Trojaner-Board - Vorschaubilder von Bilderordnern vertauscht

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Vorschaubilder von Bilderordnern vertauscht (https://www.trojaner-board.de/126301-vorschaubilder-bilderordnern-vertauscht.html)

Vorschaubilder von Bilderordnern vertauscht

Hallo,

ich habe seit einigen Tagen ein seltsames Problem mit den Vorschaubildern meines Bilderordners.
Die Bildersammlung ist relativ groß (ca. 30.000) und ich habe sie daher in diverse Ordner und Subordner eingeteilt, die ich dann jeweils mit einem entsprechenden Vorschaubild versehen habe (die man natürlich nur sieht, wenn man eine Miniaturbilderansicht wählt), so dass man sich schneller zurechtfindet (auswählbar unter: Rechtklick auf einen Ordner -> Eigenschaften -> Anpassen -> unter Ordnerbilder "Datei auswählen"). Nun vertauschen sich diese Ordnerbilder seit einigen Tagen immer wieder. Ein Muster ist mir dabei nicht aufgefallen. Es verschwinden Vorschaubilder oder sie werden mit anderen vertauscht, auch solchen, die in ganz anderen Überordnern ausgewählt wurden. Korrigiere ich die Vorschaubilder, klicke mich also durch jeden Ordner und erneuere die jeweiligen Bild, bleiben die Vorschaubilder für kurze Zeit korrekt, bis plötzlich, bei einem späteren Besuch des Ordners, die Bilder wieder vertauscht sind.

Defogger war unauffällig, die anderen Logs (OTL, Extras, Gmer) habe ich angehängt.
Ich hoffe, ihr könnt mir helfen.

Grüße
JDB

Hallo,

noch eine Ergänzung, diesen Beitrag also bitte nicht als "Pushen" oder "Bumpen" missverstehen.

Die vertauschten Ordnerbilder sind nun nicht mehr das einzige Problem. Mittlerweile verstellen sich die Einstellungen zur Ansicht in jedem Ordner nach belieben. D.h.: Ich stelle z.B. die Detailansicht ein und verlasse den Ordner, besuche ich den Ordner später wieder, ist plötzlich die "Kleine Symbole"-Ansicht aktiv. Korrigiert man dies, hat man für unbestimmte Zeit Ruhe, danach wechselt die Ansicht wieder. Ich gehe fest davon aus, dass es sich um irgendeine Art Wurm handelt, der sich eingenistet hat.
Die Logfiles sind oben. Ich hoffe irgendjemand kann mir helfen.

Grüße
JDB

Hallo und Herzlich Willkommen! :)

Bevor wir unsere Zusammenarbeit beginnen, [Bitte Vollständig lesen]:

Zitat:

"Fernbehandlungen/Fernhilfe" und die damit verbundenen Haftungsrisken:
- da die Fehlerprüfung und Handlung werden über große Entfernungen durchgeführt, besteht keine Haftung unsererseits für die daraus entstehenden Folgen.
- also, jede Haftung für die daraus entstandene Schäden wird ausgeschlossen, ANWEISUNGEN UND DEREN BEFOLGUNG, ERFOLGT AUF DEINE EIGENE VERANTWORTUNG!
Charakteristische Merkmale/Profilinformationen:
- aus der verwendeten Loglisten oder Logdateien - wie z.B. deinen Realnamen, Seriennummer in Programm etc)- kannst Du durch [X] oder Sternchen (*) ersetzen
Die Systemprüfung und Bereinigung:
- kann einige Zeit in Anspruch nehmen (je nach Art der Infektion), kann aber sogar so stark kompromittiert sein, so dass eine wirkungsvolle technische Säuberung ist nicht mehr möglich bzw Du es neu installieren musst
Ich empfehle Dir die Anweisungen erst einmal komplett durchzulesen, bevor du es anwendest, weil wenn du etwas falsch machst, kann es wirklich gefährlich werden. Wenn du meinen Anweisungen Schritt für Schritt folgst, kann eigentlich nichts schief gehen.
Innerhalb der Betreuungszeit:
- ohne Abspräche bitte nicht auf eigene Faust handeln!- bei Problemen nachfragen.
Die Reihenfolge:
- genau so wie beschrieben bitte einhalten, nicht selbst die Reihenfolge wählen!
GECRACKTE SOFTWARE werden hier nicht geduldet!!!!
Ansonsten unsere Forumsregeln:
- Bitte erst lesen, dann posten!-> Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten?

Alle Logfile mit einem vBCode Tag eingefügen, das bietet hier eine gute Übersicht, erleichtert mir die Arbeit! Falls das Logfile zu groß, teile es in mehrere Teile auf.

Sobald Du diesen Einführungstext gelesen hast, kannst Du beginnen:)

► Hilfeleistung - geplante Vorgehensweise:

Problemsuche
Problembeseitigung/Systembereinigung
Verwendete Programme deinstallieren/entfernen
Thema abschließen: Tipps zur Computersicherheit

Für Vista und Win7:
Wichtig: Alle Befehle bitte als Administrator ausführen! rechte Maustaste auf die Eingabeaufforderung und "als Administrator ausführen" auswählen
Auf der angewählten Anwendung einen Rechtsklick (rechte Maustaste) und "Als Administrator ausführen" wählen!

** Bitte kein Dateiformat *.rar!
- kannst auch, die einzelnen Ergebnisse in Textdatei speichern und hier anhängen (auf "Erweitert" -> scrolle ein bisschen runter-> Anhänge verwalten)
- Textdateien in eine ZIP-Datei packen und diese hier anhängen. auf "Erweitert" klicken...
- am besten (wie unten beschrieben) in sogenannten Code-Tags posten

1.
Lade Dir Malwarebytes Anti-Malware Lade Dir Malwarebytes Anti-Malware → von hier herunter

Installieren und per Doppelklick starten.
Deutsch einstellen und gleich mal die Datenbanken zu aktualisieren - online updaten
"Komplett Scan durchführen" wählen (überall Haken setzen)
wenn der Scanvorgang beendet ist, klicke auf "Zeige Resultate"
Alle Funde - falls MBAM meldet in C:\System Volume Information - den Haken bitte entfernen - markieren und auf "Löschen" - "Ausgewähltes entfernen") klicken.
Poste das Ergebnis hier in den Thread - den Bericht findest Du unter "Scan-Berichte"

eine bebilderte Anleitung findest Du hier: Anleitung

2.
Systemscan mit OTL

Lade Dir (falls noch nicht getan hast) bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Doppelklick auf die OTL.exe
Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
Unter Extra Registry, wähle bitte Use SafeList
Mache Häckchen bei LOP- und Purity-Prüfung
Klicke nun auf Run Scan links oben
Wenn der Scan beendet wurde werden 2 Logfiles erstellt - OTL.txt und Extras.txt
Poste die Logfiles in Code-Tags hier in den Thread.

3.
Um festzustellen, ob veraltete oder schädliche Software unter Programme installiert sind, ich würde gerne noch all deine installierten Programme sehen:

Download den CCleaner herunter
Software-Lizenzvereinbarung lesen, falls irgendeine Toolbar angeboten wird, bitte abwählen!-> starten -> Falls nötig, auf "Deutsch" einstellen.
starten-> klick auf `Extras` (um auf deinem System installierte Software zu anzeigen)-> dann auf `Als Textdatei speichern...`
ein Textdatei wird automatisch erstellt, poste auch dieses Logfile (also die Liste alle installierten Programme...eine Textdatei)

Zitat:

Damit dein Thread übersichtlicher und schön lesbar bleibt, am besten nutze den Code-Tags für deinen Post:
→ vor dein Log schreibst Du (also am Anfang des Logfiles):[code]
hier kommt dein Logfile rein - z.B OTL-Logfile o. sonstiges
→ dahinter - also am Ende der Logdatei: [/code]

** Möglichst nicht ins internet gehen, kein Online-Banking, File-sharing, Chatprogramme usw

gruß
kira

Hi,

erstmal herzlichen Dank für die prompte Antwort auf meine Mail.

Anbei findest du alle Logs, die du haben wolltest.

MBAM war unauffällig:

Code:

Malwarebytes Anti-Malware 1.65.1.1000

www.malwarebytes.org
 

Datenbank Version: v2012.10.30.02
 

Windows 7 Service Pack 1 x86 NTFS

Internet Explorer 9.0.8112.16421

*** :: JUBELDIBUB [Administrator]
 

02.11.2012 17:05:06

mbam-log-2012-11-02 (17-05-06).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM | P2P

Deaktivierte Suchlaufeinstellungen: 

Durchsuchte Objekte: 378713

Laufzeit: 1 Stunde(n), 1 Minute(n), 38 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Die OTL.txt:
OTL Logfile:

Code:

OTL logfile created on: 02.11.2012 18:32:03 - Run 2

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\***\Tools, Treiber & Programme\Trojaner Board Programme

 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,25 Gb Total Physical Memory | 1,67 Gb Available Physical Memory | 51,31% Memory free

13,01 Gb Paging File | 11,16 Gb Available in Paging File | 85,74% Paging File free

Paging file location(s): c:\pagefile.sys 10000 10000 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 465,66 Gb Total Space | 313,29 Gb Free Space | 67,28% Space Free | Partition Type: NTFS

 

Computer Name: JUBELDIBUB | User Name: *** | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\***\Tools, Treiber & Programme\Trojaner Board Programme\OTL.exe (OldTimer Tools)

PRC - C:\Windows\System32\Macromed\Flash\FlashUtil32_11_4_402_287_ActiveX.exe (Adobe Systems Incorporated)

PRC - C:\Programme\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Advanced Micro Devices, Inc.)

PRC - C:\Windows\System32\atieclxx.exe (AMD)

PRC - C:\Windows\System32\atiesrxx.exe (AMD)

PRC - C:\Programme\G Data\InternetSecurity\AVKTray\AVKTray.exe (G Data Software AG)

PRC - C:\Programme\G Data\InternetSecurity\AVK\AVKWCtl.exe (G Data Software AG)

PRC - C:\Programme\SlySoft\AnyDVD\AnyDVDtray.exe (SlySoft, Inc.)

PRC - C:\Programme\Internet Explorer\iexplore.exe (Microsoft Corporation)

PRC - C:\Programme\Common Files\G Data\AVKProxy\AVKProxy.exe (G Data Software AG)

PRC - C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

PRC - C:\Programme\G Data\InternetSecurity\Firewall\GDFwSvc.exe (G Data Software AG)

PRC - C:\Programme\Common Files\G Data\GDScan\GDScan.exe (G Data Software AG)

PRC - C:\Programme\G Data\InternetSecurity\Firewall\GDFirewallTray.exe (G Data Software AG)

PRC - C:\Programme\G Data\InternetSecurity\AVK\AVKService.exe (G Data Software AG)

PRC - C:\Programme\TomTom HOME 2\TomTomHOMEService.exe (TomTom)

PRC - C:\Programme\Nero\Nero 10\Nero BackItUp\NBAgent.exe (Nero AG)

PRC - C:\Programme\Nero\Update\NASvc.exe (Nero AG)

PRC - C:\Windows\explorer.exe (Microsoft Corporation)

PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)

PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)

PRC - C:\Programme\Microsoft Office\OFFICE11\OUTLOOK.EXE (Microsoft Corporation)

PRC - C:\Programme\Common Files\microsoft shared\VS7Debug\MDM.EXE (Microsoft Corporation)

 

 
 ========== Modules (No Company Name) ==========

 

MOD - C:\Programme\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsFormsIntegra#\44752ffa92ebb7170951a41898d8b9c6\WindowsFormsIntegration.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\3971e166cf827b6726e142f344061dc9\System.Windows.Forms.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\199683f6e79076b634ee6cc0a82c0654\PresentationFramework.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\e7dc084827f8df2dbdc819db5c633a0d\PresentationCore.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\21f37f9f5162af7efb52169012bd111e\WindowsBase.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\8c40f40ef36622109793788049fbe9ab\System.Drawing.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\UIAutomationProvider\05787d96761cf20b76b927ace10ef1d3\UIAutomationProvider.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\65f0d70169a0e73b45307dddbd86f92b\System.Runtime.Remoting.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\d234eceae699d070b5a5712ce776c01f\System.Xaml.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\a5fa2a1cfc6e9fdc39d9a8f2baa57bc9\PresentationFramework.Aero.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\ed91b57205429a23bb91f4499059a459\System.Core.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\d1f299160424bad90fe9f658661389e2\System.Xml.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\623d2a0f11dd82bb9bc13d1cb981b239\System.Configuration.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System\6f9f0467e8b2dd3f69b015c8e30ac945\System.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\3953b1d8b9b57e4957bff8f58145384e\mscorlib.ni.dll ()

MOD - C:\Programme\Common Files\LightScribe\QtGui4.dll ()

MOD - C:\Programme\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll ()

MOD - C:\Programme\Common Files\LightScribe\QtCore4.dll ()

 

 
 ========== Services (SafeList) ==========

 

SRV - (WinHttpAutoProxySvc) -- winhttp.dll File not found

SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)

SRV - (AMD FUEL Service) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Advanced Micro Devices, Inc.)

SRV - (AMD External Events Utility) -- C:\Windows\System32\atiesrxx.exe (AMD)

SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)

SRV - (AVKWCtl) -- C:\Programme\G Data\InternetSecurity\AVK\AVKWCtl.exe (G Data Software AG)

SRV - (AVKProxy) -- C:\Programme\Common Files\G Data\AVKProxy\AVKProxy.exe (G Data Software AG)

SRV - (AdobeARMservice) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

SRV - (GDFwSvc) -- C:\Programme\G Data\InternetSecurity\Firewall\GDFwSvc.exe (G Data Software AG)

SRV - (ServiceLayer) -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia)

SRV - (GDScan) -- C:\Programme\Common Files\G Data\GDScan\GDScan.exe (G Data Software AG)

SRV - (AVKService) -- C:\Programme\G Data\InternetSecurity\AVK\AVKService.exe (G Data Software AG)

SRV - (odserv) -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)

SRV - (TomTomHOMEService) -- C:\Programme\TomTom HOME 2\TomTomHOMEService.exe (TomTom)

SRV - (NAUpdate) -- C:\Programme\Nero\Update\NASvc.exe (Nero AG)

SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)

SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation)

SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)

SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SRV - (MDM) -- C:\Programme\Common Files\microsoft shared\VS7Debug\MDM.EXE (Microsoft Corporation)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)

DRV - (amdkmdag) -- C:\Windows\System32\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)

DRV - (amdkmdap) -- C:\Windows\System32\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)

DRV - (GDPkIcpt) -- C:\Windows\System32\drivers\PktIcpt.sys (G Data Software AG)

DRV - (GDMnIcpt) -- C:\Windows\System32\drivers\MiniIcpt.sys (G Data Software AG)

DRV - (GDBehave) -- C:\Windows\System32\drivers\GDBehave.sys (G Data Software AG)

DRV - (gdwfpcd) -- C:\Windows\System32\drivers\gdwfpcd32.sys (G Data Software AG)

DRV - (AnyDVD) -- C:\Windows\System32\drivers\AnyDVD.sys (SlySoft, Inc.)

DRV - (HookCentre) -- C:\Windows\System32\drivers\HookCentre.sys (G Data Software AG)

DRV - (AtiHDAudioService) -- C:\Windows\System32\drivers\AtihdW73.sys (Advanced Micro Devices)

DRV - (pccsmcfd) -- C:\Windows\System32\drivers\pccsmcfd.sys (Nokia)

DRV - (dtsoftbus01) -- C:\Windows\System32\drivers\dtsoftbus01.sys (DT Soft Ltd)

DRV - (AODDriver4.2) -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\i386\aoddriver2.sys (Advanced Micro Devices)

DRV - (AODDriver4.01) -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\i386\aoddriver2.sys (Advanced Micro Devices)

DRV - (nmwcdnsu) -- C:\Windows\System32\drivers\nmwcdnsu.sys (Nokia)

DRV - (nmwcdc) -- C:\Windows\System32\drivers\ccdcmbo.sys (Nokia)

DRV - (nmwcd) -- C:\Windows\System32\drivers\ccdcmb.sys (Nokia)

DRV - (nmwcdnsuc) -- C:\Windows\System32\drivers\nmwcdnsuc.sys (Nokia)

DRV - (UsbserFilt) -- C:\Windows\System32\drivers\usbser_lowerfltj.sys (Nokia)

DRV - (upperdev) -- C:\Windows\System32\drivers\usbser_lowerflt.sys (Nokia)

DRV - (GRD) -- C:\Windows\System32\drivers\GRD.sys (G Data Software)

DRV - (MotioninJoyXFilter) -- C:\Windows\System32\drivers\MijXfilt.sys (MotioninJoy)

DRV - (GdNetMon) -- C:\Windows\System32\drivers\GdNetMon32.sys (G Data Software AG)

DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)

DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)

DRV - (TsUsbGD) -- C:\Windows\System32\drivers\TsUsbGD.sys (Microsoft Corporation)

DRV - (amdiox86) -- C:\Windows\System32\drivers\amdiox86.sys (Advanced Micro Devices)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default Download Directory = C:\Users\***

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ig

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 7A 8A 88 C6 5B 75 CC 01  [binary data]

IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 
 ========== FireFox ==========

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF - HKLM\Software\MozillaPlugins\@nokia.com/EnablerPlugin: C:\Program Files\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

 

[2011.11.09 15:54:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions

[2011.11.09 15:54:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions\home2@tomtom.com

 

O1 HOSTS File: ([2009.06.10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O2 - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Programme\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)

O2 - BHO: (G Data BankGuard) - {BA3295CF-17ED-4F49-9E95-D999A0ADBFDC} - C:\Programme\Common Files\G Data\AVKProxy\BanksafeBHO.dll (G Data Software AG)

O4 - HKLM..\Run: [G Data AntiVirus Tray Application] C:\Programme\G Data\InternetSecurity\AVKTray\AVKTray.exe (G Data Software AG)

O4 - HKLM..\Run: [GDFirewallTray] C:\Programme\G Data\InternetSecurity\Firewall\GDFirewallTray.exe (G Data Software AG)

O4 - HKLM..\Run: [NBAgent] C:\Program Files\Nero\Nero 10\Nero BackItUp\NBAgent.exe (Nero AG)

O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKCU..\Run: []  File not found

O4 - HKCU..\Run: [AnyDVD] C:\Programme\SlySoft\AnyDVD\AnyDVDtray.exe (SlySoft, Inc.)

O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)

O4 - HKCU..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1

O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105 File not found

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)

O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000 File not found

O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)

O13 - gopher Prefix: missing

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0B880486-C259-45D7-A17F-6B65B73BE9EA}: DhcpNameServer = 192.168.178.1

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll File not found

O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll File not found

O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll File not found

O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)

O18 - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Programme\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)

O18 - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Programme\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)

O20 - HKLM Winlogon: Shell - (explorer.exe) -  File not found

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -  File not found

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O29 - HKLM SecurityProviders - (credssp.dll) -  File not found

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.11.02 16:41:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2012.11.02 16:41:47 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2012.10.30 09:47:09 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes

[2012.10.30 09:46:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.10.30 09:46:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.10.30 09:46:54 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2012.10.30 09:46:54 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2012.10.27 19:48:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UltraEdit

[2012.10.27 19:48:06 | 000,000,000 | ---D | C] -- C:\Program Files\UltraEdit

[2012.10.26 08:14:45 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI

[2012.10.26 08:14:42 | 000,000,000 | ---D | C] -- C:\Program Files\AMD AVT

[2012.10.26 08:14:38 | 000,000,000 | ---D | C] -- C:\Program Files\AMD APP

[2012.10.26 08:14:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center

[2012.10.10 07:14:51 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll

[2012.10.10 07:14:45 | 000,271,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe

[2012.10.10 07:14:45 | 000,169,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winsrv.dll

[2012.10.10 07:14:45 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll

[2012.10.10 07:14:45 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll

[2012.10.10 07:14:45 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll

[2012.10.10 07:14:45 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll

[2012.10.10 07:14:45 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll

[2012.10.10 07:14:45 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll

[2012.10.10 07:14:45 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll

[2012.10.10 07:14:45 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll

[2012.10.10 07:14:45 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll

[2012.10.10 07:14:35 | 003,968,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe

[2012.10.10 07:14:35 | 003,914,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.11.02 18:36:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.11.02 18:27:01 | 000,001,114 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012.11.02 16:38:49 | 000,021,664 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.11.02 16:38:49 | 000,021,664 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.11.02 16:36:56 | 000,657,428 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012.11.02 16:36:56 | 000,618,714 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012.11.02 16:36:56 | 000,130,818 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012.11.02 16:36:56 | 000,107,034 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012.11.02 16:31:42 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012.11.02 16:31:35 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.11.02 16:31:32 | 2615,320,576 | -HS- | M] () -- C:\hiberfil.sys

[2012.11.02 11:25:37 | 000,848,812 | ---- | M] () -- C:\Windows\System32\sig.bin

[2012.11.02 11:25:37 | 000,045,712 | ---- | M] () -- C:\Windows\System32\nmp.map

[2012.11.01 23:46:28 | 516,696,064 | ---- | M] () -- C:\Users\***\CriminalMinds-S07E20.avi

[2012.10.31 22:25:25 | 681,934,848 | ---- | M] () -- C:\Users\***\Dexter-S06E11.avi

[2012.10.29 22:49:32 | 524,220,416 | ---- | M] () -- C:\Users\***\GreysAnatomy-S08E22.avi

[2012.10.29 17:47:29 | 000,000,257 | ---- | M] () -- C:\Users\***\Desktop\Clever-Forum.de - das clevere Forum  Das Excel-Forum  X in Spalte A zählen, wenn Y in Spalte B.url

[2012.10.29 17:19:46 | 000,078,336 | ---- | M] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2012.10.26 04:28:31 | 186,723,478 | ---- | M] () -- C:\Users\***\TBBT-S06E05.avi

[2012.10.21 18:30:45 | 000,000,258 | ---- | M] () -- C:\Users\***\Desktop\Amazon.com Sea Of Serenity Purewhitenoise.Com MP3 Downloads.url

[2012.10.21 18:30:17 | 000,000,139 | ---- | M] () -- C:\Users\***\Desktop\Rain Fall Music for Sleep Rain Song [Rain Sounds for Sleep] Relax to the Music of Rain with Rain Song Rain Storm Sound with Music for Sleep.url

[2012.10.09 14:36:06 | 000,696,760 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe

[2012.10.09 14:36:06 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl

 
 ========== Files Created - No Company Name ==========

 

[2012.11.02 10:20:14 | 524,220,416 | ---- | C] () -- C:\Users\***\GreysAnatomy-S08E22.avi

[2012.11.02 10:19:24 | 681,934,848 | ---- | C] () -- C:\Users\***\Dexter-S06E11.avi

[2012.11.02 10:18:36 | 516,696,064 | ---- | C] () -- C:\Users\***\CriminalMinds-S07E20.avi

[2012.11.02 10:18:30 | 186,723,478 | ---- | C] () -- C:\Users\***\TBBT-S06E05.avi

[2012.10.29 17:47:29 | 000,000,257 | ---- | C] () -- C:\Users\***\Desktop\Clever-Forum.de - das clevere Forum  Das Excel-Forum  X in Spalte A zählen, wenn Y in Spalte B.url

[2012.10.21 18:30:45 | 000,000,258 | ---- | C] () -- C:\Users\***\Desktop\Amazon.com Sea Of Serenity Purewhitenoise.Com MP3 Downloads.url

[2012.10.21 18:30:17 | 000,000,139 | ---- | C] () -- C:\Users\***\Desktop\Rain Fall Music for Sleep Rain Song [Rain Sounds for Sleep] Relax to the Music of Rain with Rain Song Rain Storm Sound with Music for Sleep.url

[2012.09.28 14:36:56 | 000,180,224 | ---- | C] () -- C:\Windows\System32\clinfo.exe

[2012.05.23 16:31:02 | 000,632,252 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat

[2012.05.02 13:58:10 | 000,029,184 | ---- | C] () -- C:\Windows\System32\kdbsdk32.dll

[2012.03.21 15:33:47 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol

[2012.02.15 03:28:34 | 000,157,144 | ---- | C] () -- C:\Windows\System32\ativvsva.dat

[2012.02.15 03:28:32 | 000,204,952 | ---- | C] () -- C:\Windows\System32\ativvsvl.dat

[2011.09.30 11:24:13 | 000,004,096 | -H-- | C] () -- C:\Users\***\AppData\Local\keyfile3.drm

[2011.09.19 17:01:50 | 000,078,336 | ---- | C] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011.09.18 15:33:47 | 000,000,083 | -HS- | C] () -- C:\ProgramData\.zreglib

[2011.09.18 10:49:23 | 000,000,534 | ---- | C] () -- C:\Windows\ODBC.INI

[2011.09.17 19:13:24 | 000,848,812 | ---- | C] () -- C:\Windows\System32\sig.bin

[2011.09.17 16:44:36 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2011.09.12 23:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\System32\atipblag.dat

[2011.08.31 13:29:00 | 004,023,808 | ---- | C] () -- C:\Windows\System32\x264vfw.dll

[2011.07.12 15:56:50 | 000,074,752 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll

[2011.07.03 18:48:42 | 000,147,456 | ---- | C] ( ) -- C:\Windows\System32\lagarith.dll

[2011.06.17 05:26:10 | 000,243,200 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll

[2011.06.17 05:17:28 | 000,650,752 | ---- | C] () -- C:\Windows\System32\xvidcore.dll

[2011.04.12 02:30:05 | 000,657,428 | ---- | C] () -- C:\Windows\System32\perfh007.dat

[2011.04.12 02:30:05 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat

[2011.04.12 02:30:05 | 000,130,818 | ---- | C] () -- C:\Windows\System32\perfc007.dat

[2011.04.12 02:30:05 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat

 
 ========== ZeroAccess Check ==========

 

[2009.07.14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 22:29:20 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 
 ========== LOP Check ==========

 

[2012.07.12 08:54:47 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\avidemux

[2012.10.25 12:01:18 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Canon

[2011.09.19 17:01:27 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\COWON

[2012.04.18 19:40:31 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DAEMON Tools Lite

[2012.03.28 14:36:08 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\elsterformular

[2011.10.19 13:19:32 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\GHISLER

[2012.07.13 13:31:12 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\gtk-2.0

[2012.01.05 18:22:37 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ImgBurn

[2012.08.02 20:05:20 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\MaaTec

[2012.04.24 19:34:19 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Might & Magic Heroes VI

[2012.04.20 20:45:48 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\MotioninJoy

[2012.01.24 16:59:14 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Nokia

[2012.04.24 10:08:57 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Notepad++

[2012.01.24 17:01:15 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\PC Suite

[2012.09.08 14:31:50 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\RenPy

[2012.03.21 16:09:44 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ScanSoft

[2012.03.21 16:48:09 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Softi Software

[2012.06.06 22:38:53 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Titanium

[2011.11.09 15:54:19 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TomTom

[2011.09.20 18:13:54 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Win7codecs

[2012.03.21 15:38:17 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Zeon

 
 ========== Purity Check ==========

 

 
 

< End of report >

--- --- ---

Die OTL-Extras.txt:
OTL Logfile:

Code:

OTL Extras logfile created on: 02.11.2012 18:32:03 - Run 2

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\***\Tools, Treiber & Programme\Trojaner Board Programme

 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,25 Gb Total Physical Memory | 1,67 Gb Available Physical Memory | 51,31% Memory free

13,01 Gb Paging File | 11,16 Gb Available in Paging File | 85,74% Paging File free

Paging file location(s): c:\pagefile.sys 10000 10000 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 465,66 Gb Total Space | 313,29 Gb Free Space | 67,28% Space Free | Partition Type: NTFS

 

Computer Name: JUBELDIBUB | User Name: *** | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

.reg [@ = regfile] -- regedit.exe "%1"

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [open] -- regedit.exe "%1"

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files\VLC Media Player\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [cmd] -- cmd.exe /s /k pushd "%V"

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Program Files\VLC Media Player\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 0

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 0

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"EnableFirewall" = 0

"DisableNotifications" = 0

 
 ========== Authorized Applications List ==========

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{07418BEC-32B2-4BBB-90B6-96A18C26C57E}" = lport=445 | protocol=6 | dir=in | app=system | 

"{1ACFEB17-25FE-4962-8418-A7076255ADC1}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 

"{1E018D47-4D7A-4BCC-8D10-9C291B643920}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{1EFAAE3F-E135-4507-9597-7528F935EC92}" = rport=445 | protocol=6 | dir=out | app=system | 

"{37AA065A-4630-4A6A-AB5F-9CEDA2BFE59E}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{38EB0773-D885-43CA-AF37-CE22BADC41F8}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{6F6FB99F-338E-4C2E-BACA-9D93D54C5142}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{7C088D17-B82B-4C23-A74F-EFB7409A58A4}" = rport=139 | protocol=6 | dir=out | app=system | 

"{85AA6498-9DF5-44D1-B418-2502F65DCAB1}" = rport=10243 | protocol=6 | dir=out | app=system | 

"{8CB01AE0-9095-4838-9C1A-4C5217654AAD}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{8DC2B5DD-A6B4-4EA9-9AD1-CED060EBDC22}" = lport=10243 | protocol=6 | dir=in | app=system | 

"{8F0B4B9F-4E20-413E-B1EB-F7D9BBE0F2E1}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{99A71136-42E0-45EE-9032-23DDD807BD73}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{A2530926-955F-4F25-B7D7-75F7183ED877}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{BCE01428-F70E-4C6E-8ADF-264BD465BCAC}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{BF558F8D-C6AD-41CE-950C-FDF17E09F539}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{CC66DC8D-2AE4-44A3-98E1-90E738159D2B}" = rport=138 | protocol=17 | dir=out | app=system | 

"{D01FDF4C-3BDF-4BE2-A432-9D0713176EF2}" = rport=137 | protocol=17 | dir=out | app=system | 

"{D06530E9-89F5-4D81-A67C-3F7CB6470D0A}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{D5D399BD-5068-4376-9F26-8C8BA89BCF0B}" = lport=138 | protocol=17 | dir=in | app=system | 

"{DA61C31C-0312-466D-A8EA-619D6DB03474}" = lport=139 | protocol=6 | dir=in | app=system | 

"{F267B621-B82E-472E-BA85-D747B9D5001A}" = lport=137 | protocol=17 | dir=in | app=system | 

"{FC880E3E-4500-4976-BCCA-57ACD26C3A27}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{03801C07-BEF6-4CA5-9296-00B9B4B06CD9}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{06219141-0D21-4A2C-9634-35805E76908D}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{0711E96B-E7E0-4EE1-B5C7-F5C90D7CB19F}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\skyrim\skyrimlauncher.exe | 

"{078EE463-BD11-47F2-816F-872AED480C7E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{1924588C-CF8A-41D7-898E-24408F5DAFFA}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{204137CE-745C-4F30-BB6C-07561581EE95}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 

"{23468757-9272-4115-B18E-585F94ECAD55}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe | 

"{23B4B459-7355-4670-9127-4E85796D47F8}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe | 

"{3715C2AD-F1F5-419D-B165-2029388B6930}" = protocol=6 | dir=out | app=system | 

"{3F3FFB0B-C27C-45AD-9B3C-88ACAE5311EB}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 

"{54B3D7B2-91DE-404F-86D1-862F239DA914}" = protocol=17 | dir=in | app=c:\program files\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | 

"{640B2679-75CA-4F31-B54C-04CF2F21D884}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{76095CBE-581E-4FD9-8B3F-27CFA186B5C8}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 

"{7BE8D95A-ED28-470D-81AD-B2E77FB6BDF6}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\skyrim\creationkit.exe | 

"{8920E2F1-2B2C-41EE-A813-D273006E24DF}" = protocol=6 | dir=in | app=c:\program files\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | 

"{8DF698FE-3F08-4846-AF12-BC4A110E83E2}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\skyrim\creationkit.exe | 

"{99E3DF3C-D217-4E30-8B86-F687FC33116F}" = protocol=6 | dir=in | app=c:\program files\ubisoft\might & magic heroes vi\might & magic heroes vi.exe | 

"{A56A6984-19A2-49DC-8ABF-E19DB72F45BD}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{B473C7EC-BAE1-4233-8814-2576F05F865A}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{B786D160-106F-403C-A66D-66A3E879D0DE}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\skyrim\creationkit.exe | 

"{C18D05A7-37D2-4545-8F8D-E4541C7ECF01}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\skyrim\skyrimlauncher.exe | 

"{C5AE2B9C-1534-4169-8DE5-1CB48F2E710A}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\skyrim\skyrimlauncher.exe | 

"{D19827E9-4971-490A-BE1E-D9E512F64130}" = protocol=17 | dir=in | app=c:\program files\ubisoft\might & magic heroes vi\might & magic heroes vi.exe | 

"{D774FC06-2844-48B0-9EAB-0F8DAD595BF6}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\skyrim\creationkit.exe | 

"{D9C02157-C663-4CB1-A5AD-B071BC77B713}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 

"{DDA6738F-177B-432A-AFA4-A7D32AD6CE48}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\skyrim\skyrimlauncher.exe | 

"{DFC83CDD-61B9-47F8-90E5-EB2492D56B26}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{E932EE0A-692A-4210-9F9A-7E5DA83F2B02}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{F0A759CB-5D3B-4D01-A364-6B0CD1C49845}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{F5B9E49B-14A0-46FC-90B1-0F2EDEEE16EA}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{02FCAA8F-59D3-4198-822E-135C61EE4F0B}" = NeroKwikMedia Help (CHM)

"{03AEAB60-A7B3-A8DB-468B-EB30FB4B40B0}" = CCC Help German

"{03F1CC67-5BD8-4C36-8394-76311B2AE69A}" = ArcSoft PhotoStudio 5

"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam

"{07010016-0001-2010-0110-4D6161546563}" = MaaTec Sudoku

"{08C8666B-C502-4AB3-B4CB-D74AC42D14FE}" = Nero BackItUp 10 Help (CHM)

"{162ABED6-E60C-6CFF-100E-43C16ABBC5BE}" = CCC Help Chinese Standard

"{16987E99-C95C-4513-9239-7B44A0A71DB5}" = Nero SoundTrax 10 Help (CHM)

"{1808A2AC-DB66-6B80-9340-F6476390CB18}" = AMD Drag and Drop Transcoding

"{1CB724FF-D18C-8FFB-E7C9-0A09CF8EC066}" = CCC Help Japanese

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{1F7D9F37-C39C-486C-BDF8-8F440FFB3352}" = Nero Kwik Media

"{20C14CC3-5E3B-D39A-5B37-B15E59785063}" = CCC Help Chinese Traditional

"{2436F2A8-4B7E-4B6C-AE4E-604C84AA6A4F}" = Nero Core Components 10

"{2632A2C0-ECF4-7F79-7136-9FEA4C253A4C}" = CCC Help Turkish

"{277C1559-4CF7-44FF-8D07-98AA9C13AABD}" = Nero Multimedia Suite 10

"{2E376AD9-5C49-4F7D-A0BA-6A44E8FA5A3B}" = Next Generation Visualisations

"{30F712DA-64FE-5DBE-AE76-3F8EA3F8223C}" = CCC Help French

"{329411A0-19F3-4740-874F-17400B126F27}" = Nero Vision 10 Help (CHM)

"{330DAC67-5B62-452A-A0E4-6B4A5923940F}_is1" = MotioninJoy ds3 driver version 0.6.0005

"{33643918-7957-4839-92C7-EA96CB621A98}" = Nero Express 10 Help (CHM)

"{34490F4E-48D0-492E-8249-B48BECF0537C}" = Nero DiscSpeed 10

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{3C39B3CC-4EC8-C756-AF4B-72366504FCA5}" = CCC Help Hungarian

"{3E7D839E-A6E7-B6F8-F855-CF69756E6331}" = AMD Media Foundation Decoders

"{4CC9D761-A9B6-D8EA-D2A9-B74B5A90B108}" = CCC Help Norwegian

"{4F198874-3C7D-5983-02EB-9E234C43F174}" = AMD Steady Video Plug-In 

"{5180FB30-2AC7-1627-9856-AA0AE6ACB7E7}" = ccc-utility

"{523B2B1B-D8DB-4B41-90FF-C4D799E2758A}" = Nero ControlCenter 10 Help (CHM)

"{54B227A6-BDBE-69FA-D450-B99609063044}" = CCC Help Greek

"{555868C6-49FB-484F-BB43-8980651A1B00}" = Nero BurnRights 10 Help (CHM)

"{58CB9A9A-1EFB-4EA8-B50C-3097E754AC21}" = High-Definition Video Playback

"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth

"{5F548A02-80BC-404D-BAE6-F05F9BF6B449}" = Nero DiscCopyGadget 10 Help (CHM)

"{6006059E-013D-4B77-BC5C-4DD5E4A6570D}" = G Data InternetSecurity 2012

"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM

"{635A6AF2-63AF-4C1C-AF57-BDC8AF6D397D}" = UltraEdit

"{63AA3EAB-23BB-48B2-9AD0-44F878075604}" = Nero 10 Menu TemplatePack Basic

"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update

"{66049135-9659-4AAD-9169-9CCA269EBB3E}" = Nero InfoTool 10 Help (CHM)

"{68AB6930-5BFF-4FF6-923B-516A91984FE6}" = Nero BackItUp 10

"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2

"{6DFB899F-17A2-48F0-A533-ED8D6866CF38}" = Nero Control Center 10

"{70550193-1C22-445C-8FA4-564E155DB1A7}" = Nero Express 10

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{745D37C2-26F4-4B65-BA13-F9840EBFA75B}" = Might & Magic Heroes VI

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{7964AE02-9127-42C0-A917-2CE4CD4EFE3B}" = Nokia Suite

"{7A295D8F-484B-4FFB-89AB-C1FD497591FE}" = Nero WaveEditor 10 Help (CHM)

"{7A5D731D-B4B3-490E-B339-75685712BAAB}" = Nero Burning ROM 10

"{7C587778-C433-980E-F3C1-203890DC4FBE}" = CCC Help Polish

"{7DC3EABF-66A2-6D79-B485-6328525CA387}" = CCC Help Swedish

"{7E8242F8-BD2A-44D7-BCED-9B231A02B367}" = SpellForce 2 Patch

"{843603C6-75B7-BAB5-80DE-E76FB28DEEF2}" = CCC Help Finnish

"{876B50AF-D46A-ED35-C625-20F326FE0C49}" = AMD Accelerated Video Transcoding

"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8BBC66FD-0195-29B4-5A58-E0B0554E8F42}" = AMD VISION Engine Control Center

"{8C0CAA7A-3272-4991-A808-2C7559DE3409}" = Win7codecs

"{8D9EEAC7-42D5-3951-612A-EAA7B684C592}" = CCC Help Italian

"{8ECEC853-5C3D-4B10-B5C7-FF11FF724807}" = Nero Recode 10

"{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules

"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003

"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007

"{90120000-001F-0407-0000-0000000FF1CE}_VISPRO_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-0409-0000-0000000FF1CE}_VISPRO_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007

"{90120000-001F-040C-0000-0000000FF1CE}_VISPRO_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007

"{90120000-001F-0410-0000-0000000FF1CE}_VISPRO_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System

"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007

"{90120000-0051-0000-0000-0000000FF1CE}" = Microsoft Office Visio Professional 2007

"{90120000-0051-0000-0000-0000000FF1CE}_VISPRO_{CE144BF4-4950-4CDB-A5F7-CCE1888F49CB}" = Microsoft Office Visio 2007 Service Pack 3 (SP3)

"{90120000-0054-0407-0000-0000000FF1CE}" = Microsoft Office Visio MUI (German) 2007

"{90120000-0054-0407-0000-0000000FF1CE}_VISPRO_{3CB0380B-0413-4C44-A63B-DCD6369EAF4E}" = Microsoft Office Visio 2007 Service Pack 3 (SP3)

"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007

"{90120000-006E-0407-0000-0000000FF1CE}_VISPRO_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In

"{92E25238-61A3-4ACD-A407-3C480EEF47A7}" = Nero RescueAgent 10 Help (CHM)

"{92EC1A84-7FFC-42DF-A8F6-79C21C4765A5}" = Nero DiscCopy Gadget 10

"{943CFD7D-5336-47AF-9418-E02473A5A517}" = Nero BurnRights 10

"{9791DAED-B734-2835-988B-157BDA087496}" = CCC Help Dutch

"{98B740C3-FAA4-C523-7478-4DBCAB7B27D1}" = Catalyst Control Center Graphics Previews Common

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9A4297F3-2A51-4ED9-92CA-4BCB8380947E}" = Nero Vision 10

"{9B6B24BE-80E7-46C4-9FA5-B167D5E0F345}" = Nero BurningROM 10 Help (CHM)

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{9F0CAC6D-9B0D-A95F-CF61-6E88952D6181}" = CCC Help Thai

"{A25FF1C0-80B6-4B8B-A551-DC525697A408}" = AMD APP SDK Runtime

"{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1" = PDF-Viewer

"{A57025CC-5F2E-4D01-B387-06DB10500D43}" = Nokia Connectivity Cable Driver

"{A625DB70-98D5-16FD-C49D-4B8B1B2304A4}" = CCC Help Spanish

"{A90214C3-3A0C-2F05-6083-E1A4BAD9E30D}" = CCC Help Danish

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{AA123216-6DE0-E57C-DC57-4FECEACB482F}" = CCC Help Russian

"{ABBACAD2-4DAF-490E-932B-E330B33FCF98}" = Softi FreeOCR

"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch

"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86

"{BCE46757-7674-4416-BEDB-68205A60409E}" = Canon CanoScan Toolbox 4.1

"{BF14351F-DCB6-5F0B-9884-A49DFA901B4A}" = AMD Fuel

"{C18A0418-442A-4186-AF98-D08F5054A2FC}" = Nero DiscSpeed 10 Help (CHM)

"{C3273C55-E1E4-41FF-8D69-0158090DB8D8}" = Nero CoverDesigner 10 Help (CHM)

"{C3580AC4-C827-4332-B935-9A282ED5BB97}" = Nero Dolby Files 10

"{CCF298AF-9CE1-4B26-B251-486E98A34789}" = Windows 7 USB/DVD Download Tool

"{D0837A59-83E6-3392-1BD9-86D3445676DB}" = CCC Help Korean

"{D5068813-9F8D-9F7A-92C0-A3EECBA2D82B}" = AMD Catalyst Install Manager

"{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}" = Microsoft XNA Framework Redistributable 4.0 Refresh

"{D70AB273-113B-D7DE-5C8D-82CABA7CB0AF}" = Catalyst Control Center Localization All

"{DA5B2BDC-F654-4A88-A669-4D34BC7846A1}" = PC Connectivity Solution

"{DB7C1D4A-08BA-4C7E-A8AA-B7F9BB372DCF}" = Nero Recode 10 Help (CHM)

"{DC8772D4-C75F-5235-63E2-BBC73F909B7A}" = CCC Help Czech

"{DED7FD3C-DDD2-43BB-B0F5-B07F9D0430D3}" = CCC Help Portuguese

"{DF8195AF-8E6F-4487-A0EE-196F7E3F4B8A}" = jetAudio Plus VX

"{E0E55FC1-C53D-4F8D-B14B-B59C312747C8}" = LightScribe System Software

"{E157F2EB-E06F-B57F-9105-68F348DB2EAD}" = CCC Help English

"{E1EE5339-5D32-458F-BAAB-B19F6301BCE2}" = Nero SoundTrax 10

"{E2F0AF23-FE2F-4222-9A43-55E63CC41EF1}" = Catalyst Control Center - Branding

"{E337E787-CF61-4B7B-B84F-509202A54023}" = Nero RescueAgent 10

"{E3B64CC5-C011-40C0-92BC-7316CD5E5688}" = Microsoft_VC100_CRT_SP1_x86

"{EDCDFAD5-DF80-4600-A493-E9DAD6810230}" = Nero WaveEditor 10

"{EF036F44-A287-BC23-3F6E-AAE6FDEF47EF}" = Catalyst Control Center InstallProxy

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5

"{F412B4AF-388C-4FF5-9B2F-33DB1C536953}" = Nero InfoTool 10

"{F5CB822F-B365-43D1-BCC0-4FDA1A2017A7}" = Nero 10 Movie ThemePack Basic

"{F6117F9C-ADB5-4590-9BE4-12C7BEC28702}" = Nero StartSmart 10 Help (CHM)

"{F61D489E-6C44-49AC-AD02-7DA8ACA73A65}" = Nero StartSmart 10

"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"{FCF00A6E-FB58-477A-ABE9-232907105521}" = Nero CoverDesigner 10

"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)

"6af12c54-643b-4752-87d0-8335503010de_is1" = Nexus Mod Manager

"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX

"Adobe Shockwave Player" = Adobe Shockwave Player 11.6

"AnyDVD" = AnyDVD

"Avidemux 2.5" = Avidemux 2.5 (32-bit)

"CCleaner" = CCleaner

"CloneDVD2" = CloneDVD2

"DAEMON Tools Lite" = DAEMON Tools Lite

"Diablo III" = Diablo III

"Easy Video Splitter_is1" = Easy Video Splitter 1.28

"ElsterFormular 13.1.1.8531p" = ElsterFormular

"ImgBurn" = ImgBurn

"InstallShield_{635A6AF2-63AF-4C1C-AF57-BDC8AF6D397D}" = UltraEdit

"IrfanView" = IrfanView (remove only)

"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.1.1000

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"Nokia Suite" = Nokia Suite

"Notepad++" = Notepad++

"Steam App 202480" = Creation Kit

"Steam App 72850" = The Elder Scrolls V: Skyrim

"TomTom HOME" = TomTom HOME 2.8.2.2264

"Totalcmd" = Total Commander (Remove or Repair)

"VISPRO" = Microsoft Office Visio Professional 2007

"VLC media player" = VLC media player 1.1.11

"VobSub" = VobSub v2.23 (Remove Only)

"vsfilter_is1" = DirectVobSub 2.40.3644 x86

"WinGimp-2.0_is1" = GIMP 2.6.11

"WinRAR archiver" = WinRAR 4.01 (32-Bit)

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"SuDoKu-Cracker" = SuDoKu-Cracker

 
 ========== Last 20 Event Log Errors ==========

 

[ Application Events ]

Error - 05.07.2012 05:52:57 | Computer Name = Jubeldibub | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567,

 Zeitstempel: 0x4d6727a7  Name des fehlerhaften Moduls: MSVCR80.dll, Version: 8.0.50727.6195,

 Zeitstempel: 0x4dcddbf3  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0001541c  ID des fehlerhaften

 Prozesses: 0x1cb4  Startzeit der fehlerhaften Anwendung: 0x01cd5a91fe76a3a4  Pfad der

 fehlerhaften Anwendung: C:\Windows\explorer.exe  Pfad des fehlerhaften Moduls: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\MSVCR80.dll

Berichtskennung:

 329eddcd-c687-11e1-85f3-6cf049013ce5

 

Error - 05.07.2012 06:14:44 | Computer Name = Jubeldibub | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567,

 Zeitstempel: 0x4d6727a7  Name des fehlerhaften Moduls: DivXMFSource.dll, Version:

 1.0.0.72, Zeitstempel: 0x4cffcf66  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0009b890

ID

 des fehlerhaften Prozesses: 0x1eb0  Startzeit der fehlerhaften Anwendung: 0x01cd5a96e90677f5

Pfad

 der fehlerhaften Anwendung: C:\Windows\explorer.exe  Pfad des fehlerhaften Moduls:

 C:\Program Files\Win7codecs\filters\DivXMFSource.dll  Berichtskennung: 3d1a2100-c68a-11e1-85f3-6cf049013ce5

 

Error - 05.07.2012 08:45:36 | Computer Name = Jubeldibub | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567,

 Zeitstempel: 0x4d6727a7  Name des fehlerhaften Moduls: DivXMFSource.dll, Version:

 1.0.0.72, Zeitstempel: 0x4cffcf66  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0009b8a1

ID

 des fehlerhaften Prozesses: 0x16b4  Startzeit der fehlerhaften Anwendung: 0x01cd5aabd5b800af

Pfad

 der fehlerhaften Anwendung: C:\Windows\explorer.exe  Pfad des fehlerhaften Moduls:

 C:\Program Files\Win7codecs\filters\DivXMFSource.dll  Berichtskennung: 509cf719-c69f-11e1-85f3-6cf049013ce5

 

Error - 05.07.2012 08:53:41 | Computer Name = Jubeldibub | Source = WinMgmt | ID = 10

Description = 

 

Error - 05.07.2012 13:46:00 | Computer Name = Jubeldibub | Source = WinMgmt | ID = 10

Description = 

 

Error - 06.07.2012 01:55:12 | Computer Name = Jubeldibub | Source = WinMgmt | ID = 10

Description = 

 

Error - 06.07.2012 02:04:21 | Computer Name = Jubeldibub | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: MsiExec.exe, Version: 5.0.7601.17514,

 Zeitstempel: 0x4ce792c4  Name des fehlerhaften Moduls: MSIFB36.tmp, Version: 2.0.0.9,

 Zeitstempel: 0x4d4b089c  Ausnahmecode: 0xc000000d  Fehleroffset: 0x00019d88  ID des fehlerhaften

 Prozesses: 0x980  Startzeit der fehlerhaften Anwendung: 0x01cd5b3d26a6f11c  Pfad der

 fehlerhaften Anwendung: C:\Windows\system32\MsiExec.exe  Pfad des fehlerhaften Moduls:

 C:\Windows\Installer\MSIFB36.tmp  Berichtskennung: 6da2816e-c730-11e1-9aef-6cf049013ce5

 

Error - 06.07.2012 02:04:38 | Computer Name = Jubeldibub | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: MsiExec.exe, Version: 5.0.7601.17514,

 Zeitstempel: 0x4ce792c4  Name des fehlerhaften Moduls: MSI7893.tmp, Version: 2.0.0.9,

 Zeitstempel: 0x4d4b089c  Ausnahmecode: 0xc000000d  Fehleroffset: 0x00019d88  ID des fehlerhaften

 Prozesses: 0x1508  Startzeit der fehlerhaften Anwendung: 0x01cd5b3d39966a82  Pfad der

 fehlerhaften Anwendung: C:\Windows\system32\MsiExec.exe  Pfad des fehlerhaften Moduls:

 C:\Windows\Installer\MSI7893.tmp  Berichtskennung: 77b798cf-c730-11e1-9aef-6cf049013ce5

 

Error - 06.07.2012 08:31:33 | Computer Name = Jubeldibub | Source = WinMgmt | ID = 10

Description = 

 

Error - 06.07.2012 10:17:08 | Computer Name = Jubeldibub | Source = WinMgmt | ID = 10

Description = 

 

[ System Events ]

Error - 30.10.2012 14:13:26 | Computer Name = Jubeldibub | Source = Service Control Manager | ID = 7000

Description = Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%2

 

Error - 30.10.2012 14:13:34 | Computer Name = Jubeldibub | Source = Service Control Manager | ID = 7000

Description = Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%2

 

Error - 30.10.2012 16:59:17 | Computer Name = Jubeldibub | Source = Service Control Manager | ID = 7000

Description = Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%2

 

Error - 31.10.2012 03:21:19 | Computer Name = Jubeldibub | Source = Service Control Manager | ID = 7000

Description = Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%2

 

Error - 31.10.2012 09:10:00 | Computer Name = Jubeldibub | Source = Service Control Manager | ID = 7000

Description = Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%2

 

Error - 31.10.2012 18:14:32 | Computer Name = Jubeldibub | Source = Service Control Manager | ID = 7000

Description = Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%2

 

Error - 01.11.2012 03:10:24 | Computer Name = Jubeldibub | Source = Service Control Manager | ID = 7000

Description = Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%2

 

Error - 01.11.2012 13:45:01 | Computer Name = Jubeldibub | Source = Service Control Manager | ID = 7000

Description = Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%2

 

Error - 02.11.2012 03:21:38 | Computer Name = Jubeldibub | Source = Service Control Manager | ID = 7000

Description = Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%2

 

Error - 02.11.2012 11:31:41 | Computer Name = Jubeldibub | Source = Service Control Manager | ID = 7000

Description = Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%2

 

 

< End of report >

--- --- ---

Und die CCleaner-Liste der installierten Programme:

Code:

Adobe Flash Player 11 ActiveX        Adobe Systems Incorporated        09.10.2012        6,00MB        11.4.402.287

Adobe Reader X (10.1.4) - Deutsch        Adobe Systems Incorporated        15.08.2012        121MB        10.1.4

Adobe Shockwave Player 11.6        Adobe Systems, Inc.        14.05.2012                11.6.5.635

AMD Catalyst Install Manager        Advanced Micro Devices, Inc.        26.10.2012        20,2MB        8.0.891.0

ArcSoft PhotoStudio 5                03.12.2011                

Avidemux 2.5 (32-bit)                12.07.2012                2.5.6.7716

Canon CanoScan Toolbox 4.1                01.12.2011                

CCleaner        Piriform        24.10.2012                3.24

Compatibility Pack für 2007 Office System        Microsoft Corporation        10.10.2012        147MB        12.0.6612.1000

Creation Kit                20.04.2012                

DAEMON Tools Lite        DT Soft Ltd        18.04.2012                4.45.4.0315

Diablo III        Blizzard Entertainment        17.05.2012                1.0.1.9558

DirectVobSub 2.40.3644 x86        MPC-HC Team        20.09.2011        2,10MB        2.40.3644

Easy Video Splitter 1.28        DoEasier Tech Inc        25.06.2012                

ElsterFormular        Landesfinanzdirektion Thüringen        28.03.2012        160MB        13.1.1.8531p

G Data InternetSecurity 2012        G Data Software AG        17.09.2011        78,5MB        22.0.0.0

GIMP 2.6.11        The GIMP Team        14.10.2011        107MB        2.6.11

Google Earth        Google        19.11.2011        92,7MB        6.1.0.5001

ImgBurn        LIGHTNING UK!        05.01.2012                2.5.6.0

IrfanView (remove only)        Irfan Skiljan        25.09.2011        1,50MB        4.30

jetAudio Plus VX        COWON        18.09.2011                8.0.6

LightScribe System Software        LightScribe        18.09.2011        25,1MB        1.18.22.2

MaaTec Sudoku        MaaTec        02.08.2012        4,78MB        1.9.3

Malwarebytes Anti-Malware Version 1.65.1.1000        Malwarebytes Corporation        30.10.2012        19,4MB        1.65.1.1000

Microsoft .NET Framework 4 Client Profile        Microsoft Corporation        17.09.2011        38,8MB        4.0.30319

Microsoft .NET Framework 4 Client Profile DEU Language Pack        Microsoft Corporation        17.09.2011        2,93MB        4.0.30319

Microsoft Office File Validation Add-In        Microsoft Corporation        20.09.2011        7,95MB        14.0.5130.5003

Microsoft Office Live Add-in 1.5        Microsoft Corporation        18.04.2012        508KB        2.0.4024.1

Microsoft Office Professional Edition 2003        Microsoft Corporation        10.10.2012        955MB        11.0.8173.0

Microsoft Office Visio Professional 2007        Microsoft Corporation        30.10.2011                12.0.6612.1000

Microsoft Silverlight        Microsoft Corporation        09.05.2012        102MB        5.1.10411.0

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053        Microsoft Corporation        24.01.2012        250KB        8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable        Microsoft Corporation        19.09.2011        300KB        8.0.56336

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17        Microsoft Corporation        18.09.2011        240KB        9.0.30729

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148        Microsoft Corporation        17.09.2011        588KB        9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161        Microsoft Corporation        17.09.2011        600KB        9.0.30729.6161

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219        Microsoft Corporation        21.04.2012        12,2MB        10.0.40219

Microsoft XNA Framework Redistributable 4.0 Refresh        Microsoft Corporation        25.04.2012        8,03MB        4.0.30901.0

Might & Magic Heroes VI        Ubisoft        24.01.2012                1.2.1

MotioninJoy ds3 driver version 0.6.0005        www.motioninjoy.com        20.04.2012        3,35MB        0.6.00005

MSXML 4.0 SP2 (KB954430)        Microsoft Corporation        19.09.2011        35,0KB        4.20.9870.0

MSXML 4.0 SP2 (KB973688)        Microsoft Corporation        19.09.2011        1,33MB        4.20.9876.0

Nero BackItUp 10        Nero AG        18.09.2011        117MB        5.8.10400.4.100

Nero Burning ROM 10        Nero AG        18.09.2011        168MB        10.6.10600.4.100

Nero BurnRights 10        Nero AG        18.09.2011        6,14MB        4.4.10300.1.100

Nero CoverDesigner 10        Nero AG        18.09.2011        91,4MB        5.6.10500.3.100

Nero DiscCopy Gadget 10        Nero AG        18.09.2011        34,6MB        3.6.10200.1.100

Nero DiscSpeed 10        Nero AG        18.09.2011        7,21MB        6.4.10400.0.100

Nero Express 10        Nero AG        18.09.2011        165MB        10.6.10600.4.100

Nero InfoTool 10        Nero AG        18.09.2011        7,78MB        7.4.10200.0.100

Nero Kwik Media        Nero AG        18.09.2011        249MB        1.6.14000.46.100

Nero Multimedia Suite 10        Nero AG        18.09.2011        1,67GB        10.6.11300

Nero Recode 10        Nero AG        18.09.2011        79,3MB        4.10.10600.4.100

Nero RescueAgent 10        Nero AG        18.09.2011        6,53MB        3.6.10500.3.100

Nero SoundTrax 10        Nero AG        18.09.2011        98,1MB        4.10.10300.2.100

Nero StartSmart 10        Nero AG        18.09.2011        143MB        10.6.10400.2.100

Nero Update        Nero AG        18.09.2011        1,46MB        1.0.10900.31.0

Nero Vision 10        Nero AG        18.09.2011        223MB        7.4.10800.7.100

Nero WaveEditor 10        Nero AG        18.09.2011        79,1MB        5.10.10400.3.100

Next Generation Visualisations         Microsoft        26.09.2011        14,5MB        1.0.0

Nexus Mod Manager        Black Tree Gaming        04.09.2012        13,4MB        0.19.0

Nokia Connectivity Cable Driver        Nokia        17.06.2012        3,35MB        7.1.78.0

Nokia Suite        Nokia        17.06.2012                3.4.49.0

Notepad++                24.04.2012                6.1.1

PC Connectivity Solution        Nokia        17.06.2012        14,8MB        12.0.17.0

PDF-Viewer        Tracker Software Products Ltd        05.07.2012        36,7MB        2.5.203.0

Softi FreeOCR        Softi Software        21.03.2012        8,91MB        2.6.0

Steam        Valve Corporation        19.04.2012        35,4MB        1.0.0.0

SuDoKu-Cracker                02.08.2012                

The Elder Scrolls V: Skyrim        Bethesda Game Studios        20.04.2012                

TomTom HOME 2.8.2.2264        TomTom        09.11.2011                2.8.2.2264

TomTom HOME Visual Studio Merge Modules        TomTom International B.V.        09.11.2011        1,88MB        1.0.2

Total Commander (Remove or Repair)        Ghisler Software GmbH        18.09.2011                7.55a

Ubisoft Game Launcher        UBISOFT        24.01.2012                1.0.0.0

UltraEdit        IDM Computer Solutions, Inc.        27.10.2012        47,4MB        18.00.1029

VLC media player 1.1.11        VideoLAN        18.09.2011                1.1.11

VobSub v2.23 (Remove Only)                09.05.2012                

Win7codecs        Shark007        20.09.2011        63,1MB        3.0.7

Windows 7 USB/DVD Download Tool        Microsoft Corporation        05.01.2012        2,71MB        1.0.30

Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)        Nokia        17.06.2012                08/22/2008 7.0.0.0

WinRAR 4.01 (32-Bit)        win.rar GmbH        18.09.2011                4.01.0

Alle Logs sind auch noch einmal als TXT im Anhang.

1.
OTL wurde falsch platziert/gespeichert:
OTL muss auf dem Desktop abgelegt werden!
Stell deine Browser so ein, dass er OTL auf dem Desktop speichern soll!
also entfernen und erneut herunterladen:-> Lade OTL von Oldtimer herunter und speichere es auf Deinem Desktop.
** nachdem es gespeichert wurde auf dem Desktop in das Logfile von OTL, soll etwa so aussehen:

Zitat:

Folder = C:\Users\Dein Name\Desktop

2.
Systemscan mit OTL

Doppelklick auf die OTL.exe
Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
Unter Extra Registry, wähle bitte Use SafeList
Mache Häckchen bei LOP- und Purity-Prüfung
Klicke nun auf Run Scan links oben
Wenn der Scan beendet wurde werden 2 Logfiles erstellt - OTL.txt und Extras.txt
Poste die Logfiles in Code-Tags hier in den Thread.

Hi,

okay - wusste nicht, dass das relevant ist. Hier also vom Desktop aus gestartet:

OTL Logfile:

Code:

OTL logfile created on: 02.11.2012 23:27:48 - Run 3

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\***\Desktop

 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,25 Gb Total Physical Memory | 2,07 Gb Available Physical Memory | 63,80% Memory free

13,01 Gb Paging File | 11,54 Gb Available in Paging File | 88,70% Paging File free

Paging file location(s): c:\pagefile.sys 10000 10000 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 465,66 Gb Total Space | 314,88 Gb Free Space | 67,62% Space Free | Partition Type: NTFS

 

Computer Name: JUBELDIBUB | User Name: *** | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\***\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Windows\System32\Macromed\Flash\FlashUtil32_11_4_402_287_ActiveX.exe (Adobe Systems Incorporated)

PRC - C:\Programme\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Advanced Micro Devices, Inc.)

PRC - C:\Windows\System32\atieclxx.exe (AMD)

PRC - C:\Windows\System32\atiesrxx.exe (AMD)

PRC - C:\Programme\G Data\InternetSecurity\AVKTray\AVKTray.exe (G Data Software AG)

PRC - C:\Programme\G Data\InternetSecurity\AVK\AVKWCtl.exe (G Data Software AG)

PRC - C:\Programme\Internet Explorer\iexplore.exe (Microsoft Corporation)

PRC - C:\Programme\Common Files\G Data\AVKProxy\AVKProxy.exe (G Data Software AG)

PRC - C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

PRC - C:\Programme\G Data\InternetSecurity\Firewall\GDFwSvc.exe (G Data Software AG)

PRC - C:\Programme\Common Files\G Data\GDScan\GDScan.exe (G Data Software AG)

PRC - C:\Programme\G Data\InternetSecurity\Firewall\GDFirewallTray.exe (G Data Software AG)

PRC - C:\Programme\G Data\InternetSecurity\AVK\AVKService.exe (G Data Software AG)

PRC - C:\Programme\TomTom HOME 2\TomTomHOMEService.exe (TomTom)

PRC - C:\Programme\Nero\Nero 10\Nero BackItUp\NBAgent.exe (Nero AG)

PRC - C:\Programme\Nero\Update\NASvc.exe (Nero AG)

PRC - C:\Windows\explorer.exe (Microsoft Corporation)

PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)

PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)

PRC - C:\Programme\Common Files\microsoft shared\VS7Debug\MDM.EXE (Microsoft Corporation)

 

 
 ========== Modules (No Company Name) ==========

 

MOD - C:\Programme\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsFormsIntegra#\44752ffa92ebb7170951a41898d8b9c6\WindowsFormsIntegration.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\3971e166cf827b6726e142f344061dc9\System.Windows.Forms.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\199683f6e79076b634ee6cc0a82c0654\PresentationFramework.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\e7dc084827f8df2dbdc819db5c633a0d\PresentationCore.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\21f37f9f5162af7efb52169012bd111e\WindowsBase.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\8c40f40ef36622109793788049fbe9ab\System.Drawing.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\UIAutomationProvider\05787d96761cf20b76b927ace10ef1d3\UIAutomationProvider.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\65f0d70169a0e73b45307dddbd86f92b\System.Runtime.Remoting.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\d234eceae699d070b5a5712ce776c01f\System.Xaml.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\a5fa2a1cfc6e9fdc39d9a8f2baa57bc9\PresentationFramework.Aero.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\ed91b57205429a23bb91f4499059a459\System.Core.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\d1f299160424bad90fe9f658661389e2\System.Xml.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\623d2a0f11dd82bb9bc13d1cb981b239\System.Configuration.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System\6f9f0467e8b2dd3f69b015c8e30ac945\System.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\3953b1d8b9b57e4957bff8f58145384e\mscorlib.ni.dll ()

MOD - C:\Programme\Notepad++\NppShell_04.dll ()

MOD - C:\Programme\WinRAR\RarExt.dll ()

MOD - C:\Programme\Common Files\LightScribe\QtGui4.dll ()

MOD - C:\Programme\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll ()

MOD - C:\Programme\Common Files\LightScribe\QtCore4.dll ()

 

 
 ========== Services (SafeList) ==========

 

SRV - (WinHttpAutoProxySvc) -- winhttp.dll File not found

SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)

SRV - (AMD FUEL Service) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Advanced Micro Devices, Inc.)

SRV - (AMD External Events Utility) -- C:\Windows\System32\atiesrxx.exe (AMD)

SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)

SRV - (AVKWCtl) -- C:\Programme\G Data\InternetSecurity\AVK\AVKWCtl.exe (G Data Software AG)

SRV - (AVKProxy) -- C:\Programme\Common Files\G Data\AVKProxy\AVKProxy.exe (G Data Software AG)

SRV - (AdobeARMservice) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

SRV - (GDFwSvc) -- C:\Programme\G Data\InternetSecurity\Firewall\GDFwSvc.exe (G Data Software AG)

SRV - (ServiceLayer) -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia)

SRV - (GDScan) -- C:\Programme\Common Files\G Data\GDScan\GDScan.exe (G Data Software AG)

SRV - (AVKService) -- C:\Programme\G Data\InternetSecurity\AVK\AVKService.exe (G Data Software AG)

SRV - (odserv) -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)

SRV - (TomTomHOMEService) -- C:\Programme\TomTom HOME 2\TomTomHOMEService.exe (TomTom)

SRV - (NAUpdate) -- C:\Programme\Nero\Update\NASvc.exe (Nero AG)

SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)

SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation)

SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)

SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SRV - (MDM) -- C:\Programme\Common Files\microsoft shared\VS7Debug\MDM.EXE (Microsoft Corporation)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)

DRV - (amdkmdag) -- C:\Windows\System32\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)

DRV - (amdkmdap) -- C:\Windows\System32\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)

DRV - (GDPkIcpt) -- C:\Windows\System32\drivers\PktIcpt.sys (G Data Software AG)

DRV - (GDMnIcpt) -- C:\Windows\System32\drivers\MiniIcpt.sys (G Data Software AG)

DRV - (GDBehave) -- C:\Windows\System32\drivers\GDBehave.sys (G Data Software AG)

DRV - (gdwfpcd) -- C:\Windows\System32\drivers\gdwfpcd32.sys (G Data Software AG)

DRV - (HookCentre) -- C:\Windows\System32\drivers\HookCentre.sys (G Data Software AG)

DRV - (AtiHDAudioService) -- C:\Windows\System32\drivers\AtihdW73.sys (Advanced Micro Devices)

DRV - (pccsmcfd) -- C:\Windows\System32\drivers\pccsmcfd.sys (Nokia)

DRV - (dtsoftbus01) -- C:\Windows\System32\drivers\dtsoftbus01.sys (DT Soft Ltd)

DRV - (AODDriver4.2) -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\i386\aoddriver2.sys (Advanced Micro Devices)

DRV - (AODDriver4.01) -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\i386\aoddriver2.sys (Advanced Micro Devices)

DRV - (nmwcdnsu) -- C:\Windows\System32\drivers\nmwcdnsu.sys (Nokia)

DRV - (nmwcdc) -- C:\Windows\System32\drivers\ccdcmbo.sys (Nokia)

DRV - (nmwcd) -- C:\Windows\System32\drivers\ccdcmb.sys (Nokia)

DRV - (nmwcdnsuc) -- C:\Windows\System32\drivers\nmwcdnsuc.sys (Nokia)

DRV - (UsbserFilt) -- C:\Windows\System32\drivers\usbser_lowerfltj.sys (Nokia)

DRV - (upperdev) -- C:\Windows\System32\drivers\usbser_lowerflt.sys (Nokia)

DRV - (GRD) -- C:\Windows\System32\drivers\GRD.sys (G Data Software)

DRV - (MotioninJoyXFilter) -- C:\Windows\System32\drivers\MijXfilt.sys (MotioninJoy)

DRV - (GdNetMon) -- C:\Windows\System32\drivers\GdNetMon32.sys (G Data Software AG)

DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)

DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)

DRV - (TsUsbGD) -- C:\Windows\System32\drivers\TsUsbGD.sys (Microsoft Corporation)

DRV - (amdiox86) -- C:\Windows\System32\drivers\amdiox86.sys (Advanced Micro Devices)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default Download Directory = C:\Users\***

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ig

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 7A 8A 88 C6 5B 75 CC 01  [binary data]

IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 
 ========== FireFox ==========

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF - HKLM\Software\MozillaPlugins\@nokia.com/EnablerPlugin: C:\Program Files\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

 

[2011.11.09 15:54:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions

[2011.11.09 15:54:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions\home2@tomtom.com

 

O1 HOSTS File: ([2009.06.10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O2 - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Programme\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)

O2 - BHO: (G Data BankGuard) - {BA3295CF-17ED-4F49-9E95-D999A0ADBFDC} - C:\Programme\Common Files\G Data\AVKProxy\BanksafeBHO.dll (G Data Software AG)

O4 - HKLM..\Run: [G Data AntiVirus Tray Application] C:\Programme\G Data\InternetSecurity\AVKTray\AVKTray.exe (G Data Software AG)

O4 - HKLM..\Run: [GDFirewallTray] C:\Programme\G Data\InternetSecurity\Firewall\GDFirewallTray.exe (G Data Software AG)

O4 - HKLM..\Run: [NBAgent] C:\Program Files\Nero\Nero 10\Nero BackItUp\NBAgent.exe (Nero AG)

O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKCU..\Run: []  File not found

O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)

O4 - HKCU..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1

O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105 File not found

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)

O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000 File not found

O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)

O13 - gopher Prefix: missing

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0B880486-C259-45D7-A17F-6B65B73BE9EA}: DhcpNameServer = 192.168.178.1

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll File not found

O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll File not found

O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll File not found

O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)

O18 - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Programme\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)

O18 - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Programme\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)

O20 - HKLM Winlogon: Shell - (explorer.exe) -  File not found

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -  File not found

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O29 - HKLM SecurityProviders - (credssp.dll) -  File not found

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.11.02 23:26:53 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe

[2012.11.02 16:41:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2012.11.02 16:41:47 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2012.10.30 09:47:09 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes

[2012.10.30 09:46:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.10.30 09:46:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.10.30 09:46:54 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2012.10.30 09:46:54 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2012.10.27 19:48:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UltraEdit

[2012.10.27 19:48:06 | 000,000,000 | ---D | C] -- C:\Program Files\UltraEdit

[2012.10.26 08:14:45 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI

[2012.10.26 08:14:42 | 000,000,000 | ---D | C] -- C:\Program Files\AMD AVT

[2012.10.26 08:14:38 | 000,000,000 | ---D | C] -- C:\Program Files\AMD APP

[2012.10.26 08:14:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center

[2012.10.10 07:14:51 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll

[2012.10.10 07:14:45 | 000,271,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe

[2012.10.10 07:14:45 | 000,169,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winsrv.dll

[2012.10.10 07:14:45 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll

[2012.10.10 07:14:45 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll

[2012.10.10 07:14:45 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll

[2012.10.10 07:14:45 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll

[2012.10.10 07:14:45 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll

[2012.10.10 07:14:45 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll

[2012.10.10 07:14:45 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll

[2012.10.10 07:14:45 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll

[2012.10.10 07:14:45 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll

[2012.10.10 07:14:35 | 003,968,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe

[2012.10.10 07:14:35 | 003,914,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.11.02 23:27:00 | 000,001,114 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012.11.02 23:26:53 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe

[2012.11.02 23:24:26 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012.11.02 23:24:19 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.11.02 23:24:17 | 2615,320,576 | -HS- | M] () -- C:\hiberfil.sys

[2012.11.02 20:36:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.11.02 20:35:04 | 000,848,851 | ---- | M] () -- C:\Windows\System32\sig.bin

[2012.11.02 20:35:04 | 000,045,713 | ---- | M] () -- C:\Windows\System32\nmp.map

[2012.11.02 20:34:03 | 000,657,428 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012.11.02 20:34:03 | 000,618,714 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012.11.02 20:34:03 | 000,130,818 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012.11.02 20:34:03 | 000,107,034 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012.11.02 16:38:49 | 000,021,664 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.11.02 16:38:49 | 000,021,664 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.10.29 17:47:29 | 000,000,257 | ---- | M] () -- C:\Users\***\Desktop\Clever-Forum.de - das clevere Forum  Das Excel-Forum  X in Spalte A zählen, wenn Y in Spalte B.url

[2012.10.29 17:19:46 | 000,078,336 | ---- | M] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2012.10.26 04:28:31 | 186,723,478 | ---- | M] () -- C:\Users\***\TBBT-S06E05.avi

[2012.10.21 18:30:45 | 000,000,258 | ---- | M] () -- C:\Users\***\Desktop\Amazon.com Sea Of Serenity Purewhitenoise.Com MP3 Downloads.url

[2012.10.21 18:30:17 | 000,000,139 | ---- | M] () -- C:\Users\***\Desktop\Rain Fall Music for Sleep Rain Song [Rain Sounds for Sleep] Relax to the Music of Rain with Rain Song Rain Storm Sound with Music for Sleep.url

[2012.10.09 14:36:06 | 000,696,760 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe

[2012.10.09 14:36:06 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl

 
 ========== Files Created - No Company Name ==========

 

[2012.11.02 10:18:30 | 186,723,478 | ---- | C] () -- C:\Users\***\TBBT-S06E05.avi

[2012.10.29 17:47:29 | 000,000,257 | ---- | C] () -- C:\Users\***\Desktop\Clever-Forum.de - das clevere Forum  Das Excel-Forum  X in Spalte A zählen, wenn Y in Spalte B.url

[2012.10.21 18:30:45 | 000,000,258 | ---- | C] () -- C:\Users\***\Desktop\Amazon.com Sea Of Serenity Purewhitenoise.Com MP3 Downloads.url

[2012.10.21 18:30:17 | 000,000,139 | ---- | C] () -- C:\Users\***\Desktop\Rain Fall Music for Sleep Rain Song [Rain Sounds for Sleep] Relax to the Music of Rain with Rain Song Rain Storm Sound with Music for Sleep.url

[2012.09.28 14:36:56 | 000,180,224 | ---- | C] () -- C:\Windows\System32\clinfo.exe

[2012.05.23 16:31:02 | 000,632,252 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat

[2012.05.02 13:58:10 | 000,029,184 | ---- | C] () -- C:\Windows\System32\kdbsdk32.dll

[2012.03.21 15:33:47 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol

[2012.02.15 03:28:34 | 000,157,144 | ---- | C] () -- C:\Windows\System32\ativvsva.dat

[2012.02.15 03:28:32 | 000,204,952 | ---- | C] () -- C:\Windows\System32\ativvsvl.dat

[2011.09.30 11:24:13 | 000,004,096 | -H-- | C] () -- C:\Users\***\AppData\Local\keyfile3.drm

[2011.09.19 17:01:50 | 000,078,336 | ---- | C] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011.09.18 15:33:47 | 000,000,083 | -HS- | C] () -- C:\ProgramData\.zreglib

[2011.09.18 10:49:23 | 000,000,534 | ---- | C] () -- C:\Windows\ODBC.INI

[2011.09.17 19:13:24 | 000,848,851 | ---- | C] () -- C:\Windows\System32\sig.bin

[2011.09.17 16:44:36 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2011.09.12 23:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\System32\atipblag.dat

[2011.08.31 13:29:00 | 004,023,808 | ---- | C] () -- C:\Windows\System32\x264vfw.dll

[2011.07.12 15:56:50 | 000,074,752 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll

[2011.07.03 18:48:42 | 000,147,456 | ---- | C] ( ) -- C:\Windows\System32\lagarith.dll

[2011.06.17 05:26:10 | 000,243,200 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll

[2011.06.17 05:17:28 | 000,650,752 | ---- | C] () -- C:\Windows\System32\xvidcore.dll

[2011.04.12 02:30:05 | 000,657,428 | ---- | C] () -- C:\Windows\System32\perfh007.dat

[2011.04.12 02:30:05 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat

[2011.04.12 02:30:05 | 000,130,818 | ---- | C] () -- C:\Windows\System32\perfc007.dat

[2011.04.12 02:30:05 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat

 
 ========== ZeroAccess Check ==========

 

[2009.07.14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 22:29:20 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 
 ========== LOP Check ==========

 

[2012.07.12 08:54:47 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\avidemux

[2012.10.25 12:01:18 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Canon

[2011.09.19 17:01:27 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\COWON

[2012.04.18 19:40:31 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DAEMON Tools Lite

[2012.03.28 14:36:08 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\elsterformular

[2011.10.19 13:19:32 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\GHISLER

[2012.07.13 13:31:12 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\gtk-2.0

[2012.01.05 18:22:37 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ImgBurn

[2012.08.02 20:05:20 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\MaaTec

[2012.04.24 19:34:19 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Might & Magic Heroes VI

[2012.04.20 20:45:48 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\MotioninJoy

[2012.01.24 16:59:14 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Nokia

[2012.04.24 10:08:57 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Notepad++

[2012.01.24 17:01:15 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\PC Suite

[2012.09.08 14:31:50 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\RenPy

[2012.03.21 16:09:44 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ScanSoft

[2012.03.21 16:48:09 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Softi Software

[2012.06.06 22:38:53 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Titanium

[2011.11.09 15:54:19 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TomTom

[2011.09.20 18:13:54 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Win7codecs

[2012.03.21 15:38:17 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Zeon

 
 ========== Purity Check ==========

 

 
 

< End of report >

--- --- ---

OTL Logfile:

Code:

OTL Extras logfile created on: 02.11.2012 23:27:48 - Run 3

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\***\Desktop

 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,25 Gb Total Physical Memory | 2,07 Gb Available Physical Memory | 63,80% Memory free

13,01 Gb Paging File | 11,54 Gb Available in Paging File | 88,70% Paging File free

Paging file location(s): c:\pagefile.sys 10000 10000 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 465,66 Gb Total Space | 314,88 Gb Free Space | 67,62% Space Free | Partition Type: NTFS

 

Computer Name: JUBELDIBUB | User Name: *** | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

.reg [@ = regfile] -- regedit.exe "%1"

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [open] -- regedit.exe "%1"

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files\VLC Media Player\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [cmd] -- cmd.exe /s /k pushd "%V"

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Program Files\VLC Media Player\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 0

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 0

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"EnableFirewall" = 0

"DisableNotifications" = 0

 
 ========== Authorized Applications List ==========

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{07418BEC-32B2-4BBB-90B6-96A18C26C57E}" = lport=445 | protocol=6 | dir=in | app=system | 

"{1ACFEB17-25FE-4962-8418-A7076255ADC1}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 

"{1E018D47-4D7A-4BCC-8D10-9C291B643920}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{1EFAAE3F-E135-4507-9597-7528F935EC92}" = rport=445 | protocol=6 | dir=out | app=system | 

"{37AA065A-4630-4A6A-AB5F-9CEDA2BFE59E}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{38EB0773-D885-43CA-AF37-CE22BADC41F8}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{6F6FB99F-338E-4C2E-BACA-9D93D54C5142}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{7C088D17-B82B-4C23-A74F-EFB7409A58A4}" = rport=139 | protocol=6 | dir=out | app=system | 

"{85AA6498-9DF5-44D1-B418-2502F65DCAB1}" = rport=10243 | protocol=6 | dir=out | app=system | 

"{8CB01AE0-9095-4838-9C1A-4C5217654AAD}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{8DC2B5DD-A6B4-4EA9-9AD1-CED060EBDC22}" = lport=10243 | protocol=6 | dir=in | app=system | 

"{8F0B4B9F-4E20-413E-B1EB-F7D9BBE0F2E1}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{99A71136-42E0-45EE-9032-23DDD807BD73}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{A2530926-955F-4F25-B7D7-75F7183ED877}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{BCE01428-F70E-4C6E-8ADF-264BD465BCAC}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{BF558F8D-C6AD-41CE-950C-FDF17E09F539}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{CC66DC8D-2AE4-44A3-98E1-90E738159D2B}" = rport=138 | protocol=17 | dir=out | app=system | 

"{D01FDF4C-3BDF-4BE2-A432-9D0713176EF2}" = rport=137 | protocol=17 | dir=out | app=system | 

"{D06530E9-89F5-4D81-A67C-3F7CB6470D0A}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{D5D399BD-5068-4376-9F26-8C8BA89BCF0B}" = lport=138 | protocol=17 | dir=in | app=system | 

"{DA61C31C-0312-466D-A8EA-619D6DB03474}" = lport=139 | protocol=6 | dir=in | app=system | 

"{F267B621-B82E-472E-BA85-D747B9D5001A}" = lport=137 | protocol=17 | dir=in | app=system | 

"{FC880E3E-4500-4976-BCCA-57ACD26C3A27}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{03801C07-BEF6-4CA5-9296-00B9B4B06CD9}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{06219141-0D21-4A2C-9634-35805E76908D}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{0711E96B-E7E0-4EE1-B5C7-F5C90D7CB19F}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\skyrim\skyrimlauncher.exe | 

"{078EE463-BD11-47F2-816F-872AED480C7E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{1924588C-CF8A-41D7-898E-24408F5DAFFA}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{204137CE-745C-4F30-BB6C-07561581EE95}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 

"{23468757-9272-4115-B18E-585F94ECAD55}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe | 

"{23B4B459-7355-4670-9127-4E85796D47F8}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe | 

"{3715C2AD-F1F5-419D-B165-2029388B6930}" = protocol=6 | dir=out | app=system | 

"{3F3FFB0B-C27C-45AD-9B3C-88ACAE5311EB}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 

"{54B3D7B2-91DE-404F-86D1-862F239DA914}" = protocol=17 | dir=in | app=c:\program files\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | 

"{640B2679-75CA-4F31-B54C-04CF2F21D884}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{76095CBE-581E-4FD9-8B3F-27CFA186B5C8}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 

"{7BE8D95A-ED28-470D-81AD-B2E77FB6BDF6}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\skyrim\creationkit.exe | 

"{8920E2F1-2B2C-41EE-A813-D273006E24DF}" = protocol=6 | dir=in | app=c:\program files\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | 

"{8DF698FE-3F08-4846-AF12-BC4A110E83E2}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\skyrim\creationkit.exe | 

"{99E3DF3C-D217-4E30-8B86-F687FC33116F}" = protocol=6 | dir=in | app=c:\program files\ubisoft\might & magic heroes vi\might & magic heroes vi.exe | 

"{A56A6984-19A2-49DC-8ABF-E19DB72F45BD}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{B473C7EC-BAE1-4233-8814-2576F05F865A}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{B786D160-106F-403C-A66D-66A3E879D0DE}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\skyrim\creationkit.exe | 

"{C18D05A7-37D2-4545-8F8D-E4541C7ECF01}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\skyrim\skyrimlauncher.exe | 

"{C5AE2B9C-1534-4169-8DE5-1CB48F2E710A}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\skyrim\skyrimlauncher.exe | 

"{D19827E9-4971-490A-BE1E-D9E512F64130}" = protocol=17 | dir=in | app=c:\program files\ubisoft\might & magic heroes vi\might & magic heroes vi.exe | 

"{D774FC06-2844-48B0-9EAB-0F8DAD595BF6}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\skyrim\creationkit.exe | 

"{D9C02157-C663-4CB1-A5AD-B071BC77B713}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 

"{DDA6738F-177B-432A-AFA4-A7D32AD6CE48}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\skyrim\skyrimlauncher.exe | 

"{DFC83CDD-61B9-47F8-90E5-EB2492D56B26}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{E932EE0A-692A-4210-9F9A-7E5DA83F2B02}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{F0A759CB-5D3B-4D01-A364-6B0CD1C49845}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{F5B9E49B-14A0-46FC-90B1-0F2EDEEE16EA}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{02FCAA8F-59D3-4198-822E-135C61EE4F0B}" = NeroKwikMedia Help (CHM)

"{03AEAB60-A7B3-A8DB-468B-EB30FB4B40B0}" = CCC Help German

"{03F1CC67-5BD8-4C36-8394-76311B2AE69A}" = ArcSoft PhotoStudio 5

"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam

"{07010016-0001-2010-0110-4D6161546563}" = MaaTec Sudoku

"{08C8666B-C502-4AB3-B4CB-D74AC42D14FE}" = Nero BackItUp 10 Help (CHM)

"{162ABED6-E60C-6CFF-100E-43C16ABBC5BE}" = CCC Help Chinese Standard

"{16987E99-C95C-4513-9239-7B44A0A71DB5}" = Nero SoundTrax 10 Help (CHM)

"{1808A2AC-DB66-6B80-9340-F6476390CB18}" = AMD Drag and Drop Transcoding

"{1CB724FF-D18C-8FFB-E7C9-0A09CF8EC066}" = CCC Help Japanese

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{1F7D9F37-C39C-486C-BDF8-8F440FFB3352}" = Nero Kwik Media

"{20C14CC3-5E3B-D39A-5B37-B15E59785063}" = CCC Help Chinese Traditional

"{2436F2A8-4B7E-4B6C-AE4E-604C84AA6A4F}" = Nero Core Components 10

"{2632A2C0-ECF4-7F79-7136-9FEA4C253A4C}" = CCC Help Turkish

"{277C1559-4CF7-44FF-8D07-98AA9C13AABD}" = Nero Multimedia Suite 10

"{2E376AD9-5C49-4F7D-A0BA-6A44E8FA5A3B}" = Next Generation Visualisations

"{30F712DA-64FE-5DBE-AE76-3F8EA3F8223C}" = CCC Help French

"{329411A0-19F3-4740-874F-17400B126F27}" = Nero Vision 10 Help (CHM)

"{330DAC67-5B62-452A-A0E4-6B4A5923940F}_is1" = MotioninJoy ds3 driver version 0.6.0005

"{33643918-7957-4839-92C7-EA96CB621A98}" = Nero Express 10 Help (CHM)

"{34490F4E-48D0-492E-8249-B48BECF0537C}" = Nero DiscSpeed 10

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{3C39B3CC-4EC8-C756-AF4B-72366504FCA5}" = CCC Help Hungarian

"{3E7D839E-A6E7-B6F8-F855-CF69756E6331}" = AMD Media Foundation Decoders

"{4CC9D761-A9B6-D8EA-D2A9-B74B5A90B108}" = CCC Help Norwegian

"{4F198874-3C7D-5983-02EB-9E234C43F174}" = AMD Steady Video Plug-In 

"{5180FB30-2AC7-1627-9856-AA0AE6ACB7E7}" = ccc-utility

"{523B2B1B-D8DB-4B41-90FF-C4D799E2758A}" = Nero ControlCenter 10 Help (CHM)

"{54B227A6-BDBE-69FA-D450-B99609063044}" = CCC Help Greek

"{555868C6-49FB-484F-BB43-8980651A1B00}" = Nero BurnRights 10 Help (CHM)

"{58CB9A9A-1EFB-4EA8-B50C-3097E754AC21}" = High-Definition Video Playback

"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth

"{5F548A02-80BC-404D-BAE6-F05F9BF6B449}" = Nero DiscCopyGadget 10 Help (CHM)

"{6006059E-013D-4B77-BC5C-4DD5E4A6570D}" = G Data InternetSecurity 2012

"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM

"{635A6AF2-63AF-4C1C-AF57-BDC8AF6D397D}" = UltraEdit

"{63AA3EAB-23BB-48B2-9AD0-44F878075604}" = Nero 10 Menu TemplatePack Basic

"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update

"{66049135-9659-4AAD-9169-9CCA269EBB3E}" = Nero InfoTool 10 Help (CHM)

"{68AB6930-5BFF-4FF6-923B-516A91984FE6}" = Nero BackItUp 10

"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2

"{6DFB899F-17A2-48F0-A533-ED8D6866CF38}" = Nero Control Center 10

"{70550193-1C22-445C-8FA4-564E155DB1A7}" = Nero Express 10

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{745D37C2-26F4-4B65-BA13-F9840EBFA75B}" = Might & Magic Heroes VI

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{7964AE02-9127-42C0-A917-2CE4CD4EFE3B}" = Nokia Suite

"{7A295D8F-484B-4FFB-89AB-C1FD497591FE}" = Nero WaveEditor 10 Help (CHM)

"{7A5D731D-B4B3-490E-B339-75685712BAAB}" = Nero Burning ROM 10

"{7C587778-C433-980E-F3C1-203890DC4FBE}" = CCC Help Polish

"{7DC3EABF-66A2-6D79-B485-6328525CA387}" = CCC Help Swedish

"{7E8242F8-BD2A-44D7-BCED-9B231A02B367}" = SpellForce 2 Patch

"{843603C6-75B7-BAB5-80DE-E76FB28DEEF2}" = CCC Help Finnish

"{876B50AF-D46A-ED35-C625-20F326FE0C49}" = AMD Accelerated Video Transcoding

"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8BBC66FD-0195-29B4-5A58-E0B0554E8F42}" = AMD VISION Engine Control Center

"{8C0CAA7A-3272-4991-A808-2C7559DE3409}" = Win7codecs

"{8D9EEAC7-42D5-3951-612A-EAA7B684C592}" = CCC Help Italian

"{8ECEC853-5C3D-4B10-B5C7-FF11FF724807}" = Nero Recode 10

"{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules

"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003

"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007

"{90120000-001F-0407-0000-0000000FF1CE}_VISPRO_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-0409-0000-0000000FF1CE}_VISPRO_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007

"{90120000-001F-040C-0000-0000000FF1CE}_VISPRO_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007

"{90120000-001F-0410-0000-0000000FF1CE}_VISPRO_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System

"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007

"{90120000-0051-0000-0000-0000000FF1CE}" = Microsoft Office Visio Professional 2007

"{90120000-0051-0000-0000-0000000FF1CE}_VISPRO_{CE144BF4-4950-4CDB-A5F7-CCE1888F49CB}" = Microsoft Office Visio 2007 Service Pack 3 (SP3)

"{90120000-0054-0407-0000-0000000FF1CE}" = Microsoft Office Visio MUI (German) 2007

"{90120000-0054-0407-0000-0000000FF1CE}_VISPRO_{3CB0380B-0413-4C44-A63B-DCD6369EAF4E}" = Microsoft Office Visio 2007 Service Pack 3 (SP3)

"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007

"{90120000-006E-0407-0000-0000000FF1CE}_VISPRO_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In

"{92E25238-61A3-4ACD-A407-3C480EEF47A7}" = Nero RescueAgent 10 Help (CHM)

"{92EC1A84-7FFC-42DF-A8F6-79C21C4765A5}" = Nero DiscCopy Gadget 10

"{943CFD7D-5336-47AF-9418-E02473A5A517}" = Nero BurnRights 10

"{9791DAED-B734-2835-988B-157BDA087496}" = CCC Help Dutch

"{98B740C3-FAA4-C523-7478-4DBCAB7B27D1}" = Catalyst Control Center Graphics Previews Common

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9A4297F3-2A51-4ED9-92CA-4BCB8380947E}" = Nero Vision 10

"{9B6B24BE-80E7-46C4-9FA5-B167D5E0F345}" = Nero BurningROM 10 Help (CHM)

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{9F0CAC6D-9B0D-A95F-CF61-6E88952D6181}" = CCC Help Thai

"{A25FF1C0-80B6-4B8B-A551-DC525697A408}" = AMD APP SDK Runtime

"{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1" = PDF-Viewer

"{A57025CC-5F2E-4D01-B387-06DB10500D43}" = Nokia Connectivity Cable Driver

"{A625DB70-98D5-16FD-C49D-4B8B1B2304A4}" = CCC Help Spanish

"{A90214C3-3A0C-2F05-6083-E1A4BAD9E30D}" = CCC Help Danish

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{AA123216-6DE0-E57C-DC57-4FECEACB482F}" = CCC Help Russian

"{ABBACAD2-4DAF-490E-932B-E330B33FCF98}" = Softi FreeOCR

"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch

"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86

"{BCE46757-7674-4416-BEDB-68205A60409E}" = Canon CanoScan Toolbox 4.1

"{BF14351F-DCB6-5F0B-9884-A49DFA901B4A}" = AMD Fuel

"{C18A0418-442A-4186-AF98-D08F5054A2FC}" = Nero DiscSpeed 10 Help (CHM)

"{C3273C55-E1E4-41FF-8D69-0158090DB8D8}" = Nero CoverDesigner 10 Help (CHM)

"{C3580AC4-C827-4332-B935-9A282ED5BB97}" = Nero Dolby Files 10

"{CCF298AF-9CE1-4B26-B251-486E98A34789}" = Windows 7 USB/DVD Download Tool

"{D0837A59-83E6-3392-1BD9-86D3445676DB}" = CCC Help Korean

"{D5068813-9F8D-9F7A-92C0-A3EECBA2D82B}" = AMD Catalyst Install Manager

"{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}" = Microsoft XNA Framework Redistributable 4.0 Refresh

"{D70AB273-113B-D7DE-5C8D-82CABA7CB0AF}" = Catalyst Control Center Localization All

"{DA5B2BDC-F654-4A88-A669-4D34BC7846A1}" = PC Connectivity Solution

"{DB7C1D4A-08BA-4C7E-A8AA-B7F9BB372DCF}" = Nero Recode 10 Help (CHM)

"{DC8772D4-C75F-5235-63E2-BBC73F909B7A}" = CCC Help Czech

"{DED7FD3C-DDD2-43BB-B0F5-B07F9D0430D3}" = CCC Help Portuguese

"{DF8195AF-8E6F-4487-A0EE-196F7E3F4B8A}" = jetAudio Plus VX

"{E0E55FC1-C53D-4F8D-B14B-B59C312747C8}" = LightScribe System Software

"{E157F2EB-E06F-B57F-9105-68F348DB2EAD}" = CCC Help English

"{E1EE5339-5D32-458F-BAAB-B19F6301BCE2}" = Nero SoundTrax 10

"{E2F0AF23-FE2F-4222-9A43-55E63CC41EF1}" = Catalyst Control Center - Branding

"{E337E787-CF61-4B7B-B84F-509202A54023}" = Nero RescueAgent 10

"{E3B64CC5-C011-40C0-92BC-7316CD5E5688}" = Microsoft_VC100_CRT_SP1_x86

"{EDCDFAD5-DF80-4600-A493-E9DAD6810230}" = Nero WaveEditor 10

"{EF036F44-A287-BC23-3F6E-AAE6FDEF47EF}" = Catalyst Control Center InstallProxy

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5

"{F412B4AF-388C-4FF5-9B2F-33DB1C536953}" = Nero InfoTool 10

"{F5CB822F-B365-43D1-BCC0-4FDA1A2017A7}" = Nero 10 Movie ThemePack Basic

"{F6117F9C-ADB5-4590-9BE4-12C7BEC28702}" = Nero StartSmart 10 Help (CHM)

"{F61D489E-6C44-49AC-AD02-7DA8ACA73A65}" = Nero StartSmart 10

"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"{FCF00A6E-FB58-477A-ABE9-232907105521}" = Nero CoverDesigner 10

"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)

"6af12c54-643b-4752-87d0-8335503010de_is1" = Nexus Mod Manager

"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX

"Adobe Shockwave Player" = Adobe Shockwave Player 11.6

"AnyDVD" = AnyDVD

"Avidemux 2.5" = Avidemux 2.5 (32-bit)

"CCleaner" = CCleaner

"DAEMON Tools Lite" = DAEMON Tools Lite

"Diablo III" = Diablo III

"Easy Video Splitter_is1" = Easy Video Splitter 1.28

"ElsterFormular 13.1.1.8531p" = ElsterFormular

"ImgBurn" = ImgBurn

"InstallShield_{635A6AF2-63AF-4C1C-AF57-BDC8AF6D397D}" = UltraEdit

"IrfanView" = IrfanView (remove only)

"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.1.1000

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"Nokia Suite" = Nokia Suite

"Notepad++" = Notepad++

"Steam App 202480" = Creation Kit

"Steam App 72850" = The Elder Scrolls V: Skyrim

"TomTom HOME" = TomTom HOME 2.8.2.2264

"Totalcmd" = Total Commander (Remove or Repair)

"VISPRO" = Microsoft Office Visio Professional 2007

"VLC media player" = VLC media player 1.1.11

"VobSub" = VobSub v2.23 (Remove Only)

"vsfilter_is1" = DirectVobSub 2.40.3644 x86

"WinGimp-2.0_is1" = GIMP 2.6.11

"WinRAR archiver" = WinRAR 4.01 (32-Bit)

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"SuDoKu-Cracker" = SuDoKu-Cracker

 
 ========== Last 20 Event Log Errors ==========

 

[ Application Events ]

Error - 05.07.2012 06:14:44 | Computer Name = Jubeldibub | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567,

 Zeitstempel: 0x4d6727a7  Name des fehlerhaften Moduls: DivXMFSource.dll, Version:

 1.0.0.72, Zeitstempel: 0x4cffcf66  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0009b890

ID

 des fehlerhaften Prozesses: 0x1eb0  Startzeit der fehlerhaften Anwendung: 0x01cd5a96e90677f5

Pfad

 der fehlerhaften Anwendung: C:\Windows\explorer.exe  Pfad des fehlerhaften Moduls:

 C:\Program Files\Win7codecs\filters\DivXMFSource.dll  Berichtskennung: 3d1a2100-c68a-11e1-85f3-6cf049013ce5

 

Error - 05.07.2012 08:45:36 | Computer Name = Jubeldibub | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567,

 Zeitstempel: 0x4d6727a7  Name des fehlerhaften Moduls: DivXMFSource.dll, Version:

 1.0.0.72, Zeitstempel: 0x4cffcf66  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0009b8a1

ID

 des fehlerhaften Prozesses: 0x16b4  Startzeit der fehlerhaften Anwendung: 0x01cd5aabd5b800af

Pfad

 der fehlerhaften Anwendung: C:\Windows\explorer.exe  Pfad des fehlerhaften Moduls:

 C:\Program Files\Win7codecs\filters\DivXMFSource.dll  Berichtskennung: 509cf719-c69f-11e1-85f3-6cf049013ce5

 

Error - 05.07.2012 08:53:41 | Computer Name = Jubeldibub | Source = WinMgmt | ID = 10

Description = 

 

Error - 05.07.2012 13:46:00 | Computer Name = Jubeldibub | Source = WinMgmt | ID = 10

Description = 

 

Error - 06.07.2012 01:55:12 | Computer Name = Jubeldibub | Source = WinMgmt | ID = 10

Description = 

 

Error - 06.07.2012 02:04:21 | Computer Name = Jubeldibub | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: MsiExec.exe, Version: 5.0.7601.17514,

 Zeitstempel: 0x4ce792c4  Name des fehlerhaften Moduls: MSIFB36.tmp, Version: 2.0.0.9,

 Zeitstempel: 0x4d4b089c  Ausnahmecode: 0xc000000d  Fehleroffset: 0x00019d88  ID des fehlerhaften

 Prozesses: 0x980  Startzeit der fehlerhaften Anwendung: 0x01cd5b3d26a6f11c  Pfad der

 fehlerhaften Anwendung: C:\Windows\system32\MsiExec.exe  Pfad des fehlerhaften Moduls:

 C:\Windows\Installer\MSIFB36.tmp  Berichtskennung: 6da2816e-c730-11e1-9aef-6cf049013ce5

 

Error - 06.07.2012 02:04:38 | Computer Name = Jubeldibub | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: MsiExec.exe, Version: 5.0.7601.17514,

 Zeitstempel: 0x4ce792c4  Name des fehlerhaften Moduls: MSI7893.tmp, Version: 2.0.0.9,

 Zeitstempel: 0x4d4b089c  Ausnahmecode: 0xc000000d  Fehleroffset: 0x00019d88  ID des fehlerhaften

 Prozesses: 0x1508  Startzeit der fehlerhaften Anwendung: 0x01cd5b3d39966a82  Pfad der

 fehlerhaften Anwendung: C:\Windows\system32\MsiExec.exe  Pfad des fehlerhaften Moduls:

 C:\Windows\Installer\MSI7893.tmp  Berichtskennung: 77b798cf-c730-11e1-9aef-6cf049013ce5

 

Error - 06.07.2012 08:31:33 | Computer Name = Jubeldibub | Source = WinMgmt | ID = 10

Description = 

 

Error - 06.07.2012 10:17:08 | Computer Name = Jubeldibub | Source = WinMgmt | ID = 10

Description = 

 

Error - 07.07.2012 03:47:51 | Computer Name = Jubeldibub | Source = WinMgmt | ID = 10

Description = 

 

[ System Events ]

Error - 30.10.2012 14:13:34 | Computer Name = Jubeldibub | Source = Service Control Manager | ID = 7000

Description = Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%2

 

Error - 30.10.2012 16:59:17 | Computer Name = Jubeldibub | Source = Service Control Manager | ID = 7000

Description = Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%2

 

Error - 31.10.2012 03:21:19 | Computer Name = Jubeldibub | Source = Service Control Manager | ID = 7000

Description = Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%2

 

Error - 31.10.2012 09:10:00 | Computer Name = Jubeldibub | Source = Service Control Manager | ID = 7000

Description = Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%2

 

Error - 31.10.2012 18:14:32 | Computer Name = Jubeldibub | Source = Service Control Manager | ID = 7000

Description = Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%2

 

Error - 01.11.2012 03:10:24 | Computer Name = Jubeldibub | Source = Service Control Manager | ID = 7000

Description = Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%2

 

Error - 01.11.2012 13:45:01 | Computer Name = Jubeldibub | Source = Service Control Manager | ID = 7000

Description = Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%2

 

Error - 02.11.2012 03:21:38 | Computer Name = Jubeldibub | Source = Service Control Manager | ID = 7000

Description = Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%2

 

Error - 02.11.2012 11:31:41 | Computer Name = Jubeldibub | Source = Service Control Manager | ID = 7000

Description = Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%2

 

Error - 02.11.2012 18:24:25 | Computer Name = Jubeldibub | Source = Service Control Manager | ID = 7000

Description = Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%2

 

 

< End of report >

--- --- ---

Systembereinigung und Prüfung:

► Wenn Du nun alle Schritte erledigt hast, melde dich mit die gewünschten Ergebnisse zurück!
Nur bei Probleme inzwischen melden!

1.
nicht mehr installiert?:

Zitat:

AnyDVD

Zitat:

Achtung wichtig!:
Falls Du selber im Logfile Änderungen vorgenommen hast, musst Du durch die Originalbezeichnung ersetzen und so in Script einfügen! sonst funktioniert nicht!
(Benutzerordner, dein Name oder sonstige Änderungen durch X, Stern oder andere Namen ersetzt)

Fixen mit OTL

Starte die OTL.exe.
Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
Kopiere folgendes Skript also - nach dem "Code", alles was in der Codebox steht - (also beginnend mit :OTL und am Ende [emptytemp]), alles was in der Codebox steht (ohne "code"!) :

Code:

:OTL

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://de.msn.com/?ocid=iehp

IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

O4 - HKCU..\Run: []  File not found

O4 - HKCU..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup File not found
 

:Files

ipconfig /flushdns /c

:Commands

[purity]

[emptytemp]

und füge es hier ein: http://image.hijackthis.eu/upload/hjt1-021.jpg
Schließe alle Programme.
Klicke auf den Fix Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
OTL verlangt einen Neustart. Bitte zulassen.
Nach dem Neustart findest Du ein Textdokument.
Kopiere den Inhalt hier in Deinen Thread.

3.
Tipps - Der Internet Explorer von Microsoft gehört zur Grundausstattung unter Windows, somit wie alle andere installierte Software muss gepflegt werden! Auch bei Nicht-Verwendung!:
-> Tipps zu Internet Explorer
-> Standard Suchmaschine des Explorers ändern
-> Ändern oder Auswählen eines Suchanbieters in Internet Explorer 7/8
-> Wie kann ich den Cache im Internet Explorer leeren?

4.
Alle Programme/Fenster schliessen
reinige dein System mit CCleaner:

"CCleaner"→ "Analysieren"→ Klick auf den Button "Start CCleaner"
"Registry""Fehler suchen"→ "Fehler beheben"→ "Alle beheben"
Starte dein System neu auf

5.
Vorbereitung

Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an.
Bitte während der Online-Scans deaktivieren:
Anti-Virus-Programm und Firewall.
Internet Explorer starten => im Menü unter Extras => Internetoption => Datenschutz => den Haken bei "Popupblocker einschalten" entfernen und
unter dem Reiter "Sicherheit" => die Sicherheitsstufe ggfs. auf "Mittelhoch" herabsetzen.
Nicht vergessen, sie hinterher wieder einzuschalten bzw. die Internetoptionen wie zuvor einzustellen..
Während der Online-Scans auf andere Online-Aktivitäten verzichten.
Du musst das Herunterladen und Installieren von ActiveX-Steuerelementen (Controls) zulassen.
http://image.hijackthis.eu/upload/activex1.jpg
.

Den PC NUR online scannen und NICHT ein zweites Antivirenprogramm installieren!!!

Eset Online Scanner (NOD32)
- Unterstützte Betriebssysteme: Microsoft Windows 7 - Vista - XP - 2000 - NT.
- Anmerkung für Vista und Windows 7-User: Bitte den Browser unbedingt als Administrator starten.
- Dein Anti-Virus-Programm während des Scans deaktivieren.
- Button "ESET Online Scanner" drücken.
- IE-User müssen das Installieren eines ActiveX Elements erlauben.
- Einen Haken bei "YES, I accept the Terms of Use." machen und auf den Button "Start" drücken.
- Einen Haken bei "Remove found threads" und "Scan archives" machen.
- Start drücken.
- Signaturen werden heruntergeladen.
- Der Scan beginnt automatisch.
- Wenn fertig, das Protokoll speichern und mir posten.
  -> List of found threats
  -> Export to text file
  -> Back
  -> Delete quarantäne files
- Finish drücken.
- Browser schließen.
- Deinstallation nachdem das Protokoll mir gepostet hast: Systemsteuerung => Software => Eset Online Scanner V3 entfernen.
- Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

6.
erneut einen Scan mit OTL:

Doppelklick auf die OTL.exe
Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
Oben findest Du ein Kästchen mit Ausgabe.
Wähle bitte Standard-Ausgabe
Unter Extra-Registrierung wähle bitte Benutze SafeList.
Mache Häckchen bei LOP- und Purity-Prüfung.
Klicke nun auf Scan links oben.
Wenn der Scan beendet wurde werden zwei Logfiles erstellt.
Du findest die Logfiles auf Deinem Desktop => OTL.txt und Extras.txt
Poste die Logfiles in Code-Tags hier in den Thread.

► berichte erneut über den Zustand des Computers. Ob noch Probleme auftreten, wenn ja, welche?

Hallo,

ich habe die von dir gewünschten Schritte ausgeführt - und das Problem ist verschwunden!!! Die Vorschaubilder und die Ansichtseinstellungen bleiben nun so wie gewünscht und verändern sich nicht mehr willkürlich.
Tausend Dank schonmal dafür! Anbei findest du die Logs:

ESET:

Code:

C:\Users\***\AppData\Local\InstallShare\2_16037_installer.exe        a variant of Win32/InstallShare.A application        cleaned by deleting - quarantined

C:\Users\***\Tools, Treiber & Programme\Notebook-Rettung\_OTL.rar        a variant of Java/Exploit.CVE-2012-0507.BZ trojan        deleted - quarantined

OTL Logfile:

Code:

OTL logfile created on: 05.11.2012 10:31:00 - Run 4

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\***\Desktop

 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,25 Gb Total Physical Memory | 2,09 Gb Available Physical Memory | 64,22% Memory free

13,01 Gb Paging File | 11,59 Gb Available in Paging File | 89,04% Paging File free

Paging file location(s): c:\pagefile.sys 10000 10000 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 465,66 Gb Total Space | 309,79 Gb Free Space | 66,53% Space Free | Partition Type: NTFS

 

Computer Name: JUBELDIBUB | User Name: *** | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\***\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Programme\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Advanced Micro Devices, Inc.)

PRC - C:\Windows\System32\atieclxx.exe (AMD)

PRC - C:\Windows\System32\atiesrxx.exe (AMD)

PRC - C:\Programme\G Data\InternetSecurity\AVKTray\AVKTray.exe (G Data Software AG)

PRC - C:\Programme\G Data\InternetSecurity\AVK\AVKWCtl.exe (G Data Software AG)

PRC - C:\Programme\SlySoft\AnyDVD\AnyDVDtray.exe (SlySoft, Inc.)

PRC - C:\Programme\Common Files\G Data\AVKProxy\AVKProxy.exe (G Data Software AG)

PRC - C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

PRC - C:\Programme\G Data\InternetSecurity\Firewall\GDFwSvc.exe (G Data Software AG)

PRC - C:\Programme\Common Files\G Data\GDScan\GDScan.exe (G Data Software AG)

PRC - C:\Programme\G Data\InternetSecurity\Firewall\GDFirewallTray.exe (G Data Software AG)

PRC - C:\Programme\G Data\InternetSecurity\AVK\AVKService.exe (G Data Software AG)

PRC - C:\Programme\TomTom HOME 2\TomTomHOMEService.exe (TomTom)

PRC - C:\Programme\Nero\Nero 10\Nero BackItUp\NBAgent.exe (Nero AG)

PRC - C:\Programme\Nero\Update\NASvc.exe (Nero AG)

PRC - C:\Windows\explorer.exe (Microsoft Corporation)

PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)

PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)

PRC - C:\Programme\Microsoft Office\OFFICE11\OUTLOOK.EXE (Microsoft Corporation)

PRC - C:\Programme\Common Files\microsoft shared\VS7Debug\MDM.EXE (Microsoft Corporation)

 

 
 ========== Modules (No Company Name) ==========

 

MOD - C:\Programme\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsFormsIntegra#\44752ffa92ebb7170951a41898d8b9c6\WindowsFormsIntegration.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\3971e166cf827b6726e142f344061dc9\System.Windows.Forms.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\199683f6e79076b634ee6cc0a82c0654\PresentationFramework.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\e7dc084827f8df2dbdc819db5c633a0d\PresentationCore.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\21f37f9f5162af7efb52169012bd111e\WindowsBase.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\8c40f40ef36622109793788049fbe9ab\System.Drawing.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\UIAutomationProvider\05787d96761cf20b76b927ace10ef1d3\UIAutomationProvider.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\65f0d70169a0e73b45307dddbd86f92b\System.Runtime.Remoting.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\d234eceae699d070b5a5712ce776c01f\System.Xaml.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\a5fa2a1cfc6e9fdc39d9a8f2baa57bc9\PresentationFramework.Aero.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\ed91b57205429a23bb91f4499059a459\System.Core.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\d1f299160424bad90fe9f658661389e2\System.Xml.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\623d2a0f11dd82bb9bc13d1cb981b239\System.Configuration.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System\6f9f0467e8b2dd3f69b015c8e30ac945\System.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\3953b1d8b9b57e4957bff8f58145384e\mscorlib.ni.dll ()

MOD - C:\Programme\Notepad++\NppShell_04.dll ()

MOD - C:\Programme\WinRAR\RarExt.dll ()

MOD - C:\Programme\Common Files\LightScribe\QtGui4.dll ()

MOD - C:\Programme\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll ()

MOD - C:\Programme\Common Files\LightScribe\QtCore4.dll ()

 

 
 ========== Services (SafeList) ==========

 

SRV - (WinHttpAutoProxySvc) -- winhttp.dll File not found

SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)

SRV - (AMD FUEL Service) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Advanced Micro Devices, Inc.)

SRV - (AMD External Events Utility) -- C:\Windows\System32\atiesrxx.exe (AMD)

SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)

SRV - (AVKWCtl) -- C:\Programme\G Data\InternetSecurity\AVK\AVKWCtl.exe (G Data Software AG)

SRV - (AVKProxy) -- C:\Programme\Common Files\G Data\AVKProxy\AVKProxy.exe (G Data Software AG)

SRV - (AdobeARMservice) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

SRV - (GDFwSvc) -- C:\Programme\G Data\InternetSecurity\Firewall\GDFwSvc.exe (G Data Software AG)

SRV - (ServiceLayer) -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia)

SRV - (GDScan) -- C:\Programme\Common Files\G Data\GDScan\GDScan.exe (G Data Software AG)

SRV - (AVKService) -- C:\Programme\G Data\InternetSecurity\AVK\AVKService.exe (G Data Software AG)

SRV - (odserv) -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)

SRV - (TomTomHOMEService) -- C:\Programme\TomTom HOME 2\TomTomHOMEService.exe (TomTom)

SRV - (NAUpdate) -- C:\Programme\Nero\Update\NASvc.exe (Nero AG)

SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)

SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation)

SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)

SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SRV - (MDM) -- C:\Programme\Common Files\microsoft shared\VS7Debug\MDM.EXE (Microsoft Corporation)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)

DRV - (amdkmdag) -- C:\Windows\System32\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)

DRV - (amdkmdap) -- C:\Windows\System32\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)

DRV - (GDPkIcpt) -- C:\Windows\System32\drivers\PktIcpt.sys (G Data Software AG)

DRV - (GDMnIcpt) -- C:\Windows\System32\drivers\MiniIcpt.sys (G Data Software AG)

DRV - (GDBehave) -- C:\Windows\System32\drivers\GDBehave.sys (G Data Software AG)

DRV - (gdwfpcd) -- C:\Windows\System32\drivers\gdwfpcd32.sys (G Data Software AG)

DRV - (AnyDVD) -- C:\Windows\System32\drivers\AnyDVD.sys (SlySoft, Inc.)

DRV - (HookCentre) -- C:\Windows\System32\drivers\HookCentre.sys (G Data Software AG)

DRV - (AtiHDAudioService) -- C:\Windows\System32\drivers\AtihdW73.sys (Advanced Micro Devices)

DRV - (pccsmcfd) -- C:\Windows\System32\drivers\pccsmcfd.sys (Nokia)

DRV - (dtsoftbus01) -- C:\Windows\System32\drivers\dtsoftbus01.sys (DT Soft Ltd)

DRV - (AODDriver4.2) -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\i386\aoddriver2.sys (Advanced Micro Devices)

DRV - (AODDriver4.01) -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\i386\aoddriver2.sys (Advanced Micro Devices)

DRV - (nmwcdnsu) -- C:\Windows\System32\drivers\nmwcdnsu.sys (Nokia)

DRV - (nmwcdc) -- C:\Windows\System32\drivers\ccdcmbo.sys (Nokia)

DRV - (nmwcd) -- C:\Windows\System32\drivers\ccdcmb.sys (Nokia)

DRV - (nmwcdnsuc) -- C:\Windows\System32\drivers\nmwcdnsuc.sys (Nokia)

DRV - (UsbserFilt) -- C:\Windows\System32\drivers\usbser_lowerfltj.sys (Nokia)

DRV - (upperdev) -- C:\Windows\System32\drivers\usbser_lowerflt.sys (Nokia)

DRV - (GRD) -- C:\Windows\System32\drivers\GRD.sys (G Data Software)

DRV - (MotioninJoyXFilter) -- C:\Windows\System32\drivers\MijXfilt.sys (MotioninJoy)

DRV - (GdNetMon) -- C:\Windows\System32\drivers\GdNetMon32.sys (G Data Software AG)

DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)

DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)

DRV - (TsUsbGD) -- C:\Windows\System32\drivers\TsUsbGD.sys (Microsoft Corporation)

DRV - (amdiox86) -- C:\Windows\System32\drivers\amdiox86.sys (Advanced Micro Devices)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\..\SearchScopes,DefaultScope = 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default Download Directory = C:\Users\***

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ig

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 7A 8A 88 C6 5B 75 CC 01  [binary data]

IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 
 ========== FireFox ==========

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF - HKLM\Software\MozillaPlugins\@nokia.com/EnablerPlugin: C:\Program Files\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101753.dll (Amazon.com, Inc.)

 

 

[2011.11.09 15:54:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions

[2011.11.09 15:54:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions\home2@tomtom.com

 

O1 HOSTS File: ([2009.06.10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O2 - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Programme\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)

O2 - BHO: (G Data BankGuard) - {BA3295CF-17ED-4F49-9E95-D999A0ADBFDC} - C:\Programme\Common Files\G Data\AVKProxy\BanksafeBHO.dll (G Data Software AG)

O4 - HKLM..\Run: [G Data AntiVirus Tray Application] C:\Programme\G Data\InternetSecurity\AVKTray\AVKTray.exe (G Data Software AG)

O4 - HKLM..\Run: [GDFirewallTray] C:\Programme\G Data\InternetSecurity\Firewall\GDFirewallTray.exe (G Data Software AG)

O4 - HKLM..\Run: [NBAgent] C:\Program Files\Nero\Nero 10\Nero BackItUp\NBAgent.exe (Nero AG)

O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKCU..\Run: [AnyDVD] C:\Programme\SlySoft\AnyDVD\AnyDVDtray.exe (SlySoft, Inc.)

O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1

O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105 File not found

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)

O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000 File not found

O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)

O13 - gopher Prefix: missing

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0B880486-C259-45D7-A17F-6B65B73BE9EA}: DhcpNameServer = 192.168.178.1

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll File not found

O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll File not found

O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll File not found

O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)

O18 - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Programme\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)

O18 - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Programme\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)

O20 - HKLM Winlogon: Shell - (explorer.exe) -  File not found

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -  File not found

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O29 - HKLM SecurityProviders - (credssp.dll) -  File not found

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.11.03 15:19:47 | 000,000,000 | ---D | C] -- C:\Users\***\Documents\Amazon MP3

[2012.11.03 15:19:47 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Amazon

[2012.11.03 15:18:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Amazon

[2012.11.03 15:18:44 | 000,000,000 | ---D | C] -- C:\Program Files\Amazon

[2012.11.03 10:37:52 | 000,000,000 | ---D | C] -- C:\_OTL

[2012.11.02 23:26:53 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe

[2012.11.02 16:41:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2012.11.02 16:41:47 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2012.10.30 09:47:09 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes

[2012.10.30 09:46:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.10.30 09:46:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.10.30 09:46:54 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2012.10.30 09:46:54 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2012.10.27 19:48:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UltraEdit

[2012.10.27 19:48:06 | 000,000,000 | ---D | C] -- C:\Program Files\UltraEdit

[2012.10.26 08:14:45 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI

[2012.10.26 08:14:42 | 000,000,000 | ---D | C] -- C:\Program Files\AMD AVT

[2012.10.26 08:14:38 | 000,000,000 | ---D | C] -- C:\Program Files\AMD APP

[2012.10.26 08:14:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center

[2012.10.10 07:14:51 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll

[2012.10.10 07:14:45 | 000,271,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe

[2012.10.10 07:14:45 | 000,169,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winsrv.dll

[2012.10.10 07:14:45 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll

[2012.10.10 07:14:45 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll

[2012.10.10 07:14:45 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll

[2012.10.10 07:14:45 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll

[2012.10.10 07:14:45 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll

[2012.10.10 07:14:45 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll

[2012.10.10 07:14:45 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll

[2012.10.10 07:14:45 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll

[2012.10.10 07:14:45 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll

[2012.10.10 07:14:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll

[2012.10.10 07:14:35 | 003,968,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe

[2012.10.10 07:14:35 | 003,914,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.11.05 10:27:00 | 000,001,114 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012.11.05 09:36:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.11.05 09:02:26 | 000,021,664 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.11.05 09:02:26 | 000,021,664 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.11.05 09:02:02 | 000,657,428 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012.11.05 09:02:02 | 000,618,714 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012.11.05 09:02:02 | 000,130,818 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012.11.05 09:02:02 | 000,107,034 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012.11.05 08:59:34 | 000,852,670 | ---- | M] () -- C:\Windows\System32\sig.bin

[2012.11.05 08:59:34 | 000,045,813 | ---- | M] () -- C:\Windows\System32\nmp.map

[2012.11.05 08:55:14 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012.11.05 08:55:07 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.11.05 08:55:04 | 2615,320,576 | -HS- | M] () -- C:\hiberfil.sys

[2012.11.03 15:21:36 | 000,044,650 | -HS- | M] () -- C:\Users\***\Folder.jpg

[2012.11.03 15:21:36 | 000,044,650 | -HS- | M] () -- C:\Users\***\AlbumArt_{7B90367D-DBE4-47BA-B373-C4C7DEC67091}_Large.jpg

[2012.11.03 15:21:36 | 000,008,005 | -HS- | M] () -- C:\Users\***\AlbumArtSmall.jpg

[2012.11.03 15:21:36 | 000,008,005 | -HS- | M] () -- C:\Users\***\AlbumArt_{7B90367D-DBE4-47BA-B373-C4C7DEC67091}_Small.jpg

[2012.11.03 12:33:04 | 000,001,441 | ---- | M] () -- C:\scu.dat

[2012.11.02 23:26:53 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe

[2012.10.29 17:47:29 | 000,000,257 | ---- | M] () -- C:\Users\***\Desktop\Clever-Forum.de - das clevere Forum  Das Excel-Forum  X in Spalte A zählen, wenn Y in Spalte B.url

[2012.10.29 17:19:46 | 000,078,336 | ---- | M] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2012.10.26 22:50:38 | 325,568,580 | ---- | M] () -- C:\Users\***\TBBT-S06E05.avi

[2012.10.21 18:30:45 | 000,000,258 | ---- | M] () -- C:\Users\***\Desktop\Amazon.com Sea Of Serenity Purewhitenoise.Com MP3 Downloads.url

[2012.10.21 18:30:17 | 000,000,139 | ---- | M] () -- C:\Users\***\Desktop\Rain Fall Music for Sleep Rain Song [Rain Sounds for Sleep] Relax to the Music of Rain with Rain Song Rain Storm Sound with Music for Sleep.url

[2012.10.09 14:36:06 | 000,696,760 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe

[2012.10.09 14:36:06 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl

 
 ========== Files Created - No Company Name ==========

 

[2012.11.03 15:21:36 | 000,044,650 | -HS- | C] () -- C:\Users\***\Folder.jpg

[2012.11.03 15:21:36 | 000,044,650 | -HS- | C] () -- C:\Users\***\AlbumArt_{7B90367D-DBE4-47BA-B373-C4C7DEC67091}_Large.jpg

[2012.11.03 15:21:36 | 000,008,005 | -HS- | C] () -- C:\Users\***\AlbumArtSmall.jpg

[2012.11.03 15:21:36 | 000,008,005 | -HS- | C] () -- C:\Users\***\AlbumArt_{7B90367D-DBE4-47BA-B373-C4C7DEC67091}_Small.jpg

[2012.11.03 11:54:20 | 000,001,441 | ---- | C] () -- C:\scu.dat

[2012.10.29 17:47:29 | 000,000,257 | ---- | C] () -- C:\Users\***\Desktop\Clever-Forum.de - das clevere Forum  Das Excel-Forum  X in Spalte A zählen, wenn Y in Spalte B.url

[2012.10.26 22:42:44 | 325,568,580 | ---- | C] () -- C:\Users\***\TBBT-S06E05.avi

[2012.10.21 18:30:45 | 000,000,258 | ---- | C] () -- C:\Users\***\Desktop\Amazon.com Sea Of Serenity Purewhitenoise.Com MP3 Downloads.url

[2012.10.21 18:30:17 | 000,000,139 | ---- | C] () -- C:\Users\***\Desktop\Rain Fall Music for Sleep Rain Song [Rain Sounds for Sleep] Relax to the Music of Rain with Rain Song Rain Storm Sound with Music for Sleep.url

[2012.09.28 14:36:56 | 000,180,224 | ---- | C] () -- C:\Windows\System32\clinfo.exe

[2012.05.23 16:31:02 | 000,632,252 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat

[2012.05.02 13:58:10 | 000,029,184 | ---- | C] () -- C:\Windows\System32\kdbsdk32.dll

[2012.03.21 15:33:47 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol

[2012.02.15 03:28:34 | 000,157,144 | ---- | C] () -- C:\Windows\System32\ativvsva.dat

[2012.02.15 03:28:32 | 000,204,952 | ---- | C] () -- C:\Windows\System32\ativvsvl.dat

[2011.09.30 11:24:13 | 000,004,096 | -H-- | C] () -- C:\Users\***\AppData\Local\keyfile3.drm

[2011.09.19 17:01:50 | 000,078,336 | ---- | C] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011.09.18 15:33:47 | 000,000,083 | -HS- | C] () -- C:\ProgramData\.zreglib

[2011.09.18 10:49:23 | 000,000,534 | ---- | C] () -- C:\Windows\ODBC.INI

[2011.09.17 19:13:24 | 000,852,670 | ---- | C] () -- C:\Windows\System32\sig.bin

[2011.09.17 16:44:36 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2011.09.12 23:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\System32\atipblag.dat

[2011.08.31 13:29:00 | 004,023,808 | ---- | C] () -- C:\Windows\System32\x264vfw.dll

[2011.07.12 15:56:50 | 000,074,752 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll

[2011.07.03 18:48:42 | 000,147,456 | ---- | C] ( ) -- C:\Windows\System32\lagarith.dll

[2011.06.17 05:26:10 | 000,243,200 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll

[2011.06.17 05:17:28 | 000,650,752 | ---- | C] () -- C:\Windows\System32\xvidcore.dll

[2011.04.12 02:30:05 | 000,657,428 | ---- | C] () -- C:\Windows\System32\perfh007.dat

[2011.04.12 02:30:05 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat

[2011.04.12 02:30:05 | 000,130,818 | ---- | C] () -- C:\Windows\System32\perfc007.dat

[2011.04.12 02:30:05 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat

 
 ========== ZeroAccess Check ==========

 

[2009.07.14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 22:29:20 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 
 ========== LOP Check ==========

 

[2012.11.03 15:19:47 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Amazon

[2012.07.12 08:54:47 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\avidemux

[2012.10.25 12:01:18 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Canon

[2011.09.19 17:01:27 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\COWON

[2012.11.03 11:00:02 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DAEMON Tools Lite

[2012.03.28 14:36:08 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\elsterformular

[2011.10.19 13:19:32 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\GHISLER

[2012.07.13 13:31:12 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\gtk-2.0

[2012.01.05 18:22:37 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ImgBurn

[2012.08.02 20:05:20 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\MaaTec

[2012.04.24 19:34:19 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Might & Magic Heroes VI

[2012.04.20 20:45:48 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\MotioninJoy

[2012.01.24 16:59:14 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Nokia

[2012.04.24 10:08:57 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Notepad++

[2012.01.24 17:01:15 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\PC Suite

[2012.09.08 14:31:50 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\RenPy

[2012.03.21 16:09:44 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ScanSoft

[2012.03.21 16:48:09 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Softi Software

[2012.06.06 22:38:53 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Titanium

[2011.11.09 15:54:19 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TomTom

[2011.09.20 18:13:54 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Win7codecs

[2012.03.21 15:38:17 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Zeon

 
 ========== Purity Check ==========

 

 
 

< End of report >

--- --- ---

OTL Logfile:

Code:

OTL Extras logfile created on: 05.11.2012 10:31:00 - Run 4

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\***\Desktop

 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,25 Gb Total Physical Memory | 2,09 Gb Available Physical Memory | 64,22% Memory free

13,01 Gb Paging File | 11,59 Gb Available in Paging File | 89,04% Paging File free

Paging file location(s): c:\pagefile.sys 10000 10000 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 465,66 Gb Total Space | 309,79 Gb Free Space | 66,53% Space Free | Partition Type: NTFS

 

Computer Name: JUBELDIBUB | User Name: *** | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

.reg [@ = regfile] -- regedit.exe "%1"

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [open] -- regedit.exe "%1"

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files\VLC Media Player\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [cmd] -- cmd.exe /s /k pushd "%V"

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Program Files\VLC Media Player\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 0

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 0

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"EnableFirewall" = 0

"DisableNotifications" = 0

 
 ========== Authorized Applications List ==========

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{07418BEC-32B2-4BBB-90B6-96A18C26C57E}" = lport=445 | protocol=6 | dir=in | app=system | 

"{1ACFEB17-25FE-4962-8418-A7076255ADC1}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 

"{1E018D47-4D7A-4BCC-8D10-9C291B643920}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{1EFAAE3F-E135-4507-9597-7528F935EC92}" = rport=445 | protocol=6 | dir=out | app=system | 

"{37AA065A-4630-4A6A-AB5F-9CEDA2BFE59E}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{38EB0773-D885-43CA-AF37-CE22BADC41F8}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{6F6FB99F-338E-4C2E-BACA-9D93D54C5142}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{7C088D17-B82B-4C23-A74F-EFB7409A58A4}" = rport=139 | protocol=6 | dir=out | app=system | 

"{85AA6498-9DF5-44D1-B418-2502F65DCAB1}" = rport=10243 | protocol=6 | dir=out | app=system | 

"{8CB01AE0-9095-4838-9C1A-4C5217654AAD}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{8DC2B5DD-A6B4-4EA9-9AD1-CED060EBDC22}" = lport=10243 | protocol=6 | dir=in | app=system | 

"{8F0B4B9F-4E20-413E-B1EB-F7D9BBE0F2E1}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{99A71136-42E0-45EE-9032-23DDD807BD73}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{A2530926-955F-4F25-B7D7-75F7183ED877}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{BCE01428-F70E-4C6E-8ADF-264BD465BCAC}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{BF558F8D-C6AD-41CE-950C-FDF17E09F539}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{CC66DC8D-2AE4-44A3-98E1-90E738159D2B}" = rport=138 | protocol=17 | dir=out | app=system | 

"{D01FDF4C-3BDF-4BE2-A432-9D0713176EF2}" = rport=137 | protocol=17 | dir=out | app=system | 

"{D06530E9-89F5-4D81-A67C-3F7CB6470D0A}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{D5D399BD-5068-4376-9F26-8C8BA89BCF0B}" = lport=138 | protocol=17 | dir=in | app=system | 

"{DA61C31C-0312-466D-A8EA-619D6DB03474}" = lport=139 | protocol=6 | dir=in | app=system | 

"{F267B621-B82E-472E-BA85-D747B9D5001A}" = lport=137 | protocol=17 | dir=in | app=system | 

"{FC880E3E-4500-4976-BCCA-57ACD26C3A27}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{03801C07-BEF6-4CA5-9296-00B9B4B06CD9}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{06219141-0D21-4A2C-9634-35805E76908D}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{0711E96B-E7E0-4EE1-B5C7-F5C90D7CB19F}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\skyrim\skyrimlauncher.exe | 

"{078EE463-BD11-47F2-816F-872AED480C7E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{1924588C-CF8A-41D7-898E-24408F5DAFFA}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{204137CE-745C-4F30-BB6C-07561581EE95}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 

"{23468757-9272-4115-B18E-585F94ECAD55}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe | 

"{23B4B459-7355-4670-9127-4E85796D47F8}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe | 

"{3715C2AD-F1F5-419D-B165-2029388B6930}" = protocol=6 | dir=out | app=system | 

"{3F3FFB0B-C27C-45AD-9B3C-88ACAE5311EB}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 

"{54B3D7B2-91DE-404F-86D1-862F239DA914}" = protocol=17 | dir=in | app=c:\program files\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | 

"{640B2679-75CA-4F31-B54C-04CF2F21D884}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{76095CBE-581E-4FD9-8B3F-27CFA186B5C8}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 

"{7BE8D95A-ED28-470D-81AD-B2E77FB6BDF6}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\skyrim\creationkit.exe | 

"{8920E2F1-2B2C-41EE-A813-D273006E24DF}" = protocol=6 | dir=in | app=c:\program files\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | 

"{8DF698FE-3F08-4846-AF12-BC4A110E83E2}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\skyrim\creationkit.exe | 

"{99E3DF3C-D217-4E30-8B86-F687FC33116F}" = protocol=6 | dir=in | app=c:\program files\ubisoft\might & magic heroes vi\might & magic heroes vi.exe | 

"{A56A6984-19A2-49DC-8ABF-E19DB72F45BD}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{B473C7EC-BAE1-4233-8814-2576F05F865A}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{B786D160-106F-403C-A66D-66A3E879D0DE}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\skyrim\creationkit.exe | 

"{C18D05A7-37D2-4545-8F8D-E4541C7ECF01}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\skyrim\skyrimlauncher.exe | 

"{C5AE2B9C-1534-4169-8DE5-1CB48F2E710A}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\skyrim\skyrimlauncher.exe | 

"{D19827E9-4971-490A-BE1E-D9E512F64130}" = protocol=17 | dir=in | app=c:\program files\ubisoft\might & magic heroes vi\might & magic heroes vi.exe | 

"{D774FC06-2844-48B0-9EAB-0F8DAD595BF6}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\skyrim\creationkit.exe | 

"{D9C02157-C663-4CB1-A5AD-B071BC77B713}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 

"{DDA6738F-177B-432A-AFA4-A7D32AD6CE48}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\skyrim\skyrimlauncher.exe | 

"{DFC83CDD-61B9-47F8-90E5-EB2492D56B26}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{E932EE0A-692A-4210-9F9A-7E5DA83F2B02}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{F0A759CB-5D3B-4D01-A364-6B0CD1C49845}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{F5B9E49B-14A0-46FC-90B1-0F2EDEEE16EA}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{02FCAA8F-59D3-4198-822E-135C61EE4F0B}" = NeroKwikMedia Help (CHM)

"{03AEAB60-A7B3-A8DB-468B-EB30FB4B40B0}" = CCC Help German

"{03F1CC67-5BD8-4C36-8394-76311B2AE69A}" = ArcSoft PhotoStudio 5

"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam

"{07010016-0001-2010-0110-4D6161546563}" = MaaTec Sudoku

"{08C8666B-C502-4AB3-B4CB-D74AC42D14FE}" = Nero BackItUp 10 Help (CHM)

"{162ABED6-E60C-6CFF-100E-43C16ABBC5BE}" = CCC Help Chinese Standard

"{16987E99-C95C-4513-9239-7B44A0A71DB5}" = Nero SoundTrax 10 Help (CHM)

"{1808A2AC-DB66-6B80-9340-F6476390CB18}" = AMD Drag and Drop Transcoding

"{1CB724FF-D18C-8FFB-E7C9-0A09CF8EC066}" = CCC Help Japanese

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{1F7D9F37-C39C-486C-BDF8-8F440FFB3352}" = Nero Kwik Media

"{20C14CC3-5E3B-D39A-5B37-B15E59785063}" = CCC Help Chinese Traditional

"{2436F2A8-4B7E-4B6C-AE4E-604C84AA6A4F}" = Nero Core Components 10

"{2632A2C0-ECF4-7F79-7136-9FEA4C253A4C}" = CCC Help Turkish

"{277C1559-4CF7-44FF-8D07-98AA9C13AABD}" = Nero Multimedia Suite 10

"{2E376AD9-5C49-4F7D-A0BA-6A44E8FA5A3B}" = Next Generation Visualisations

"{30F712DA-64FE-5DBE-AE76-3F8EA3F8223C}" = CCC Help French

"{329411A0-19F3-4740-874F-17400B126F27}" = Nero Vision 10 Help (CHM)

"{330DAC67-5B62-452A-A0E4-6B4A5923940F}_is1" = MotioninJoy ds3 driver version 0.6.0005

"{33643918-7957-4839-92C7-EA96CB621A98}" = Nero Express 10 Help (CHM)

"{34490F4E-48D0-492E-8249-B48BECF0537C}" = Nero DiscSpeed 10

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{3C39B3CC-4EC8-C756-AF4B-72366504FCA5}" = CCC Help Hungarian

"{3E7D839E-A6E7-B6F8-F855-CF69756E6331}" = AMD Media Foundation Decoders

"{4CC9D761-A9B6-D8EA-D2A9-B74B5A90B108}" = CCC Help Norwegian

"{4F198874-3C7D-5983-02EB-9E234C43F174}" = AMD Steady Video Plug-In 

"{5180FB30-2AC7-1627-9856-AA0AE6ACB7E7}" = ccc-utility

"{523B2B1B-D8DB-4B41-90FF-C4D799E2758A}" = Nero ControlCenter 10 Help (CHM)

"{54B227A6-BDBE-69FA-D450-B99609063044}" = CCC Help Greek

"{555868C6-49FB-484F-BB43-8980651A1B00}" = Nero BurnRights 10 Help (CHM)

"{58CB9A9A-1EFB-4EA8-B50C-3097E754AC21}" = High-Definition Video Playback

"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth

"{5F548A02-80BC-404D-BAE6-F05F9BF6B449}" = Nero DiscCopyGadget 10 Help (CHM)

"{6006059E-013D-4B77-BC5C-4DD5E4A6570D}" = G Data InternetSecurity 2012

"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM

"{635A6AF2-63AF-4C1C-AF57-BDC8AF6D397D}" = UltraEdit

"{63AA3EAB-23BB-48B2-9AD0-44F878075604}" = Nero 10 Menu TemplatePack Basic

"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update

"{66049135-9659-4AAD-9169-9CCA269EBB3E}" = Nero InfoTool 10 Help (CHM)

"{68AB6930-5BFF-4FF6-923B-516A91984FE6}" = Nero BackItUp 10

"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2

"{6DFB899F-17A2-48F0-A533-ED8D6866CF38}" = Nero Control Center 10

"{70550193-1C22-445C-8FA4-564E155DB1A7}" = Nero Express 10

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{745D37C2-26F4-4B65-BA13-F9840EBFA75B}" = Might & Magic Heroes VI

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{7964AE02-9127-42C0-A917-2CE4CD4EFE3B}" = Nokia Suite

"{7A295D8F-484B-4FFB-89AB-C1FD497591FE}" = Nero WaveEditor 10 Help (CHM)

"{7A5D731D-B4B3-490E-B339-75685712BAAB}" = Nero Burning ROM 10

"{7C587778-C433-980E-F3C1-203890DC4FBE}" = CCC Help Polish

"{7DC3EABF-66A2-6D79-B485-6328525CA387}" = CCC Help Swedish

"{7E8242F8-BD2A-44D7-BCED-9B231A02B367}" = SpellForce 2 Patch

"{843603C6-75B7-BAB5-80DE-E76FB28DEEF2}" = CCC Help Finnish

"{876B50AF-D46A-ED35-C625-20F326FE0C49}" = AMD Accelerated Video Transcoding

"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8BBC66FD-0195-29B4-5A58-E0B0554E8F42}" = AMD VISION Engine Control Center

"{8C0CAA7A-3272-4991-A808-2C7559DE3409}" = Win7codecs

"{8D9EEAC7-42D5-3951-612A-EAA7B684C592}" = CCC Help Italian

"{8ECEC853-5C3D-4B10-B5C7-FF11FF724807}" = Nero Recode 10

"{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules

"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003

"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007

"{90120000-001F-0407-0000-0000000FF1CE}_VISPRO_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-0409-0000-0000000FF1CE}_VISPRO_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007

"{90120000-001F-040C-0000-0000000FF1CE}_VISPRO_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007

"{90120000-001F-0410-0000-0000000FF1CE}_VISPRO_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System

"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007

"{90120000-0051-0000-0000-0000000FF1CE}" = Microsoft Office Visio Professional 2007

"{90120000-0051-0000-0000-0000000FF1CE}_VISPRO_{CE144BF4-4950-4CDB-A5F7-CCE1888F49CB}" = Microsoft Office Visio 2007 Service Pack 3 (SP3)

"{90120000-0054-0407-0000-0000000FF1CE}" = Microsoft Office Visio MUI (German) 2007

"{90120000-0054-0407-0000-0000000FF1CE}_VISPRO_{3CB0380B-0413-4C44-A63B-DCD6369EAF4E}" = Microsoft Office Visio 2007 Service Pack 3 (SP3)

"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007

"{90120000-006E-0407-0000-0000000FF1CE}_VISPRO_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In

"{92E25238-61A3-4ACD-A407-3C480EEF47A7}" = Nero RescueAgent 10 Help (CHM)

"{92EC1A84-7FFC-42DF-A8F6-79C21C4765A5}" = Nero DiscCopy Gadget 10

"{943CFD7D-5336-47AF-9418-E02473A5A517}" = Nero BurnRights 10

"{9791DAED-B734-2835-988B-157BDA087496}" = CCC Help Dutch

"{98B740C3-FAA4-C523-7478-4DBCAB7B27D1}" = Catalyst Control Center Graphics Previews Common

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9A4297F3-2A51-4ED9-92CA-4BCB8380947E}" = Nero Vision 10

"{9B6B24BE-80E7-46C4-9FA5-B167D5E0F345}" = Nero BurningROM 10 Help (CHM)

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{9F0CAC6D-9B0D-A95F-CF61-6E88952D6181}" = CCC Help Thai

"{A25FF1C0-80B6-4B8B-A551-DC525697A408}" = AMD APP SDK Runtime

"{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1" = PDF-Viewer

"{A57025CC-5F2E-4D01-B387-06DB10500D43}" = Nokia Connectivity Cable Driver

"{A625DB70-98D5-16FD-C49D-4B8B1B2304A4}" = CCC Help Spanish

"{A90214C3-3A0C-2F05-6083-E1A4BAD9E30D}" = CCC Help Danish

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{AA123216-6DE0-E57C-DC57-4FECEACB482F}" = CCC Help Russian

"{ABBACAD2-4DAF-490E-932B-E330B33FCF98}" = Softi FreeOCR

"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch

"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86

"{BCE46757-7674-4416-BEDB-68205A60409E}" = Canon CanoScan Toolbox 4.1

"{BF14351F-DCB6-5F0B-9884-A49DFA901B4A}" = AMD Fuel

"{C18A0418-442A-4186-AF98-D08F5054A2FC}" = Nero DiscSpeed 10 Help (CHM)

"{C3273C55-E1E4-41FF-8D69-0158090DB8D8}" = Nero CoverDesigner 10 Help (CHM)

"{C3580AC4-C827-4332-B935-9A282ED5BB97}" = Nero Dolby Files 10

"{CCF298AF-9CE1-4B26-B251-486E98A34789}" = Windows 7 USB/DVD Download Tool

"{D0837A59-83E6-3392-1BD9-86D3445676DB}" = CCC Help Korean

"{D5068813-9F8D-9F7A-92C0-A3EECBA2D82B}" = AMD Catalyst Install Manager

"{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}" = Microsoft XNA Framework Redistributable 4.0 Refresh

"{D70AB273-113B-D7DE-5C8D-82CABA7CB0AF}" = Catalyst Control Center Localization All

"{DA5B2BDC-F654-4A88-A669-4D34BC7846A1}" = PC Connectivity Solution

"{DB7C1D4A-08BA-4C7E-A8AA-B7F9BB372DCF}" = Nero Recode 10 Help (CHM)

"{DC8772D4-C75F-5235-63E2-BBC73F909B7A}" = CCC Help Czech

"{DED7FD3C-DDD2-43BB-B0F5-B07F9D0430D3}" = CCC Help Portuguese

"{DF8195AF-8E6F-4487-A0EE-196F7E3F4B8A}" = jetAudio Plus VX

"{E0E55FC1-C53D-4F8D-B14B-B59C312747C8}" = LightScribe System Software

"{E157F2EB-E06F-B57F-9105-68F348DB2EAD}" = CCC Help English

"{E1EE5339-5D32-458F-BAAB-B19F6301BCE2}" = Nero SoundTrax 10

"{E2F0AF23-FE2F-4222-9A43-55E63CC41EF1}" = Catalyst Control Center - Branding

"{E337E787-CF61-4B7B-B84F-509202A54023}" = Nero RescueAgent 10

"{E3B64CC5-C011-40C0-92BC-7316CD5E5688}" = Microsoft_VC100_CRT_SP1_x86

"{EDCDFAD5-DF80-4600-A493-E9DAD6810230}" = Nero WaveEditor 10

"{EF036F44-A287-BC23-3F6E-AAE6FDEF47EF}" = Catalyst Control Center InstallProxy

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5

"{F412B4AF-388C-4FF5-9B2F-33DB1C536953}" = Nero InfoTool 10

"{F5CB822F-B365-43D1-BCC0-4FDA1A2017A7}" = Nero 10 Movie ThemePack Basic

"{F6117F9C-ADB5-4590-9BE4-12C7BEC28702}" = Nero StartSmart 10 Help (CHM)

"{F61D489E-6C44-49AC-AD02-7DA8ACA73A65}" = Nero StartSmart 10

"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"{FCF00A6E-FB58-477A-ABE9-232907105521}" = Nero CoverDesigner 10

"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)

"6af12c54-643b-4752-87d0-8335503010de_is1" = Nexus Mod Manager

"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX

"Adobe Shockwave Player" = Adobe Shockwave Player 11.6

"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.17

"AnyDVD" = AnyDVD

"Avidemux 2.5" = Avidemux 2.5 (32-bit)

"CCleaner" = CCleaner

"CloneDVD2" = CloneDVD2

"DAEMON Tools Lite" = DAEMON Tools Lite

"Diablo III" = Diablo III

"Easy Video Splitter_is1" = Easy Video Splitter 1.28

"ElsterFormular 13.1.1.8531p" = ElsterFormular

"ImgBurn" = ImgBurn

"InstallShield_{635A6AF2-63AF-4C1C-AF57-BDC8AF6D397D}" = UltraEdit

"IrfanView" = IrfanView (remove only)

"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.1.1000

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"Nokia Suite" = Nokia Suite

"Notepad++" = Notepad++

"Steam App 202480" = Creation Kit

"Steam App 72850" = The Elder Scrolls V: Skyrim

"TomTom HOME" = TomTom HOME 2.8.2.2264

"Totalcmd" = Total Commander (Remove or Repair)

"VISPRO" = Microsoft Office Visio Professional 2007

"VLC media player" = VLC media player 1.1.11

"vsfilter_is1" = DirectVobSub 2.40.3644 x86

"WinGimp-2.0_is1" = GIMP 2.6.11

"WinRAR archiver" = WinRAR 4.01 (32-Bit)

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"SuDoKu-Cracker" = SuDoKu-Cracker

 
 ========== Last 20 Event Log Errors ==========

 

[ Application Events ]

Error - 05.07.2012 08:45:36 | Computer Name = Jubeldibub | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567,

 Zeitstempel: 0x4d6727a7  Name des fehlerhaften Moduls: DivXMFSource.dll, Version:

 1.0.0.72, Zeitstempel: 0x4cffcf66  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0009b8a1

ID

 des fehlerhaften Prozesses: 0x16b4  Startzeit der fehlerhaften Anwendung: 0x01cd5aabd5b800af

Pfad

 der fehlerhaften Anwendung: C:\Windows\explorer.exe  Pfad des fehlerhaften Moduls:

 C:\Program Files\Win7codecs\filters\DivXMFSource.dll  Berichtskennung: 509cf719-c69f-11e1-85f3-6cf049013ce5

 

Error - 05.07.2012 08:53:41 | Computer Name = Jubeldibub | Source = WinMgmt | ID = 10

Description = 

 

Error - 05.07.2012 13:46:00 | Computer Name = Jubeldibub | Source = WinMgmt | ID = 10

Description = 

 

Error - 06.07.2012 01:55:12 | Computer Name = Jubeldibub | Source = WinMgmt | ID = 10

Description = 

 

Error - 06.07.2012 02:04:21 | Computer Name = Jubeldibub | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: MsiExec.exe, Version: 5.0.7601.17514,

 Zeitstempel: 0x4ce792c4  Name des fehlerhaften Moduls: MSIFB36.tmp, Version: 2.0.0.9,

 Zeitstempel: 0x4d4b089c  Ausnahmecode: 0xc000000d  Fehleroffset: 0x00019d88  ID des fehlerhaften

 Prozesses: 0x980  Startzeit der fehlerhaften Anwendung: 0x01cd5b3d26a6f11c  Pfad der

 fehlerhaften Anwendung: C:\Windows\system32\MsiExec.exe  Pfad des fehlerhaften Moduls:

 C:\Windows\Installer\MSIFB36.tmp  Berichtskennung: 6da2816e-c730-11e1-9aef-6cf049013ce5

 

Error - 06.07.2012 02:04:38 | Computer Name = Jubeldibub | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: MsiExec.exe, Version: 5.0.7601.17514,

 Zeitstempel: 0x4ce792c4  Name des fehlerhaften Moduls: MSI7893.tmp, Version: 2.0.0.9,

 Zeitstempel: 0x4d4b089c  Ausnahmecode: 0xc000000d  Fehleroffset: 0x00019d88  ID des fehlerhaften

 Prozesses: 0x1508  Startzeit der fehlerhaften Anwendung: 0x01cd5b3d39966a82  Pfad der

 fehlerhaften Anwendung: C:\Windows\system32\MsiExec.exe  Pfad des fehlerhaften Moduls:

 C:\Windows\Installer\MSI7893.tmp  Berichtskennung: 77b798cf-c730-11e1-9aef-6cf049013ce5

 

Error - 06.07.2012 08:31:33 | Computer Name = Jubeldibub | Source = WinMgmt | ID = 10

Description = 

 

Error - 06.07.2012 10:17:08 | Computer Name = Jubeldibub | Source = WinMgmt | ID = 10

Description = 

 

Error - 07.07.2012 03:47:51 | Computer Name = Jubeldibub | Source = WinMgmt | ID = 10

Description = 

 

Error - 07.07.2012 07:13:55 | Computer Name = Jubeldibub | Source = WinMgmt | ID = 10

Description = 

 

[ System Events ]

Error - 03.11.2012 06:03:52 | Computer Name = Jubeldibub | Source = Service Control Manager | ID = 7009

Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst

 Windows Search erreicht.

 

Error - 03.11.2012 06:03:52 | Computer Name = Jubeldibub | Source = Service Control Manager | ID = 7000

Description = Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht

 gestartet:   %%1053

 

Error - 03.11.2012 06:03:52 | Computer Name = Jubeldibub | Source = Service Control Manager | ID = 7009

Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst

 Windows Search erreicht.

 

Error - 03.11.2012 06:03:52 | Computer Name = Jubeldibub | Source = Service Control Manager | ID = 7000

Description = Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht

 gestartet:   %%1053

 

Error - 03.11.2012 06:03:55 | Computer Name = Jubeldibub | Source = Service Control Manager | ID = 7009

Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst

 Windows Search erreicht.

 

Error - 03.11.2012 06:03:55 | Computer Name = Jubeldibub | Source = Service Control Manager | ID = 7000

Description = Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht

 gestartet:   %%1053

 

Error - 04.11.2012 05:44:50 | Computer Name = Jubeldibub | Source = Service Control Manager | ID = 7000

Description = Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%2

 

Error - 04.11.2012 06:31:33 | Computer Name = Jubeldibub | Source = Service Control Manager | ID = 7023

Description = Der Dienst "Windows-Zeitgeber" wurde mit folgendem Fehler beendet:

   %%1115

 

Error - 04.11.2012 06:32:31 | Computer Name = Jubeldibub | Source = Service Control Manager | ID = 7000

Description = Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%2

 

Error - 05.11.2012 03:55:13 | Computer Name = Jubeldibub | Source = Service Control Manager | ID = 7000

Description = Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%2

 

 

< End of report >

--- --- ---

AnyDVD nicht mehr installiert?

Hallo,

doch, sicher. Das war aber die ganze Zeit auf dem Rechner. Lag es etwa daran? oO

Edit:
Mist :headbang: - zu früh gefreut. Habe gerade neue Bilder in den Ordner verschoben, nun entsteht wieder das selbe Problem: Die Ansichtseinstellungen heben sich auf und die Vorschaubilder wechseln. Dabei beobachte ich aber folgendes: Stelle ich ein Bild als Ordnerbild ein und verschiebe danach weitere Bilder in diesen Ordner, wird das Ordnerbild durch die frisch hineingeschobenen Bilder ersetzt. Es scheint ganz so zu sein, als wenn das Ordnerbild nicht korrekt gespeichert wird.

Was nun?

zu AnyDVD:
unter Sytemsteuerung-> Software/Programme existiert nicht, erscheint nur im Autostart?
"Start -> Alle Programme-> Zubehör-> Ausführen" .. und gibst Du "msconfig" (ohne "") ein -> OK -> Systemstart....

Hi,

ich verstehe jetzt nicht ganz, was du mir damit sagen wolltest. Soll ich nachsehen, ob AnyDVD nur im Autostart (und nicht in der Liste der installierten Programme) ist? Dann: Nein. Es ist sowohl im Autostart als auch in der Systemsteuerung zu finden.

schaue mal deine "Zurzeit installierte Programme" an:-> http://www.trojaner-board.de/126301-...tml#post949552

ansonsten zur Info:
AnyDVD <- "Hacker-Tools"

Hallo,

ich schaue und sehe... nichts? Bringt uns das der Lösung jetzt irgendwie näher? Ich verstehe seit gut drei Posts nicht wirklich, inwiefern das nun weiterhilft. Also: Die Symptome sind dieselben geblieben, bisher haben wir was auch immer meine Einstellungen durcheinanderbringt nicht gefunden.

Was AnyDVD angeht: Ich habe das Programm vor einigen Jahren (genauer: deutlich vor 2008 - der magischen Raubkopierrechtslagenänderungsschwelle) mit einer lebenslangen Lizenz gekauft - derzeitige Rechtslage ist, meines bescheidenen Wissens nach, das die Nutzung illegal ist, der Besitz nicht - besonders nicht, wenn die Beschaffung aus einer Zeit stammt, in der man es legal erwerben konnte. Du machst dich also keinesfalls strafbar, wenn du mit mir kommunizierst (es sei denn, du stiftest mich dazu an, es zu benutzen ;-). Ich verstehe hier den Punkt nicht. Kannst du mir jetzt nicht mehr weiterhelfen, weil ich vor mehreren Jahren Geld für ein Programm ausgegeben habe, dass später als illegal eingestuft wurde und nun noch auf meinem PC ist?

es geht um darum, dass das Programm nicht "sauber" deinstalliert wurde. Zwar unter "Zurzeit installierte Programme" existiert nicht (mehr), aber läuft aktiv im Hintergrund...

1.
Programme aus dem Autostart zu entfernen ("Häkchen entfernen"), die das System garnix benötigt, aber beeinträchtigen die Systemleistung:

Code:

O4 - HKLM..\Run: [NBAgent] C:\Program Files\Nero\Nero 10\Nero BackItUp\NBAgent.exe (Nero AG)

O4 - HKCU..\Run: [AnyDVD] C:\Programme\SlySoft\AnyDVD\AnyDVDtray.exe (SlySoft, Inc.)

O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)

um den Autostart von Windows XP zu verwalten:-> "Start-> ausführen-> "msconfig" (reinschreiben ohne ""-> OK -> Systemstart
► Vista u. Win7: "Start -> Alle Programme-> Zubehör-> Ausführen" .. und gibst Du "msconfig" (ohne "") ein ->OK -> Systemstart-> Häckhen weg
Die Programme bleiben dabei erhalten, falls man braucht, können jederzeit manuell gestartet werden!
Je mehr Programme hier aufgeführt sind, umso langsamer startet Windows. Deshalb kann es sinnvoll sein, Software die man nicht unbedingt immer benötigt, aus dem Autostart zu entfernen.- Bei allem Häkchen weg was nicht starten soll.
Die Programme bleiben dabei erhalten, falls man braucht, kann jederzeit manuell gestartet werden![/COLOR][/SIZE][/I][/B]

2.
Dienste beenden:
gehe auf Start -> Ausführen -> "Services.msc" -> (reinschreiben ohne ""-> OK" - Rechtsklick auf besagten Dienst...-> Beenden
oder Rechtsklick "Eigenschaften"-> "Dienststatus"-> "Beenden" auswählen

Code:

Nero

AnyDVD / SlySoft

DAEMON Tools Lite

3.
falls es wieder nötig ist:
CD-Emulatoren mit DeFogger deaktivieren

Du hast CD-Emulatoren wie Alcohol, DaemonTools oder ähnliche auf diesem Computer installiert. Da diese Emulatoren mit Rootkit-Technik arbeiten, können sie die Fahndung nach bösartigen Rootkits verfälschen und erschweren. Aus diesem Grund bitte entweder das folgende Tool zum Deaktivieren laufen lassen oder die Software über Systemsteuerung => Software/Programme deinstallieren. Berichte mir, für welche Variante Du Dich entschieden hast. Die Deaktivierung können wir nach der Bereinigung rückgängig machen.

Lade DeFogger herunter und speichere es auf Deinem Desktop.

Doppelklicke DeFogger, um das Tool zu starten.

Es öffnet sich das Programm-Fenster des Tools.
Klick auf den Button Disable, um die CD- Emulation-Treiber zu deaktivieren.
Klicke Ja, um fortzufahren.
Wenn die Nachricht 'Finished!' erscheint,
klicke OK.
DeFogger wird nun einen Reboot erfragen - klicke OK
Poste mir das defogger_disable.log hier in den Thread.

Keinesfalls die Treiber reaktivieren, bevor es angewiesen wird.

4.
Nur für 32-Bit-Systeme
Um einen tieferen Einblick in dein System, um eine mögliche Infektion mit einem Rootkit/Info v.wikipedia.org) aufzuspüren, werden wir ein Tool - Gmer - einsetzen :

Anleitung:-> Rootkit-Suche mit Gmer
► WENN das Tool GMER NICHT AUSGEFÜHRT WERDEN KANN ODER PROBMLEME VERURSACHT, fahre mit dem nächsten Punkt fort!

5.
Kontrolle mit MBR -t, ob Master Boot Record in Ordnung ist (MBR-Rootkit)

Mit dem folgenden Tool prüfen wir, ob sich etwas Schädliches im Master Boot Record eingenistet hat.

Downloade die MBR.exe von Gmer und
kopiere die Datei mbr.exe in den Ordner C:\Windows\system32.
Falls Du den Ordner nicht sehen kannst, diese Einstellungen in den Ordneroptionen vornehmen.
Start => ausführen => cmd (da reinschreiben) => OK
es öffnet sich eine Eingabeaufforderung.

Vista- und Windows 7-User: Start => Alle Programme => Zubehör => Rechtsklick auf Eingabeaufforderung und wähle Als Administrator ausführen.
Nach dem Prompt (>_) folgenden

aus der Codebox manuell eingeben oder alternativ den mit STRG + C ins Clipboard kopieren und einfügen.
Einfügen in der Eingabeaufforderung: in der Titelleiste einen Rechtsklick machen => Bearbeiten => einfügen.

Code:

mbr.exe -t > C:\mbr.log & C:\mbr.log

(Enter drücken)
Nach kurzer Zeit wird sich Dein Editor öffnen und die Datei C:\mbr.log beinhalten.
Bitte kopiere den Inhalt hier in Deinen Thread.

Hallo,

alles klar, ich habe die genannten Dienste und Autostarts deaktiviert sowie Daemon Tools deinstalliert (wusste bis eben gar nicht, dass ich das besitze :stirn: ), habe den Schritt mit dem Defogger also ausgelassen.

Hier die entsprechenden Logs:

GMER Logfile:

Code:

GMER 1.0.15.15641 - hxxp://www.gmer.net

Rootkit scan 2012-11-07 14:06:43

Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD5001AALS-00J7B1 rev.05.00K05

Running: n9trw6m4.exe; Driver: C:\Users\PHILIP~1\AppData\Local\Temp\pwlirpow.sys
 
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text           ntkrnlpa.exe!ZwRollbackEnlistment + 140D                                                                                                    83040A49 1 Byte  [06]

.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                                                      8307A4D2 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}

.text           C:\Windows\system32\DRIVERS\atikmdag.sys                                                                                                    section is writeable [0x91634000, 0x130E98, 0xE8000020]

PAGE            spsys.sys!?SPRevision@@3PADA + 4F90                                                                                                         A15B2000 290 Bytes  [8B, FF, 55, 8B, EC, 33, C0, ...]

PAGE            spsys.sys!?SPRevision@@3PADA + 50B3                                                                                                         A15B2123 486 Bytes  [D5, 5A, A1, FE, 05, 34, D5, ...]

PAGE            spsys.sys!?SPRevision@@3PADA + 529A                                                                                                         A15B230A 142 Bytes  [5A, A1, 3B, 08, 77, 04, 3B, ...]

PAGE            spsys.sys!?SPRevision@@3PADA + 5329                                                                                                         A15B2399 101 Bytes  [6A, 28, 59, A5, 5E, C6, 03, ...]

PAGE            spsys.sys!?SPRevision@@3PADA + 538F                                                                                                         A15B23FF 148 Bytes  [18, 5D, C2, 14, 00, 8B, FF, ...]

PAGE            ...                                                                                                                                         
 

---- User IAT/EAT - GMER 1.0.15 ----
 

IAT             C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2316] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress]    [74EAFFF6] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT             C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2316] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress]     [74EAFFF6] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT             C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2316] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress]  [74EAFFF6] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

IAT             C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2316] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress]   [74EAFFF6] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
 

---- Devices - GMER 1.0.15 ----
 

Device          \Driver\ACPI_HAL \Device\00000049                                                                                                           halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)
 

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                                                      fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                                                                      fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
 

---- EOF - GMER 1.0.15 ----

--- --- ---

MBR-Logfile:

Code:

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, hxxp://www.gmer.net

Windows 6.1.7601 Disk: WDC_WD5001AALS-00J7B1 rev.05.00K05 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 
 

device: opened successfully

user: MBR read successfully
 

Disk trace:

called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll ataport.SYS pciide.sys PCIIDEX.SYS atapi.sys 

1 ntkrnlpa!IofCallDriver[0x83073BC5] -> \Device\Harddisk0\DR0[0x867AB440]

3 CLASSPNP[0x8C18759E] -> ntkrnlpa!IofCallDriver[0x83073BC5] -> [0x86270918]

5 ACPI[0x837BC3D4] -> ntkrnlpa!IofCallDriver[0x83073BC5] -> \Device\Ide\IdeDeviceP0T0L0-0[0x8596C908]

kernel: MBR read successfully

user & kernel MBR OK

1.
Vor dem nächsten Schritt, also bevor wir weitermachen:
Da jederzeit etwas passieren kann, wenn du wichtige Daten hast die Du sichern möchtest, empfehle ich Dir es jetzt machen (wie Bilder, Musik usw)
►Achte darauf: Die sicherten Daten sollen keine "Ausführbare Dateien" enthalten! - ►Dateiendungen - Dies ist eine Liste von Dateiendungen, die Dateien mit ausführbarem Code bezeichnen können.
Unabhängig von einem Befall (weil ja kann eine Festplatte auch kaputt gehen, oder es gibt andere technische Probleme ), sollte man regelmäßig Sicherung machen und an einem sicheren Ort bewahren, wie CD und DVD, externe Festplatten oder/und USB-Sticks
Mache das jetzt bitte!

2.
Lade Combofix von einem der folgenden Download-Spiegel herunter:

BleepingComputer.com - ForoSpyware.com

und speichere das Programm auf den Desktop, nicht woanders hin, das ist wichtig!
Beachte die ausführliche Original-Anleitung.

Zurzeit ist Combofix auf folgenden Windows-Versionen lauffähig:

Windows XP (nur 32-bit)
Windows 2000 (nur 32-bit)
Windows Vista (32-bit/64-bit)
Windows 7 (32-bit/64-bit)

Vorbereitung und wichtige Hinweise

Bitte während des Scans mit Combofix Antiviren- sowie Antispy-Programme, die Firewall und evtl. vorhandenes Skript-Blocking (Norton) deaktivieren.
Liste der zu deaktivierenden Programme.
Bei Unklarheiten bitte vorher fragen.
Bitte während des Laufs von Combofix nicht in das Combofix-Fenster klicken.
Das könnte Dein System einfrieren oder hängen bleiben lassen.
Es kann circa eine Viertelstunde dauern, bis der Scan fertig ist.
ComboFix wird Deine Einstellungen in Bezug auf den Bildschirmschoner zurücksetzen.
Diese Einstellungen kannst Du nach Beendigung unserer Bereinigung wieder ändern.
Mache nichts anderes, wenn es Dir nicht gelungen ist, Combofix laufen zu lassen.
Teile uns das mit und warte auf unsere Anweisungen.

Kurzanleitung zur Installation der Wiederherstellungskonsole unter XP

Doppelklicke auf die ComboFix.exe und folge den Anweisungen.
Akzeptiere die Bedingungen (Disclaimer) mit "Ja".
ComboFix wird schauen, ob die Microsoft-Windows-Wiederherstellungskonsole installiert ist.
Dies ist Teil des Prozesses. Angesichts der Art von Malware Infizierungen, die es heute gibt, wird dringend empfohlen, diese Wiederherstellungskonsole auf dem PC installiert zu haben, bevor jegliche Reinigung von Malware durchgeführt wird.
Folge den Anweisungen, um ComboFix das Herunterladen und Installieren der Wiederherstellungskonsole zu ermöglichen und stimme dem Lizenzvertrag (EULA) zu, sobald Du dazu aufgefordert wirst.

** Zur Information: Sollte die Wiederherstellungskonsole schon installiert sein, so wird ComboFix seine Malware-Entfernungsprozedur normal fortfahren.

http://i94.photobucket.com/albums/l8...eWHKonsole.jpg

Sobald die Wiederherstellungskonsole durch ComboFix installiert wurde, solltest Du folgende Nachricht sehen:

http://i94.photobucket.com/albums/l8...nstalliert.jpg

Klicke "Ja", um mit dem Suchlauf nach Malware fortzufahren.

Wenn ComboFix fertig ist, wird es ein Log erstellen (bitte warten, das dauert einen Moment).
Unbedingt warten, bis sich das Combofix-Fenster geschlossen hat und das Logfile im Editor erscheint.
Bitte poste die Log-Dateien C:\ComboFix.txt und C:\Qoobox\Add-Remove Programs.txt in Code-Tags hier in den Thread.

Hinweis: Combofix macht aus verschiedenen Gründen den Internet Explorer zum Standard-Browser und erstellt ein IE-Icon auf dem Desktop.
Das IE-Desktop-Icon kannst Du nach der Bereinigung wieder löschen und Deinen bevorzugten Browser wieder als Standard-Browser einstellen.

Combofix nicht auf eigene Faust einsetzen. Wenn keine entsprechende Infektion vorliegt, kann das den Rechner lahmlegen und/oder nachhaltig schädigen!

Hi,

ComboFix ist gelaufen. Zu Beginn beanstandete es, dass mein G Data AntiVir angeblich noch laufen würde - was es aber definitiv nicht tat. Ich habe sogar alle entsprechenden Einträge aus dem Autostart genommen, damit es bei PC-Start gar nicht erst anläuft. Auch im TaskManager war keine Spur von einer Aktivität etwaiger Prozesse / Dienste. Es dürfte also keinen Einfluss genommen haben. Gleiches gilt für die Windows Firewall - diese habe ich für den Zeitraum der Prüfung ausgestellt.

Hier die Logs:

[code]
Combofix Logfile:

Code:

ComboFix 12-11-08.01 - *** 08.11.2012  12:28:06.1.4 - x86

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.3326.2563 [GMT 1:00]

ausgeführt von:: c:\users\***\Desktop\ComboFix.exe

AV: G Data InternetSecurity 2013 *Enabled/Updated* {39B780B4-63C2-05B0-3B40-8F7A21E4F496}

FW: G Data Personal Firewall *Enabled* {018C0191-29AD-04E8-101F-264FDF37B3ED}

SP: G Data InternetSecurity 2013 *Enabled/Updated* {82D66150-45F8-0A3E-01F0-B4085A63BE2B}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\windows\pkunzip.pif

c:\windows\pkzip.pif

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-10-08 bis 2012-11-08  ))))))))))))))))))))))))))))))

.

.

2012-11-08 11:35 . 2012-11-08 11:35        --------        d-----w-        c:\users\***\AppData\Local\temp

2012-11-08 11:35 . 2012-11-08 11:35        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-11-07 13:11 . 2012-11-07 11:52        89088        ----a-w-        c:\windows\system32\mbr.exe

2012-11-06 15:16 . 2012-11-06 15:16        --------        d-----w-        c:\programdata\RELOADED

2012-11-06 14:41 . 2012-11-06 14:41        --------        d-----w-        c:\users\***\AppData\Local\Runic Games

2012-11-06 08:46 . 2012-10-12 05:56        6918632        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{7F8F6A78-066B-4256-AF2E-37FCFD549450}\mpengine.dll

2012-11-05 15:52 . 2012-11-05 15:52        --------        d-----w-        c:\program files\IconConverter

2012-11-03 14:19 . 2012-11-03 14:19        --------        d-----w-        c:\users\***\AppData\Roaming\Amazon

2012-11-03 14:18 . 2012-11-03 14:18        --------        d-----w-        c:\program files\Amazon

2012-11-03 09:37 . 2012-11-03 09:37        --------        d-----w-        C:\_OTL

2012-11-02 15:41 . 2012-11-02 15:41        --------        d-----w-        c:\program files\CCleaner

2012-10-30 08:47 . 2012-10-30 08:47        --------        d-----w-        c:\users\***\AppData\Roaming\Malwarebytes

2012-10-30 08:46 . 2012-10-30 08:46        --------        d-----w-        c:\programdata\Malwarebytes

2012-10-30 08:46 . 2012-10-30 08:46        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2012-10-30 08:46 . 2012-09-29 18:54        22856        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-10-27 18:48 . 2012-10-27 18:48        --------        d-----w-        c:\program files\UltraEdit

2012-10-26 07:14 . 2012-10-26 07:14        --------        d-----w-        c:\programdata\ATI

2012-10-26 07:14 . 2012-10-26 07:14        --------        d-----w-        c:\program files\AMD AVT

2012-10-26 07:14 . 2012-10-26 07:14        --------        d-----w-        c:\program files\AMD APP

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-10-09 13:36 . 2012-03-31 13:01        696760        ----a-w-        c:\windows\system32\FlashPlayerApp.exe

2012-10-09 13:36 . 2011-09-18 09:08        73656        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2012-09-28 13:36 . 2012-09-28 13:36        180224        ----a-w-        c:\windows\system32\clinfo.exe

2012-09-28 13:36 . 2012-09-28 13:36        65536        ----a-w-        c:\windows\system32\OpenVideo.dll

2012-09-28 13:36 . 2012-09-28 13:36        56320        ----a-w-        c:\windows\system32\OVDecode.dll

2012-09-28 13:32 . 2012-09-28 13:32        27341824        ----a-w-        c:\windows\system32\amdocl.dll

2012-09-28 02:22 . 2012-07-28 04:09        5557928        ----a-w-        c:\windows\system32\atiumdag.dll

2012-09-28 02:20 . 2012-09-28 02:20        9107968        ----a-w-        c:\windows\system32\drivers\atikmdag.sys

2012-09-28 02:05 . 2012-09-28 02:05        58880        ----a-w-        c:\windows\system32\coinst_9.002.dll

2012-09-28 02:03 . 2012-09-28 02:03        163840        ----a-w-        c:\windows\system32\atiapfxx.exe

2012-09-28 02:02 . 2012-09-28 02:02        46080        ----a-w-        c:\windows\system32\aticalrt.dll

2012-09-28 02:02 . 2012-09-28 02:02        44032        ----a-w-        c:\windows\system32\aticalcl.dll

2012-09-28 01:57 . 2012-09-28 01:57        13703168        ----a-w-        c:\windows\system32\aticaldd.dll

2012-09-28 01:43 . 2011-07-28 21:40        935424        ----a-w-        c:\windows\system32\aticfx32.dll

2012-09-28 01:41 . 2012-09-28 01:41        19624960        ----a-w-        c:\windows\system32\atioglxx.dll

2012-09-28 01:39 . 2011-07-28 21:30        6536192        ----a-w-        c:\windows\system32\atidxx32.dll

2012-09-28 01:39 . 2012-09-28 01:39        442368        ----a-w-        c:\windows\system32\atidemgy.dll

2012-09-28 01:38 . 2012-09-28 01:38        473088        ----a-w-        c:\windows\system32\atieclxx.exe

2012-09-28 01:38 . 2012-09-28 01:38        217600        ----a-w-        c:\windows\system32\atiesrxx.exe

2012-09-28 01:36 . 2012-09-28 01:36        163840        ----a-w-        c:\windows\system32\atitmmxx.dll

2012-09-28 01:36 . 2012-09-28 01:36        20992        ----a-w-        c:\windows\system32\atimuixx.dll

2012-09-28 01:36 . 2012-09-28 01:36        43520        ----a-w-        c:\windows\system32\ati2edxx.dll

2012-09-28 01:22 . 2012-07-28 01:32        2691584        ----a-w-        c:\windows\system32\atiumdva.dll

2012-09-28 01:13 . 2012-09-28 01:13        405504        ----a-w-        c:\windows\system32\atiadlxx.dll

2012-09-28 01:13 . 2012-09-28 01:13        14848        ----a-w-        c:\windows\system32\atiglpxx.dll

2012-09-28 01:13 . 2012-09-28 01:13        33280        ----a-w-        c:\windows\system32\atigktxx.dll

2012-09-28 01:12 . 2012-09-28 01:12        56832        ----a-w-        c:\windows\system32\atimpc32.dll

2012-09-28 01:12 . 2012-09-28 01:12        56832        ----a-w-        c:\windows\system32\amdpcom32.dll

2012-09-28 01:12 . 2012-09-28 01:12        370176        ----a-w-        c:\windows\system32\drivers\atikmpag.sys

2012-09-28 01:11 . 2011-07-28 20:53        109568        ----a-w-        c:\windows\system32\atiuxpag.dll

2012-09-28 01:10 . 2012-07-28 01:13        82944        ----a-w-        c:\windows\system32\atiu9pag.dll

2012-09-28 01:09 . 2012-09-28 01:09        53248        ----a-w-        c:\windows\system32\drivers\ati2erec.dll

2012-09-26 06:05 . 2011-09-17 18:05        50080        ----a-w-        c:\windows\system32\drivers\PktIcpt.sys

2012-09-25 20:08 . 2011-09-17 18:04        93728        ----a-w-        c:\windows\system32\drivers\MiniIcpt.sys

2012-09-25 20:08 . 2011-09-17 18:04        41888        ----a-w-        c:\windows\system32\drivers\GDBehave.sys

2012-09-25 20:08 . 2011-09-17 18:04        53664        ----a-w-        c:\windows\system32\drivers\gdwfpcd32.sys

2012-08-26 12:56 . 2012-08-26 12:56        121248        ----a-w-        c:\windows\system32\drivers\AnyDVD.sys

2012-08-24 06:59 . 2012-09-23 01:00        1800704        ----a-w-        c:\windows\system32\jscript9.dll

2012-08-24 06:51 . 2012-09-23 01:00        1129472        ----a-w-        c:\windows\system32\wininet.dll

2012-08-24 06:51 . 2012-09-23 01:00        1427968        ----a-w-        c:\windows\system32\inetcpl.cpl

2012-08-24 06:47 . 2012-09-23 01:00        142848        ----a-w-        c:\windows\system32\ieUnatt.exe

2012-08-24 06:47 . 2012-09-23 01:00        420864        ----a-w-        c:\windows\system32\vbscript.dll

2012-08-24 06:43 . 2012-09-23 01:00        2382848        ----a-w-        c:\windows\system32\mshtml.tlb

2012-08-22 17:16 . 2012-09-12 06:31        1292144        ----a-w-        c:\windows\system32\drivers\tcpip.sys

2012-08-22 17:16 . 2012-09-12 06:31        240496        ----a-w-        c:\windows\system32\drivers\netio.sys

2012-08-22 17:16 . 2012-09-12 06:31        712048        ----a-w-        c:\windows\system32\drivers\ndis.sys

2012-08-22 17:16 . 2012-09-12 06:31        187760        ----a-w-        c:\windows\system32\drivers\FWPKCLNT.SYS

2012-08-21 20:12 . 2012-09-26 06:10        245760        ----a-w-        c:\windows\system32\OxpsConverter.exe

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2011-03-04 2741616]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]

"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-09-28 642728]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"EnableLinkedConnections"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnyDVD]

2012-08-29 18:35        6315680        ----a-w-        c:\program files\SlySoft\AnyDVD\AnyDVDtray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\G Data AntiVirus Tray Application]

2012-09-17 03:24        995352        ----a-w-        c:\program files\G Data\InternetSecurity\AVKTray\AVKTray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GDFirewallTray]

2012-01-27 04:13        1470968        ----a-w-        c:\program files\G Data\InternetSecurity\Firewall\GDFirewallTray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBAgent]

2011-04-08 06:50        1406248        ----a-w-        c:\program files\Nero\Nero 10\Nero BackItUp\NBAgent.exe

.

R2 AODDriver4.2;AODDriver4.2;c:\program files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [x]

R3 GdNetMon;G Data Network Monitor;c:\windows\system32\drivers\GdNetMon32.sys [x]

R3 GDPkIcpt;GDPkIcpt;c:\windows\system32\drivers\PktIcpt.sys [x]

R3 MotioninJoyXFilter;MotioninJoy Virtual Xinput device Filter Driver;c:\windows\system32\DRIVERS\MijXfilt.sys [x]

R3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [x]

R3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]

R4 AVKProxy;G Data AntiVirus Proxy;c:\program files\Common Files\G Data\AVKProxy\AVKProxy.exe [x]

R4 AVKService;G Data Scheduler;c:\program files\G Data\InternetSecurity\AVK\AVKService.exe [x]

R4 AVKWCtl;G Data Dateisystem Wächter;c:\program files\G Data\InternetSecurity\AVK\AVKWCtl.exe [x]

R4 GDFwSvc;G Data Personal Firewall;c:\program files\G Data\InternetSecurity\Firewall\GDFwSvc.exe [x]

R4 GDScan;G Data Scanner;c:\program files\Common Files\G Data\GDScan\GDScan.exe [x]

S0 GDBehave;GDBehave;c:\windows\system32\drivers\GDBehave.sys [x]

S1 GDMnIcpt;GDMnIcpt;c:\windows\system32\drivers\MiniIcpt.sys [x]

S1 gdwfpcd;G Data WFP CD;c:\windows\system32\drivers\gdwfpcd32.sys [x]

S1 GRD;G Data Rootkit Detector Driver;c:\windows\system32\drivers\GRD.sys [x]

S1 HookCentre;HookCentre;c:\windows\system32\drivers\HookCentre.sys [x]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]

S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]

S2 AODDriver4.01;AODDriver4.01;c:\program files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [x]

S2 NAUpdate;Nero Update;c:\program files\Nero\Update\NASvc.exe [x]

S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [x]

S3 amdiox86;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox86.sys [x]

S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x]

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2011-03-04 10:29        451872        ----a-w-        c:\program files\Common Files\LightScribe\LSRunOnce.exe

.

Inhalt des "geplante Tasks" Ordners

.

2012-11-08 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 13:36]

.

2012-11-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-10-21 10:00]

.

2012-11-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-10-21 10:00]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/ig

IE: An OneNote s&enden - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105

IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.178.1

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

MSConfigStartUp-DAEMON Tools Lite - c:\program files\DAEMON Tools Lite\DTLite.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2012-11-08  12:36:24

ComboFix-quarantined-files.txt  2012-11-08 11:36

.

Vor Suchlauf: 10 Verzeichnis(se), 354.056.052.736 Bytes frei

Nach Suchlauf: 16 Verzeichnis(se), 353.907.773.440 Bytes frei

.

- - End Of File - - 2E7296A0620E01977D1A8DDEA33025BC

--- --- ---

Code:

 Update for Microsoft Office 2007 (KB2508958)

Adobe Flash Player 11 ActiveX

Adobe Reader X (10.1.4) - Deutsch

Adobe Shockwave Player 11.6

Amazon MP3-Downloader 1.0.17

AMD Accelerated Video Transcoding

AMD APP SDK Runtime

AMD Catalyst Install Manager

AMD Drag and Drop Transcoding

AMD Fuel

AMD Media Foundation Decoders

AMD Steady Video Plug-In 

AMD VISION Engine Control Center

AnyDVD

ArcSoft PhotoStudio 5

Avidemux 2.5 (32-bit)

Canon CanoScan Toolbox 4.1

Catalyst Control Center - Branding

Catalyst Control Center Graphics Previews Common

Catalyst Control Center InstallProxy

Catalyst Control Center Localization All

ccc-utility

CCC Help Chinese Standard

CCC Help Chinese Traditional

CCC Help Czech

CCC Help Danish

CCC Help Dutch

CCC Help English

CCC Help Finnish

CCC Help French

CCC Help German

CCC Help Greek

CCC Help Hungarian

CCC Help Italian

CCC Help Japanese

CCC Help Korean

CCC Help Norwegian

CCC Help Polish

CCC Help Portuguese

CCC Help Russian

CCC Help Spanish

CCC Help Swedish

CCC Help Thai

CCC Help Turkish

CCleaner

CloneDVD2

Compatibility Pack für 2007 Office System

Creation Kit

DirectVobSub 2.40.3644 x86

Easy Video Splitter 1.28

ElsterFormular

G Data InternetSecurity 2012

GIMP 2.6.11

Google Earth

Google Update Helper

High-Definition Video Playback

IconConverter 2.0

ImgBurn

IrfanView (remove only)

jetAudio Plus VX

LightScribe System Software

MaaTec Sudoku

Malwarebytes Anti-Malware Version 1.65.1.1000

Microsoft .NET Framework 4 Client Profile

Microsoft .NET Framework 4 Client Profile DEU Language Pack

Microsoft Office 2007 Service Pack 3 (SP3)

Microsoft Office File Validation Add-In

Microsoft Office Live Add-in 1.5

Microsoft Office Professional Edition 2003

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (German) 2007

Microsoft Office Proof (Italian) 2007

Microsoft Office Proofing (German) 2007

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

Microsoft Office Shared MUI (German) 2007

Microsoft Office Visio 2007 Service Pack 3 (SP3)

Microsoft Office Visio MUI (German) 2007

Microsoft Office Visio Professional 2007

Microsoft Silverlight

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

Microsoft XNA Framework Redistributable 4.0 Refresh

Microsoft_VC100_CRT_SP1_x86

MotioninJoy ds3 driver version 0.6.0005

MSVC80_x86_v2

MSVC90_x86

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

Nero 10 Menu TemplatePack Basic

Nero 10 Movie ThemePack Basic

Nero BackItUp 10

Nero BackItUp 10 Help (CHM)

Nero Burning ROM 10

Nero BurningROM 10 Help (CHM)

Nero BurnRights 10

Nero BurnRights 10 Help (CHM)

Nero Control Center 10

Nero ControlCenter 10 Help (CHM)

Nero Core Components 10

Nero CoverDesigner 10

Nero CoverDesigner 10 Help (CHM)

Nero DiscCopy Gadget 10

Nero DiscCopyGadget 10 Help (CHM)

Nero DiscSpeed 10

Nero DiscSpeed 10 Help (CHM)

Nero Dolby Files 10

Nero Express 10

Nero Express 10 Help (CHM)

Nero InfoTool 10

Nero InfoTool 10 Help (CHM)

Nero Kwik Media

Nero Multimedia Suite 10

Nero Recode 10

Nero Recode 10 Help (CHM)

Nero RescueAgent 10

Nero RescueAgent 10 Help (CHM)

Nero SoundTrax 10

Nero SoundTrax 10 Help (CHM)

Nero StartSmart 10

Nero StartSmart 10 Help (CHM)

Nero Update

Nero Vision 10

Nero Vision 10 Help (CHM)

Nero WaveEditor 10

Nero WaveEditor 10 Help (CHM)

NeroKwikMedia Help (CHM)

Next Generation Visualisations

Nexus Mod Manager

Nokia Connectivity Cable Driver

Nokia Suite

Notepad++

PC Connectivity Solution

PDF-Viewer

Security Update for CAPICOM (KB931906)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2518870)

Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition 

Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition 

Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition 

Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition 

Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596856) 32-Bit Edition 

Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2687441) 32-Bit Edition 

Softi FreeOCR

SpellForce 2 Patch

Steam

SuDoKu-Cracker

swMSM

The Elder Scrolls V: Skyrim

TomTom HOME 2.8.2.2264

TomTom HOME Visual Studio Merge Modules

Total Commander (Remove or Repair)

Ubisoft Game Launcher

UltraEdit

Update for 2007 Microsoft Office System (KB967642)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

VLC media player 1.1.11

Win7codecs

Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)

Windows 7 USB/DVD Download Tool

WinRAR 4.01 (32-Bit)

hat sich was geändert, oder das Problem besteht immer noch?

Hi kira,

soweit sieht das erstmal gut aus. Ich werde das die kommende Woche beobachten und mich dann noch einmal melden, nicht dass ich wieder verfrühte Entwarnung gebe ;-)

Vielen Dank für die Hilfe.

Ok, also bis danne :)

Möööp :wtf:

Ein paar Tage hatte ich keine Probleme und alles lief super, seit heute ist alles wieder beim Alten: Die Vorschaubilder der Ordner und die eingestellten Ansichten (Details, Miniaturbilder, Liste etc.) wechseln willkürlich. Kann doch echt nicht wahr sein, dass das immer nur kurzzeitig verschwindet.
Wie machen wir nun weiter?

Hi,

jup, habe ich. Ich passe die Ansichtseinstellungen für einen bestimmten Ordnertyp (in meinem Fall also vornehmlich "Bilder") an, übernehme sie für alle derartigen Ordner und habe ca. 3-4 Stunden Ruhe. Danach beginnen die Ordnerbilder zu verschwinden oder sich zu vertauschen. Die Ansicht wechselt dagegen seltener, doch es kommt immer wieder vor, dass ich z.B. die "Große Symbole"-Ansicht erneut wählen muss, weil sie sich selbstätig auf "Details" geändert hat.

Lies dir folgende Diskussion über dieses Thema durch, vielleicht hilft es auch bei Deinem Problem?:-> "Ansichteinstellungen für jeden Ordner speichern"

Tipp noch hier:-> Änderungen an Größe, Ansicht, Symbol oder Position eines Ordners gehen verloren