetmap.org/        22.09.2011                4399
Kies Air Discovery Service        Samsung        07.10.2012               
LAME v3.98.3 for Audacity                24.10.2011        1,16MB       
League of Legends        Riot Games        03.06.2012                1.3
LightScribe Applications        LightScribe        24.02.2012        12,6MB        1.18.15.1
LightScribe System Software        LightScribe        24.02.2012        26,3MB        1.18.24.1
LightScribe Template Designs - Music Pack 1        LightScribe        24.02.2012        3,12MB        1.15.0.0
LightScribe Template Labeler        LightScribe        24.02.2012        22,6MB        1.18.24.1
Logitech Gaming Software 8.20        Logitech Inc.        04.01.2012        76,6MB        8.20.74
Logitech MouseWare 9.79.1                19.02.2011               
Logitech SetPoint 6.32        Logitech        05.10.2012        39,0MB        6.32.20
LogMeIn Hamachi        LogMeIn, Inc.        30.08.2012                2.1.0.215
Malwarebytes Anti-Malware Version 1.65.0.1400        Malwarebytes Corporation        10.10.2012        19,3MB        1.65.0.1400
Mass Effect 2        Electronic Arts, Inc.        04.03.2012                1.02
Microsoft .NET Framework 4 Client Profile        Microsoft Corporation        01.10.2012        38,8MB        4.0.30319
Microsoft .NET Framework 4 Client Profile DEU Language Pack        Microsoft Corporation        20.10.2011        2,93MB        4.0.30320
Microsoft .NET Framework 4 Extended DEU Language Pack        Microsoft Corporation        29.09.2012        10,6MB        4.0.30319
Microsoft Games for Windows - LIVE Redistributable        Microsoft Corporation        14.03.2012        31,3MB        3.5.92.0
Microsoft Games for Windows Marketplace        Microsoft Corporation        06.05.2011        6,03MB        3.5.50.0
Microsoft Office Enterprise 2007        Microsoft Corporation        22.01.2012                12.0.6612.1000
Microsoft Office File Validation Add-In        Microsoft Corporation        15.09.2011        7,95MB        14.0.5130.5003
Microsoft Office Live Add-in 1.5        Microsoft Corporation        18.04.2012        508KB        2.0.4024.1
Microsoft Silverlight        Microsoft Corporation        11.05.2012        100MB        5.1.10411.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053        Microsoft Corporation        24.01.2012        250KB        8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable        Microsoft Corporation        15.06.2011        300KB        8.0.61001
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570        Microsoft Corporation        13.04.2011        790KB        9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570        Microsoft Corporation        13.04.2011        598KB        9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17        Microsoft Corporation        19.02.2011        252KB        9.0.30729
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148        Microsoft Corporation        19.02.2011        788KB        9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161        Microsoft Corporation        15.06.2011        788KB        9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729        Microsoft Corporation        07.10.2011        222KB        9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17        Microsoft Corporation        19.02.2011        240KB        9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148        Microsoft Corporation        19.02.2011        596KB        9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161        Microsoft Corporation        15.06.2011        600KB        9.0.30729.6161
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219        Microsoft Corporation        30.09.2012        13,8MB        10.0.40219
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219        Microsoft Corporation        20.08.2011        15,0MB        10.0.40219
Microsoft XNA Framework Redistributable 4.0        Microsoft Corporation        13.07.2011        9,17MB        4.0.20823.0
Miranda IM 0.10.4        Miranda IM Project        02.10.2012                0.10.4
mIRC        mIRC Co. Ltd.        02.07.2012                7.25
Mozilla Firefox 15.0.1 (x86 de)        Mozilla        07.10.2012        41,7MB        15.0.1
Mozilla Firefox 6.0 (x86 de)        Mozilla        14.08.2011        34,5MB        6.0
Mp3tag v2.48        Florian Heidenreich        20.02.2011                v2.48
MSXML 4.0 SP2 (KB954430)        Microsoft Corporation        14.07.2011        1,27MB        4.20.9870.0
MSXML 4.0 SP2 (KB973688)        Microsoft Corporation        14.07.2011        1,33MB        4.20.9876.0
MSXML 4.0 SP2 Parser and SDK        Microsoft Corporation        18.03.2011        1,22MB        4.20.9818.0
MSXML 4.0 SP3 Parser        Microsoft Corporation        03.10.2012        1,47MB        4.30.2100.0
MSXML 4.0 SP3 Parser (KB2721691)        Microsoft Corporation        04.10.2012        1,53MB        4.30.2114.0
NAVIGON Fresh 3.4.1        NAVIGON        25.05.2012                3.4.1
Notepad++                20.02.2011                5.8.7
NVIDIA Grafiktreiber 301.42        NVIDIA Corporation        02.06.2012                301.42
NVIDIA PhysX-Systemsoftware 9.12.0213        NVIDIA Corporation        02.06.2012                9.12.0213
OpenAL                15.10.2011               
OpenOffice.org 3.3        OpenOffice.org        05.06.2011        414MB        3.3.9567
Opera 12.02        Opera Software ASA        28.09.2012                12.02.1578
Pando Media Booster        Pando Networks Inc.        03.06.2012        5,46MB        2.6.0.7
PC Connectivity Solution        Nokia        18.08.2011        17,5MB        8.47.7.0
PDFCreator        Frank Heindörfer, Philip Chinery        26.08.2011                1.2.2
Picasa 3        Google, Inc.        04.08.2011                3.8
PlanetSide 2 Beta        Sony Online Entertainment        07.10.2012               
POV-Ray for Windows v3.62        Persistence of Vision Raytracer Pty. Ltd.        24.02.2011        19,7MB        3.62
PunkBuster Services        Even Balance, Inc.        29.09.2011                0.991
QLandkarte GT (remove only)                07.10.2012               
QuickTime        Apple Inc.        08.08.2011        73,0MB        7.70.80.34
RAD Video Tools                22.11.2011               
Revo Uninstaller Pro 2.5.7        VS Revo Group, Ltd.        01.03.2012        54,2MB        2.5.7
SABnzbd 0.7.3        The SABnzbd Team        08.09.2012        28,9MB        0.7.3
Samsung Kies        Samsung Electronics Co., Ltd.        20.10.2011        193MB        2.0.3.11082_152
Samsung PC Studio 7        Samsung        22.05.2012                7.2.20.9
SAMSUNG USB Driver for Mobile Phones        SAMSUNG Electronics Co., Ltd.        27.09.2012        42,9MB        1.5.9.0
SamsungConnectivityCableDriver        Samsung        22.05.2012        741KB        6.83.6.2.1
Sibelius Scorch (all browsers)        Sibelius Software        26.02.2011        41,3MB        5.2.1
Sibelius Scorch (Firefox, Opera, Netscape only)        Sibelius Software        26.02.2011        21,1MB        6.2.0
Six Updater        Six Projects        25.07.2012        38,7MB        2.09.7016
Skype™ 5.10        Skype Technologies S.A.        27.07.2012        19,4MB        5.10.116
Sound Blaster X-Fi                15.10.2011                1.0
Spoiler Sync        aRRKS        07.06.2011        3,99MB       
Spotify        Spotify AB        15.05.2012                0.8.3.222.g317ab79d
Stegano.Net        Svenomenal.Net        07.10.2012                2.1.1.9
stolencamerafinder        mattburns        07.10.2012               
TeamSpeak 3 Client        TeamSpeak Systems GmbH        07.10.2012                3.0.8.1
Topaz Adjust 4        Topaz Labs        03.02.2012                4.1.0
Topaz Adjust 4 (64-bit)        Topaz Labs        03.02.2012                4.1.0
Topaz Adjust 4 (64-bit)                19.02.2011               
Topaz Clean 3        Topaz Labs        03.02.2012                3.0.2
Topaz Clean 3 (64-bit)        Topaz Labs        03.02.2012                3.0.2
Topaz Clean 3 (64-bit)                19.02.2011               
Topaz DeJpeg 4        Topaz Labs        03.02.2012                4.0.2
Topaz DeJpeg 4 (64-bit)        Topaz Labs        03.02.2012                4.0.2
Topaz DeJpeg 4 (64-bit)                19.02.2011               
Topaz DeNoise 5        Topaz Labs        03.02.2012                5.0.1
Topaz DeNoise 5 (64-bit)                19.02.2011               
Topaz DeNoise 5 (64-bit)        Topaz Labs        03.02.2012                5.0.1
Topaz Detail 2        Topaz Labs        03.02.2012                2.0.5
Topaz Detail 2 (64-bit)        Topaz Labs        03.02.2012                2.0.5
Topaz Detail 2 (64-bit)                19.02.2011               
Topaz Fusion Express 2        Topaz Labs        03.02.2012                2.0.2
Topaz Fusion Express 2 (64-bit)        Topaz Labs        03.02.2012                2.0.2
Topaz Fusion Express 2 (64-bit)                19.02.2011               
Topaz InFocus        Topaz Labs        03.02.2012                1.0.0
Topaz InFocus (64-bit)        Topaz Labs        03.02.2012                1.0.0
Topaz InFocus (64-bit)                19.02.2011               
Topaz Lens Effects        Topaz Labs        03.02.2012                1.0.0
Topaz Lens Effects (64-bit)        Topaz Labs        03.02.2012                1.0.0
Topaz Lens Effects (64-bit)                19.02.2011               
Topaz ReMask 3        Topaz Labs        03.02.2012                3.1.0
Topaz ReMask 3 (64-bit)        Topaz Labs        03.02.2012                3.1.0
Topaz ReMask 3 (64-bit)                19.02.2011               
Topaz Simplify 3        Topaz Labs        03.02.2012                3.0.2
Topaz Simplify 3 (64-bit)        Topaz Labs        03.02.2012                3.0.2
Topaz Simplify 3 (64-bit)                19.02.2011               
Total Commander (Remove or Repair)        Ghisler Software GmbH        12.03.2012                7.57a
Tribes Ascend        Hi-Rez Studios        15.07.2012                1.0.1016.7
TweetDeck        Twitter, Inc.        14.02.2012        29,9MB        1.0.0
Ubisoft Game Launcher        UBISOFT        21.08.2011                1.0.0.0
UltraMon        Realtime Soft Ltd        28.01.2012        6,18MB        3.1.0
Unity Web Player        Unity Technologies ApS        07.10.2012        12,0MB       
Veoh Giraffic Video Accelerator        Giraffic        25.03.2012                0.86.192.230
Veoh Web Player        Veoh Networks, Inc.        25.03.2012                1.1.2.0000
Virtual Audio Cable 4.10                26.07.2012               
VirtualCloneDrive        Elaborate Bytes        27.03.2011               
VirtualDJ Home FREE        Atomix Productions        29.02.2012        48,3MB        7.0.5
VLC media player 2.0.0        VideoLAN        19.02.2012                2.0.0
WampServer 2.2        Hervé Leclerc (HeL)        15.03.2012        225MB       
Winamp        Nullsoft, Inc        12.03.2012                5.623
Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (06/03/2009 2.3.0.0)        Garmin        25.10.2011                06/03/2009 2.3.0.0
Windows Live ID Sign-in Assistant        Microsoft Corporation        14.04.2011        10,0MB        6.500.3165.0
Windows Media Center Add-in for Silverlight        Microsoft Corporation        14.03.2011        245KB        4.7.3.0
Windows Media Player Firefox Plugin        Microsoft Corp        12.04.2011        296KB        1.0.0.8
Windows XP Mode        Microsoft Corporation        26.04.2012        1,13GB        1.3.7600.16422
Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)        Nokia        18.08.2011                08/22/2008 7.0.0.0
WinRAR                22.02.2011               
WinSCP 4.3.7        Martin Prikryl        19.02.2012        8,76MB        4.3.7
WinUAE 2.3.3        Arabuusimiehet        19.01.2012                2.3.3
Wireshark 1.6.7 (64-bit)        The Wireshark developer community, hxxp://www.wireshark.org        30.04.2012        80,9MB        1.6.7
XAMPP 1.7.4                14.03.2011               
Xara 3D Maker 7        Xara Group Ltd        03.10.2012                7.0.0.415
XMedia Recode 3.0.7.0        Sebastian Dörfler        19.01.2012                3.0.7.0
xp-AntiSpy 3.97-11        Christian Taubenheim        01.03.2011               
XSplit        SplitMediaLabs        16.07.2012        47,8MB        1.0.1206.0203
Xvid Video Codec        Xvid Team        26.03.2012                1.3.2
Hijackthis-Logfile:
Code:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:45:19, on 10.10.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16450)
Boot mode: Normal

Running processes:
D:\Programme\DynDNS Updater\DynTray.exe
D:\Programme\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe
D:\Programme\avast Antivirus\AvastUI.exe
D:\Programme\LogMeIn Hamachi\hamachi-2-ui.exe
C:\Windows\SysWOW64\CTXFISPI.EXE
D:\Programme\Opera\opera.exe
C:\Program Files (x86)\Common Files\Realtime Soft\RTSHookInterop\x32\RTSHookInterop.exe
C:\Windows\SysWOW64\NOTEPAD.EXE
D:\Programme\Notepad++\notepad++.exe
C:\Users\meric\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Increase performance and video formats for your HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\avast Antivirus\aswWebRepIE.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\avast Antivirus\aswWebRepIE.dll
O4 - HKLM\..\Run: [VirtualCloneDrive] "D:\Programme\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [Module Loader] C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe -StartUpRun
O4 - HKLM\..\Run: [avast] "D:\Programme\avast Antivirus\avastUI.exe" /nogui
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "D:\Programme\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
O4 - HKUS\S-1-5-18\..\Run: [Samsung.PCSync] "D:\Programme\Samsung\Samsung PC Studio 7\PcSync2.exe" /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Samsung.PCSync] "D:\Programme\Samsung\Samsung PC Studio 7\PcSync2.exe" /NoDialog (User 'Default user')
O4 - Startup: launch.jnlp
O4 - Global Startup: Dyn Updater Tray Icon.lnk = D:\Programme\DynDNS Updater\DynTray.exe
O4 - Global Startup: UltraMon.lnk = ?
O8 - Extra context menu item: add to &BOM - D:\\PROGRA~1\\BIET-O~1\\\\AddToBOM.hta
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://D:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} (Creative Software AutoUpdate Support Package 2) - hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15114/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7261E20A-4D13-42CD-AACA-ADDBC90946B2}: NameServer = 192.168.2.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{7261E20A-4D13-42CD-AACA-ADDBC90946B2}: NameServer = 192.168.2.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{7261E20A-4D13-42CD-AACA-ADDBC90946B2}: NameServer = 192.168.2.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: avast! Antivirus - AVAST Software - D:\Programme\avast Antivirus\AvastSvc.exe
O23 - Service: Creative ALchemy AL6 Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
O23 - Service: Dyn Updater - Dyn, Inc. - D:\Programme\DynDNS Updater\DynUpSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: LogMeIn Hamachi Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - D:\Programme\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: Hi-Rez Studios Authenticate and Update Service (HiPatchService) - Hi-Rez Studios - D:\Spiele\Hi-Rez Studios\HiPatchService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.21\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.5.20\bin\mysqld.exe
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 9394 bytes
So ganz ahnungslos bin ich ja selber nicht. Deswegen hab ich mir die Logfiles alle schon einmal selber angeschaut. Etwas verdächtiges aufgefallen ist mir aber leider nicht :(

kira 11.10.2012 07:24
Systemreinigung und Prüfung:

► Wenn Du nun alle Schritte erledigt hast, melde dich mit die gewünschten Ergebnisse zurück!
Nur bei Probleme inzwischen melden!

1.
Deinstalliere - nicht empfohlen:
Zitat:
Veoh Web Player <- Softwareart: Adware
finanziert sich über eine Adware-Komponente
Hinweis: Um den "Veoh Web Player" vollständig nutzen zu können, müssen Sie sich nach der Installation beim Hersteller mit einer E-Mail-Adresse registrieren. Während der Installation sollten Sie die angebotene Software abklicken, diese hat nichts mit dem eigentlichen Programm zu tun. Zudem empfehlen wir Ihnen, die ungefragt mitgelieferte Veoh-Toolbar gleich nach der Installation wieder aus dem System zu löschen.

2.
Hast du es denn in der Hosts selbst eingetragen bzw absichtlich zugefügt? Wenn ja, warum?
Code:
O1 - Hosts: 127.0.0.1 clients.your-server.de
O1 - Hosts: 127.0.0.1 your-server.de
O1 - Hosts: 127.0.0.1 rackcentre.redstation.net.uk
O1 - Hosts: 127.0.0.1 redstation.net.uk
3.
Zitat:
Achtung wichtig!:
Falls Du selber im Logfile Änderungen vorgenommen hast, musst Du durch die Originalbezeichnung ersetzen und so in Script einfügen! sonst funktioniert nicht!
(Benutzerordner, dein Name oder sonstige Änderungen durch X, Stern oder andere Namen ersetzt)
Fixen mit OTL
  • Starte die OTL.exe.
  • Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
  • Kopiere folgendes Skript also - nach dem "Code", alles was in der Codebox steht - (also beginnend mit :OTL und am Ende [emptytemp]), alles was in der Codebox steht (ohne "code"!) :
Code:
:OTL
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\..\SearchScopes\{3D336522-0C99-4412-B500-3472495092DA}: "URL" = http://www.google.de/search?q={searchTerms}
IE - HKU\S-1-5-21-2964708887-1028853983-2314628941-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\meric\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\meric\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{374c1187-4813-11e1-9fcd-00241ddbd724}\Shell - "" = AutoRun
O33 - MountPoints2\{374c1187-4813-11e1-9fcd-00241ddbd724}\Shell\AutoRun\command - "" = H:\iStudio.exe
O33 - MountPoints2\{f79fdbda-579f-11e0-857b-a96a988e982a}\Shell - "" = AutoRun
O33 - MountPoints2\{f79fdbda-579f-11e0-857b-a96a988e982a}\Shell\AutoRun\command - "" = G:\start.exe
@Alternate Data Stream - 1225 bytes -> C:\Users\meric\AppData\Local\1vCCkxoreGSr:LmKM0wxK1yKopb7y44SV8UUG
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:5F64C164
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:9D1B94FD

:Files
C:\Users\meric\AppData\Roaming\uTorrent
C:\Users\meric\AppData\Roaming\DAEMON Tools Lite
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]

4.
Hast Du zur Zone Vertrauenswürdige Sites absichtlich hinzugefügt? einer Reihe der von dir besuchten Websites vollständig vertrauen?:
Zitat:
O15 - HKU\.DEFAULT\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: sony.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: sony.com ([]* in Trusted sites)
O15 - HKU\S-1-5-19\..Trusted Domains: clonewarsadventures.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: freerealms.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: soe.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: sony.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: clonewarsadventures.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: freerealms.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: soe.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: sony.com ([]* in )
wenn nicht: -> Sicherheitszonen: Hinzufügen oder Entfernen von Websites.

5.
Deine Javaversion ist nicht aktuell!
Da aufgrund alter Sicherheitslücken ist Java sehr anfällig, deinstalliere zunächst alle vorhandenen Java-Versionen:
→ Systemsteuerung → Software → deinstallieren...
→ Rechner neu aufstarten
→ Downloade nun die Offline-Version von Java "Empfohlen Version Java(TM) 7 Update 7 - von Oracle herunter
Achte darauf, eventuell angebotene Toolbars abwählen (den Haken bei der Toolbar entfernen)!
Tipp: -> Java-Updates konfigurieren

6.
Aktualisieren:
Code:
OpenOffice.org
7.
Tipps - Der Internet Explorer von Microsoft gehört zur Grundausstattung unter Windows, somit wie alle andere installierte Software muss gepflegt werden! Auch bei Nicht-Verwendung!:
-> Tipps zu Internet Explorer
-> Standard Suchmaschine des Explorers ändern
-> Ändern oder Auswählen eines Suchanbieters in Internet Explorer 7/8
-> Wie kann ich den Cache im Internet Explorer leeren?

8.
Alle Programme/Fenster schliessen
reinige dein System mit CCleaner:
  • "CCleaner"→ "Analysieren"→ Klick auf den Button "Start CCleaner"
  • "Registry""Fehler suchen"→ "Fehler beheben"→ "Alle beheben"
  • Starte dein System neu auf

9.
Vorbereitung
  • Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an.
  • Bitte während der Online-Scans deaktivieren:
    Anti-Virus-Programm und Firewall.
  • Internet Explorer starten => im Menü unter Extras => Internetoption => Datenschutz => den Haken bei "Popupblocker einschalten" entfernen und
  • unter dem Reiter "Sicherheit" => die Sicherheitsstufe ggfs. auf "Mittelhoch" herabsetzen.
    Nicht vergessen, sie hinterher wieder einzuschalten bzw. die Internetoptionen wie zuvor einzustellen..
  • Während der Online-Scans auf andere Online-Aktivitäten verzichten.
  • Du musst das Herunterladen und Installieren von ActiveX-Steuerelementen (Controls) zulassen.

  • http://image.hijackthis.eu/upload/activex1.jpg
    .

Den PC NUR online scannen und NICHT ein zweites Antivirenprogramm installieren!!!
  • Eset Online Scanner (NOD32)
    • Unterstützte Betriebssysteme: Microsoft Windows 7 - Vista - XP - 2000 - NT.
    • Anmerkung für Vista und Windows 7-User: Bitte den Browser unbedingt als Administrator starten.
    • Dein Anti-Virus-Programm während des Scans deaktivieren.
    • Button "ESET Online Scanner" drücken.
    • IE-User müssen das Installieren eines ActiveX Elements erlauben.
    • Einen Haken bei "YES, I accept the Terms of Use." machen und auf den Button "Start" drücken.
    • Einen Haken bei "Remove found threads" und "Scan archives" machen.
    • Start drücken.
    • Signaturen werden heruntergeladen.
    • Der Scan beginnt automatisch.
    • Wenn fertig, das Protokoll speichern und mir posten.
      -> List of found threats
      -> Export to text file
      -> Back
      -> Delete quarantäne files
    • Finish drücken.
    • Browser schließen.
    • Deinstallation nachdem das Protokoll mir gepostet hast: Systemsteuerung => Software => Eset Online Scanner V3 entfernen.
    • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

10.
erneut einen Scan mit OTL:
  • Doppelklick auf die OTL.exe
  • Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
  • Oben findest Du ein Kästchen mit Ausgabe.
    Wähle bitte Standard-Ausgabe
  • Unter Extra-Registrierung wähle bitte Benutze SafeList.
  • Mache Häckchen bei LOP- und Purity-Prüfung.
  • Klicke nun auf Scan links oben.
  • Wenn der Scan beendet wurde werden zwei Logfiles erstellt.
    Du findest die Logfiles auf Deinem Desktop => OTL.txt und Extras.txt
  • Poste die Logfiles in Code-Tags hier in den Thread.

► berichte erneut über den Zustand des Computers. Ob noch Probleme auftreten, wenn ja, welche?

meric 12.10.2012 00:45
1.
Hab den "Veoh Web Player" deinstalliert. Weiß selber nicht mehr so genau, warum der überhaupt drauf war.

2.
Die Hosts hatte ich eingetrage, in der Hoffnung, dass mein Computer keine Verbindung mehr zu diesen herstellen kann. Hat aber nicht funktioniert. Hab die Einträge wieder entfernt.

Allerdings haben die wohl über die Remotedesktopverbindung zugegriffen. Seit dem ich die deaktiviert hab, hatte ich keine Verbindung mehr von und zu diesen Hosts.

3.
Hab OTL mit diesen Befehlen ausgeführt. Hier die Logdatei:
Code:
OTL logfile created on: 11.10.2012 17:01:58 - Run 3
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\meric\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 1,64 Gb Available Physical Memory | 40,95% Memory free
6,00 Gb Paging File | 3,86 Gb Available in Paging File | 64,33% Paging File free
Paging file location(s): d:\pagefile.sys 2048 2048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 40,43 Gb Total Space | 2,29 Gb Free Space | 5,66% Space Free | Partition Type: NTFS
Drive D: | 425,33 Gb Total Space | 30,44 Gb Free Space | 7,16% Space Free | Partition Type: NTFS
Drive E: | 149,04 Gb Total Space | 4,55 Gb Free Space | 3,05% Space Free | Partition Type: NTFS
Drive F: | 3,85 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: CHOSENONE | User Name: meric | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.10.10 16:53:01 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\meric\Desktop\OTL.exe
PRC - [2012.10.09 16:06:31 | 000,692,152 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_4_402_287_ActiveX.exe
PRC - [2012.08.29 12:03:38 | 001,996,200 | ---- | M] (LogMeIn Inc.) -- D:\Programme\LogMeIn Hamachi\hamachi-2-ui.exe
PRC - [2012.08.21 11:12:26 | 004,282,728 | ---- | M] (AVAST Software) -- D:\Programme\avast Antivirus\AvastUI.exe
PRC - [2012.08.21 11:12:25 | 000,044,808 | ---- | M] (AVAST Software) -- D:\Programme\avast Antivirus\AvastSvc.exe
PRC - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.05.29 17:09:57 | 000,076,888 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2011.11.15 19:20:26 | 000,095,608 | ---- | M] (Dyn, Inc.) -- D:\Programme\DynDNS Updater\DynUpSvc.exe
PRC - [2011.11.15 19:20:26 | 000,078,192 | ---- | M] (Dyn, Inc.) -- D:\Programme\DynDNS Updater\DynTray.exe
PRC - [2011.03.07 15:33:08 | 000,089,456 | ---- | M] (Elaborate Bytes AG) -- D:\Programme\VirtualCloneDrive\VCDDaemon.exe
PRC - [2010.07.07 21:27:16 | 001,268,224 | ---- | M] (Creative Technology Ltd) -- C:\Windows\SysWOW64\CTxfispi.exe
PRC - [2010.02.12 10:23:12 | 000,286,720 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
PRC - [2009.12.21 09:00:50 | 000,081,920 | ---- | M] (Realtime Soft Ltd) -- C:\Program Files (x86)\Common Files\Realtime Soft\RTSHookInterop\x32\RTSHookInterop.exe
PRC - [2007.07.18 09:19:02 | 000,057,344 | ---- | M] (Creative Technology Ltd.) -- C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2009.06.29 10:54:08 | 000,164,864 | ---- | M] () -- C:\Windows\SysWOW64\APOMngr.DLL
MOD - [2009.02.06 18:52:24 | 000,073,728 | ---- | M] () -- C:\Windows\SysWOW64\CmdRtr.DLL
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2012.10.09 17:14:30 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.09.15 02:02:29 | 000,529,744 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.08.29 12:03:36 | 002,369,960 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- D:\Programme\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2012.08.21 11:12:25 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Running] -- D:\Programme\avast Antivirus\AvastSvc.exe -- (avast! Antivirus)
SRV - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.07.12 15:16:56 | 000,008,704 | ---- | M] (Hi-Rez Studios) [On_Demand | Stopped] -- D:\Spiele\Hi-Rez Studios\HiPatchService.exe -- (HiPatchService)
SRV - [2012.06.07 19:12:14 | 000,160,944 | R--- | M] (Skype Technologies) [Disabled | Stopped] -- D:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.05.29 17:09:57 | 000,076,888 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2012.03.06 17:19:00 | 003,953,632 | ---- | M] (INCA Internet Co., Ltd.) [Disabled | Stopped] -- C:\Windows\SysWOW64\GameMon.des -- (npggsvc)
SRV - [2012.01.25 10:56:30 | 009,690,112 | ---- | M] () [On_Demand | Stopped] -- c:\wamp\bin\mysql\mysql5.5.20\bin\mysqld.exe -- (wampmysqld)
SRV - [2011.11.15 19:20:26 | 000,095,608 | ---- | M] (Dyn, Inc.) [Auto | Running] -- D:\Programme\DynDNS Updater\DynUpSvc.exe -- (Dyn Updater)
SRV - [2011.10.15 16:04:37 | 000,079,360 | ---- | M] (Creative Labs) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service)
SRV - [2011.10.15 15:40:18 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe -- (Creative ALchemy AL6 Licensing Service)
SRV - [2011.09.27 21:04:08 | 000,359,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2011.09.26 11:06:54 | 000,021,504 | ---- | M] (Apache Software Foundation) [On_Demand | Stopped] -- c:\wamp\bin\apache\Apache2.2.21\bin\httpd.exe -- (wampapache)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.19 14:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2010.02.12 10:23:12 | 000,286,720 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService)
SRV - [2009.08.18 12:48:02 | 002,291,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008.11.11 09:38:06 | 000,620,544 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.09.19 10:02:08 | 000,102,368 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudbus.sys -- (dg_ssudbus)
DRV:64bit: - [2012.09.19 10:02:06 | 000,203,104 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudmdm.sys -- (ssudmdm)
DRV:64bit: - [2012.08.21 11:13:13 | 000,969,200 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx)
DRV:64bit: - [2012.08.21 11:13:13 | 000,359,464 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswSP.sys -- (aswSP)
DRV:64bit: - [2012.08.21 11:13:13 | 000,059,728 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswTdi.sys -- (aswTdi)
DRV:64bit: - [2012.08.21 11:13:12 | 000,071,600 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV:64bit: - [2012.08.21 11:13:12 | 000,054,072 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr)
DRV:64bit: - [2012.08.21 11:13:11 | 000,025,232 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV:64bit: - [2012.07.26 21:32:08 | 000,066,728 | ---- | M] (Eugene V. Muzychenko) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vrtaucbl.sys -- (EuMusDesignVirtualAudioCableWdm)
DRV:64bit: - [2012.03.07 01:02:45 | 000,028,504 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswKbd.sys -- (aswKbd)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.11.16 15:35:58 | 000,054,400 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbfilter.sys -- (usbfilter)
DRV:64bit: - [2011.10.29 03:41:28 | 000,042,624 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amd_xata.sys -- (amd_xata)
DRV:64bit: - [2011.10.29 03:41:26 | 000,080,512 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amd_sata.sys -- (amd_sata)
DRV:64bit: - [2011.09.02 08:30:36 | 000,060,696 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt)
DRV:64bit: - [2011.09.02 08:30:24 | 000,066,840 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)
DRV:64bit: - [2011.07.26 19:49:12 | 000,037,888 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\taphss.sys -- (taphss)
DRV:64bit: - [2011.06.02 07:47:22 | 000,177,640 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadmdm.sys -- (ssadmdm)
DRV:64bit: - [2011.06.02 07:47:22 | 000,157,672 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadbus.sys -- (ssadbus)
DRV:64bit: - [2011.06.02 07:47:22 | 000,016,872 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadmdfl.sys -- (ssadmdfl)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.02.19 05:18:18 | 000,022,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGBusEnum.sys -- (LGBusEnum)
DRV:64bit: - [2011.02.19 05:18:18 | 000,016,008 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGVirHid.sys -- (LGVirHid)
DRV:64bit: - [2011.01.15 18:21:04 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone)
DRV:64bit: - [2010.12.21 07:55:02 | 000,161,280 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sscemdm.sys -- (sscemdm)
DRV:64bit: - [2010.12.21 07:55:02 | 000,129,024 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssceserd.sys -- (ssceserd)
DRV:64bit: - [2010.12.21 07:55:02 | 000,127,488 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sscebus.sys -- (sscebus)
DRV:64bit: - [2010.12.21 07:55:02 | 000,036,328 | ---- | M] (Google Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadadb.sys -- (androidusb)
DRV:64bit: - [2010.12.21 07:55:02 | 000,018,944 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sscemdfl.sys -- (sscemdfl)
DRV:64bit: - [2010.12.17 00:58:14 | 000,040,816 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO)
DRV:64bit: - [2010.11.20 15:34:04 | 000,360,832 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vpcvmm.sys -- (vpcvmm)
DRV:64bit: - [2010.11.20 15:34:04 | 000,194,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vpchbus.sys -- (vpcbus)
DRV:64bit: - [2010.11.20 13:35:34 | 000,095,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vpcusb.sys -- (vpcusb)
DRV:64bit: - [2010.11.20 13:35:26 | 000,016,384 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vpcuxd.sys -- (vpcuxd)
DRV:64bit: - [2010.11.20 13:35:22 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vpcnfltr.sys -- (vpcnfltr)
DRV:64bit: - [2010.11.20 06:33:36 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 04:07:06 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.07.12 20:36:10 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2010.07.07 23:21:18 | 001,612,888 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ha20x22k.sys -- (ha20x22k)
DRV:64bit: - [2010.07.07 23:21:06 | 001,567,832 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ha20x2k.sys -- (ha20x2k)
DRV:64bit: - [2010.07.07 23:20:56 | 000,118,360 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\emupia2k.sys -- (emupia)
DRV:64bit: - [2010.07.07 23:20:48 | 000,213,080 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctsfm2k.sys -- (ctsfm2k)
DRV:64bit: - [2010.07.07 23:20:40 | 000,015,960 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctprxy2k.sys -- (ctprxy2k)
DRV:64bit: - [2010.07.07 23:16:32 | 000,179,288 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctoss2k.sys -- (ossrv)
DRV:64bit: - [2010.07.07 23:16:24 | 000,697,816 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctaud2k.sys -- (ctaud2k)
DRV:64bit: - [2010.07.07 23:16:14 | 000,580,696 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ctac32k.sys -- (ctac32k)
DRV:64bit: - [2010.07.07 23:16:06 | 001,445,976 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CTEXFIFX.sys -- (CTEXFIFX.SYS)
DRV:64bit: - [2010.07.07 23:16:06 | 001,445,976 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTEXFIFX.sys -- (CTEXFIFX)
DRV:64bit: - [2010.07.07 23:15:56 | 000,095,320 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CTHWIUT.sys -- (CTHWIUT.SYS)
DRV:64bit: - [2010.07.07 23:15:56 | 000,095,320 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTHWIUT.sys -- (CTHWIUT)
DRV:64bit: - [2010.07.07 23:15:50 | 000,230,488 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CT20XUT.sys -- (CT20XUT.SYS)
DRV:64bit: - [2010.07.07 23:15:50 | 000,230,488 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CT20XUT.sys -- (CT20XUT)
DRV:64bit: - [2010.06.17 11:15:36 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie64.sys -- (AtiPcie)
DRV:64bit: - [2009.12.30 11:21:26 | 000,031,800 | ---- | M] (VS Revo Group) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\revoflt.sys -- (Revoflt)
DRV:64bit: - [2009.08.24 11:36:00 | 000,010,752 | ---- | M] (hxxp://www.recursion.jp/avrcdc/) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lowcdc.sys -- (lowcdc)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.18 14:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009.05.08 17:08:00 | 000,020,520 | ---- | M] (GARMIN Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\grmnusb.sys -- (grmnusb)
DRV:64bit: - [2009.03.18 17:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)
DRV:64bit: - [2009.03.02 00:05:32 | 000,187,392 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2008.12.26 12:56:04 | 000,021,504 | ---- | M] (Avnex) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vcsvad.sys -- (VCSVADHWSer)
DRV:64bit: - [2008.08.28 11:44:42 | 000,025,600 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys -- (pccsmcfd)
DRV:64bit: - [2007.05.02 16:34:30 | 000,171,008 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nmwcdsax64.sys -- (nmwcdsax64)
DRV:64bit: - [2007.05.02 16:33:38 | 000,017,408 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nmwcdsacjx64.sys -- (nmwcdsacjx64)
DRV:64bit: - [2007.05.02 16:33:36 | 000,012,288 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nmwcdsacx64.sys -- (nmwcdsacx64)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2008.11.14 03:11:42 | 000,020,512 | ---- | M] (Realtime Soft Ltd) [Kernel | Auto | Running] -- C:\Program Files (x86)\Common Files\Realtime Soft\UltraMonMirrorDrv\x64\UltraMonUtility.sys -- (UltraMonUtility)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 51 07 D0 4F 35 A4 CD 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "chrome://speeddial/content/speeddial.xul"
FF - prefs.js..extensions.enabledAddons: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E}:3.0.1
FF - prefs.js..extensions.enabledAddons: {8b86149f-01fb-4842-9dd8-4d7eb02fd055}:0.22.1
FF - prefs.js..extensions.enabledAddons: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.10
FF - prefs.js..extensions.enabledAddons: {dc572301-7619-498c-a57d-39143191b318}:0.4.0.3
FF - prefs.js..extensions.enabledAddons: ich@maltegoetz.de:1.4.3
FF - prefs.js..extensions.enabledAddons: yetanothersmoothscrolling@kataho:3.0.24
FF - prefs.js..extensions.enabledAddons: {64161300-e22b-11db-8314-0800200c9a66}:0.9.6.10
FF - prefs.js..extensions.enabledAddons: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:1.4
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_287.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1165635.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.0: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=0.80.0: C:\Program Files (x86)\Battlelog Web Plugins\0.80.0\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@garmin.com/GpsControl: C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: D:\Programme\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: D:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\meric\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011.08.05 04:20:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: D:\Programme\avast Antivirus\WebRep\FF [2012.09.07 06:02:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Components: D:\Programme\Mozilla Firefox 4\components [2012.09.07 19:37:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Plugins: D:\Programme\Mozilla Firefox 4\plugins [2012.10.11 10:04:29 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: D:\Programme\Mozilla Firefox 4\components [2012.09.07 19:37:21 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: D:\Programme\Mozilla Firefox 4\plugins [2012.10.11 10:04:29 | 000,000,000 | ---D | M]
 
[2011.02.19 06:14:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\Extensions
[2012.10.11 08:59:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions
[2011.08.26 14:05:17 | 000,000,000 | ---D | M] (Garmin Communicator) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2011.06.29 22:54:50 | 000,000,000 | ---D | M] (All-in-One Gestures) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\{8b86149f-01fb-4842-9dd8-4d7eb02fd055}
[2012.09.16 02:47:33 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012.10.02 23:00:12 | 000,000,000 | ---D | M] (FoxyProxy Standard) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\foxyproxy-basic@eric.h.jung
[2012.09.15 12:21:45 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\ich@maltegoetz.de
[2012.02.23 17:04:32 | 000,164,722 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\compatibility@addons.mozilla.org.xpi
[2012.10.10 04:24:53 | 001,626,141 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\firebug@software.joehewitt.com.xpi
[2012.09.15 12:21:45 | 000,066,522 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\yetanothersmoothscrolling@kataho.xpi
[2012.10.10 14:30:49 | 000,281,285 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{64161300-e22b-11db-8314-0800200c9a66}.xpi
[2012.10.10 04:24:51 | 000,529,404 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2012.09.05 13:40:27 | 001,268,546 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}.xpi
[2012.07.25 05:41:33 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2011.11.05 14:28:38 | 000,434,392 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi
[2012.07.21 13:05:28 | 000,702,524 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi
[2012.09.13 01:44:36 | 000,698,867 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi
[2012.10.11 08:59:30 | 000,252,340 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: chrome://speeddial/content/speeddial.xul
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\meric\AppData\Local\Google\Chrome\Application\17.0.963.78\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.240.7 (Enabled) = D:\Programme\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U24 (Enabled) = D:\Programme\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = D:\Programme\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\np-mswmp.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\meric\AppData\Local\Google\Chrome\Application\17.0.963.78\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\meric\AppData\Local\Google\Chrome\Application\17.0.963.78\pdf.dll
CHR - plugin: Google Talk Plugin (Enabled) = C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: Garmin Communicator Plug-In (Enabled) = C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
CHR - plugin: Windows Activation Technologies (Enabled) = C:\Windows\system32\Wat\npWatWeb.dll
CHR - plugin: Picasa (Enabled) = D:\Programme\Google\Picasa3\npPicasa3.dll
CHR - plugin: iTunes Application Detector (Enabled) = D:\Programme\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: TooManyTabs f\u00FCr Chrome = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\amigcgbheognjmfkaieeeadojiibgbdp\1.9.1_0\
CHR - Extension: TooManyTabs f\u00FCr Chrome = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\amigcgbheognjmfkaieeeadojiibgbdp\1.9.2_0\
CHR - Extension: Turn Off the Lights = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfbmjmiodbnnpllbbbfblcplfjjepjdn\2.0.0.81_0\
CHR - Extension: GCVote = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\boingbkmoapffongfpcancmephhnmehp\2.4.5_0\
CHR - Extension: GCVote = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\boingbkmoapffongfpcancmephhnmehp\2.4.5_0\~
CHR - Extension: SmoothScroll = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\cccpiddacjljmfbbgeimpelpndgpoknn\1.0.6_0\
CHR - Extension: Adblock Plus f\u00FCr Google Chrome\u2122 (Beta) = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.1.3_0\
CHR - Extension: Session Buddy = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\edacconmaakjimmfgnblocblbcdcpbko\2.1.2_0\
CHR - Extension: Direkt Werbung auf YouTube = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\epbmnbdplhcomkedpjfceakddnbgfjmf\1.199_0\
CHR - Extension: Direkt Werbung auf YouTube = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\epbmnbdplhcomkedpjfceakddnbgfjmf\1.52_0\
CHR - Extension: AdBlock = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.33_0\
CHR - Extension: avast! WebRep = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\
CHR - Extension: Speed Dial 2 = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpfpebmajhhopeonhlcgidhclcccjcik\1.6.0.8_0\
CHR - Extension: Smooth Gestures = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfkgmnnajiljnolcgolmmgnecgldgeld\0.15.4.13_0\
CHR - Extension: GC little helper = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\nagohipignfajbmgdcedbnmafoebnnjg\1.0_0\
CHR - Extension: New Tabs Always Last = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\nldmhfnlbkkdhboedalogjpeedjbmjgi\0.1_0\
CHR - Extension: Mehr Leistung und Videoformate f\u00FCr dein HTML5 \u003Cvideo\u003E = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.126_0\
 
O1 HOSTS File: ([2012.10.11 09:57:32 | 000,000,771 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - D:\Programme\avast Antivirus\aswWebRepIE64.dll (AVAST Software)
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\avast Antivirus\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - D:\Programme\avast Antivirus\aswWebRepIE64.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\avast Antivirus\aswWebRepIE.dll (AVAST Software)
O4:64bit: - HKLM..\Run: [EvtMgr6] D:\Programme\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [Launch LCore] C:\Program Files\Logitech Gaming Software\LCore.exe (Logitech Inc.)
O4 - HKLM..\Run: [avast] D:\Programme\avast Antivirus\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] D:\Programme\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [Module Loader] C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [VirtualCloneDrive] D:\Programme\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG)
O4 - Startup: C:\Users\meric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\launch.jnlp ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1
O8:64bit: - Extra context menu item: add to &BOM - D:\\PROGRA~1\\BIET-O~1\\\\AddToBOM.hta ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: add to &BOM - D:\\PROGRA~1\\BIET-O~1\\\\AddToBOM.hta ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15114/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7261E20A-4D13-42CD-AACA-ADDBC90946B2}: NameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\gopher - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\AutorunsDisabled: DllName - (Reg Error: Value error.) - Reg Error: Value error. File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.10.11 10:35:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.10.11 10:09:10 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.4.1
[2012.10.11 10:05:34 | 001,034,216 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\npDeployJava1.dll
[2012.10.11 10:05:34 | 000,289,768 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\javaws.exe
[2012.10.11 10:05:29 | 000,189,416 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\javaw.exe
[2012.10.11 10:05:29 | 000,188,904 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\java.exe
[2012.10.11 10:05:29 | 000,108,008 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\WindowsAccessBridge-64.dll
[2012.10.11 10:05:17 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2012.10.11 10:04:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2012.10.11 10:04:29 | 000,821,736 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\npDeployJava1.dll
[2012.10.11 10:04:29 | 000,246,760 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2012.10.11 10:04:21 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2012.10.11 10:04:21 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2012.10.11 10:04:21 | 000,095,208 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2012.10.11 10:04:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2012.10.11 09:26:20 | 000,000,000 | ---D | C] -- C:\_OTL
[2012.10.10 17:38:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012.10.10 17:38:39 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012.10.10 17:38:22 | 003,941,312 | ---- | C] (Piriform Ltd) -- C:\Users\meric\Desktop\ccsetup323.exe
[2012.10.10 16:53:00 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\meric\Desktop\OTL.exe
[2012.10.10 16:33:54 | 000,000,000 | ---D | C] -- C:\Users\meric\Desktop\OSAM
[2012.10.10 16:13:14 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Users\meric\Desktop\aswMBR.exe
[2012.10.10 16:01:56 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Roaming\Malwarebytes
[2012.10.10 16:01:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.10.10 16:01:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.10.10 16:01:41 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.10.10 15:20:59 | 000,000,000 | ---D | C] -- C:\Users\meric\Desktop\backups
[2012.10.10 15:01:33 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\meric\Desktop\HijackThis.exe
[2012.10.10 14:46:18 | 000,424,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll
[2012.10.10 14:46:17 | 001,162,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll
[2012.10.10 14:46:17 | 000,338,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\conhost.exe
[2012.10.10 14:46:17 | 000,215,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll
[2012.10.10 14:46:14 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll
[2012.10.10 14:46:13 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe
[2012.10.10 14:46:13 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll
[2012.10.10 14:46:13 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll
[2012.10.10 14:46:12 | 000,362,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll
[2012.10.10 14:46:12 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll
[2012.10.10 14:46:12 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe
[2012.10.10 14:46:12 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll
[2012.10.10 14:46:12 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2012.10.10 14:46:12 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2012.10.10 14:46:12 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012.10.10 14:46:11 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2012.10.10 14:46:10 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2012.10.10 14:46:09 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2012.10.10 14:46:09 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2012.10.10 14:46:08 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2012.10.10 14:46:08 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2012.10.10 14:46:07 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2012.10.10 14:46:07 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2012.10.10 14:46:07 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2012.10.10 14:46:07 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2012.10.10 14:46:07 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2012.10.10 14:46:07 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2012.10.10 14:46:06 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2012.10.10 14:46:06 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2012.10.10 14:46:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2012.10.10 14:46:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2012.10.10 14:46:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2012.10.10 14:46:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2012.10.10 14:46:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2012.10.10 14:46:05 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe
[2012.10.10 14:45:24 | 001,464,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll
[2012.10.10 14:45:23 | 000,140,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll
[2012.10.10 14:45:01 | 000,220,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll
[2012.10.10 14:44:21 | 005,559,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2012.10.10 14:44:20 | 003,914,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2012.10.10 14:44:19 | 003,968,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2012.10.07 04:57:11 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Local\SCE
[2012.10.07 04:57:11 | 000,000,000 | ---D | C] -- C:\Crash
[2012.10.05 17:44:27 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Logishrd
[2012.10.03 16:44:17 | 000,000,000 | ---D | C] -- C:\ProgramData\MAGIX
[2012.10.03 16:44:16 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Local\Xara
[2012.10.03 16:44:16 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Roaming\MAGIX
[2012.10.03 16:43:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Xara
[2012.10.03 16:43:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xara
[2012.09.29 15:31:59 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Local\Solid State Networks
[2012.09.29 15:31:52 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Meteor Entertainment
[2012.09.26 11:14:27 | 000,245,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\OxpsConverter.exe
[2012.09.22 11:51:09 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012.09.22 11:51:09 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012.09.22 11:51:08 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012.09.22 11:51:08 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012.09.22 11:51:08 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2012.09.22 11:51:08 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2012.09.22 11:51:07 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2012.09.22 11:51:07 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012.09.22 11:51:07 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012.09.22 11:51:07 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012.09.22 11:51:06 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2012.09.22 11:51:06 | 000,729,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2012.09.22 11:51:04 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2012.09.22 11:51:04 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012.09.22 11:51:04 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2012.09.19 10:02:08 | 000,102,368 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudbus.sys
[2012.09.19 10:02:06 | 000,203,104 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudmdm.sys
[2012.09.15 03:50:21 | 000,000,000 | --SD | C] -- C:\Users\meric\Documents\Eigene Datenquellen
[2012.09.12 12:44:00 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\RNDISMP.sys
[2012.09.12 12:43:59 | 000,574,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10level9.dll
[2012.09.12 12:43:58 | 000,376,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\netio.sys
[2012.09.12 12:43:58 | 000,288,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\FWPKCLNT.SYS
 
========== Files - Modified Within 30 Days ==========
 
[2012.10.11 17:00:29 | 000,007,631 | ---- | M] () -- C:\Users\meric\AppData\Local\Resmon.ResmonCfg
[2012.10.11 16:06:27 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.10.11 10:29:42 | 000,000,306 | ---- | M] () -- C:\Windows\tasks\GlaryInitialize.job
[2012.10.11 10:25:12 | 000,013,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.10.11 10:25:12 | 000,013,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.10.11 10:16:56 | 004,983,856 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.10.11 10:16:47 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.10.11 10:16:32 | 3220,037,632 | -HS- | M] () -- C:\hiberfil.sys
[2012.10.11 10:15:59 | 000,062,308 | ---- | M] () -- C:\Windows\SysNative\BMXStateBkp-{00000002-00000000-00000000-00001102-0000000B-00411102}.rfx
[2012.10.11 10:15:59 | 000,062,308 | ---- | M] () -- C:\Windows\SysNative\BMXState-{00000002-00000000-00000000-00001102-0000000B-00411102}.rfx
[2012.10.11 10:15:59 | 000,000,820 | ---- | M] () -- C:\Windows\SysNative\DVCState-{00000002-00000000-00000000-00001102-0000000B-00411102}.rfx
[2012.10.11 10:13:46 | 000,376,550 | ---- | M] () -- C:\Users\meric\Desktop\cc_20121011_101328.reg
[2012.10.11 10:05:24 | 000,108,008 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\WindowsAccessBridge-64.dll
[2012.10.11 10:05:20 | 000,289,768 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\javaws.exe
[2012.10.11 10:05:20 | 000,189,416 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\javaw.exe
[2012.10.11 10:05:19 | 001,034,216 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\npDeployJava1.dll
[2012.10.11 10:05:19 | 000,916,456 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\deployJava1.dll
[2012.10.11 10:05:19 | 000,188,904 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\java.exe
[2012.10.11 10:04:15 | 000,095,208 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2012.10.11 10:04:12 | 000,246,760 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2012.10.11 10:04:12 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2012.10.11 10:04:11 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2012.10.11 10:04:10 | 000,821,736 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\npDeployJava1.dll
[2012.10.11 10:04:10 | 000,746,984 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\deployJava1.dll
[2012.10.11 09:33:53 | 000,002,083 | ---- | M] () -- C:\Users\meric\Desktop\stolencamerafinder.lnk
[2012.10.10 20:56:20 | 000,986,624 | ---- | M] () -- C:\Users\meric\Desktop\MicrosoftFixit50844.msi
[2012.10.10 18:52:10 | 000,281,120 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2012.10.10 18:52:10 | 000,281,120 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012.10.10 17:38:22 | 003,941,312 | ---- | M] (Piriform Ltd) -- C:\Users\meric\Desktop\ccsetup323.exe
[2012.10.10 17:00:10 | 000,856,244 | ---- | M] () -- C:\Users\meric\Desktop\svchost.exe_clients.your-server.de.png
[2012.10.10 16:53:01 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\meric\Desktop\OTL.exe
[2012.10.10 16:13:21 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Users\meric\Desktop\aswMBR.exe
[2012.10.10 16:02:47 | 000,646,577 | ---- | M] () -- C:\Users\meric\Desktop\svchost.exe_redstation.net.uk.png
[2012.10.10 15:01:34 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\meric\Desktop\HijackThis.exe
[2012.10.10 03:29:07 | 000,281,120 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0
[2012.10.09 18:10:11 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
[2012.10.09 17:14:28 | 000,696,760 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012.10.09 17:14:28 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012.10.08 09:04:12 | 000,053,095 | ---- | M] () -- C:\Users\meric\Desktop\Hochschulsport - Anmeldebestätigung.pdf
[2012.10.07 04:56:54 | 000,000,707 | ---- | M] () -- C:\Users\meric\Desktop\PlanetSide 2 Beta.lnk
[2012.10.05 17:45:08 | 000,018,960 | ---- | M] (Logitech, Inc.) -- C:\Windows\SysNative\drivers\LNonPnP.sys
[2012.10.03 17:07:09 | 000,010,387 | ---- | M] () -- C:\Users\meric\Desktop\sdfsdf.png
[2012.10.01 23:26:20 | 001,517,344 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.10.01 23:26:20 | 000,653,918 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.10.01 23:26:20 | 000,614,770 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.10.01 23:26:20 | 000,129,718 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.10.01 23:26:20 | 000,106,012 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.10.01 21:13:21 | 001,594,114 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.10.01 21:13:08 | 000,265,598 | ---- | M] () -- C:\Users\meric\Desktop\dotnetfx_cleanup_tool.zip
[2012.09.26 18:33:12 | 000,617,992 | ---- | M] () -- C:\Users\meric\Desktop\parken.jpg
[2012.09.25 16:47:17 | 000,000,248 | ---- | M] () -- C:\Users\meric\Desktop\dbscheme.ase
[2012.09.24 23:15:52 | 000,176,169 | ---- | M] () -- C:\Users\meric\Desktop\gangnamstyle.mp3
[2012.09.19 10:02:08 | 000,102,368 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudbus.sys
[2012.09.19 10:02:06 | 000,203,104 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudmdm.sys
 
========== Files Created - No Company Name ==========
 
[2012.10.11 10:13:32 | 000,376,550 | ---- | C] () -- C:\Users\meric\Desktop\cc_20121011_101328.reg
[2012.10.11 09:33:53 | 000,002,083 | ---- | C] () -- C:\Users\meric\Desktop\stolencamerafinder.lnk
[2012.10.10 20:56:25 | 000,986,624 | ---- | C] () -- C:\Users\meric\Desktop\MicrosoftFixit50844.msi
[2012.10.10 17:00:10 | 000,856,244 | ---- | C] () -- C:\Users\meric\Desktop\svchost.exe_clients.your-server.de.png
[2012.10.10 16:02:46 | 000,646,577 | ---- | C] () -- C:\Users\meric\Desktop\svchost.exe_redstation.net.uk.png
[2012.10.08 09:04:11 | 000,053,095 | ---- | C] () -- C:\Users\meric\Desktop\Hochschulsport - Anmeldebestätigung.pdf
[2012.10.07 04:56:54 | 000,000,707 | ---- | C] () -- C:\Users\meric\Desktop\PlanetSide 2 Beta.lnk
[2012.10.07 04:56:54 | 000,000,707 | ---- | C] () -- C:\Users\meric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PlanetSide 2 Beta.lnk
[2012.10.03 17:05:26 | 000,010,387 | ---- | C] () -- C:\Users\meric\Desktop\sdfsdf.png
[2012.10.01 21:13:24 | 000,265,598 | ---- | C] () -- C:\Users\meric\Desktop\dotnetfx_cleanup_tool.zip
[2012.09.29 16:22:19 | 001,594,114 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.09.26 18:33:09 | 000,617,992 | ---- | C] () -- C:\Users\meric\Desktop\parken.jpg
[2012.09.25 16:47:16 | 000,000,248 | ---- | C] () -- C:\Users\meric\Desktop\dbscheme.ase
[2012.09.24 23:15:51 | 000,176,169 | ---- | C] () -- C:\Users\meric\Desktop\gangnamstyle.mp3
[2012.05.29 19:59:33 | 000,003,193 | ---- | C] () -- C:\Users\meric\.TransferManager.db
[2012.05.14 04:45:43 | 000,000,703 | ---- | C] () -- C:\Windows\NewsRover.INI
[2012.03.26 01:16:02 | 000,645,632 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2012.03.26 01:16:02 | 000,240,640 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2012.03.03 16:30:28 | 000,577,536 | ---- | C] () -- C:\Windows\SysWow64\ChilkatCsv.dll
[2012.02.29 18:14:42 | 000,000,060 | ---- | C] () -- C:\Windows\picture2avi.ini
[2011.10.15 15:41:55 | 000,002,560 | ---- | C] () -- C:\Windows\SysWow64\CTXFIGER.DLL
[2011.10.15 14:24:42 | 000,164,864 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2011.10.15 14:24:42 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2011.09.28 18:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011.09.22 12:29:58 | 000,321,856 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2011.09.19 09:07:46 | 000,015,360 | ---- | C] () -- C:\Windows\SysWow64\bdmjpeg.dll
[2011.09.19 09:07:32 | 000,058,368 | ---- | C] () -- C:\Windows\SysWow64\bdmpegv.dll
[2011.09.16 11:54:48 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2011.09.16 11:54:44 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2011.09.16 11:54:44 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2011.09.16 11:54:44 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2011.09.16 11:54:44 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2011.09.14 11:36:30 | 000,000,184 | ---- | C] () -- C:\Users\meric\AppData\Roaming\3a99ed39.dat
[2011.05.12 01:10:29 | 000,000,600 | ---- | C] () -- C:\Users\meric\AppData\Roaming\winscp.rnd
[2011.04.22 01:53:09 | 000,010,240 | ---- | C] () -- C:\Users\meric\qlgt.db
[2011.04.17 18:34:36 | 000,000,132 | ---- | C] () -- C:\Users\meric\AppData\Roaming\Adobe GIF Format CS5 Prefs
[2011.04.16 16:16:51 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll
[2011.04.03 20:23:51 | 000,015,873 | ---- | C] () -- C:\Windows\SysWow64\Inetde.dll
[2011.03.10 22:53:14 | 000,000,600 | ---- | C] () -- C:\Users\meric\AppData\Local\PUTTY.RND
[2011.03.05 00:41:26 | 000,007,631 | ---- | C] () -- C:\Users\meric\AppData\Local\Resmon.ResmonCfg
[2011.02.25 07:51:49 | 000,000,132 | ---- | C] () -- C:\Users\meric\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2011.02.19 19:30:01 | 000,281,120 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011.02.19 19:30:00 | 000,837,192 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe
[2011.02.19 19:30:00 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 05:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2011.11.22 23:53:29 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft
[2011.11.22 23:47:21 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft - 1.0 aktuell
[2011.03.04 13:23:26 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft - john smith texture pack v7
[2011.03.04 13:22:58 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft - misa's texture pack
[2012.09.24 23:28:07 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Audacity
[2011.05.04 21:05:29 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Avnex
[2012.04.28 05:12:56 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\BANDISOFT
[2011.10.20 05:29:38 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Beat Hazard
[2011.04.13 03:07:11 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Bridge!
[2011.03.02 21:12:17 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Canon
[2011.04.15 21:18:40 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2012.03.03 21:42:36 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\EurekaLog
[2012.10.11 10:12:51 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\FileZilla
[2011.08.21 15:46:14 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\flightgear.org
[2011.02.26 21:08:06 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GARMIN
[2012.03.03 16:51:09 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GeoSetter
[2011.02.21 19:32:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GetRight
[2011.08.15 02:12:07 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GlarySoft
[2012.05.17 19:30:34 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GrabIt
[2012.07.17 17:53:03 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\gslist
[2011.12.27 20:46:27 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Highresolution Enterprises
[2012.05.29 13:49:48 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\ijjigame
[2011.02.23 18:24:43 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\ImgBurn
[2011.04.14 01:02:14 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\JAM Software
[2011.09.22 13:04:12 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\JOSM
[2011.02.19 05:17:20 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Leadertech
[2012.07.13 21:51:22 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\LolClient
[2012.06.04 00:45:51 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\LolClient2
[2012.10.03 16:44:17 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\MAGIX
[2011.04.15 02:06:11 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\mirkes.de
[2011.02.20 07:14:12 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Mp3tag
[2011.03.12 16:55:07 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\net.tw.Boks.7C34F9BA9FAD6689FAABBE85F1F5B46BA5A32DE5.1
[2011.02.20 02:07:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Notepad++
[2011.06.05 16:36:43 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\OpenOffice.org
[2011.02.26 20:56:52 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Opera
[2011.04.15 20:58:26 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\PACE Anti-Piracy
[2011.03.18 19:27:45 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\PC Suite
[2011.02.24 18:28:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\POV-Ray
[2011.11.20 03:52:57 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\pymclevel
[2011.10.20 21:30:41 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Samsung
[2012.07.17 03:41:36 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\six-updater
[2012.07.17 02:38:53 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\six-zsync
[2012.07.16 00:15:08 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\SplitMediaLabs
[2012.06.02 14:43:42 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Spotify
[2011.02.23 16:52:00 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2011.08.21 15:45:04 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Subversion
[2011.08.03 23:55:14 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\System
[2012.06.03 21:03:45 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\TeamViewer
[2012.07.10 13:32:48 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Temp
[2012.05.17 19:14:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Thunderbird
[2011.08.11 02:27:43 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Tropico 4 Demo
[2012.06.29 19:17:56 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\ts3overlay
[2011.10.07 23:33:58 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Unity
[2012.04.30 15:42:37 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Wireshark
[2011.10.19 18:15:14 | 000,000,000 | -HSD | M] -- C:\Users\meric\AppData\Roaming\wyUpdate AU
[2012.01.19 23:25:41 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\XMedia Recode
 
========== Purity Check ==========
 
 < End of report >
4.
Nein, diese Sites hatte ich nicht zu den Vertrauenswürdigen hinzugefügt. Hab sie entfernt.

5.
Die alten Java-Versionen (32bit/64bit) hab ich deinstalliert und nach einem Neustart die aktuellen aufgespielt.

6.
Open Office ebenfalls aktualisiert.

7.
Internet Explorer ist auf dem neusten Stand.

8.
CCleaner hab ich laufenlassen. Hat etliche überflüssige Einträge entfernt.

9.
ESET Online Scan hab ich laufen lassen. Hat fast 7 Stunden gedauert. Hier die gefundenen Schädlinge:

Code:
C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\qlps-qlipso-sntb.exe        Win32/Toolbar.Zugo application        cleaned by deleting - quarantined
D:\Programme\PDFCreator\Toolbar\pdfforge Toolbar-4_4_0_setup.exe        Win32/Toolbar.Widgi application        cleaned by deleting - quarantined
D:\Programme\Win7codecs\Tools\Settings32.exe        Win32/Packed.Autoit.C.Gen application        cleaned by deleting - quarantined
D:\Progz\davinci_client_22.35.exe        a variant of Win32/Packed.Themida application        cleaned by deleting - quarantined
D:\Progz\gamebooster.exe        a variant of Win32/Toolbar.Widgi application        cleaned by deleting - quarantined
D:\Progz\HSS-1.30-install-anchorfree-76-conduit.exe        a variant of Win32/HotSpotShield application        cleaned by deleting - quarantined
D:\Progz\HSS-1.37-install-anchorfree-76-conduit.exe        a variant of Win32/HotSpotShield application        cleaned by deleting - quarantined
D:\Progz\JAF_Suite_Setup_1.1.1.exe        a variant of Win32/Packed.Themida application        cleaned by deleting - quarantined
D:\Progz\JAF_Virtual_PKEY_V5.zip        a variant of Win32/Packed.Themida application        deleted - quarantined
D:\Progz\PDFCreator-1_2_2_setup.exe        Win32/Toolbar.Widgi application        cleaned by deleting - quarantined
D:\Progz\picture2avi-setup_exe.exe        a variant of Win32/InstallCore.D application        cleaned by deleting - quarantined
D:\Progz\RarRecoveryToolboxv1147.rar        probably a variant of Win32/Agent.DJCXUEH trojan        deleted - quarantined
D:\Progz\Setup_FreeFlvConverter.exe        Win32/Toolbar.Widgi application        cleaned by deleting - quarantined
D:\Progz\stylexp_Longhorn-Aero-PDC.exe        multiple threats        cleaned by deleting - quarantined
D:\Progz\VeohWebPlayer138Setup_eng.exe        Win32/Toolbar.Zugo application        cleaned by deleting - quarantined
D:\tmpDIR\BetterInstaller.exe        a variant of Win32/Somoto.A application        cleaned by deleting - quarantined
Bei manchen Sachen war's zwar wahrscheinlich nur n heuristischer Treffer, hab aber trotzdem alles löschen lassen.


weiter im nächsten Posting =>

meric 12.10.2012 00:48
10.
Hier die beiden Logfiles des OTL-Scans. OTL-Logfile:

Code:
OTL logfile created on: 11.10.2012 17:01:58 - Run 3
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\meric\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 1,64 Gb Available Physical Memory | 40,95% Memory free
6,00 Gb Paging File | 3,86 Gb Available in Paging File | 64,33% Paging File free
Paging file location(s): d:\pagefile.sys 2048 2048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 40,43 Gb Total Space | 2,29 Gb Free Space | 5,66% Space Free | Partition Type: NTFS
Drive D: | 425,33 Gb Total Space | 30,44 Gb Free Space | 7,16% Space Free | Partition Type: NTFS
Drive E: | 149,04 Gb Total Space | 4,55 Gb Free Space | 3,05% Space Free | Partition Type: NTFS
Drive F: | 3,85 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: CHOSENONE | User Name: meric | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.10.10 16:53:01 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\meric\Desktop\OTL.exe
PRC - [2012.10.09 16:06:31 | 000,692,152 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_4_402_287_ActiveX.exe
PRC - [2012.08.29 12:03:38 | 001,996,200 | ---- | M] (LogMeIn Inc.) -- D:\Programme\LogMeIn Hamachi\hamachi-2-ui.exe
PRC - [2012.08.21 11:12:26 | 004,282,728 | ---- | M] (AVAST Software) -- D:\Programme\avast Antivirus\AvastUI.exe
PRC - [2012.08.21 11:12:25 | 000,044,808 | ---- | M] (AVAST Software) -- D:\Programme\avast Antivirus\AvastSvc.exe
PRC - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.05.29 17:09:57 | 000,076,888 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2011.11.15 19:20:26 | 000,095,608 | ---- | M] (Dyn, Inc.) -- D:\Programme\DynDNS Updater\DynUpSvc.exe
PRC - [2011.11.15 19:20:26 | 000,078,192 | ---- | M] (Dyn, Inc.) -- D:\Programme\DynDNS Updater\DynTray.exe
PRC - [2011.03.07 15:33:08 | 000,089,456 | ---- | M] (Elaborate Bytes AG) -- D:\Programme\VirtualCloneDrive\VCDDaemon.exe
PRC - [2010.07.07 21:27:16 | 001,268,224 | ---- | M] (Creative Technology Ltd) -- C:\Windows\SysWOW64\CTxfispi.exe
PRC - [2010.02.12 10:23:12 | 000,286,720 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
PRC - [2009.12.21 09:00:50 | 000,081,920 | ---- | M] (Realtime Soft Ltd) -- C:\Program Files (x86)\Common Files\Realtime Soft\RTSHookInterop\x32\RTSHookInterop.exe
PRC - [2007.07.18 09:19:02 | 000,057,344 | ---- | M] (Creative Technology Ltd.) -- C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2009.06.29 10:54:08 | 000,164,864 | ---- | M] () -- C:\Windows\SysWOW64\APOMngr.DLL
MOD - [2009.02.06 18:52:24 | 000,073,728 | ---- | M] () -- C:\Windows\SysWOW64\CmdRtr.DLL
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2012.10.09 17:14:30 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.09.15 02:02:29 | 000,529,744 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.08.29 12:03:36 | 002,369,960 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- D:\Programme\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2012.08.21 11:12:25 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Running] -- D:\Programme\avast Antivirus\AvastSvc.exe -- (avast! Antivirus)
SRV - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.07.12 15:16:56 | 000,008,704 | ---- | M] (Hi-Rez Studios) [On_Demand | Stopped] -- D:\Spiele\Hi-Rez Studios\HiPatchService.exe -- (HiPatchService)
SRV - [2012.06.07 19:12:14 | 000,160,944 | R--- | M] (Skype Technologies) [Disabled | Stopped] -- D:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.05.29 17:09:57 | 000,076,888 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2012.03.06 17:19:00 | 003,953,632 | ---- | M] (INCA Internet Co., Ltd.) [Disabled | Stopped] -- C:\Windows\SysWOW64\GameMon.des -- (npggsvc)
SRV - [2012.01.25 10:56:30 | 009,690,112 | ---- | M] () [On_Demand | Stopped] -- c:\wamp\bin\mysql\mysql5.5.20\bin\mysqld.exe -- (wampmysqld)
SRV - [2011.11.15 19:20:26 | 000,095,608 | ---- | M] (Dyn, Inc.) [Auto | Running] -- D:\Programme\DynDNS Updater\DynUpSvc.exe -- (Dyn Updater)
SRV - [2011.10.15 16:04:37 | 000,079,360 | ---- | M] (Creative Labs) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service)
SRV - [2011.10.15 15:40:18 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe -- (Creative ALchemy AL6 Licensing Service)
SRV - [2011.09.27 21:04:08 | 000,359,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2011.09.26 11:06:54 | 000,021,504 | ---- | M] (Apache Software Foundation) [On_Demand | Stopped] -- c:\wamp\bin\apache\Apache2.2.21\bin\httpd.exe -- (wampapache)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.19 14:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2010.02.12 10:23:12 | 000,286,720 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService)
SRV - [2009.08.18 12:48:02 | 002,291,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008.11.11 09:38:06 | 000,620,544 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.09.19 10:02:08 | 000,102,368 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudbus.sys -- (dg_ssudbus)
DRV:64bit: - [2012.09.19 10:02:06 | 000,203,104 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudmdm.sys -- (ssudmdm)
DRV:64bit: - [2012.08.21 11:13:13 | 000,969,200 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx)
DRV:64bit: - [2012.08.21 11:13:13 | 000,359,464 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswSP.sys -- (aswSP)
DRV:64bit: - [2012.08.21 11:13:13 | 000,059,728 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswTdi.sys -- (aswTdi)
DRV:64bit: - [2012.08.21 11:13:12 | 000,071,600 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV:64bit: - [2012.08.21 11:13:12 | 000,054,072 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr)
DRV:64bit: - [2012.08.21 11:13:11 | 000,025,232 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV:64bit: - [2012.07.26 21:32:08 | 000,066,728 | ---- | M] (Eugene V. Muzychenko) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vrtaucbl.sys -- (EuMusDesignVirtualAudioCableWdm)
DRV:64bit: - [2012.03.07 01:02:45 | 000,028,504 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswKbd.sys -- (aswKbd)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.11.16 15:35:58 | 000,054,400 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbfilter.sys -- (usbfilter)
DRV:64bit: - [2011.10.29 03:41:28 | 000,042,624 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amd_xata.sys -- (amd_xata)
DRV:64bit: - [2011.10.29 03:41:26 | 000,080,512 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amd_sata.sys -- (amd_sata)
DRV:64bit: - [2011.09.02 08:30:36 | 000,060,696 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt)
DRV:64bit: - [2011.09.02 08:30:24 | 000,066,840 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)
DRV:64bit: - [2011.07.26 19:49:12 | 000,037,888 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\taphss.sys -- (taphss)
DRV:64bit: - [2011.06.02 07:47:22 | 000,177,640 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadmdm.sys -- (ssadmdm)
DRV:64bit: - [2011.06.02 07:47:22 | 000,157,672 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadbus.sys -- (ssadbus)
DRV:64bit: - [2011.06.02 07:47:22 | 000,016,872 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadmdfl.sys -- (ssadmdfl)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.02.19 05:18:18 | 000,022,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGBusEnum.sys -- (LGBusEnum)
DRV:64bit: - [2011.02.19 05:18:18 | 000,016,008 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGVirHid.sys -- (LGVirHid)
DRV:64bit: - [2011.01.15 18:21:04 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone)
DRV:64bit: - [2010.12.21 07:55:02 | 000,161,280 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sscemdm.sys -- (sscemdm)
DRV:64bit: - [2010.12.21 07:55:02 | 000,129,024 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssceserd.sys -- (ssceserd)
DRV:64bit: - [2010.12.21 07:55:02 | 000,127,488 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sscebus.sys -- (sscebus)
DRV:64bit: - [2010.12.21 07:55:02 | 000,036,328 | ---- | M] (Google Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadadb.sys -- (androidusb)
DRV:64bit: - [2010.12.21 07:55:02 | 000,018,944 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sscemdfl.sys -- (sscemdfl)
DRV:64bit: - [2010.12.17 00:58:14 | 000,040,816 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO)
DRV:64bit: - [2010.11.20 15:34:04 | 000,360,832 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vpcvmm.sys -- (vpcvmm)
DRV:64bit: - [2010.11.20 15:34:04 | 000,194,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vpchbus.sys -- (vpcbus)
DRV:64bit: - [2010.11.20 13:35:34 | 000,095,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vpcusb.sys -- (vpcusb)
DRV:64bit: - [2010.11.20 13:35:26 | 000,016,384 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vpcuxd.sys -- (vpcuxd)
DRV:64bit: - [2010.11.20 13:35:22 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vpcnfltr.sys -- (vpcnfltr)
DRV:64bit: - [2010.11.20 06:33:36 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 04:07:06 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.07.12 20:36:10 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2010.07.07 23:21:18 | 001,612,888 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ha20x22k.sys -- (ha20x22k)
DRV:64bit: - [2010.07.07 23:21:06 | 001,567,832 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ha20x2k.sys -- (ha20x2k)
DRV:64bit: - [2010.07.07 23:20:56 | 000,118,360 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\emupia2k.sys -- (emupia)
DRV:64bit: - [2010.07.07 23:20:48 | 000,213,080 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctsfm2k.sys -- (ctsfm2k)
DRV:64bit: - [2010.07.07 23:20:40 | 000,015,960 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctprxy2k.sys -- (ctprxy2k)
DRV:64bit: - [2010.07.07 23:16:32 | 000,179,288 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctoss2k.sys -- (ossrv)
DRV:64bit: - [2010.07.07 23:16:24 | 000,697,816 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctaud2k.sys -- (ctaud2k)
DRV:64bit: - [2010.07.07 23:16:14 | 000,580,696 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ctac32k.sys -- (ctac32k)
DRV:64bit: - [2010.07.07 23:16:06 | 001,445,976 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CTEXFIFX.sys -- (CTEXFIFX.SYS)
DRV:64bit: - [2010.07.07 23:16:06 | 001,445,976 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTEXFIFX.sys -- (CTEXFIFX)
DRV:64bit: - [2010.07.07 23:15:56 | 000,095,320 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CTHWIUT.sys -- (CTHWIUT.SYS)
DRV:64bit: - [2010.07.07 23:15:56 | 000,095,320 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTHWIUT.sys -- (CTHWIUT)
DRV:64bit: - [2010.07.07 23:15:50 | 000,230,488 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CT20XUT.sys -- (CT20XUT.SYS)
DRV:64bit: - [2010.07.07 23:15:50 | 000,230,488 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CT20XUT.sys -- (CT20XUT)
DRV:64bit: - [2010.06.17 11:15:36 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie64.sys -- (AtiPcie)
DRV:64bit: - [2009.12.30 11:21:26 | 000,031,800 | ---- | M] (VS Revo Group) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\revoflt.sys -- (Revoflt)
DRV:64bit: - [2009.08.24 11:36:00 | 000,010,752 | ---- | M] (hxxp://www.recursion.jp/avrcdc/) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lowcdc.sys -- (lowcdc)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.18 14:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009.05.08 17:08:00 | 000,020,520 | ---- | M] (GARMIN Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\grmnusb.sys -- (grmnusb)
DRV:64bit: - [2009.03.18 17:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)
DRV:64bit: - [2009.03.02 00:05:32 | 000,187,392 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2008.12.26 12:56:04 | 000,021,504 | ---- | M] (Avnex) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vcsvad.sys -- (VCSVADHWSer)
DRV:64bit: - [2008.08.28 11:44:42 | 000,025,600 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys -- (pccsmcfd)
DRV:64bit: - [2007.05.02 16:34:30 | 000,171,008 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nmwcdsax64.sys -- (nmwcdsax64)
DRV:64bit: - [2007.05.02 16:33:38 | 000,017,408 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nmwcdsacjx64.sys -- (nmwcdsacjx64)
DRV:64bit: - [2007.05.02 16:33:36 | 000,012,288 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nmwcdsacx64.sys -- (nmwcdsacx64)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2008.11.14 03:11:42 | 000,020,512 | ---- | M] (Realtime Soft Ltd) [Kernel | Auto | Running] -- C:\Program Files (x86)\Common Files\Realtime Soft\UltraMonMirrorDrv\x64\UltraMonUtility.sys -- (UltraMonUtility)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 51 07 D0 4F 35 A4 CD 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "chrome://speeddial/content/speeddial.xul"
FF - prefs.js..extensions.enabledAddons: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E}:3.0.1
FF - prefs.js..extensions.enabledAddons: {8b86149f-01fb-4842-9dd8-4d7eb02fd055}:0.22.1
FF - prefs.js..extensions.enabledAddons: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.10
FF - prefs.js..extensions.enabledAddons: {dc572301-7619-498c-a57d-39143191b318}:0.4.0.3
FF - prefs.js..extensions.enabledAddons: ich@maltegoetz.de:1.4.3
FF - prefs.js..extensions.enabledAddons: yetanothersmoothscrolling@kataho:3.0.24
FF - prefs.js..extensions.enabledAddons: {64161300-e22b-11db-8314-0800200c9a66}:0.9.6.10
FF - prefs.js..extensions.enabledAddons: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:1.4
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_287.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1165635.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.0: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=0.80.0: C:\Program Files (x86)\Battlelog Web Plugins\0.80.0\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@garmin.com/GpsControl: C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: D:\Programme\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: D:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\meric\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011.08.05 04:20:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: D:\Programme\avast Antivirus\WebRep\FF [2012.09.07 06:02:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Components: D:\Programme\Mozilla Firefox 4\components [2012.09.07 19:37:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Plugins: D:\Programme\Mozilla Firefox 4\plugins [2012.10.11 10:04:29 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: D:\Programme\Mozilla Firefox 4\components [2012.09.07 19:37:21 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: D:\Programme\Mozilla Firefox 4\plugins [2012.10.11 10:04:29 | 000,000,000 | ---D | M]
 
[2011.02.19 06:14:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\Extensions
[2012.10.11 08:59:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions
[2011.08.26 14:05:17 | 000,000,000 | ---D | M] (Garmin Communicator) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2011.06.29 22:54:50 | 000,000,000 | ---D | M] (All-in-One Gestures) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\{8b86149f-01fb-4842-9dd8-4d7eb02fd055}
[2012.09.16 02:47:33 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012.10.02 23:00:12 | 000,000,000 | ---D | M] (FoxyProxy Standard) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\foxyproxy-basic@eric.h.jung
[2012.09.15 12:21:45 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\meric\AppData\Roaming\mozilla\Firefox\Profiles\t840sdej.default\extensions\ich@maltegoetz.de
[2012.02.23 17:04:32 | 000,164,722 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\compatibility@addons.mozilla.org.xpi
[2012.10.10 04:24:53 | 001,626,141 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\firebug@software.joehewitt.com.xpi
[2012.09.15 12:21:45 | 000,066,522 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\yetanothersmoothscrolling@kataho.xpi
[2012.10.10 14:30:49 | 000,281,285 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{64161300-e22b-11db-8314-0800200c9a66}.xpi
[2012.10.10 04:24:51 | 000,529,404 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2012.09.05 13:40:27 | 001,268,546 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}.xpi
[2012.07.25 05:41:33 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2011.11.05 14:28:38 | 000,434,392 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi
[2012.07.21 13:05:28 | 000,702,524 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi
[2012.09.13 01:44:36 | 000,698,867 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi
[2012.10.11 08:59:30 | 000,252,340 | ---- | M] () (No name found) -- C:\Users\meric\AppData\Roaming\mozilla\firefox\profiles\t840sdej.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: chrome://speeddial/content/speeddial.xul
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\meric\AppData\Local\Google\Chrome\Application\17.0.963.78\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.240.7 (Enabled) = D:\Programme\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U24 (Enabled) = D:\Programme\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = D:\Programme\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = D:\Programme\Mozilla Firefox 4\plugins\np-mswmp.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\meric\AppData\Local\Google\Chrome\Application\17.0.963.78\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\meric\AppData\Local\Google\Chrome\Application\17.0.963.78\pdf.dll
CHR - plugin: Google Talk Plugin (Enabled) = C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Users\meric\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: Garmin Communicator Plug-In (Enabled) = C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
CHR - plugin: Windows Activation Technologies (Enabled) = C:\Windows\system32\Wat\npWatWeb.dll
CHR - plugin: Picasa (Enabled) = D:\Programme\Google\Picasa3\npPicasa3.dll
CHR - plugin: iTunes Application Detector (Enabled) = D:\Programme\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: TooManyTabs f\u00FCr Chrome = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\amigcgbheognjmfkaieeeadojiibgbdp\1.9.1_0\
CHR - Extension: TooManyTabs f\u00FCr Chrome = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\amigcgbheognjmfkaieeeadojiibgbdp\1.9.2_0\
CHR - Extension: Turn Off the Lights = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfbmjmiodbnnpllbbbfblcplfjjepjdn\2.0.0.81_0\
CHR - Extension: GCVote = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\boingbkmoapffongfpcancmephhnmehp\2.4.5_0\
CHR - Extension: GCVote = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\boingbkmoapffongfpcancmephhnmehp\2.4.5_0\~
CHR - Extension: SmoothScroll = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\cccpiddacjljmfbbgeimpelpndgpoknn\1.0.6_0\
CHR - Extension: Adblock Plus f\u00FCr Google Chrome\u2122 (Beta) = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.1.3_0\
CHR - Extension: Session Buddy = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\edacconmaakjimmfgnblocblbcdcpbko\2.1.2_0\
CHR - Extension: Direkt Werbung auf YouTube = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\epbmnbdplhcomkedpjfceakddnbgfjmf\1.199_0\
CHR - Extension: Direkt Werbung auf YouTube = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\epbmnbdplhcomkedpjfceakddnbgfjmf\1.52_0\
CHR - Extension: AdBlock = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.33_0\
CHR - Extension: avast! WebRep = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\
CHR - Extension: Speed Dial 2 = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpfpebmajhhopeonhlcgidhclcccjcik\1.6.0.8_0\
CHR - Extension: Smooth Gestures = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfkgmnnajiljnolcgolmmgnecgldgeld\0.15.4.13_0\
CHR - Extension: GC little helper = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\nagohipignfajbmgdcedbnmafoebnnjg\1.0_0\
CHR - Extension: New Tabs Always Last = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\nldmhfnlbkkdhboedalogjpeedjbmjgi\0.1_0\
CHR - Extension: Mehr Leistung und Videoformate f\u00FCr dein HTML5 \u003Cvideo\u003E = C:\Users\meric\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.126_0\
 
O1 HOSTS File: ([2012.10.11 09:57:32 | 000,000,771 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - D:\Programme\avast Antivirus\aswWebRepIE64.dll (AVAST Software)
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\avast Antivirus\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - D:\Programme\avast Antivirus\aswWebRepIE64.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\avast Antivirus\aswWebRepIE.dll (AVAST Software)
O4:64bit: - HKLM..\Run: [EvtMgr6] D:\Programme\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [Launch LCore] C:\Program Files\Logitech Gaming Software\LCore.exe (Logitech Inc.)
O4 - HKLM..\Run: [avast] D:\Programme\avast Antivirus\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] D:\Programme\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [Module Loader] C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [VirtualCloneDrive] D:\Programme\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG)
O4 - Startup: C:\Users\meric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\launch.jnlp ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1
O8:64bit: - Extra context menu item: add to &BOM - D:\\PROGRA~1\\BIET-O~1\\\\AddToBOM.hta ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: add to &BOM - D:\\PROGRA~1\\BIET-O~1\\\\AddToBOM.hta ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15114/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7261E20A-4D13-42CD-AACA-ADDBC90946B2}: NameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\gopher - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\AutorunsDisabled: DllName - (Reg Error: Value error.) - Reg Error: Value error. File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.10.11 10:35:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.10.11 10:09:10 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.4.1
[2012.10.11 10:05:34 | 001,034,216 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\npDeployJava1.dll
[2012.10.11 10:05:34 | 000,289,768 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\javaws.exe
[2012.10.11 10:05:29 | 000,189,416 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\javaw.exe
[2012.10.11 10:05:29 | 000,188,904 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\java.exe
[2012.10.11 10:05:29 | 000,108,008 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\WindowsAccessBridge-64.dll
[2012.10.11 10:05:17 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2012.10.11 10:04:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2012.10.11 10:04:29 | 000,821,736 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\npDeployJava1.dll
[2012.10.11 10:04:29 | 000,246,760 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2012.10.11 10:04:21 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2012.10.11 10:04:21 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2012.10.11 10:04:21 | 000,095,208 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2012.10.11 10:04:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2012.10.11 09:26:20 | 000,000,000 | ---D | C] -- C:\_OTL
[2012.10.10 17:38:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012.10.10 17:38:39 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012.10.10 17:38:22 | 003,941,312 | ---- | C] (Piriform Ltd) -- C:\Users\meric\Desktop\ccsetup323.exe
[2012.10.10 16:53:00 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\meric\Desktop\OTL.exe
[2012.10.10 16:33:54 | 000,000,000 | ---D | C] -- C:\Users\meric\Desktop\OSAM
[2012.10.10 16:13:14 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Users\meric\Desktop\aswMBR.exe
[2012.10.10 16:01:56 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Roaming\Malwarebytes
[2012.10.10 16:01:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.10.10 16:01:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.10.10 16:01:41 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.10.10 15:20:59 | 000,000,000 | ---D | C] -- C:\Users\meric\Desktop\backups
[2012.10.10 15:01:33 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\meric\Desktop\HijackThis.exe
[2012.10.10 14:46:18 | 000,424,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll
[2012.10.10 14:46:17 | 001,162,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll
[2012.10.10 14:46:17 | 000,338,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\conhost.exe
[2012.10.10 14:46:17 | 000,215,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll
[2012.10.10 14:46:14 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll
[2012.10.10 14:46:13 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe
[2012.10.10 14:46:13 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll
[2012.10.10 14:46:13 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll
[2012.10.10 14:46:12 | 000,362,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll
[2012.10.10 14:46:12 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll
[2012.10.10 14:46:12 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe
[2012.10.10 14:46:12 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll
[2012.10.10 14:46:12 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2012.10.10 14:46:12 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2012.10.10 14:46:12 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2012.10.10 14:46:12 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012.10.10 14:46:11 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2012.10.10 14:46:11 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2012.10.10 14:46:10 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2012.10.10 14:46:10 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2012.10.10 14:46:09 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2012.10.10 14:46:09 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2012.10.10 14:46:08 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2012.10.10 14:46:08 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2012.10.10 14:46:07 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2012.10.10 14:46:07 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2012.10.10 14:46:07 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2012.10.10 14:46:07 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2012.10.10 14:46:07 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2012.10.10 14:46:07 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2012.10.10 14:46:06 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2012.10.10 14:46:06 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2012.10.10 14:46:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2012.10.10 14:46:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2012.10.10 14:46:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2012.10.10 14:46:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2012.10.10 14:46:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2012.10.10 14:46:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2012.10.10 14:46:05 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe
[2012.10.10 14:45:24 | 001,464,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll
[2012.10.10 14:45:23 | 000,140,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll
[2012.10.10 14:45:01 | 000,220,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll
[2012.10.10 14:44:21 | 005,559,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2012.10.10 14:44:20 | 003,914,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2012.10.10 14:44:19 | 003,968,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2012.10.07 04:57:11 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Local\SCE
[2012.10.07 04:57:11 | 000,000,000 | ---D | C] -- C:\Crash
[2012.10.05 17:44:27 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Logishrd
[2012.10.03 16:44:17 | 000,000,000 | ---D | C] -- C:\ProgramData\MAGIX
[2012.10.03 16:44:16 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Local\Xara
[2012.10.03 16:44:16 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Roaming\MAGIX
[2012.10.03 16:43:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Xara
[2012.10.03 16:43:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xara
[2012.09.29 15:31:59 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Local\Solid State Networks
[2012.09.29 15:31:52 | 000,000,000 | ---D | C] -- C:\Users\meric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Meteor Entertainment
[2012.09.26 11:14:27 | 000,245,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\OxpsConverter.exe
[2012.09.22 11:51:09 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012.09.22 11:51:09 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012.09.22 11:51:08 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012.09.22 11:51:08 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012.09.22 11:51:08 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2012.09.22 11:51:08 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2012.09.22 11:51:07 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2012.09.22 11:51:07 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012.09.22 11:51:07 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012.09.22 11:51:07 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012.09.22 11:51:06 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2012.09.22 11:51:06 | 000,729,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2012.09.22 11:51:04 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2012.09.22 11:51:04 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012.09.22 11:51:04 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2012.09.19 10:02:08 | 000,102,368 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudbus.sys
[2012.09.19 10:02:06 | 000,203,104 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudmdm.sys
[2012.09.15 03:50:21 | 000,000,000 | --SD | C] -- C:\Users\meric\Documents\Eigene Datenquellen
[2012.09.12 12:44:00 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\RNDISMP.sys
[2012.09.12 12:43:59 | 000,574,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10level9.dll
[2012.09.12 12:43:58 | 000,376,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\netio.sys
[2012.09.12 12:43:58 | 000,288,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\FWPKCLNT.SYS
 
========== Files - Modified Within 30 Days ==========
 
[2012.10.11 17:00:29 | 000,007,631 | ---- | M] () -- C:\Users\meric\AppData\Local\Resmon.ResmonCfg
[2012.10.11 16:06:27 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.10.11 10:29:42 | 000,000,306 | ---- | M] () -- C:\Windows\tasks\GlaryInitialize.job
[2012.10.11 10:25:12 | 000,013,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.10.11 10:25:12 | 000,013,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.10.11 10:16:56 | 004,983,856 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.10.11 10:16:47 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.10.11 10:16:32 | 3220,037,632 | -HS- | M] () -- C:\hiberfil.sys
[2012.10.11 10:15:59 | 000,062,308 | ---- | M] () -- C:\Windows\SysNative\BMXStateBkp-{00000002-00000000-00000000-00001102-0000000B-00411102}.rfx
[2012.10.11 10:15:59 | 000,062,308 | ---- | M] () -- C:\Windows\SysNative\BMXState-{00000002-00000000-00000000-00001102-0000000B-00411102}.rfx
[2012.10.11 10:15:59 | 000,000,820 | ---- | M] () -- C:\Windows\SysNative\DVCState-{00000002-00000000-00000000-00001102-0000000B-00411102}.rfx
[2012.10.11 10:13:46 | 000,376,550 | ---- | M] () -- C:\Users\meric\Desktop\cc_20121011_101328.reg
[2012.10.11 10:05:24 | 000,108,008 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\WindowsAccessBridge-64.dll
[2012.10.11 10:05:20 | 000,289,768 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\javaws.exe
[2012.10.11 10:05:20 | 000,189,416 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\javaw.exe
[2012.10.11 10:05:19 | 001,034,216 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\npDeployJava1.dll
[2012.10.11 10:05:19 | 000,916,456 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\deployJava1.dll
[2012.10.11 10:05:19 | 000,188,904 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\java.exe
[2012.10.11 10:04:15 | 000,095,208 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2012.10.11 10:04:12 | 000,246,760 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2012.10.11 10:04:12 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2012.10.11 10:04:11 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2012.10.11 10:04:10 | 000,821,736 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\npDeployJava1.dll
[2012.10.11 10:04:10 | 000,746,984 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\deployJava1.dll
[2012.10.11 09:33:53 | 000,002,083 | ---- | M] () -- C:\Users\meric\Desktop\stolencamerafinder.lnk
[2012.10.10 20:56:20 | 000,986,624 | ---- | M] () -- C:\Users\meric\Desktop\MicrosoftFixit50844.msi
[2012.10.10 18:52:10 | 000,281,120 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2012.10.10 18:52:10 | 000,281,120 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012.10.10 17:38:22 | 003,941,312 | ---- | M] (Piriform Ltd) -- C:\Users\meric\Desktop\ccsetup323.exe
[2012.10.10 17:00:10 | 000,856,244 | ---- | M] () -- C:\Users\meric\Desktop\svchost.exe_clients.your-server.de.png
[2012.10.10 16:53:01 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\meric\Desktop\OTL.exe
[2012.10.10 16:13:21 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Users\meric\Desktop\aswMBR.exe
[2012.10.10 16:02:47 | 000,646,577 | ---- | M] () -- C:\Users\meric\Desktop\svchost.exe_redstation.net.uk.png
[2012.10.10 15:01:34 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\meric\Desktop\HijackThis.exe
[2012.10.10 03:29:07 | 000,281,120 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0
[2012.10.09 18:10:11 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
[2012.10.09 17:14:28 | 000,696,760 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012.10.09 17:14:28 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012.10.08 09:04:12 | 000,053,095 | ---- | M] () -- C:\Users\meric\Desktop\Hochschulsport - Anmeldebestätigung.pdf
[2012.10.07 04:56:54 | 000,000,707 | ---- | M] () -- C:\Users\meric\Desktop\PlanetSide 2 Beta.lnk
[2012.10.05 17:45:08 | 000,018,960 | ---- | M] (Logitech, Inc.) -- C:\Windows\SysNative\drivers\LNonPnP.sys
[2012.10.03 17:07:09 | 000,010,387 | ---- | M] () -- C:\Users\meric\Desktop\sdfsdf.png
[2012.10.01 23:26:20 | 001,517,344 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.10.01 23:26:20 | 000,653,918 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.10.01 23:26:20 | 000,614,770 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.10.01 23:26:20 | 000,129,718 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.10.01 23:26:20 | 000,106,012 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.10.01 21:13:21 | 001,594,114 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.10.01 21:13:08 | 000,265,598 | ---- | M] () -- C:\Users\meric\Desktop\dotnetfx_cleanup_tool.zip
[2012.09.26 18:33:12 | 000,617,992 | ---- | M] () -- C:\Users\meric\Desktop\parken.jpg
[2012.09.25 16:47:17 | 000,000,248 | ---- | M] () -- C:\Users\meric\Desktop\dbscheme.ase
[2012.09.24 23:15:52 | 000,176,169 | ---- | M] () -- C:\Users\meric\Desktop\gangnamstyle.mp3
[2012.09.19 10:02:08 | 000,102,368 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudbus.sys
[2012.09.19 10:02:06 | 000,203,104 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudmdm.sys
 
========== Files Created - No Company Name ==========
 
[2012.10.11 10:13:32 | 000,376,550 | ---- | C] () -- C:\Users\meric\Desktop\cc_20121011_101328.reg
[2012.10.11 09:33:53 | 000,002,083 | ---- | C] () -- C:\Users\meric\Desktop\stolencamerafinder.lnk
[2012.10.10 20:56:25 | 000,986,624 | ---- | C] () -- C:\Users\meric\Desktop\MicrosoftFixit50844.msi
[2012.10.10 17:00:10 | 000,856,244 | ---- | C] () -- C:\Users\meric\Desktop\svchost.exe_clients.your-server.de.png
[2012.10.10 16:02:46 | 000,646,577 | ---- | C] () -- C:\Users\meric\Desktop\svchost.exe_redstation.net.uk.png
[2012.10.08 09:04:11 | 000,053,095 | ---- | C] () -- C:\Users\meric\Desktop\Hochschulsport - Anmeldebestätigung.pdf
[2012.10.07 04:56:54 | 000,000,707 | ---- | C] () -- C:\Users\meric\Desktop\PlanetSide 2 Beta.lnk
[2012.10.07 04:56:54 | 000,000,707 | ---- | C] () -- C:\Users\meric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PlanetSide 2 Beta.lnk
[2012.10.03 17:05:26 | 000,010,387 | ---- | C] () -- C:\Users\meric\Desktop\sdfsdf.png
[2012.10.01 21:13:24 | 000,265,598 | ---- | C] () -- C:\Users\meric\Desktop\dotnetfx_cleanup_tool.zip
[2012.09.29 16:22:19 | 001,594,114 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.09.26 18:33:09 | 000,617,992 | ---- | C] () -- C:\Users\meric\Desktop\parken.jpg
[2012.09.25 16:47:16 | 000,000,248 | ---- | C] () -- C:\Users\meric\Desktop\dbscheme.ase
[2012.09.24 23:15:51 | 000,176,169 | ---- | C] () -- C:\Users\meric\Desktop\gangnamstyle.mp3
[2012.05.29 19:59:33 | 000,003,193 | ---- | C] () -- C:\Users\meric\.TransferManager.db
[2012.05.14 04:45:43 | 000,000,703 | ---- | C] () -- C:\Windows\NewsRover.INI
[2012.03.26 01:16:02 | 000,645,632 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2012.03.26 01:16:02 | 000,240,640 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2012.03.03 16:30:28 | 000,577,536 | ---- | C] () -- C:\Windows\SysWow64\ChilkatCsv.dll
[2012.02.29 18:14:42 | 000,000,060 | ---- | C] () -- C:\Windows\picture2avi.ini
[2011.10.15 15:41:55 | 000,002,560 | ---- | C] () -- C:\Windows\SysWow64\CTXFIGER.DLL
[2011.10.15 14:24:42 | 000,164,864 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2011.10.15 14:24:42 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2011.09.28 18:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011.09.22 12:29:58 | 000,321,856 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2011.09.19 09:07:46 | 000,015,360 | ---- | C] () -- C:\Windows\SysWow64\bdmjpeg.dll
[2011.09.19 09:07:32 | 000,058,368 | ---- | C] () -- C:\Windows\SysWow64\bdmpegv.dll
[2011.09.16 11:54:48 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2011.09.16 11:54:44 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2011.09.16 11:54:44 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2011.09.16 11:54:44 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2011.09.16 11:54:44 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2011.09.14 11:36:30 | 000,000,184 | ---- | C] () -- C:\Users\meric\AppData\Roaming\3a99ed39.dat
[2011.05.12 01:10:29 | 000,000,600 | ---- | C] () -- C:\Users\meric\AppData\Roaming\winscp.rnd
[2011.04.22 01:53:09 | 000,010,240 | ---- | C] () -- C:\Users\meric\qlgt.db
[2011.04.17 18:34:36 | 000,000,132 | ---- | C] () -- C:\Users\meric\AppData\Roaming\Adobe GIF Format CS5 Prefs
[2011.04.16 16:16:51 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll
[2011.04.03 20:23:51 | 000,015,873 | ---- | C] () -- C:\Windows\SysWow64\Inetde.dll
[2011.03.10 22:53:14 | 000,000,600 | ---- | C] () -- C:\Users\meric\AppData\Local\PUTTY.RND
[2011.03.05 00:41:26 | 000,007,631 | ---- | C] () -- C:\Users\meric\AppData\Local\Resmon.ResmonCfg
[2011.02.25 07:51:49 | 000,000,132 | ---- | C] () -- C:\Users\meric\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2011.02.19 19:30:01 | 000,281,120 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011.02.19 19:30:00 | 000,837,192 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe
[2011.02.19 19:30:00 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 05:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2011.11.22 23:53:29 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft
[2011.11.22 23:47:21 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft - 1.0 aktuell
[2011.03.04 13:23:26 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft - john smith texture pack v7
[2011.03.04 13:22:58 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\.minecraft - misa's texture pack
[2012.09.24 23:28:07 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Audacity
[2011.05.04 21:05:29 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Avnex
[2012.04.28 05:12:56 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\BANDISOFT
[2011.10.20 05:29:38 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Beat Hazard
[2011.04.13 03:07:11 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Bridge!
[2011.03.02 21:12:17 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Canon
[2011.04.15 21:18:40 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2012.03.03 21:42:36 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\EurekaLog
[2012.10.11 10:12:51 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\FileZilla
[2011.08.21 15:46:14 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\flightgear.org
[2011.02.26 21:08:06 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GARMIN
[2012.03.03 16:51:09 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GeoSetter
[2011.02.21 19:32:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GetRight
[2011.08.15 02:12:07 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GlarySoft
[2012.05.17 19:30:34 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\GrabIt
[2012.07.17 17:53:03 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\gslist
[2011.12.27 20:46:27 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Highresolution Enterprises
[2012.05.29 13:49:48 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\ijjigame
[2011.02.23 18:24:43 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\ImgBurn
[2011.04.14 01:02:14 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\JAM Software
[2011.09.22 13:04:12 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\JOSM
[2011.02.19 05:17:20 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Leadertech
[2012.07.13 21:51:22 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\LolClient
[2012.06.04 00:45:51 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\LolClient2
[2012.10.03 16:44:17 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\MAGIX
[2011.04.15 02:06:11 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\mirkes.de
[2011.02.20 07:14:12 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Mp3tag
[2011.03.12 16:55:07 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\net.tw.Boks.7C34F9BA9FAD6689FAABBE85F1F5B46BA5A32DE5.1
[2011.02.20 02:07:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Notepad++
[2011.06.05 16:36:43 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\OpenOffice.org
[2011.02.26 20:56:52 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Opera
[2011.04.15 20:58:26 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\PACE Anti-Piracy
[2011.03.18 19:27:45 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\PC Suite
[2011.02.24 18:28:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\POV-Ray
[2011.11.20 03:52:57 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\pymclevel
[2011.10.20 21:30:41 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Samsung
[2012.07.17 03:41:36 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\six-updater
[2012.07.17 02:38:53 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\six-zsync
[2012.07.16 00:15:08 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\SplitMediaLabs
[2012.06.02 14:43:42 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Spotify
[2011.02.23 16:52:00 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2011.08.21 15:45:04 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Subversion
[2011.08.03 23:55:14 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\System
[2012.06.03 21:03:45 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\TeamViewer
[2012.07.10 13:32:48 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Temp
[2012.05.17 19:14:23 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Thunderbird
[2011.08.11 02:27:43 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Tropico 4 Demo
[2012.06.29 19:17:56 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\ts3overlay
[2011.10.07 23:33:58 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Unity
[2012.04.30 15:42:37 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\Wireshark
[2011.10.19 18:15:14 | 000,000,000 | -HSD | M] -- C:\Users\meric\AppData\Roaming\wyUpdate AU
[2012.01.19 23:25:41 | 000,000,000 | ---D | M] -- C:\Users\meric\AppData\Roaming\XMedia Recode
 
========== Purity Check ==========
 
 
< End of report >
weiter im nächsten Posting =>

meric 12.10.2012 00:51
Extras-Logfile:
Code:
OTL Extras logfile created on: 11.10.2012 17:01:58 - Run 3
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\meric\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 1,64 Gb Available Physical Memory | 40,95% Memory free
6,00 Gb Paging File | 3,86 Gb Available in Paging File | 64,33% Paging File free
Paging file location(s): d:\pagefile.sys 2048 2048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 40,43 Gb Total Space | 2,29 Gb Free Space | 5,66% Space Free | Partition Type: NTFS
Drive D: | 425,33 Gb Total Space | 30,44 Gb Free Space | 7,16% Space Free | Partition Type: NTFS
Drive E: | 149,04 Gb Total Space | 4,55 Gb Free Space | 3,05% Space Free | Partition Type: NTFS
Drive F: | 3,85 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: CHOSENONE | User Name: meric | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- D:\Programme\Mozilla Firefox 4\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "D:\Programme\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "D:\Programme\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "D:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- D:\Programme\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [Browse with FastStone] -- "D:\Programme\FastStone Image Viewer\FSViewer.exe" "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "D:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "D:\Programme\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "D:\Programme\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "D:\Programme\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "D:\Programme\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "D:\Programme\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "D:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- D:\Programme\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [Browse with FastStone] -- "D:\Programme\FastStone Image Viewer\FSViewer.exe" "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "D:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "D:\Programme\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "D:\Programme\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "D:\Programme\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00508039-7CF1-4A2C-9DDB-BA202FB11D07}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{0AD1D6F1-8B78-4BE7-90E5-AA00AD50BB9B}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{0E3E5C01-558C-4E58-AE8D-10A8FB13B6FC}" = lport=56406 | protocol=6 | dir=in | name=pando media booster |
"{19251F23-146A-4C42-BB9F-54C418947D24}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{2497FCF4-0595-401D-A11C-CAF861688655}" = lport=138 | protocol=17 | dir=in | app=system |
"{41C26ECF-D38C-4A4C-9778-DF38B1A2FF6A}" = rport=137 | protocol=17 | dir=out | app=system |
"{50D58C32-8ED7-4F95-8A02-C2F11AB77006}" = lport=137 | protocol=17 | dir=in | app=system |
"{58A51194-6747-4239-A2CB-6614F91FF310}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{6886AE2F-C3B0-4EAC-B9D9-78ED8CF314EE}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{6B15977B-73D3-4063-A46C-1AF3C47B5653}" = lport=6004 | protocol=17 | dir=in | app=d:\programme\microsoft office\office12\outlook.exe |
"{74FF7201-FA07-4C18-A5C4-87CC4C1EE689}" = lport=10243 | protocol=6 | dir=in | app=system |
"{77431649-43C3-4F98-9AC6-D695D8226A80}" = rport=10243 | protocol=6 | dir=out | app=system |
"{78F06AC8-06FC-4048-868F-24037BE6BD73}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{7BB96959-6746-4BF3-96A3-D18A64D81F0B}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{857A2DB8-3106-42FF-B15B-77A0C3EB0A2D}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{8F431EC4-7011-4C0C-B714-BDF81538A796}" = rport=25565 | protocol=6 | dir=out | name=tcp 25565 |
"{A06D7DD6-593B-4E77-BDB1-B4672B0768C3}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{A5E152E1-AA2D-402D-B60F-9FE11CEC0C11}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{A9DFEA34-35CB-4093-A081-15FFB425892C}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{AAA8F1D8-7F06-410A-8898-3446EB827C68}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=%systemroot%\microsoft.net\framework64\v3.0\windows communication foundation\smsvchost.exe |
"{AF560F43-DA77-4C76-8F2F-5DC06794EF6B}" = lport=56406 | protocol=6 | dir=in | name=pando media booster |
"{BEE8FAD8-E981-4A5F-ACCB-FC25CA2BB322}" = lport=445 | protocol=6 | dir=in | app=system |
"{D4A4AD24-E93A-4A7F-8BF4-A000252D4252}" = lport=56406 | protocol=17 | dir=in | name=pando media booster |
"{D833835F-EF23-4C01-973B-D8B1F0CC9C8D}" = lport=139 | protocol=6 | dir=in | app=system |
"{E5D6481D-9499-44FB-9CA7-05EF8D6BFCFC}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{E72DC097-A4B2-4A5D-8A53-FB7B15BE83F0}" = rport=139 | protocol=6 | dir=out | app=system |
"{ECCBCF7F-0229-4C71-843D-C1EC918EA5E3}" = rport=138 | protocol=17 | dir=out | app=system |
"{EE3D1011-B499-4C13-9AA1-0C92A5E588B9}" = lport=2869 | protocol=6 | dir=in | app=system |
"{F5B4A3DB-C610-4892-8D0F-CC0531C4DC9B}" = rport=445 | protocol=6 | dir=out | app=system |
"{F7712D9A-C937-4CB9-85CA-6807BDA44E27}" = lport=25565 | protocol=6 | dir=in | name=tcp 25565 |
"{F8C72413-CFDF-47A0-830E-D61FC759BA73}" = lport=56406 | protocol=17 | dir=in | name=pando media booster |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0541A680-5679-46CD-9F05-6EA5C9FA9211}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{128ED864-5D52-4993-98FF-E984F9D0EB31}" = protocol=6 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\arma 2 operation arrowhead\besetup\setup_battleyearma2oa.exe |
"{1B194C32-114B-4802-8788-32055BB3F9D3}" = protocol=17 | dir=in | app=d:\programme\utorrent\utorrent.exe |
"{1C7E83FF-1339-4FA9-A982-0A222EA37C40}" = protocol=6 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\arma 2 operation arrowhead\arma2oa.exe |
"{1E7C91EC-F2AC-4223-A755-F5964A2BF6CE}" = protocol=6 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\counter-strike global offensive\csgo.exe |
"{232639FF-C8A5-49FB-A940-95D59001CD60}" = dir=in | app=d:\programme\itunes\itunes.exe |
"{292F9C47-D5FC-4755-8FD7-39E508D03779}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{2E2FABB2-E15E-4B55-9EED-5FD49CBEBAFC}" = protocol=6 | dir=in | app=c:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001c_366d3edf94a00510\launcher.exe |
"{32D13DF9-16A0-4292-974D-CFF0B645CA1E}" = protocol=6 | dir=in | app=%appdata%\.minecraft\minecraft.exe |
"{38096B87-6A24-4179-B6D2-3397947EFC13}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{3972BAE7-4924-4B2E-AC3F-F94C2E3A0E47}" = dir=out | app=d:\programme\bandicam\bdcam.exe |
"{3C18229F-BE22-4322-A59F-0DACFE1A71A7}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{3C9FE258-4B52-4DE5-B9AC-F908F7C5F393}" = protocol=6 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\arma 2 operation arrowhead\_runa2co.cmd |
"{3CA6BBF9-8ACC-482E-831A-0DFA9DB3E80B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{3F85FBED-9575-4DA9-8F9D-7800EDE7259A}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{409C291A-451E-4E66-9EB5-AFBDC0B6B8DD}" = protocol=17 | dir=in | app=d:\programme\utorrent\utorrent.exe |
"{42E35E42-03F2-4617-8CD0-0B474FC58F05}" = protocol=17 | dir=in | app=d:\programme\opera\opera.exe |
"{45795116-8D63-43E1-BEB7-33261B6AE7BA}" = protocol=17 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\arma 2 operation arrowhead\arma2oa.exe |
"{45E2B776-DFE4-44EA-8DBF-638AA0403219}" = protocol=6 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.0\sonarhost.exe |
"{4600DB1D-4F72-4090-92C9-ABC11508C64E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{48AB5A0D-9B8C-49B0-AFDE-34306B020C06}" = protocol=6 | dir=in | app=d:\programme\mirc\mirc.exe |
"{4B1F2338-EA1A-4A3D-9EA0-A7F3D2976CBE}" = protocol=6 | dir=in | app=d:\programme\six updater\tools\bin\rsync.exe |
"{4D4A6D8C-4906-4CB7-A9E5-F55192EF1301}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{4E2CF5B4-AF4D-400C-921D-5EF72BE3288B}" = protocol=6 | dir=in | app=d:\spiele\ghost recon online\pdc-live\ghostrecononline.exe |
"{4F2C1B34-CB8F-4E14-8F47-F2A5190EE24E}" = dir=in | app=d:\programme\skype\phone\skype.exe |
"{50C9B3BD-6D71-4DC5-A8ED-46CC57FF85CC}" = protocol=6 | dir=in | app=d:\programme\utorrent\utorrent.exe |
"{51F73730-BAE1-4BD2-B9B8-F59D3B7E3239}" = protocol=6 | dir=in | app=c:\users\meric\appdata\roaming\spotify\spotify.exe |
"{523F97E7-CFF7-4639-A187-A475F58E9839}" = protocol=17 | dir=in | app=c:\users\meric\appdata\roaming\spotify\spotify.exe |
"{54C08B16-255F-4494-AD20-2181E309FEA5}" = protocol=17 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe |
"{59AB37DC-D664-48D1-BD84-492322DFC932}" = protocol=6 | dir=in | app=d:\programme\utorrent\utorrent.exe |
"{60151BC5-6C29-4B16-807B-FDE600F9652C}" = protocol=6 | dir=in | app=d:\spiele\hawken\installedhawkenfiles\binaries\win32\hawkengame-win32-shipping.exe |
"{6043A5D8-D09E-4D70-B126-394026DD94D9}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{60BBE5AC-84C7-45D4-B7D9-8CA73AE4BF6D}" = protocol=17 | dir=in | app=d:\programme\six updater\tools\bin\rsync.exe |
"{63EEFB3D-47AD-44B8-846E-247C49834C1A}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{663BD697-6B65-4A4E-A4CF-3AD3BD05C3F4}" = protocol=6 | dir=out | app=system |
"{67228BA5-5C05-46B5-B203-608AA6689771}" = protocol=17 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\counter-strike global offensive\csgo.exe |
"{689556B1-0C8D-40D3-82DC-C663F5CFE5EF}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{6A9F9CA3-E1FD-42F3-8C59-B9D4FDF0EB90}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{6BAF1994-7340-42AE-BCB6-E6711EB7119E}" = protocol=6 | dir=in | app=d:\programme\adobe\adobe dreamweaver cs5\dreamweaver.exe |
"{6D4065DD-76BC-49AC-B248-95E2277599D7}" = protocol=6 | dir=in | app=d:\spiele\half-life 2\steam\steam.exe |
"{6EDABEEC-B0C3-46B0-928D-6ADFEE1034B7}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe |
"{6F34A2F6-228B-43C8-9380-7F7A6F4380CE}" = protocol=17 | dir=in | app=d:\programme\videolan\vlc\vlc.exe |
"{70DF4D72-5879-4E19-BD2B-B4330FCC4971}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe |
"{721E2DD3-3951-47BE-B89B-4D9DD49D9B77}" = protocol=6 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe |
"{74B6C7ED-AEEC-402C-A6D6-1624F1521DFC}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{759636B5-F6B9-4AC3-9EFD-76BEFB0E08C2}" = protocol=6 | dir=in | app=d:\programme\mirc nn\mirc.exe |
"{80DA9889-85BE-4011-9306-50E796B75DAF}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{810B4719-9B73-4808-A668-875786030376}" = protocol=17 | dir=in | app=d:\programme\mirc\mirc.exe |
"{84C5E22B-0BCF-49EB-AF47-F54A53DC60CE}" = protocol=17 | dir=in | app=d:\spiele\ghost recon online\pdc-live\ghostrecononline.exe |
"{85573977-50B5-45E6-B256-724E3EE2763C}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{868939A6-920F-4F50-BC63-7C54FCA98051}" = protocol=17 | dir=in | app=d:\spiele\planetside 2\planetside2.exe |
"{873A0F0D-E456-4FFF-A4C7-8513376B6F22}" = protocol=17 | dir=in | app=c:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001b_817f604b896cb110\launcher.exe |
"{87BAEDE9-AE7B-43F3-8658-B7800C5EACB7}" = protocol=6 | dir=in | app=c:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001b_817f604b896cb110\launcher.exe |
"{88E1BCFE-9C27-4151-8481-30A791988AA4}" = protocol=6 | dir=in | app=d:\programme\sabnzbd\sabnzbd.exe |
"{90D1D022-5467-4478-AA78-5EF0B9672A5B}" = protocol=17 | dir=in | app=d:\spiele\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe |
"{92325F97-578F-4276-A205-CF98AFF17283}" = protocol=17 | dir=in | app=d:\programme\opera\opera.exe |
"{966637B1-0925-4932-A5FF-4749B3DD82C9}" = protocol=17 | dir=in | app=d:\spiele\hawken\installedhawkenfiles\binaries\win32\hawkengame-win32-shipping.exe |
"{968E650E-E618-4143-A122-62CE5A24E800}" = protocol=17 | dir=in | app=d:\programme\sabnzbd\sabnzbd.exe |
"{97A1D593-C13D-4C9E-B2D7-3ED85EB0228B}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{9AAF83B3-8C5A-48B3-92BB-034D3C219BCE}" = protocol=17 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\arma 2 operation arrowhead\_runa2co.cmd |
"{9E41013B-8475-4B4F-8671-1AA42E30F40C}" = protocol=6 | dir=in | app=d:\spiele\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe |
"{A2933AA3-FDD8-4B43-B6BC-FC22EDCB22E0}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{A3F03CE0-BDB8-405C-A52C-2A30108FE2B3}" = protocol=58 | dir=out | name=@iphlpsvc.dll,-503 |
"{A6B38796-C8FA-4626-BD35-4ABBD9400A42}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{AB43B80F-3416-49FB-8350-6BD74E824EAC}" = protocol=6 | dir=in | app=d:\spiele\half-life 2\steam\steam.exe |
"{B655970A-F4C8-47F0-8756-72E951D1D9C6}" = protocol=6 | dir=in | app=c:\users\meric\appdata\local\google\google talk plugin\googletalkplugin.exe |
"{BA2E2033-4E6E-42A4-A439-577820857BB8}" = protocol=17 | dir=in | app=d:\spiele\half-life 2\steam\steam.exe |
"{BE852182-C99E-440B-A72D-CF65A1689D5D}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{BF6923CA-DCA3-40A5-B25E-256E9A35530A}" = protocol=6 | dir=in | app=d:\programme\opera\opera.exe |
"{C07BC1CB-8676-44E2-BBB2-5EC5AE384D73}" = protocol=6 | dir=in | app=d:\programme\videolan\vlc\vlc.exe |
"{C2163DA1-099D-4523-9141-448007248F05}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{C7D0B286-8586-431B-B699-8FFA8A9E4AD9}" = protocol=17 | dir=in | app=c:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001c_366d3edf94a00510\launcher.exe |
"{C8A68D35-64B2-42D9-BFDB-2D62766469AF}" = protocol=6 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe |
"{C9817132-B0FC-481A-9FAE-0F2D8475005E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{CD583279-8BED-4288-9755-52497C9ABB3D}" = protocol=6 | dir=in | app=c:\windows\syswow64\muzapp.exe |
"{CD83B2F5-E38A-4280-9D1B-8AA6F08D9224}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{CFB7A880-EB69-4091-AE83-4069766BED99}" = protocol=17 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe |
"{D074A86B-5CAB-4FB3-BBD1-30640CCAE9DE}" = protocol=6 | dir=in | app=d:\spiele\planetside 2\planetside2.exe |
"{D21A157A-4323-4ADF-B35A-523BDE243D34}" = protocol=17 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.0\sonarhost.exe |
"{D40B643E-17DB-4E0D-99CB-FF214CD82A30}" = protocol=6 | dir=in | app=d:\programme\opera\opera.exe |
"{D5249B07-BF7F-4C25-987B-9577F8A65085}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{D725C448-EC9C-424D-AB9E-9763F6BDDA75}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{DD4462C1-30AA-4B9E-A156-1B64AABC1FD8}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{DD6CA922-7A81-432B-AB49-A746F3E42ADD}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{E08287D2-0208-4270-B4C7-BE0035AE5F35}" = protocol=17 | dir=in | app=c:\users\meric\appdata\local\google\google talk plugin\googletalkplugin.exe |
"{E3195CC5-E600-46DC-8C42-93F557154CC1}" = protocol=6 | dir=out | app=%appdata%\.minecraft\minecraft.exe |
"{E7AA2864-DB9A-484D-B1BF-9F8B7C36FDED}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{E996E945-C9A1-4EDD-8702-191D3025ACCC}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{EB43F44C-93D2-4A17-8048-2C1E58A36AAE}" = protocol=58 | dir=in | app=system |
"{ECB965A3-C8AA-4572-B7C9-DA3961F97718}" = protocol=17 | dir=in | app=d:\spiele\half-life 2\steam\steam.exe |
"{EF0B9A79-29A9-4E78-9E9C-970C2E459999}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{EFC8C6B2-EE97-4FBF-9F50-5E616F438881}" = protocol=6 | dir=in | app=c:\wamp\bin\apache\apache2.2.21\bin\httpd.exe |
"{EFCF9BE1-C770-4CC1-B092-E7C10CC64B5B}" = protocol=17 | dir=in | app=c:\wamp\bin\apache\apache2.2.21\bin\httpd.exe |
"{F14194A5-E314-4F85-B8C9-691D73A99E07}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{F41A5B11-2863-4CD7-95DA-21DE69D7702C}" = protocol=17 | dir=in | app=d:\programme\adobe\adobe dreamweaver cs5\dreamweaver.exe |
"{FAABDCD7-9C65-4EE8-849B-46E69CD4DC8A}" = protocol=17 | dir=in | app=d:\programme\mirc nn\mirc.exe |
"{FACCC685-62E7-46BF-ABD8-A18B2D8AEEDB}" = dir=out | app=d:\spiele\half-life 2\steam\steamapps\common\arma 2 operation arrowhead\arma2oa.exe |
"{FB348F75-F419-4743-8F5B-A30D546832DC}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{FD5093E3-1AD9-40BA-B5BF-B8E4C29F48A3}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{FD559FD5-3238-44B0-AF56-FCC1D58A882E}" = protocol=17 | dir=in | app=d:\spiele\half-life 2\steam\steamapps\common\arma 2 operation arrowhead\besetup\setup_battleyearma2oa.exe |
"{FD779045-5162-4D23-A2C4-8F219AC0FD88}" = protocol=17 | dir=in | app=c:\windows\syswow64\muzapp.exe |
"TCP Query User{00228D16-0FC3-4B3D-A5FD-13929B8C6324}D:\spiele\quake3arena\quake3.exe" = protocol=6 | dir=in | app=d:\spiele\quake3arena\quake3.exe |
"TCP Query User{00686F92-1199-49DF-AE15-941DF384A383}D:\spiele\audiosurf\engine\questviewer.exe" = protocol=6 | dir=in | app=d:\spiele\audiosurf\engine\questviewer.exe |
"TCP Query User{093C9511-899C-4C5C-A8FF-918747DC4839}C:\program files (x86)\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files (x86)\google\google earth\client\googleearth.exe |
"TCP Query User{0DF8A9B3-A9E7-4965-8AC1-B6A974438310}D:\spiele\hawken\installedhawkenfiles\binaries\win32\hawkengame-win32-shipping.exe" = protocol=6 | dir=in | app=d:\spiele\hawken\installedhawkenfiles\binaries\win32\hawkengame-win32-shipping.exe |
"TCP Query User{1FBF7D4A-4082-4DC0-8D17-4791D6A59DA9}D:\programme\six updater\tools\bin\rsync.exe" = protocol=6 | dir=in | app=d:\programme\six updater\tools\bin\rsync.exe |
"TCP Query User{25540708-4B09-4A79-AF1C-8C7371471CEA}C:\users\meric\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\meric\appdata\roaming\spotify\spotify.exe |
"TCP Query User{25EF3598-AA5B-4CC1-ACF0-6A5B8BDBB654}C:\wamp\bin\apache\apache2.2.21\bin\httpd.exe" = protocol=6 | dir=in | app=c:\wamp\bin\apache\apache2.2.21\bin\httpd.exe |
"TCP Query User{2A3C6D7E-B4AA-4B8F-8DCC-8C74EAAAD168}D:\programme\mirc\mirc.exe" = protocol=6 | dir=in | app=d:\programme\mirc\mirc.exe |
"TCP Query User{4955611A-E2C2-43DD-9277-92C6605C2A16}C:\program files (x86)\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files (x86)\google\google earth\plugin\geplugin.exe |
"TCP Query User{4F656317-8C2F-4634-ACB3-00CF5150DAFA}C:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001b_817f604b896cb110\launcher.exe" = protocol=6 | dir=in | app=c:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001b_817f604b896cb110\launcher.exe |
"TCP Query User{5B2AD425-4187-4D3A-B8C5-23E9773BBE63}D:\spiele\planetside 2\planetside2.exe" = protocol=6 | dir=in | app=d:\spiele\planetside 2\planetside2.exe |
"TCP Query User{6598E2D4-0561-4078-9CE8-262EDEB08865}D:\spiele\battlefield 2142 server\bf2142_w32ded.exe" = protocol=6 | dir=in | app=d:\spiele\battlefield 2142 server\bf2142_w32ded.exe |
"TCP Query User{71B20AAD-CFDD-4056-9DB3-431DC842585F}D:\programme\miranda im\miranda32.exe" = protocol=6 | dir=in | app=d:\programme\miranda im\miranda32.exe |
"TCP Query User{89F40BAE-FFFC-4610-B119-1F84E9695BB6}D:\programme\winamp\winamp.exe" = protocol=6 | dir=in | app=d:\programme\winamp\winamp.exe |
"TCP Query User{8D330ABB-CBB8-4576-928A-1883FEA113CA}C:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001c_366d3edf94a00510\launcher.exe" = protocol=6 | dir=in | app=c:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001c_366d3edf94a00510\launcher.exe |
"TCP Query User{99FA4863-BA1E-4C46-9BAD-B8D84FC2CAEC}D:\spiele\ghost recon online\pdc-live\ghostrecononline.exe" = protocol=6 | dir=in | app=d:\spiele\ghost recon online\pdc-live\ghostrecononline.exe |
"TCP Query User{AE648ADB-4A3D-433C-95A6-84D8E3A6BDEC}D:\programme\miranda im\miranda32.exe" = protocol=6 | dir=in | app=d:\programme\miranda im\miranda32.exe |
"TCP Query User{C0FDAA2B-F7ED-4FA6-9BE5-239E0FE27DA7}D:\programme\mirc nn\mirc.exe" = protocol=6 | dir=in | app=d:\programme\mirc nn\mirc.exe |
"TCP Query User{C70DCF43-6A94-409B-865F-636101A2D428}D:\spiele\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe" = protocol=6 | dir=in | app=d:\spiele\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe |
"TCP Query User{C8B71324-13F8-41F8-AA89-1BEBB8D5084F}D:\programme\sabnzbd\sabnzbd.exe" = protocol=6 | dir=in | app=d:\programme\sabnzbd\sabnzbd.exe |
"TCP Query User{D094878D-0AA1-4CF6-9BA8-9ECB5084A5D1}D:\xampp\mysql\bin\mysqld.exe" = protocol=6 | dir=in | app=d:\xampp\mysql\bin\mysqld.exe |
"TCP Query User{D83A90D7-77CE-43FC-A4D4-C4AF8331D490}D:\xampp\apache\bin\httpd.exe" = protocol=6 | dir=in | app=d:\xampp\apache\bin\httpd.exe |
"TCP Query User{DD2A90FC-BA86-43B5-8AE9-426847F5A0A1}D:\spiele\battlefield 2142\bf2143.exe" = protocol=6 | dir=in | app=d:\spiele\battlefield 2142\bf2143.exe |
"TCP Query User{E6FBA2E8-F0F4-4FAC-9DAE-3B72B69E6DE2}D:\programme\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=d:\programme\videolan\vlc\vlc.exe |
"TCP Query User{ED739BF7-0345-4747-B859-EC2BA4F686CE}D:\programme\mozilla firefox 4\plugin-container.exe" = protocol=6 | dir=in | app=d:\programme\mozilla firefox 4\plugin-container.exe |
"TCP Query User{F7B90FAB-B8E8-46E5-92CA-D2DC939139A7}D:\programme\adobe\adobe dreamweaver cs5\dreamweaver.exe" = protocol=6 | dir=in | app=d:\programme\adobe\adobe dreamweaver cs5\dreamweaver.exe |
"UDP Query User{0712ABA5-2844-4017-B8E5-9F27E83BFC0E}D:\programme\mozilla firefox 4\plugin-container.exe" = protocol=17 | dir=in | app=d:\programme\mozilla firefox 4\plugin-container.exe |
"UDP Query User{073FB327-3CFC-4817-AE0F-E8DAF16BEF19}D:\programme\sabnzbd\sabnzbd.exe" = protocol=17 | dir=in | app=d:\programme\sabnzbd\sabnzbd.exe |
"UDP Query User{20218A3D-BE0F-433B-9C20-94015502C497}D:\spiele\planetside 2\planetside2.exe" = protocol=17 | dir=in | app=d:\spiele\planetside 2\planetside2.exe |
"UDP Query User{3105E842-AEAC-496B-A555-3B16C6B08DE4}D:\programme\miranda im\miranda32.exe" = protocol=17 | dir=in | app=d:\programme\miranda im\miranda32.exe |
"UDP Query User{3FE8DDEB-156E-491F-8EE7-9013CED354CB}D:\xampp\mysql\bin\mysqld.exe" = protocol=17 | dir=in | app=d:\xampp\mysql\bin\mysqld.exe |
"UDP Query User{48509221-2EA6-4C62-A7A8-B6A664230C51}D:\spiele\ghost recon online\pdc-live\ghostrecononline.exe" = protocol=17 | dir=in | app=d:\spiele\ghost recon online\pdc-live\ghostrecononline.exe |
"UDP Query User{5284B253-72A1-4C01-8BA4-87ACC24AB35E}D:\spiele\quake3arena\quake3.exe" = protocol=17 | dir=in | app=d:\spiele\quake3arena\quake3.exe |
"UDP Query User{6E389CBB-DE9B-4CC4-AB27-F289383B982F}D:\programme\miranda im\miranda32.exe" = protocol=17 | dir=in | app=d:\programme\miranda im\miranda32.exe |
"UDP Query User{78EED378-0881-4E04-8BE3-83DC037FAF27}D:\spiele\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe" = protocol=17 | dir=in | app=d:\spiele\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe |
"UDP Query User{87E6F8C8-EF2C-422D-8EFF-D36B206074D5}C:\wamp\bin\apache\apache2.2.21\bin\httpd.exe" = protocol=17 | dir=in | app=c:\wamp\bin\apache\apache2.2.21\bin\httpd.exe |
"UDP Query User{903370A3-1F24-4559-99B0-C33B4577DF57}D:\spiele\battlefield 2142 server\bf2142_w32ded.exe" = protocol=17 | dir=in | app=d:\spiele\battlefield 2142 server\bf2142_w32ded.exe |
"UDP Query User{93E04D91-B7CC-45F7-86A2-16B8E4B7FC29}D:\spiele\audiosurf\engine\questviewer.exe" = protocol=17 | dir=in | app=d:\spiele\audiosurf\engine\questviewer.exe |
"UDP Query User{97F03256-44CC-47C8-8F40-48119749BA67}C:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001b_817f604b896cb110\launcher.exe" = protocol=17 | dir=in | app=c:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001b_817f604b896cb110\launcher.exe |
"UDP Query User{9886DE5C-F99C-4228-83D0-0DDF9331F4A6}C:\program files (x86)\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files (x86)\google\google earth\plugin\geplugin.exe |
"UDP Query User{B5685612-6619-464A-8C3F-A410ED878C9D}D:\spiele\battlefield 2142\bf2143.exe" = protocol=17 | dir=in | app=d:\spiele\battlefield 2142\bf2143.exe |
"UDP Query User{C32B6DAE-356E-4556-A75C-04B89AAF6123}D:\programme\winamp\winamp.exe" = protocol=17 | dir=in | app=d:\programme\winamp\winamp.exe |
"UDP Query User{CF8B775D-4171-49A0-A3CD-9E361AD1C5BA}C:\users\meric\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\meric\appdata\roaming\spotify\spotify.exe |
"UDP Query User{CFF0D63B-9B01-4FC4-B1F8-FC5B08111ECF}C:\program files (x86)\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files (x86)\google\google earth\client\googleearth.exe |
"UDP Query User{D30CB98B-7313-4281-A3CA-F895EA70FEDE}D:\programme\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=d:\programme\videolan\vlc\vlc.exe |
"UDP Query User{D6B4EAC1-74C7-4C49-A902-AF07210DBECB}D:\programme\mirc nn\mirc.exe" = protocol=17 | dir=in | app=d:\programme\mirc nn\mirc.exe |
"UDP Query User{D7D32004-D441-4877-9A42-AEDFFA95B4F7}D:\programme\adobe\adobe dreamweaver cs5\dreamweaver.exe" = protocol=17 | dir=in | app=d:\programme\adobe\adobe dreamweaver cs5\dreamweaver.exe |
"UDP Query User{DD17E047-308C-4CF4-AEB7-917D3D4B6B69}D:\programme\mirc\mirc.exe" = protocol=17 | dir=in | app=d:\programme\mirc\mirc.exe |
"UDP Query User{E53D7B6A-FFED-445F-800D-07E60C3683B9}D:\programme\six updater\tools\bin\rsync.exe" = protocol=17 | dir=in | app=d:\programme\six updater\tools\bin\rsync.exe |
"UDP Query User{EBB0E080-84A0-40E1-AD59-4841030ABEEE}D:\xampp\apache\bin\httpd.exe" = protocol=17 | dir=in | app=d:\xampp\apache\bin\httpd.exe |
"UDP Query User{F476BB7A-69FB-4746-8C12-3256CE4EAC8C}D:\spiele\hawken\installedhawkenfiles\binaries\win32\hawkengame-win32-shipping.exe" = protocol=17 | dir=in | app=d:\spiele\hawken\installedhawkenfiles\binaries\win32\hawkengame-win32-shipping.exe |
"UDP Query User{FA90199D-D869-4F86-957E-1F289B22F728}C:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001c_366d3edf94a00510\launcher.exe" = protocol=17 | dir=in | app=c:\users\meric\appdata\local\apps\2.0\roy0gooy.x90\dyt9qc29.m3n\laun...app_59711684aa47878d_0001.001c_366d3edf94a00510\launcher.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{06B60360-9DBD-4593-90A0-FD237F0845A2}" = Topaz DeNoise 5 (64-bit)
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP620_series" = Canon MP620 series MP Drivers
"{1374CC63-B520-4f3f-98E8-E9020BF01CFF}" = Windows XP Mode
"{1CDE9DB9-7D47-46F8-83DC-9DD9899BBBFC}" = Topaz ReMask 3 (64-bit)
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)
"{26A24AE4-039D-4CA4-87B4-2F86417007FF}" = Java 7 Update 7 (64-bit)
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{4D668D4F-FAA2-4726-834C-31F4614F312E}" = MSVC80_x64_v2
"{537056B7-32A4-4408-9B54-0341963C7C9C}" = UltraMon
"{574CFBE2-E50C-A112-EA65-BA5AE7C3AB2C}" = AMD Catalyst Install Manager
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1" = Revo Uninstaller Pro 2.5.7
"{68660049-8D48-427C-9FF7-139D8340CDC0}" = MSVC80_x64
"{690285C2-2481-44FB-8402-162EA970A6DD}" = Logitech Gaming Software
"{77B8B4A5-EE79-4907-A318-2DA86325B8D7}" = iTunes
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8D93BD99-EECF-4812-B3BA-B8A2E7FEEA11}" = Topaz Simplify 3 (64-bit)
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{A981E64B-0F10-45D9-BD5C-A4DF7B87E218}" = Topaz Detail 2 (64-bit)
"{AB071C8B-873C-459F-ACA9-9EBE03C3E89B}" = MSVC90_x64
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.0213
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{BA3D5FF2-A405-4654-826E-A09FABB01853}" = Topaz Fusion Express 2 (64-bit)
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D0CE053E-0E5E-4C12-9BAE-D0F36021E911}" = POV-Ray for Windows v3.62
"{DC8F0C18-E6B0-4722-A4AB-D134473091C2}" = Topaz DeJpeg 4 (64-bit)
"{E44D14E2-A6D0-4F38-BF06-2E4244E23FED}" = Topaz InFocus (64-bit)
"{E5C95CA5-4565-4B9D-97ED-05088D775614}" = Apple Mobile Device Support
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FA85C599-2569-4C48-9AA6-2B8D8F029FA7}" = Topaz Clean 3 (64-bit)
"{FB237A35-F491-4AC1-95E0-85118D6751D9}" = Topaz Adjust 4 (64-bit)
"{FF0EBE64-45AA-4B16-A0CC-945CECDCA0B6}" = Topaz Lens Effects (64-bit)
"49CF605F02C7954F4E139D18828DE298CD59217C" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (06/03/2009 2.3.0.0)
"CCleaner" = CCleaner
"FCEC33AD40CEA5E0FC4CEE6E42041A0DA189652D" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"Logitech Gaming Software" = Logitech Gaming Software 8.20
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"sp6" = Logitech SetPoint 6.32
"Virtual Audio Cable 4.10" = Virtual Audio Cable 4.10
"WinRAR archiver" = WinRAR
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{024521CF-C07E-4F8E-8481-0D75695E03AF}" = PxMergeModule
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{0659E943-DDF4-44FC-9FEE-A13B09F8BB08}" = Adobe Flash Media Live Encoder 3.2
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0EDBEB2B-7C8D-42E6-8312-0F84394A3223}" = Windows Media Center Add-in for Silverlight
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{10ABE49D-343A-463E-9753-C4C5A05ECEF9}" = Sibelius Scorch (Firefox, Opera, Netscape only)
"{15C49338-59E5-472E-94F7-D5AE15EE23C9}" = XSplit
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{19B9DAD6-5E6E-4B80-8EFE-314B5638D6D4}" = Xara 3D Maker 7
"{1BBD8D70-721A-41AD-AC8F-7308A0C8FA92}" = Adobe Creative Suite 5 Master Collection
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20288888-A7AF-4B24-8AEB-398D20CD563C}" = Sound Blaster X-Fi
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}" = OpenOffice.org 3.4.1
"{266D79A6-3857-8A1F-3200-325F318208B4}" = Boks
"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 7
"{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}" = Microsoft XNA Framework Redistributable 4.0
"{2D8CED57-CCDB-4D86-9087-3BBCAE8F8F22}" = Six Updater
"{2FA75B40-17C9-4D22-88CA-80A5D52FAB13}" = LightScribe System Software
"{34610DE0-3C13-42CA-8E32-01FFA38AB6E8}" = PC Connectivity Solution
"{37EF63D9-3E31-45A9-A90F-BDE07CE88095}" = Sibelius Scorch (all browsers)
"{38EE230F-F631-451F-8800-E29F5E5C9E7D}" = iTunes Library Updater
"{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF010}" = Tribes Ascend
"{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}" = Hi-Rez Studios Authenticate and Update Service
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{4ECA4128-8B48-44A0-90E8-B93C6A69CE4B}" = LightScribe Template Designs - Music Pack 1
"{510D2239-6C2E-457B-9590-485EC552D94D}" = Garmin USB Drivers
"{5809E7CF-4DCF-11D4-9875-00105ACE7734}" = Logitech MouseWare 9.79.1
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5A67D2EA-FB70-4033-A6F3-606AD85B2015}_is1" = Driver Sweeper Version 3.2.0
"{5BDA2F58-1F21-4D10-9910-92B01EBCC958}" = AMD USB Filter Driver
"{5BDEA9E0-E55B-45A7-93F7-6B8F68F851E5}" = Topaz InFocus
"{5E1375CB-6792-4464-8715-CC3EC83D48FA}" = VirtualDJ Home FREE
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{61F25370-7465-4404-BE28-4629BF808699}" = LightScribe Applications
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6A3F9D74-BB80-4451-8CA1-4B3A857F1359}" = Apple Application Support
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6E07CF4B-A9EB-45BF-BE74-613B3D708E13}" = Topaz Lens Effects
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{73E80655-FB3C-46F4-BE00-62D248BC490A}" = Visual C++ 2008 Runtime (x64)
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{770D3BDC-19D7-49D0-B60B-C5BB77553FBB}" = Topaz Fusion Express 2
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7E84FAC8-C518-40F9-9807-7455301D6D25}" = SamsungConnectivityCableDriver
"{8117EA22-035F-4880-86AE-AC7C4F1FA3E2}" = Topaz ReMask 3
"{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}" = Microsoft Games for Windows - LIVE Redistributable
"{83721450-E604-4C37-ABEB-CE7F18C587C8}" = LightScribe Template Labeler
"{85E00941-FDFF-4796-A3B8-3ACC766FFCA5}" = Topaz Clean 3
"{86CE1746-9EFF-3C9C-8755-81EA8903AC34}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{8A1EBF29-7CF8-471E-B90B-95FF36AC8248}" = Topaz Simplify 3
"{8BCD7AE7-F713-4D50-BAB9-7839B9386870}" = ImageShack Uploader 2.2.0
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0407-1000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{959FA9FB-ACFF-4C38-967E-5CB5DB3130AC}" = DayZ Commander
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D318C86-AF4C-409F-A6AC-7183FF4CF424}" = Internet-TV für Windows Media Center
"{9E146BA1-26DD-4C3B-9F0F-90F2E3CEC9D2}" = Topaz DeJpeg 4
"{9E82D1DB-3AFB-4D18-A221-081F1B4B4789}" = Topaz DeNoise 5
"{9FDC7042-CB9F-4336-A14C-DF10F53762E2}" = Topaz Adjust 4
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB6F6C80-1C35-4672-BDEF-F26FF214C409}" = Samsung PC Studio 7
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{AFBAB9A0-DDE8-49AE-8C17-A01B61BEE64B}" = Garmin MapSource
"{B1EE1CC5-6CED-4801-BFFF-8454F21A245A}" = Garmin Communicator Plugin
"{B8ABD8C7-991E-4A70-B5A3-20C6FC680680}" = LogMeIn Hamachi
"{C5AC39F1-001D-4338-84C6-35109525588A}" = TweetDeck
"{C921D7C4-24D7-4210-AEE9-DFC5DDC78428}" = Topaz Detail 2
"{C9E14402-3631-4182-B377-6B0DFB1C0339}" = QuickTime
"{CC23FF9A-989C-4DEB-8970-50E6E4862315}" = EOSInfo
"{CCF13D13-A87B-34E8-B689-1896D0C2DBA2}" = Google Talk Plugin
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D801B39E-CE01-409F-8E7C-B7976EA3C9DC}_is1" = Audiosurf
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DA909E62-3B45-4BA1-8B58-FCAEBA4BCEC9}" = NVIDIA PhysX
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR
"ABC Amber Nokia Converter" = ABC Amber Nokia Converter
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"ArmA 2" = ArmA 2 Uninstall
"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.14 (Unicode)
"Audacity_is1" = Audacity 2.0
"AudioCS" = Creative Audio-Systemsteuerung
"AutoHotkey" = AutoHotkey 1.0.48.05
"avast" = avast! Free Antivirus
"AVI Joiner_is1" = AVI Joiner
"bada SDK 2.0.5" = bada SDK 2.0.5
"Bandicam" = Bandicam
"BandiMPEG1" = Bandisoft MPEG-1 Decoder
"Battlelog Web Plugins" = Battlelog Web Plugins
"BattlEye for OA" = BattlEye for OA Uninstall
"Biet-O-Matic v2.14.8" = Biet-O-Matic v2.14.8
"Canon_IJ_Network_Scan_UTILITY" = Canon IJ Network Scan Utility
"Canon_IJ_Network_UTILITY" = Canon IJ Network Tool
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"Creative Software AutoUpdate" = Creative Software AutoUpdate
"Creative Sound Blaster Properties x64 Edition" = Creative Sound Blaster Properties x64 Edition
"DivX Setup" = DivX-Setup
"DTS Connect Pack" = DTS Connect Pack
"DynUpdater" = Dyn Updater
"ENTERPRISE" = Microsoft Office Enterprise 2007
"ESET Online Scanner" = ESET Online Scanner v3
"ESN Sonar-0.70.0" = ESN Sonar
"FastStone Image Viewer" = FastStone Image Viewer 4.3
"Fraps" = Fraps (remove only)
"FWTools247" = FWTools 2.4.7
"GeoSetter_is1" = GeoSetter 3.4.16
"Glary Utilities_is1" = Glary Utilities 2.38.0.1288
"GPS-Track-Analyse.NET 6.0_is1" = GPS-Track-Analyse.NET 6.0
"GrabIt_is1" = GrabIt 1.7.2 Beta 6 (build 1008)
"GSAK_is1" = GSAK 8.1.0.10 (Final)
"ImgBurn" = ImgBurn
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"JDownloader" = JDownloader
"LAME for Audacity_is1" = LAME v3.98.3 for Audacity
"LogMeIn Hamachi" = LogMeIn Hamachi
"MAGIX_MSI_Xara3D7" = Xara 3D Maker 7
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.0.1400
"Miranda IM" = Miranda IM 0.10.4
"mIRC" = mIRC
"Mozilla Firefox 6.0 (x86 de)" = Mozilla Firefox 6.0 (x86 de)
"MP Navigator EX 2.0" = Canon MP Navigator EX 2.0
"Mp3tag" = Mp3tag v2.48
"NAVIGON Fresh" = NAVIGON Fresh 3.4.1
"net.tw.Boks.7C34F9BA9FAD6689FAABBE85F1F5B46BA5A32DE5.1" = Boks
"Notepad++" = Notepad++
"OpenAL" = OpenAL
"Opera 12.02.1578" = Opera 12.02
"OSM" = JOSM 4399
"Picasa 3" = Picasa 3
"PunkBusterSvc" = PunkBuster Services
"RADVideo" = RAD Video Tools
"SABnzbd" = SABnzbd 0.7.3
"Samsung PC Studio 7" = Samsung PC Studio 7
"Spoiler Sync_is1" = Spoiler Sync
"Steam App 33930" = ARMA 2: Operation Arrowhead
"Steam App 730" = Counter-Strike: Global Offensive
"Time Stopper4.0" = Time Stopper
"Topaz Adjust 4" = Topaz Adjust 4
"Topaz Adjust 4 (64-bit)" = Topaz Adjust 4 (64-bit)
"Topaz Clean 3" = Topaz Clean 3
"Topaz Clean 3 (64-bit)" = Topaz Clean 3 (64-bit)
"Topaz DeJpeg 4" = Topaz DeJpeg 4
"Topaz DeJpeg 4 (64-bit)" = Topaz DeJpeg 4 (64-bit)
"Topaz DeNoise 5" = Topaz DeNoise 5
"Topaz DeNoise 5 (64-bit)" = Topaz DeNoise 5 (64-bit)
"Topaz Detail 2" = Topaz Detail 2
"Topaz Detail 2 (64-bit)" = Topaz Detail 2 (64-bit)
"Topaz Fusion Express 2" = Topaz Fusion Express 2
"Topaz Fusion Express 2 (64-bit)" = Topaz Fusion Express 2 (64-bit)
"Topaz InFocus" = Topaz InFocus
"Topaz InFocus (64-bit)" = Topaz InFocus (64-bit)
"Topaz Lens Effects" = Topaz Lens Effects
"Topaz Lens Effects (64-bit)" = Topaz Lens Effects (64-bit)
"Topaz ReMask 3" = Topaz ReMask 3
"Topaz ReMask 3 (64-bit)" = Topaz ReMask 3 (64-bit)
"Topaz Simplify 3" = Topaz Simplify 3
"Topaz Simplify 3 (64-bit)" = Topaz Simplify 3 (64-bit)
"Totalcmd" = Total Commander (Remove or Repair)
"uTorrent" = µTorrent
"VirtualCloneDrive" = VirtualCloneDrive
"VLC media player" = VLC media player 2.0.0
"WampServer 2_is1" = WampServer 2.2
"Winamp" = Winamp
"winscp3_is1" = WinSCP 4.3.7
"WinUAE" = WinUAE 2.3.3
"Wireshark" = Wireshark 1.6.7 (64-bit)
"xampp" = XAMPP 1.7.4
"XMedia Recode" = XMedia Recode 3.0.7.0
"xp-AntiSpy" = xp-AntiSpy 3.97-11
"Xvid Video Codec 1.3.2" = Xvid Video Codec
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{87686C21-8A15-4b4d-A3F1-11141D9BE094}" = Battlefield Play4Free
"d734575cd6cff35b" = Stegano.Net
"FileZilla Client" = FileZilla Client 3.4.0
"Google Chrome" = Google Chrome
"Hawken" = Hawken
"Kies Air Discovery Service" = Kies Air Discovery Service
"Mozilla Firefox 15.0.1 (x86 de)" = Mozilla Firefox 15.0.1 (x86 de)
"QLandkarte GT" = QLandkarte GT (remove only)
"SOE-PlanetSide 2 Beta" = PlanetSide 2 Beta
"Spotify" = Spotify
"stolencamerafinder" = stolencamerafinder
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"UnityWebPlayer" = Unity Web Player
"uTorrent" = µTorrent
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 01.10.2012 15:40:53 | Computer Name = ChosenOne | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "D:\Programme\XSplit\XSplitBroadcasterSrc.exe".
Die
 abhängige Assemblierung "Native.XSplitBroadcaster.exe,type="win32",version="1.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 01.10.2012 15:43:48 | Computer Name = ChosenOne | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "D:\Programme\Samsung\Samsung
 PC Studio 7\TIS_VistaPIM.dll".  Die abhängige Assemblierung "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 01.10.2012 18:48:19 | Computer Name = ChosenOne | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "D:\Programme\XSplit\XSplitBroadcasterSrc.exe".
Die
 abhängige Assemblierung "Native.XSplitBroadcaster.exe,type="win32",version="1.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 02.10.2012 19:58:47 | Computer Name = ChosenOne | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "D:\Programme\XSplit\XSplitBroadcasterSrc.exe".
Die
 abhängige Assemblierung "Native.XSplitBroadcaster.exe,type="win32",version="1.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 04.10.2012 19:25:00 | Computer Name = ChosenOne | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "D:\Programme\XSplit\XSplitBroadcasterSrc.exe".
Die
 abhängige Assemblierung "Native.XSplitBroadcaster.exe,type="win32",version="1.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 06.10.2012 19:25:20 | Computer Name = ChosenOne | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "D:\Programme\XSplit\XSplitBroadcasterSrc.exe".
Die
 abhängige Assemblierung "Native.XSplitBroadcaster.exe,type="win32",version="1.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 07.10.2012 17:12:24 | Computer Name = ChosenOne | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: PlanetSide2.exe, Version: 0.0.0.0,
 Zeitstempel: 0x5070c049  Name des fehlerhaften Moduls: PlanetSide2.exe, Version:
0.0.0.0, Zeitstempel: 0x5070c049  Ausnahmecode: 0xc0000005  Fehleroffset: 0x012e61eb
ID
 des fehlerhaften Prozesses: 0x1824  Startzeit der fehlerhaften Anwendung: 0x01cda4ce24367f69
Pfad
 der fehlerhaften Anwendung: D:\Spiele\PlanetSide 2\PlanetSide2.exe  Pfad des fehlerhaften
 Moduls: D:\Spiele\PlanetSide 2\PlanetSide2.exe  Berichtskennung: aff5d9ed-10c3-11e2-bae0-00241ddbd724
 
Error - 08.10.2012 13:52:07 | Computer Name = ChosenOne | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "D:\Programme\XSplit\XSplitBroadcasterSrc.exe".
Die
 abhängige Assemblierung "Native.XSplitBroadcaster.exe,type="win32",version="1.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 09.10.2012 18:32:00 | Computer Name = ChosenOne | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "D:\Programme\XSplit\XSplitBroadcasterSrc.exe".
Die
 abhängige Assemblierung "Native.XSplitBroadcaster.exe,type="win32",version="1.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 10.10.2012 18:31:52 | Computer Name = ChosenOne | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "D:\Programme\XSplit\XSplitBroadcasterSrc.exe".
Die
 abhängige Assemblierung "Native.XSplitBroadcaster.exe,type="win32",version="1.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
[ Media Center Events ]
Error - 29.03.2011 12:11:19 | Computer Name = ChosenOne | Source = MCUpdate | ID = 0
Description = 18:11:19 - MCEClientUX konnte nicht abgerufen werden (Fehler: Die
Verbindung mit dem Remoteserver kann nicht hergestellt werden.) 
 
Error - 31.03.2011 17:30:53 | Computer Name = ChosenOne | Source = MCUpdate | ID = 0
Description = 23:30:53 - MCEClientUX konnte nicht abgerufen werden (Fehler: Die
Verbindung mit dem Remoteserver kann nicht hergestellt werden.) 
 
Error - 01.05.2011 06:21:56 | Computer Name = ChosenOne | Source = MCUpdate | ID = 0
Description = 12:21:56 - MCESpotlight konnte nicht abgerufen werden (Fehler: Die
 Verbindung mit dem Remoteserver kann nicht hergestellt werden.) 
 
Error - 05.05.2011 07:15:47 | Computer Name = ChosenOne | Source = MCUpdate | ID = 0
Description = 13:15:47 - MCESpotlight konnte nicht abgerufen werden (Fehler: Die
 Verbindung mit dem Remoteserver kann nicht hergestellt werden.) 
 
Error - 10.05.2011 10:33:27 | Computer Name = ChosenOne | Source = MCUpdate | ID = 0
Description = 16:33:26 - MCEClientUX konnte nicht abgerufen werden (Fehler: Die
Verbindung mit dem Remoteserver kann nicht hergestellt werden.) 
 
Error - 17.05.2011 08:01:39 | Computer Name = ChosenOne | Source = MCUpdate | ID = 0
Description = 14:01:28 - MCEClientUX konnte nicht abgerufen werden (Fehler: Die
Verbindung mit dem Remoteserver kann nicht hergestellt werden.) 
 
Error - 24.05.2011 16:08:28 | Computer Name = ChosenOne | Source = MCUpdate | ID = 0
Description = 22:08:19 - Broadband konnte nicht abgerufen werden (Fehler: Die Verbindung
 mit dem Remoteserver kann nicht hergestellt werden.) 
 
Error - 26.05.2011 08:49:00 | Computer Name = ChosenOne | Source = MCUpdate | ID = 0
Description = 14:48:59 - MCEClientUX konnte nicht abgerufen werden (Fehler: Die
Verbindung mit dem Remoteserver kann nicht hergestellt werden.) 
 
Error - 18.09.2011 21:02:33 | Computer Name = ChosenOne | Source = MCUpdate | ID = 0
Description = 03:01:59 - MCEClientUX konnte nicht abgerufen werden (Fehler: Die
Verbindung mit dem Remoteserver kann nicht hergestellt werden.) 
 
Error - 23.09.2011 05:23:06 | Computer Name = ChosenOne | Source = MCUpdate | ID = 0
Description = 11:23:06 - MCESpotlight konnte nicht abgerufen werden (Fehler: Die
 Verbindung mit dem Remoteserver kann nicht hergestellt werden.) 
 
[ OSession Events ]
Error - 09.03.2011 22:15:11 | Computer Name = ChosenOne | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
 12.0.6550.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 35530
 seconds with 60 seconds of active time.  This session ended with a crash.
 
Error - 18.03.2011 01:11:34 | Computer Name = ChosenOne | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
 12.0.6550.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 50556
 seconds with 120 seconds of active time.  This session ended with a crash.
 
Error - 28.03.2011 15:56:35 | Computer Name = ChosenOne | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
 12.0.6550.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 25290
 seconds with 360 seconds of active time.  This session ended with a crash.
 
Error - 05.05.2011 09:20:07 | Computer Name = ChosenOne | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
 12.0.6555.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 501
 seconds with 120 seconds of active time.  This session ended with a crash.
 
Error - 08.12.2011 15:48:26 | Computer Name = ChosenOne | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
 12.0.6562.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 6515
 seconds with 120 seconds of active time.  This session ended with a crash.
 
Error - 16.09.2012 16:13:29 | Computer Name = ChosenOne | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 6
 seconds with 0 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 10.10.2012 11:51:04 | Computer Name = ChosenOne | Source = Service Control Manager | ID = 7031
Description = Der Dienst "NLA (Network Location Awareness)" wurde unerwartet beendet.
 Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 100 Millisekunden
 durchgeführt: Neustart des Diensts.
 
Error - 10.10.2012 11:51:04 | Computer Name = ChosenOne | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Remotedesktopdienste" wurde unerwartet beendet. Dies ist
 bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden
 durchgeführt: Neustart des Diensts.
 
Error - 10.10.2012 11:53:04 | Computer Name = ChosenOne | Source = Service Control Manager | ID = 7032
Description = Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden
 des Dienstes "DNS-Client" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen,
 ist fehlgeschlagen. Fehler:  %%1056
 
Error - 10.10.2012 13:57:19 | Computer Name = ChosenOne | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
 nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
 
Error - 10.10.2012 15:51:14 | Computer Name = ChosenOne | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
 nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
 
Error - 11.10.2012 02:51:58 | Computer Name = ChosenOne | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde unerwartet
 beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden
 in 30000 Millisekunden durchgeführt: Neustart des Diensts.
 
Error - 11.10.2012 03:26:20 | Computer Name = ChosenOne | Source = Service Control Manager | ID = 7034
Description = Dienst "Creative Audio Service" wurde unerwartet beendet. Dies ist
 bereits 1 Mal passiert.
 
Error - 11.10.2012 04:01:14 | Computer Name = ChosenOne | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
 Windows Live ID Sign-in Assistant erreicht.
 
Error - 11.10.2012 04:01:14 | Computer Name = ChosenOne | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Windows Live ID Sign-in Assistant" wurde aufgrund folgenden
 Fehlers nicht gestartet:  %%1053
 
Error - 11.10.2012 11:03:57 | Computer Name = ChosenOne | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
 nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
 
 
< End of report >
Was für ein Wust an Informationen :wtf:

Falls ich es noch nicht gesagt habe: Ein wirklich dickes, dickes Dankeschön für deine Hilfe!!!

kira 12.10.2012 07:29
** Lass dein System in der nächste Zeit noch unter Beobachtung!
wenn alles gut verlaufen ist und dein System läuft stabil,mache folgendes:

1.
Programme deinstallieren/entfernen, die wir verwendet haben und nicht brauchst, bis auf:
Code:
CCleaner
- Zeitweise laufen lassen:-> Anleitung

2.
Tool-Bereinigung mit OTL

Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.
  • Bitte lade Dir (falls noch nicht vorhanden) OTL von OldTimer herunter.
  • Speichere es auf Deinem Desktop.
  • Doppelklick auf OTL.exe um das Programm auszuführen.
  • Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
  • Klicke auf den Button "Bereinigung"
  • OTL fragt eventuell nach einem Neustart.
    Sollte es dies tun, so lasse dies bitte zu.
Anmerkung: Nach dem Neustart werden OTL und andere Helferprogramme, die Du im Laufe der Bereinigung heruntergeladen hast, nicht mehr vorhanden sein. Sie wurden entfernt. Es ist daher Ok, wenn diese Programme nicht mehr vorhanden sind. Sollten noch welche übrig geblieben sein, lösche sie manuell.

3.
Windows legt beispielsweise regelmäßig Schattenkopien an (mindestens einmal täglich), die im Notfall zur Wiederherstellung des Systems und zum Zugriff auf ältere Dateiversionen dienen. Diese Funktion belegt sehr viel Speicherplatz. Standardmäßig beträgt der für Schattenkopien reservierte Speicherplatz 15 % der Volumegröße, so dass die Systemleistung auch beeinträchtigt wird. Außerdem gelöschte und ev. schädliche Objekte, die in der Systemwiederherstellung sitzen, müssen auch entfernt werden:
Also mach bitte folgendes: also zuerst deaktivieren-> dann aktivieren - also am Ende soll wieder "aktiviert" sein!

4.
Ich würde Dir vorsichtshalber raten, dein Passwort zu ändern (man sollte alle 3-4 Monate machen)
z.B. Login-, Mail- oder Website-Passwörter
Tipps:
Die sichere Passwort-Wahl - (sollte man eigentlich regelmäßigen Abständen ca. alle 3-5 Monate ändern)
auch noch hier unter: Sicheres Kennwort (Password)

5.
► Schaue bitte nach, ob für Windows neue Update gibt?!:-> - Microsoft Update hält Ihren Computer auf dem neuesten Stand!
-> Installiere jedes Update das Dir angeboten wird, wiederhole den Vorgang so oft, bis nicht mehr gibt

Lesestoff Nr.1:
Gib Kriminellen Handlungen keine Chance!
Zitat:
Sichere regelmäßig deine Daten (Bilder Musik, Dokumente, Mails (als Textdatei), im Browser Lesezeichen usw) auf CD/DVD, USB-Sticks oder externe Festplatten! Am besten 2x an verschiedenen Orten sichern!
  • Wie erstelle ich ein eingeschränktes Benutzerkonto?
  • Software immer auf dem neuesten Stand halten!:
    ALLE auf dem System installierten Programme und Treiber, sollten regelmäßig upgedatet werden um Sicherheitslücken zu vermeiden und um das reibungslose Arbeitsabläufe zu erreichen!
  • Firefox - FirefoxWiki/Einstellungen - Erweiterungen für Firefox
  • Sichere eMail Clients z.B. Thunderbird-->Erweiterungen für Mozilla Thunderbird
    - Unbekannten E-Mail-Anhang NICHT öffnen!
    - Mails besonders mit Anhang, nicht anklicken, sondern als Text oder in Druckversion anzeigen lassen
  • Sichere Paswort - Die sichere Passwort-Wahl - (sollte man eigentlich regelmäßigen Abständen ca. alle 3-5 Monate ändern)
    auch noch hier unter: Sicheres Kennwort (Password)
    Die fünf häufigsten Passwort-Fehler
  • "Never accept software from strangers" - Installiere grundsätzlich immer nur Programme, die Du auch wirklich benötigst und von denen Du überzeugt bist, dass sie seriös sind.
    Du hast die Wahl!, welche zusätzlichen Komponenten noch installiert werden sollen? -> Während der Installation immer mitlesen, Sponsoren und Partnerprogramme, Toolbars oder eventuell noch andere extra angebotene Programme möglichst abwählen!
    so wird oft Art von Adware/Spyware mitinstalliert!
  • NICHT irgendwelche Programme aus dem Netz laden, wenn nicht zu 100% fest steht, dass es sich dabei um saubere Software handelt. Nette Versprechen der Hersteller garantieren noch lange keine einwandfreie Funktionsweise, also vorher blättere die Seiten bei GOOGLE, da kannst Du Dir wertvolle Informationen holen!!!
  • Programme und Treiber:
    Nur vom Hersteller!
  • Onlinebanking:
    Gib deine Passwörter niemals preis!
    Seriöse Bankinstitute, E- Mail- Provider oder Online- Shops versenden grundsätzlich keine E- Mails, in denen Kunden aufgefordert werden, vertrauliche Daten wie Passwörter, Verfügernummer, PINs oder TANs preiszugeben. Bei dieser Art von E- Mails handelt es sich immer um Betrugsversuche, weshalb entsprechende Anfragen nicht beantwortet werden sollten. Sobald der Verdacht auf Betrug entsteht, melde deinen Verdacht der jeweiligen Bank- Hotline.
  • Computer, anderen (Gästen/Freunden) zur Nutzung überlassen überlassen - Nutze nur vertrauenswürdige Computer!
    Vergewissere dich, dass nur Personen deines Vertrauens deinen Computer nutzen oder verwalten und wickel niemals Bankgeschäfte über nicht vertrauenswürdige Computer - beispielsweise aus einem Internetcafé während des Urlaubs - ab
  • Wichtige Daten Regelmäßig sichern! - aber denk daran: dein Hauptsystem ist doch kein Lagerhalle!
  • Vorsicht bei der Nutzung fremder Computer und anschliessbare Externe Speichermedien wie Festplatte, USB Sticks, Speicherkarten usw![/color] - auch zeitweise anschließen und scannen lassen (sehe unter `kostenlose Online-Viren-Scanner`)
  • Webseiten ohne Gültiges Impressum nicht besuchen
    - Externe Geräte (Festplatte USB-Stick) nicht ständig am PC anschließen, sondern nur kurzfristig während Du etwas sichern möchtest
  • Lizenzkosten sparen? - Vorsicht bei Dateien/Programmen aus nicht vertrauenswürdigen Quellen! - "full Keygen, Crack, Serial, Warez, keygenerators" etc.
    Sind immer verseucht mit diverse Malware/Schadprogramme/Code, es gibt keine seite wo Viren frei ist. (Man sollte nicht absitlich der Teufel holen;)) Eine weitere höchst unsichere Quelle ist das File-Sharing der sog. (Musik-)Tauschbörse.
    ► Ausserdem machst Du dich damit strafbar!
  • Nur eine Firewall sowie ein Antiviren Programm verwenden, welche sich immer auf dem aktuellsten Stand befinden sollten!
    Das Installieren von `zuviel` Software beeinträchtigt die Systemleistung und Sicherheit, verlangsamt den Start-Vorgang enorm und belastet den Arbeitsspeicher (weil laufen ja die Programme nebeneinander gleichzeitig, die viel Performance fressen, aber wenig Qualität bringen). Im Laufe der Zeit wird der rechner durch zu viel unnötigen Ballast immer langsamer, und unsicherer. Um so mehr Programme installiert sind, um so häufiger treten Probleme auf, die dann unter Umständen nur schwer lösen können. Dazu kommt noch, das einige Programme große Sicherheitsrisiken mit sich bringen;)
  • Virenscanner
  • BSI für Bürger
  • SETI@home - [Sicherheit] Sicherheitskonzept

** Der gesunde Menschenverstand, Windows und Internet-Software sicher konfigurieren ist der beste Weg zur Sicherheit im Webverkehr ist !!
Zitat:
Da der Bestand der Datenbank wird täglich ergänzt und erweitert bzw werden mit der aktuellen Virendefinition die Informationen über den betroffenen Virus aufgenommen, empfehle ich dir mindestens einmal pro Woche (später genügt es sicherlich einmal im Monat) dein System Online Scannen lassen (immer mit einen anderen Scanner), um eine zweite Meinung einzuholen - Die auf dem Speichermedium gesicherten Daten sollten auch mit einbezogen werden!
(benutzen meist ActiveX und/oder Java): Kostenlose Online Scanner -
Lesestoff Nr.2:
► Kann sich auf Dauer eine Menge Datenmüll ansammeln, sich Fehlermeldungen häufen, der PC ist wahrscheinlich nicht mehr so schnell, wie früher:wünsch Dir alles Gute:)

Wenn Du uns unterstützen möchtest→ Spendekonto

gruß
kira

meric 12.10.2012 20:37
So, habe alles genaustens befolgt! :D Passwörter sind geändert. System bereinigt. Fühlt sich alles sogar einen Hauch weniger träge an ;)

Habe heute während des Tages immer ein halbes Auge auf den Ressourcenmonitor gehabt und es sind keine verdächtigen Verbindungen mehr aufgetaucht (Hab alle IPs mit tracert überprüft ;))!

Ich werd das ganze jetzt noch mal ein paar Tage weiter beobachten, aber momentan sieht alles wieder echt gut aus!

Noch einmal vielen Dank für die Hilfe!!!


Alle Zeitangaben in WEZ +1. Es ist jetzt 15:10 Uhr.

Copyright ©2000-2024, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28