Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Infizierte Dateiobjekte in der Registry (https://www.trojaner-board.de/129819-infizierte-dateiobjekte-registry.html)

Rheingold 20.01.2013 10:02
Infizierte Dateiobjekte in der Registry
 
Hallo,
bei einem scan mit anti-malwarebytes wurde folgendes gefunden:
Infizierte Dateiobjekte der Registrierung: 1
HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore|DisableConfig (Windows.Tool.Disabled) -> Bösartig: (1) Gut: (0) -> Keine Aktion durchgeführt.

Entfernen hat nicht funktioniert. Beim nächsten Scan war die gleiche Meldung wieder da. Ein Scan mit Avira und Ad-Aware hat keine Ergebnisse gebracht.

Was kann ich tun? :confused::confused:

Im Anhang der logfile von anti-malwarebytes und eine Liste meiner Programme über CCleaner.

Ich hoffe, mir kann jemand weiterhelfen?

Danke und Grüße
Jasmina

Anhang 49013
Anhang 49014

cosinus 21.01.2013 12:33
Hallo und :hallo:

Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner?
Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs posten!

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307

Rheingold 23.01.2013 10:59
Hallo und vielen Dank für deine Antwort und Hilfe. Ja,ich habe noch andere logfiles und zwar von malwarebytes und eset-online scanner.

Viele Grüße, Jasmina

Code:
Jasmina :: NICOJAS-PC [Administrator]

21.01.2013 10:15:16
MBAM-log-2013-01-21 (11-04-11).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM | P2P
Deaktivierte Suchlaufeinstellungen:
Durchsuchte Objekte: 519287
Laufzeit: 47 Minute(n), 8 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 1
HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore|DisableConfig (Windows.Tool.Disabled) -> Bösartig: (1) Gut: (0) -> Keine Aktion durchgeführt.

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Und hier das Protokoll von eset, auch vom 21., glaube ich.

Code:
C:\Windows\SysWOW64\drivers\mchccinj.sys        Win32/MCH Anwendung       
C:\Windows\SysWOW64\wdrv\wdrvccin.bin        Win32/MCH Anwendung       
C:\Program Files\Adaware_Installer_10.4.49.exe        Win32/OpenCandy Anwendung        gelöscht - in Quarantäne kopiert
C:\Program Files\FreeYouTubetoiPodConverter.exe        Win32/OpenCandy Anwendung        Gesäubert durch Löschen - in Quarantäne kopiert
C:\Program Files\FreeYouTubetoMP3Converter.exe        Win32/OpenCandy Anwendung        Gesäubert durch Löschen - in Quarantäne kopiert
C:\Program Files\kisi2012.exe        Win32/MCH Anwendung        Gesäubert durch Löschen - in Quarantäne kopiert
C:\Program Files\VideoConverterSDM.exe        Variante von Win32/SweetIM.C Anwendung        Gesäubert durch Löschen - in Quarantäne kopiert
C:\Program Files (x86)\kisi2011.exe        Win32/MCH Anwendung        Gesäubert durch Löschen - in Quarantäne kopiert
C:\Program Files (x86)\kisi2012.exe        Win32/MCH Anwendung        Gesäubert durch Löschen - in Quarantäne kopiert
C:\Users\Jasmina.NICOJAS-PC\Desktop\Sammel Dokumente\Scan Ergebnisse\Adaware_Installer_10.3.45.exe        Win32/OpenCandy Anwendung        gelöscht - in Quarantäne kopiert
C:\Users\Nico.NICOJAS-PC\Downloads\FreeYouTubeToMP3Converter31124.exe        Win32/OpenCandy Anwendung        Gesäubert durch Löschen - in Quarantäne kopiert
C:\Windows\System32\drivers\mchccinj.sys        Win32/MCH Anwendung        Gesäubert durch Löschen - in Quarantäne kopiert
C:\Windows\System32\wdrv\wdrvccin.bin        Win32/MCH Anwendung        Gesäubert durch Löschen - in Quarantäne kopiert
Außerdem ist mir die Datei bzw. das Programm sweetim.xml aufgefallen. Das habe ich mir bei irgendeiner Installation geholt und dann wieder deinstalliert. Aber es scheint trotzdem nicht weg zu sein. Ich habe es jetzt nämlich in der wininit gefunden. Sie steht unter C:/Windows. Ich poste das hier auch mal.

Code:
[rename]
c:\tempjunk5131.tmp=C:\Windows\Installer\{C3E85EE9-5892-4142-B537-BCEB3DAC4C3D}\ARPPRODUCTICON.exe
nul=c:\tempjunk5344.tmp
c:\tempjunk1937.tmp=C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\Mozilla\Firefox\Profiles\zd0m12fn.default\searchplugins\sweetim.xml
c:\tempjunk3108.tmp=C:\Windows\Installer\{C3E85EE9-5892-4142-B537-BCEB3DAC4C3D}\ARPPRODUCTICON.exe
c:\tempjunk7510.tmp=C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\Mozilla\Firefox\Profiles\zd0m12fn.default\searchplugins\sweetim.xml
c:\tempjunk1033.tmp=C:\Windows\Installer\{C3E85EE9-5892-4142-B537-BCEB3DAC4C3D}\ARPPRODUCTICON.exe
c:\tempjunk5011.tmp=C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\Mozilla\Firefox\Profiles\zd0m12fn.default\searchplugins\sweetim.xml
c:\tempjunk4408.tmp=C:\Windows\Installer\{C3E85EE9-5892-4142-B537-BCEB3DAC4C3D}\ARPPRODUCTICON.exe
c:\tempjunk6417.tmp=C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\Mozilla\Firefox\Profiles\zd0m12fn.default\searchplugins\sweetim.xml
c:\tempjunk5344.tmp=C:\Windows\Installer\{C3E85EE9-5892-4142-B537-BCEB3DAC4C3D}\ARPPRODUCTICON.exe

cosinus 23.01.2013 14:23
Bevor wir uns an die Arbeit machen, möchte ich dich bitten, folgende Punkte vollständig und aufmerksam zu lesen.
  • Lies dir meine Anleitungen, die ich im Laufe dieses Strangs hier posten werde, aufmerksam durch. Frag umgehend nach, wenn dir irgendetwas unklar sein sollte, bevor du anfängst meine Anleitungen umzusetzen.

  • Solltest du bei einem Schritt Probleme haben, stoppe dort und beschreib mir das Problem so gut du kannst. Manchmal erfordert ein Schritt den vorhergehenden.

  • Bitte nur Scans durchführen zu denen du von einem Helfer aufgefordert wurdest! Installiere / Deinstalliere keine Software ohne Aufforderung!

  • Poste die Logfiles direkt in deinen Thread (bitte in CODE-Tags) und nicht als Anhang, ausser du wurdest dazu aufgefordert. Logs in Anhängen erschweren mir das Auswerten!

  • Beachte bitte auch => Löschen von Logfiles und andere Anfragen

Note:
Sollte ich drei Tage nichts von mir hören lassen, so melde dich bitte in diesem Strang => Erinnerung an meinem Thread.
Nervige "Wann geht es weiter" Nachrichten enden mit Schließung deines Themas. Auch ich habe ein Leben abseits des Trojaner-Boards.


Erstmal eine Kontrolle mit OTL bitte:
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Setze oben mittig den Haken bei Scanne alle Benutzer
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles hier in CODE-Tags in den Thread.

Rheingold 23.01.2013 16:42
Okay, mache ich.

Beim otl scan kam bei mir nur eine datei/logfile. Oder seh ich das falsch? Poste ich hier.

Grüße, Jasmina

Code:
OTL logfile created on: 23.01.2013 15:54:38 - Run 2
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Jasmina.NICOJAS-PC\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,90 Gb Total Physical Memory | 1,99 Gb Available Physical Memory | 51,11% Memory free
7,79 Gb Paging File | 5,50 Gb Available in Paging File | 70,56% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 265,66 Gb Total Space | 80,75 Gb Free Space | 30,40% Space Free | Partition Type: NTFS
Drive D: | 200,00 Gb Total Space | 199,73 Gb Free Space | 99,87% Space Free | Partition Type: NTFS
 
Computer Name: NICOJAS-PC | User Name: Jasmina | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Jasmina.NICOJAS-PC\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe (RealNetworks, Inc.)
PRC - C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe ()
PRC - C:\Program Files (x86)\Secunia\PSI\psia.exe (Secunia)
PRC - C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
PRC - C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe (Eastman Kodak Company)
PRC - C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe (Eastman Kodak Company)
PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files (x86)\Dell Stage\Dell Stage\stage_secondary.exe ()
PRC - C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe ()
PRC - D:\Tobit Radio.fx\Server\rfx-server.exe ()
PRC - C:\Windows\tray\wintmr.exe (Salfeld Computer)
PRC - C:\Windows\SysWOW64\cc32\webtmr.exe (Salfeld Computer)
PRC - C:\Windows\SysWOW64\ccsync.exe (Salfeld Computer)
PRC - C:\Windows\SysWOW64\cchservice.exe (Salfeld Computer)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll ()
MOD - C:\Program Files (x86)\OpenOffice.org 3\program\libxslt.dll ()
MOD - C:\Program Files (x86)\Dell Stage\Dell Stage\stage_secondary.exe ()
MOD - C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe ()
MOD - C:\Program Files (x86)\Dell Stage\Dell Stage\QtGui4.dll ()
MOD - C:\Program Files (x86)\Dell Stage\Dell Stage\QtCore4.dll ()
MOD - C:\Program Files (x86)\NVIDIA Corporation\coprocmanager\detoured.dll ()
 
 
========== Services (SafeList) ==========
 
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (RealNetworks Downloader Resolver Service) -- C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe ()
SRV - (Secunia PSI Agent) -- C:\Program Files (x86)\Secunia\PSI\psia.exe (Secunia)
SRV - (Kodak AiO Network Discovery Service) -- C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe (Eastman Kodak Company)
SRV - (Kodak AiO Status Monitor Service) -- C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe (Eastman Kodak Company)
SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (Radio.fx) -- D:\Tobit Radio.fx\Server\rfx-server.exe ()
SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (ksupmgr) -- C:\Windows\SysWOW64\ksupmgr.exe (Salfeld Computer)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (gfibto) -- C:\Windows\SysNative\drivers\gfibto.sys (GFI Software)
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (nvpciflt) -- C:\Windows\SysNative\drivers\nvpciflt.sys (NVIDIA Corporation)
DRV:64bit: - (nvkflt) -- C:\Windows\SysNative\drivers\nvkflt.sys (NVIDIA Corporation)
DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (iBtFltCoex) -- C:\Windows\SysNative\drivers\iBtFltCoex.sys (Intel Corporation)
DRV:64bit: - (btmhsf) -- C:\Windows\SysNative\drivers\btmhsf.sys (Intel Corporation)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (HPub4DE3) -- C:\Windows\SysNative\drivers\HPub4DE3.sys (TPMX Electronics Ltd.)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (HPMo4DE3) -- C:\Windows\SysNative\drivers\HPMo4DE3.sys (TPMX Electronics Ltd.)
DRV:64bit: - (nusb3xhc) -- C:\Windows\SysNative\drivers\nusb3xhc.sys (Renesas Electronics Corporation)
DRV:64bit: - (nusb3hub) -- C:\Windows\SysNative\drivers\nusb3hub.sys (Renesas Electronics Corporation)
DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (NETwNs64) -- C:\Windows\SysNative\drivers\NETwNs64.sys (Intel Corporation)
DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (Acceler) -- C:\Windows\SysNative\drivers\Accelern.sys (ST Microelectronics)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (PSI) -- C:\Windows\SysNative\drivers\psi_mf.sys (Secunia)
DRV:64bit: - (AVer7231_x64) -- C:\Windows\SysNative\drivers\AVer7231_x64.sys (AVerMedia TECHNOLOGIES, Inc.)
DRV:64bit: - (stdcfltn) -- C:\Windows\SysNative\drivers\stdcfltn.sys (ST Microelectronics)
DRV:64bit: - (CtClsFlt) -- C:\Windows\SysNative\drivers\CtClsFlt.sys (Creative Technology Ltd.)
DRV:64bit: - (qicflt) -- C:\Windows\SysNative\drivers\qicflt.sys (Quanta Computer)
DRV:64bit: - (xusb21) -- C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (StillCam) -- C:\Windows\SysNative\drivers\serscan.sys (Microsoft Corporation)
DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2481020&SSPV=IEOB12
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 71 C1 6B 32 28 28 CD 01  [binary data]
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\..\URLSearchHook: {5786d022-540e-4699-b350-b4be0ae94b79} - No CLSID value found
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No CLSID value found
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\..\SearchScopes\{DA35B54C-95B6-458E-9DF6-049E661E9F57}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=NCH2&o=APN10013&src=kw&q={searchTerms}&locale=&apn_ptnrs=^ACC&apn_dtid=^YYYYYY^YY^DE&apn_uid=419c7e26-339c-4d26-a298-3fa1e007def9&apn_sauid=00B8BEDE-E5ED-4356-9B52-D9ED2B658C14
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF - prefs.js..CT2269050.browser.search.defaultthis.engineName: true
FF - prefs.js..CT2481020.browser.search.defaultthis.engineName: true
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Ashampoo DE Customized Web Search"
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledAddons: personas%40christopher.beard:1.6.2
FF - prefs.js..extensions.enabledAddons: %7B34712C68-7391-4c47-94F3-8F88D49AD632%7D:1.3.0
FF - prefs.js..extensions.enabledAddons: 2020Player_IKEA%402020Technologies.com:5.0.94.0
FF - prefs.js..extensions.enabledAddons: %7BCAFEEFAC-0016-0000-0033-ABCDEFFEDCBA%7D:6.0.33
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0.1
FF - prefs.js..keyword.URL: "hxxp://search.sweetim.com/search.asp?barid={FCC484FC-37F0-11E2-A636-BC77376D1A7C}&src=2&crg=3.09010003&q="
FF - prefs.js..network.proxy.type: 0
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_146.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF:64bit: - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.11.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@parallelgraphics.com/Cortona: C:\Program Files (x86)\Common Files\ParallelGraphics\Cortona\npcortona.dll (ParallelGraphics)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=16.0.0.282: C:\Program Files\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlchromebrowserrecordext;version=1.3.0: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlhtml5videoshim;version=1.3.0: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlpepperflashvideoshim;version=1.3.0: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=16.0.0.282: C:\Program Files\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@realnetworks.com/npdlplugin;version=1: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.124\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.124\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.5: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF - HKCU\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{34712C68-7391-4c47-94F3-8F88D49AD632}: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\ [2012.12.22 10:27:36 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.01.21 12:13:37 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.01.19 12:34:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2013.01.09 15:07:32 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2013.01.09 15:07:35 | 000,000,000 | ---D | M]
 
[2012.05.20 09:46:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\Extensions
[2013.01.14 08:34:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\Firefox\Profiles\zd0m12fn.default\extensions
[2013.01.14 08:34:21 | 000,000,000 | ---D | M] (20-20 3D Viewer - IKEA) -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\Firefox\Profiles\zd0m12fn.default\extensions\2020Player_IKEA@2020Technologies.com
[2012.11.08 11:39:07 | 000,000,000 | ---D | M] (Lavasoft Search Plugin) -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\Firefox\Profiles\zd0m12fn.default\extensions\jid1-yZwVFzbsyfMrqQ@jetpack
[2012.02.25 12:43:49 | 000,330,316 | ---- | M] () (No name found) -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\firefox\profiles\zd0m12fn.default\extensions\personas@christopher.beard.xpi
[2012.12.12 11:21:18 | 000,036,098 | ---- | M] () (No name found) -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\firefox\profiles\zd0m12fn.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
[2012.09.26 15:56:22 | 000,002,343 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\firefox\profiles\zd0m12fn.default\searchplugins\askcom.xml
[2012.11.01 14:48:38 | 000,000,915 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\firefox\profiles\zd0m12fn.default\searchplugins\conduit.xml
[2012.09.27 10:04:27 | 000,001,028 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\firefox\profiles\zd0m12fn.default\searchplugins\dvdvideosofttb-customized-web-search.xml
[2012.05.16 20:15:43 | 000,002,515 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\firefox\profiles\zd0m12fn.default\searchplugins\Search_Results.xml
[2013.01.19 12:34:33 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2013.01.19 12:34:33 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2012.12.22 10:27:36 | 000,000,000 | ---D | M] (RealDownloader) -- C:\PROGRAMDATA\REALNETWORKS\REALDOWNLOADER\BROWSERPLUGINS\FIREFOX\EXT
[2013.01.19 12:34:37 | 000,262,552 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.08.14 16:49:30 | 000,171,136 | ---- | M] (Tracker Software Products (Canada) Ltd.) -- C:\Program Files (x86)\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll
[2012.12.22 10:27:18 | 000,124,056 | ---- | M] (RealPlayer) -- C:\Program Files (x86)\mozilla firefox\plugins\nprpplugin.dll
[2013.01.05 16:11:17 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2013.01.05 16:11:17 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2013.01.05 16:11:17 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2013.01.05 16:11:17 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.05.16 20:15:43 | 000,002,515 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\Search_Results.xml
[2013.01.05 16:11:17 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2013.01.05 16:11:17 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - homepage: hxxp://www.google.com/
CHR - homepage: hxxp://www.google.com/
CHR - Extension: YouTube = C:\Users\Jasmina.NICOJAS-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2_0\
CHR - Extension: Google-Suche = C:\Users\Jasmina.NICOJAS-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.14_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\Jasmina.NICOJAS-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
CHR - Extension: Google Mail = C:\Users\Jasmina.NICOJAS-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.3_0\
 
O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (RealNetworks Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [DellStage] C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe ()
O4:64bit: - HKLM..\Run: [EKIJ5000StatusMonitor] C:\Windows\SysNative\spool\drivers\x64\3\EKIJ5000MUI.exe (Eastman Kodak Company)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [QuickSet] C:\Programme\Dell\QuickSet\quickset.exe (Dell Inc.)
O4 - HKLM..\Run: [AccuWeatherWidget] C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe ()
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [ChicoSys] C:\Windows\SysWOW64\cc32\webtmr.exe (Salfeld Computer)
O4 - HKLM..\Run: [Conime] %windir%\system32\conime.exe File not found
O4 - HKLM..\Run: [EKIJ5000StatusMonitor] C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe File not found
O4 - HKLM..\Run: [EKStatusMonitor] C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe (Eastman Kodak Company)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\update\realsched.exe (RealNetworks, Inc.)
O4 - HKU\.DEFAULT..\Run: [CCWinTray] C:\Windows\tray\wintmr.exe (Salfeld Computer)
O4 - HKU\S-1-5-18..\Run: [CCWinTray] C:\Windows\tray\wintmr.exe (Salfeld Computer)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003..\Run: [CCWinTray] C:\Windows\tray\wintmr.exe (Salfeld Computer)
O4 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1005..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\.DEFAULT..\RunOnce: [KodakHomeCenter] C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe (Eastman Kodak Company)
O4 - HKU\S-1-5-18..\RunOnce: [KodakHomeCenter] C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe (Eastman Kodak Company)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1005..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Users\Jasmina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Users\Nico.NICOJAS-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Users\Nico.NICOJAS-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Users\Nico.NICOJAS-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 1
O7 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O7 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O7 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableClock = 0
O7 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableLockWorkstation = 0
O8:64bit: - Extra context menu item: Free YouTube to iPod Converter - C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetoipodconverter.htm ()
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Free YouTube to iPod Converter - C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetoipodconverter.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/DE/Core/Player/2020PlayerAX_IKEA_Win32.cab (20-20 3D Viewer for IKEA)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6FE6BAC3-E33E-46EB-8477-B5A8961B8F76}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O20:64bit: - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation)
O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) - C:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.01.23 15:51:58 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Jasmina.NICOJAS-PC\Desktop\OTL.exe
[2013.01.23 14:20:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Secunia
[2013.01.23 14:14:20 | 003,137,416 | ---- | C] (Secunia) -- C:\Program Files\PSISetup6001.exe
[2013.01.23 07:43:56 | 000,000,000 | ---D | C] -- C:\Users\Jasmina.NICOJAS-PC\Desktop\Lernen Nico
[2013.01.21 12:13:36 | 000,000,000 | ---D | C] -- C:\ProgramData\blekko toolbars
[2013.01.21 12:13:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Toolbar Cleaner
[2013.01.21 09:19:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2013.01.20 17:37:17 | 000,000,000 | ---D | C] -- C:\Users\Jasmina.NICOJAS-PC\Desktop\Antivirus Logs etc
[2013.01.19 16:22:17 | 004,178,040 | ---- | C] (Piriform Ltd) -- C:\Program Files\ccsetup326.exe
[2013.01.19 16:16:26 | 000,000,000 | ---D | C] -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\Avira
[2013.01.19 16:12:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2013.01.19 16:12:28 | 000,129,216 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys
[2013.01.19 16:12:28 | 000,099,912 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2013.01.19 16:12:28 | 000,027,800 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2013.01.19 16:12:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2013.01.19 16:12:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira
[2013.01.19 12:34:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2013.01.18 09:13:07 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2013.01.18 09:13:07 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2013.01.18 09:13:07 | 000,095,648 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013.01.16 16:42:46 | 000,000,000 | ---D | C] -- C:\Program Files\Definitions
[2013.01.16 16:42:12 | 000,014,456 | ---- | C] (GFI Software) -- C:\Windows\SysNative\drivers\gfibto.sys
[2013.01.15 12:06:17 | 000,000,000 | ---D | C] -- C:\Users\Jasmina.NICOJAS-PC\Desktop\France
[2013.01.14 08:43:58 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\20-20 Technologies
[2013.01.10 08:31:56 | 020,151,664 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 18.0.exe
[2013.01.09 15:07:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Thunderbird
[2013.01.09 06:39:45 | 000,750,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll
[2013.01.09 06:39:45 | 000,492,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\win32spl.dll
[2013.01.09 06:39:33 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll
[2013.01.09 06:39:31 | 000,800,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\usp10.dll
[2013.01.09 06:39:20 | 002,746,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\gameux.dll
[2013.01.09 06:39:20 | 002,576,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\gameux.dll
[2013.01.09 06:39:20 | 000,441,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Wpc.dll
[2013.01.09 06:39:20 | 000,046,592 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\fpb.rs
[2013.01.09 06:39:20 | 000,046,592 | ---- | C] (Microsoft) -- C:\Windows\SysNative\fpb.rs
[2013.01.09 06:39:20 | 000,045,568 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\oflc-nz.rs
[2013.01.09 06:39:20 | 000,045,568 | ---- | C] (Microsoft) -- C:\Windows\SysNative\oflc-nz.rs
[2013.01.09 06:39:20 | 000,044,544 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\pegibbfc.rs
[2013.01.09 06:39:20 | 000,044,544 | ---- | C] (Microsoft) -- C:\Windows\SysNative\pegibbfc.rs
[2013.01.09 06:39:20 | 000,043,520 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\csrr.rs
[2013.01.09 06:39:20 | 000,043,520 | ---- | C] (Microsoft) -- C:\Windows\SysNative\csrr.rs
[2013.01.09 06:39:20 | 000,040,960 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\cob-au.rs
[2013.01.09 06:39:20 | 000,040,960 | ---- | C] (Microsoft) -- C:\Windows\SysNative\cob-au.rs
[2013.01.09 06:39:20 | 000,030,720 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\usk.rs
[2013.01.09 06:39:20 | 000,030,720 | ---- | C] (Microsoft) -- C:\Windows\SysNative\usk.rs
[2013.01.09 06:39:20 | 000,021,504 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\grb.rs
[2013.01.09 06:39:20 | 000,021,504 | ---- | C] (Microsoft) -- C:\Windows\SysNative\grb.rs
[2013.01.09 06:39:20 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\pegi-pt.rs
[2013.01.09 06:39:20 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysNative\pegi-pt.rs
[2013.01.09 06:39:20 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\pegi.rs
[2013.01.09 06:39:20 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysNative\pegi.rs
[2013.01.09 06:39:20 | 000,015,360 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\djctq.rs
[2013.01.09 06:39:20 | 000,015,360 | ---- | C] (Microsoft) -- C:\Windows\SysNative\djctq.rs
[2013.01.09 06:39:19 | 000,308,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Wpc.dll
[2013.01.09 06:39:19 | 000,051,712 | ---- | C] (Microsoft) -- C:\Windows\SysNative\esrb.rs
[2013.01.09 06:39:18 | 000,055,296 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\cero.rs
[2013.01.09 06:39:18 | 000,055,296 | ---- | C] (Microsoft) -- C:\Windows\SysNative\cero.rs
[2013.01.09 06:39:18 | 000,051,712 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\esrb.rs
[2013.01.09 06:39:18 | 000,023,552 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\oflc.rs
[2013.01.09 06:39:18 | 000,023,552 | ---- | C] (Microsoft) -- C:\Windows\SysNative\oflc.rs
[2013.01.09 06:39:18 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\pegi-fi.rs
[2013.01.09 06:39:18 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysNative\pegi-fi.rs
[2013.01.09 06:38:46 | 001,161,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll
[2013.01.09 06:38:46 | 000,424,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll
[2013.01.09 06:38:45 | 000,362,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll
[2013.01.09 06:38:45 | 000,338,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\conhost.exe
[2013.01.09 06:38:45 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll
[2013.01.09 06:38:45 | 000,215,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll
[2013.01.09 06:38:45 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll
[2013.01.09 06:38:45 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll
[2013.01.09 06:38:45 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll
[2013.01.09 06:38:45 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2013.01.09 06:38:45 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2013.01.09 06:38:45 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2013.01.09 06:38:45 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll
[2013.01.09 06:38:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2013.01.09 06:38:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2013.01.09 06:38:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2013.01.09 06:38:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2013.01.09 06:38:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2013.01.09 06:38:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2013.01.09 06:38:44 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe
[2013.01.09 06:38:44 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe
[2013.01.09 06:38:44 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2013.01.09 06:38:44 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe
[2013.01.09 06:38:16 | 000,068,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\taskhost.exe
[2013.01.06 11:45:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kodak
[2013.01.06 11:43:42 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\kodak
[2013.01.06 11:42:15 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\spool
[2013.01.06 11:35:42 | 010,000,984 | ---- | C] (Eastman Kodak Company) -- C:\Program Files\aio_install.exe
[2013.01.04 08:37:05 | 000,000,000 | ---D | C] -- C:\Users\Jasmina.NICOJAS-PC\AppData\Local\Programs
[2012.12.25 11:46:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\2K Sports
[2012.12.25 11:30:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\2K Sports
[2012.12.22 10:27:43 | 000,016,384 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\wmdmhelper.dll
[2012.12.22 10:27:42 | 001,115,376 | ---- | C] (Gracenote) -- C:\Program Files\cddbmusicid.dll
[2012.12.22 10:27:42 | 000,943,344 | ---- | C] (Gracenote) -- C:\Program Files\cddblink.dll
[2012.12.22 10:27:42 | 000,641,536 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rjbres.dll
[2012.12.22 10:27:42 | 000,370,176 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rjdlg.dll
[2012.12.22 10:27:42 | 000,139,264 | ---- | C] (Inner Media, Inc.) -- C:\Program Files\dunzip32.dll
[2012.12.22 10:27:42 | 000,045,568 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\ierjplug.dll
[2012.12.22 10:27:42 | 000,031,232 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rjprog.dll
[2012.12.22 10:27:42 | 000,008,704 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\fixrjb.exe
[2012.12.22 10:27:41 | 002,041,072 | ---- | C] (Gracenote, Inc.) -- C:\Program Files\cddbcontrol.dll
[2012.12.22 10:27:41 | 000,073,216 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\tsasdk.dll
[2012.12.22 10:27:41 | 000,044,544 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\mmcdda32.dll
[2012.12.22 10:27:41 | 000,022,528 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\tnetdtct.dll
[2012.12.22 10:27:40 | 009,159,680 | ---- | C] (MediaArea.net) -- C:\Program Files\mediainfo.dll
[2012.12.22 10:27:40 | 000,389,272 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\realcleaner.exe
[2012.12.22 10:27:40 | 000,056,320 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rpwa3260.dll
[2012.12.22 10:27:40 | 000,048,640 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\tpasdk.dll
[2012.12.22 10:27:40 | 000,044,736 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rpshellsearch.dll
[2012.12.22 10:27:31 | 000,383,640 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\realconverter.exe
[2012.12.22 10:27:31 | 000,354,968 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\convert.exe
[2012.12.22 10:27:23 | 000,719,360 | ---- | C] (Microsoft Corporation) -- C:\Program Files\dbghelp.dll
[2012.12.22 10:27:23 | 000,390,384 | ---- | C] (MainConcept GmbH) -- C:\Program Files\mc_enc_mp4v.dll
[2012.12.22 10:27:23 | 000,389,272 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\realtrimmer.exe
[2012.12.22 10:27:23 | 000,136,336 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\realshare.exe
[2012.12.22 10:27:23 | 000,115,200 | ---- | C] (RealPlayer) -- C:\Program Files\rpshellextension.dll
[2012.12.22 10:27:23 | 000,069,632 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rjwmapln.dll
[2012.12.22 10:27:22 | 000,047,616 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rpau3260.dll
[2012.12.22 10:27:18 | 000,030,368 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rndevicedbbuilder.exe
[2012.12.22 10:27:17 | 000,112,824 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rdsf3260.dll
[2012.12.22 10:27:17 | 000,087,552 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\hxaudiodevicehook.dll
[2012.12.22 10:27:17 | 000,086,016 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rpplugprot.dll
[2012.12.22 10:27:17 | 000,070,840 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rpshell.dll
[2012.12.22 10:27:17 | 000,017,080 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rphelperapp.exe
[2012.12.22 10:27:17 | 000,009,216 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\realjbox.exe
[2012.12.22 10:27:16 | 000,500,888 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\realplay.exe
[2012.12.22 08:43:14 | 000,766,272 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\RealPlayer16_de.exe
[2012.11.22 09:36:25 | 019,650,144 | ---- | C] (Mozilla) -- C:\Program Files\Thunderbird Setup 17.0.exe
[2012.11.22 09:35:36 | 019,231,504 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 17.0.exe
[2012.11.13 13:41:41 | 010,524,080 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Program Files\mbam-setup-1.65.0.1400.exe
[2012.11.13 11:16:01 | 000,895,464 | ---- | C] (Oracle Corporation) -- C:\Program Files (x86)\jxpiinstall.exe
[2012.11.13 10:15:40 | 018,090,960 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 16.0.2.exe
[2012.11.13 10:11:21 | 018,580,512 | ---- | C] (Mozilla) -- C:\Program Files\Thunderbird Setup 16.0.2.exe
[2012.11.02 13:40:21 | 000,955,488 | ---- | C] (NCH Software) -- C:\Program Files\wpsetup-5.18.exe
[2012.11.01 14:39:24 | 009,814,632 | ---- | C] (Ashampoo GmbH & Co. KG                                      ) -- C:\Program Files\ashampoo_burning_studio_6_free_6.81_3639.exe
[2012.10.15 15:25:45 | 005,922,048 | ---- | C] (ManiacTools.com                                            ) -- C:\Program Files\m4a-to-mp3-70converter.exe
[2012.09.20 06:45:49 | 008,782,120 | ---- | C] (Tobit.Software) -- C:\Program Files\radiorecorder-setup.exe
[2012.09.11 12:51:11 | 014,894,636 | ---- | C] (Gougelet Pierre-e                                          ) -- C:\Program Files\XnView1991-win-full-de.exe
[2012.09.07 06:33:50 | 017,653,976 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 15.0.1.exe
[2012.08.30 06:12:27 | 018,365,488 | ---- | C] (Mozilla) -- C:\Program Files\Thunderbird Setup 15.0.exe
[2012.08.30 06:10:52 | 017,655,464 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 15.0.exe
[2012.08.25 14:15:13 | 076,021,168 | ---- | C] (The GIMP Team                                              ) -- C:\Program Files\gimp-2.8.2-setup.exe
[2012.08.12 12:22:26 | 018,503,824 | ---- | C] (Mozilla) -- C:\Program Files\Thunderbird Setup 14.0.exe
[2012.06.12 06:31:47 | 013,107,424 | ---- | C] (Adobe Systems Inc.) -- C:\Program Files\Shockwave_Installer_Full.exe
[2012.06.12 06:09:52 | 018,362,696 | ---- | C] (Mozilla) -- C:\Program Files\Thunderbird Setup 13.0.exe
[2012.06.11 18:11:49 | 017,301,984 | ---- | C] (Adobe Systems Inc.) -- C:\Program Files\AdobeAIRInstaller.exe
[2012.06.11 17:27:14 | 016,418,456 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 13.0.exe
[2012.05.19 22:53:40 | 001,292,648 | ---- | C] (Microsoft Corporation) -- C:\Program Files\wlsetup-web_15.4.3555.exe
[2012.05.15 12:30:33 | 040,437,664 | ---- | C] (Apple Inc.) -- C:\Program Files\QuickTimeInstaller.exe
[2012.05.02 06:57:45 | 016,179,464 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 12.0.exe
[2012.04.30 17:46:07 | 017,449,712 | ---- | C] (Mozilla) -- C:\Program Files\Thunderbird Setup 12.0.1.exe
[2012.04.05 09:20:03 | 026,534,080 | ---- | C] (DVDVideoSoft Ltd.                                          ) -- C:\Program Files (x86)\FreeAudioCDBurner.exe
[2012.04.02 12:04:59 | 027,672,000 | ---- | C] (DVDVideoSoft Ltd.                                          ) -- C:\Program Files (x86)\FreeYouTubeToiPodConverter_3.10.17.exe
[2012.02.25 09:42:27 | 006,674,008 | ---- | C] (Adobe Systems Inc.) -- C:\Program Files (x86)\Shockwave_Installer_Slim.exe
[2012.02.25 09:40:38 | 039,401,336 | ---- | C] (Apple Inc.) -- C:\Program Files (x86)\QuickTimeInstaller.exe
[2012.02.25 09:39:34 | 028,038,592 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files (x86)\RealPlayer1502_de.exe
[2012.02.24 10:16:36 | 000,763,408 | ---- | C] (Google Inc.) -- C:\Program Files\GoogleEarthSetup.exe
[2008.04.11 09:09:24 | 000,093,200 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.1049.dll
[2008.04.11 07:03:48 | 000,562,688 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.exe
[2008.04.11 07:03:48 | 000,097,296 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.1036.dll
[2008.04.11 07:03:48 | 000,096,272 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.3082.dll
[2008.04.11 07:03:48 | 000,096,272 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.1031.dll
[2008.04.11 07:03:48 | 000,095,248 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.1040.dll
[2008.04.11 07:03:48 | 000,091,152 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.1033.dll
[2008.04.11 07:03:48 | 000,081,424 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.1041.dll
[2008.04.11 07:03:48 | 000,079,888 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.1042.dll
[2008.04.11 07:03:48 | 000,076,304 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.1028.dll
[2008.04.11 07:03:48 | 000,075,792 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.2052.dll
[4 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.01.23 15:58:02 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.01.23 15:57:11 | 000,001,226 | ---- | M] () -- C:\Windows\SysWow64\excltmp~.dat
[2013.01.23 15:52:00 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Jasmina.NICOJAS-PC\Desktop\OTL.exe
[2013.01.23 15:27:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.01.23 15:23:00 | 000,001,156 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1835506289-3229931497-3952218681-1004UA.job
[2013.01.23 15:16:41 | 000,014,208 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.01.23 15:16:41 | 000,014,208 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.01.23 15:10:19 | 000,000,117 | -H-- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\.~lock.Tabelle Test.odt#
[2013.01.23 15:09:07 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.01.23 15:08:27 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.01.23 15:08:24 | 3137,994,752 | -HS- | M] () -- C:\hiberfil.sys
[2013.01.23 14:20:55 | 000,001,089 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
[2013.01.23 14:14:26 | 003,137,416 | ---- | M] (Secunia) -- C:\Program Files\PSISetup6001.exe
[2013.01.23 12:30:05 | 000,011,582 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\Elternsprechtag Jan 2013.odt
[2013.01.23 12:23:00 | 000,001,134 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1835506289-3229931497-3952218681-1004Core.job
[2013.01.22 19:59:00 | 000,000,419 | ---- | M] () -- C:\NET.INI
[2013.01.22 16:01:13 | 000,013,934 | ---- | M] () -- C:\Windows\SysWow64\cchservice.err
[2013.01.21 14:58:54 | 000,009,086 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\Zu bezahlen.odt
[2013.01.21 14:52:29 | 000,008,371 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\Deutscher Bauernverband Praktikum.odt
[2013.01.21 12:14:10 | 000,014,456 | ---- | M] (GFI Software) -- C:\Windows\SysNative\drivers\gfibto.sys
[2013.01.21 10:08:51 | 000,001,069 | ---- | M] () -- C:\Windows\wininit.ini
[2013.01.19 16:22:18 | 004,178,040 | ---- | M] (Piriform Ltd) -- C:\Program Files\ccsetup326.exe
[2013.01.19 16:04:21 | 105,661,272 | ---- | M] () -- C:\Program Files\avira_free_antivirus_de.exe
[2013.01.19 15:32:44 | 000,016,227 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\Tabelle Test.odt
[2013.01.19 12:24:55 | 000,012,793 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Documents\Imperativ Übung Sätze 2.odt
[2013.01.19 12:24:25 | 000,013,615 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Documents\Imperativ Übung Verben 2.odt
[2013.01.19 12:23:47 | 000,016,176 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Documents\Imperativ Übung Sätze-Lösungen 2.odt
[2013.01.12 03:30:18 | 000,095,648 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013.01.12 03:26:16 | 000,174,496 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2013.01.12 03:24:49 | 000,174,496 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2013.01.10 08:33:13 | 000,001,130 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013.01.10 08:32:39 | 020,151,664 | ---- | M] (Mozilla) -- C:\Program Files\Firefox Setup 18.0.exe
[2013.01.10 08:29:37 | 017,301,984 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\AdobeAIRInstaller.exe
[2013.01.09 16:27:29 | 000,697,864 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2013.01.09 16:27:29 | 000,074,248 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013.01.09 12:09:59 | 000,424,008 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.01.09 12:01:30 | 001,520,734 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.01.09 12:01:30 | 000,654,400 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.01.09 12:01:30 | 000,616,242 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.01.09 12:01:30 | 000,130,240 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.01.09 12:01:30 | 000,106,622 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.01.09 09:08:08 | 000,004,082 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\AppData\Local\recently-used.xbel
[2013.01.08 12:15:31 | 000,008,726 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\HPG 19-02-2013.odt
[2013.01.06 11:51:05 | 000,008,465 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\trude.odt
[2013.01.06 11:35:52 | 010,000,984 | ---- | M] (Eastman Kodak Company) -- C:\Program Files\aio_install.exe
[2013.01.04 08:37:26 | 000,001,092 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[4 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.01.23 15:10:19 | 000,000,117 | -H-- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\.~lock.Tabelle Test.odt#
[2013.01.23 14:20:55 | 000,001,089 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
[2013.01.23 14:20:55 | 000,001,052 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk
[2013.01.21 14:50:03 | 000,008,371 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\Deutscher Bauernverband Praktikum.odt
[2013.01.21 10:02:14 | 000,001,069 | ---- | C] () -- C:\Windows\wininit.ini
[2013.01.20 10:27:08 | 000,013,934 | ---- | C] () -- C:\Windows\SysWow64\cchservice.err
[2013.01.19 14:19:29 | 000,016,227 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\Tabelle Test.odt
[2013.01.19 12:24:53 | 000,012,793 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Documents\Imperativ Übung Sätze 2.odt
[2013.01.19 12:24:23 | 000,013,615 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Documents\Imperativ Übung Verben 2.odt
[2013.01.19 12:19:06 | 000,016,176 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Documents\Imperativ Übung Sätze-Lösungen 2.odt
[2013.01.16 14:56:19 | 000,011,582 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\Elternsprechtag Jan 2013.odt
[2013.01.13 17:50:56 | 000,009,086 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\Zu bezahlen.odt
[2013.01.09 09:08:08 | 000,004,082 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\AppData\Local\recently-used.xbel
[2013.01.07 10:22:14 | 000,008,726 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\HPG 19-02-2013.odt
[2012.12.30 12:54:17 | 000,008,465 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\trude.odt
[2012.12.22 10:27:42 | 000,002,851 | ---- | C] () -- C:\Program Files\cdroms.cfg
[2012.12.22 10:27:40 | 000,119,808 | ---- | C] () -- C:\Program Files\waiting.avi
[2012.12.22 10:27:40 | 000,067,473 | ---- | C] () -- C:\Program Files\realplay.chm
[2012.12.22 10:27:40 | 000,057,762 | ---- | C] () -- C:\Program Files\howto.chm
[2012.12.22 10:27:40 | 000,027,278 | ---- | C] () -- C:\Program Files\frw.bmp
[2012.12.22 10:27:40 | 000,016,296 | ---- | C] () -- C:\Program Files\realtfon.fon
[2012.12.22 10:27:31 | 000,476,724 | ---- | C] () -- C:\Program Files\converter.vs
[2012.12.22 10:27:23 | 000,045,428 | ---- | C] () -- C:\Program Files\sharemedia.vs
[2012.12.22 10:27:23 | 000,001,209 | ---- | C] () -- C:\Program Files\flvplay.swf
[2012.12.22 10:27:22 | 000,033,157 | ---- | C] () -- C:\Program Files\RealNetworks License.html
[2012.12.22 10:27:22 | 000,033,157 | ---- | C] () -- C:\Program Files\playrlic.html
[2012.12.22 10:27:21 | 001,109,306 | ---- | C] () -- C:\Program Files\normal.vs
[2012.12.22 10:27:21 | 000,061,495 | ---- | C] () -- C:\Program Files\ssimages.vs
[2012.12.22 10:27:21 | 000,000,480 | ---- | C] () -- C:\Program Files\keys.dat
[2012.12.22 10:27:17 | 000,001,161 | ---- | C] () -- C:\Program Files\autoplaylist.dat
[2012.12.22 10:27:17 | 000,000,043 | ---- | C] () -- C:\Program Files\strs23.dat
[2012.12.22 10:27:17 | 000,000,013 | ---- | C] () -- C:\Program Files\strs26.dat
[2012.12.22 10:27:16 | 000,427,405 | ---- | C] () -- C:\Program Files\calibrate.rv
[2012.12.22 10:27:16 | 000,017,846 | ---- | C] () -- C:\Program Files\videotest.rm
[2012.12.22 10:27:16 | 000,000,221 | ---- | C] () -- C:\Program Files\subscription.rnx
[2012.12.22 10:27:16 | 000,000,177 | ---- | C] () -- C:\Program Files\freeoffers.rnx
[2012.12.15 13:46:18 | 022,916,830 | ---- | C] () -- C:\Program Files\vlc-2.0.5-win32.exe
[2012.12.15 13:06:25 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2012.09.27 10:19:36 | 000,013,824 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.09.20 06:46:53 | 000,554,496 | ---- | C] () -- C:\Windows\SysWow64\dvmsg.dll
[2012.08.31 12:55:15 | 019,609,977 | ---- | C] () -- C:\Program Files\PDFXVwer_2.5.205.zip
[2012.08.29 08:03:59 | 000,160,350 | ---- | C] () -- C:\Program Files\JavaRa.zip
[2012.08.29 07:42:01 | 009,672,192 | ---- | C] () -- C:\Program Files\Adobe_Flash_Player_AX_11.4.402.265_SPS.exe
[2012.08.29 07:41:24 | 015,567,360 | ---- | C] () -- C:\Program Files\Adobe_AIR_3.4.0.2540_SPS.exe
[2012.08.27 10:09:16 | 152,249,762 | ---- | C] () -- C:\Program Files\Apache_OpenOffice_incubating_3.4.1_Win_x86_install_de.exe
[2012.08.15 11:05:18 | 009,697,792 | ---- | C] () -- C:\Program Files\ShockwavePlayer_11.6.6.636_SPS.exe
[2012.07.15 09:39:36 | 022,657,136 | ---- | C] () -- C:\Program Files\vlc-2.0.2-win32.exe
[2012.06.27 07:54:46 | 009,679,360 | ---- | C] () -- C:\Program Files\Shockwaveplayer_11.6.4.634.exe
[2012.06.17 18:54:57 | 000,000,271 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\burnaware.ini
[2012.06.12 06:48:02 | 007,656,960 | ---- | C] () -- C:\Program Files\cortona3d.msi
[2012.06.12 06:05:13 | 000,441,829 | ---- | C] () -- C:\Program Files\ade-tb-13.0.c.xpi
[2012.06.11 08:53:53 | 000,000,085 | -HS- | C] () -- C:\ProgramData\.zreglib
[2012.05.29 09:37:28 | 151,893,470 | ---- | C] () -- C:\Program Files\Apache_OpenOffice_incubating_3.4.0_Win_x86_install_de.exe
[2012.05.23 17:49:32 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2012.05.23 17:49:32 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2012.05.23 17:49:32 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2012.05.23 17:49:32 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2012.05.22 06:51:22 | 000,338,432 | ---- | C] () -- C:\Windows\SysWow64\sqlite36_engine.dll
[2012.05.19 14:32:36 | 000,278,643 | ---- | C] () -- C:\Program Files\fast_video_download-4.1.6-fx.zip
[2012.05.19 14:22:36 | 196,941,888 | ---- | C] () -- C:\Program Files\ALDI Bestellsoftware Setup.exe
[2012.05.11 07:57:44 | 029,272,056 | ---- | C] () -- C:\Program Files\SaalDesignSoftware2.9.2.exe
[2012.05.05 16:00:03 | 004,998,707 | ---- | C] () -- C:\Program Files\flvplayer_setup20_25.exe
[2012.03.27 12:48:40 | 000,253,952 | ---- | C] () -- C:\Program Files\OOo_3.3.9567.500.exe
[2012.02.25 09:57:51 | 000,155,536 | ---- | C] () -- C:\Windows\SysWow64\dllcinx.exe
[2012.02.25 09:57:49 | 000,000,626 | ---- | C] () -- C:\Windows\SysWow64\nochook.ini
[2012.02.25 09:38:55 | 004,998,707 | ---- | C] () -- C:\Program Files (x86)\flvplayer_setup20_25.exe
[2012.02.24 16:59:09 | 000,001,226 | ---- | C] () -- C:\Windows\SysWow64\excltmp~.dat
[2012.02.24 16:58:29 | 000,000,140 | -H-- | C] () -- C:\Windows\SysWow64\ctlsw.ini
[2012.02.24 16:58:29 | 000,000,091 | ---- | C] () -- C:\Windows\SysWow64\SWCTL.DLL
[2012.02.24 11:05:44 | 018,980,864 | ---- | C] () -- C:\Program Files\SkypeSetup_5.8.0.156.msi
[2012.02.24 10:48:18 | 031,870,976 | ---- | C] () -- C:\Program Files\PXCViewer_x6425201.msi
[2012.02.24 10:47:54 | 001,376,768 | ---- | C] () -- C:\Program Files\7z920-x64.msi
[2012.02.24 10:35:22 | 105,661,272 | ---- | C] () -- C:\Program Files\avira_free_antivirus_de.exe
[2012.02.24 10:15:24 | 168,166,968 | ---- | C] () -- C:\Program Files\OOo_3.3.0_Win_x86_install-wJRE_de.exe
[2012.02.22 08:07:19 | 000,066,856 | ---- | C] () -- C:\Windows\SysWow64\SynTPEnhPS.dll
[2011.11.30 01:26:12 | 000,960,940 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin
[2011.11.30 01:26:09 | 000,213,332 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin
[2011.11.30 01:26:04 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_89001461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_6B071461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_5B011461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_49001461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_3B011461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_33011461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2B071461_ca.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2B071461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2B071461_8a.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2A0F1461_ca.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2A071461_ca.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2A071461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2A071461_8a.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2A031461_ca.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2A031461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_1C011461_61.bin
[2011.11.30 01:23:23 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_A3031461_ca.bin
[2011.11.30 01:23:23 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_A3031461_aa.bin
[2011.11.30 01:23:23 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_A3031461_8a.bin
[2011.11.30 01:23:23 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_83231461_ca.bin
[2011.11.30 01:23:23 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_83231461_aa.bin
[2011.11.30 01:23:23 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_83231461_8a.bin
[2011.11.30 01:23:23 | 000,000,436 | ---- | C] () -- C:\Windows\11317231_1C0F1461_41.bin
[2011.11.30 01:23:23 | 000,000,434 | ---- | C] () -- C:\Windows\11317231_890F1461_ca.bin
[2011.11.30 01:23:23 | 000,000,434 | ---- | C] () -- C:\Windows\11317231_3B0f1461_ca.bin
[2011.11.30 01:23:23 | 000,000,434 | ---- | C] () -- C:\Windows\11317231_2B0f1461_ca.bin
[2011.11.30 01:23:23 | 000,000,434 | ---- | C] () -- C:\Windows\11317231_29001461_ca.bin
[2011.11.30 01:23:23 | 000,000,412 | ---- | C] () -- C:\Windows\11317231_180F1461_ca.bin
[2011.11.30 01:23:23 | 000,000,412 | ---- | C] () -- C:\Windows\11317231_18071461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_14001461_61.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_13011461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_110F1461_ca.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_110F1461_8a.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_11071461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_11071461_8a.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0B071461_ca.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0B071461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0B071461_8a.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0B011461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A0F1461_ca.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A071461_ca.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A071461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A071461_8a.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A031461_ca.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A031461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A011461_ca.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A011461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_09001461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_08071461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_060F1461_ca.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_06071461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_06071461_8a.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_03011461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_03011461_8a.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_02011461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_02011461_8a.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_010F1461_ca.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_010F1461_8a.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_01071461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_01071461_8a.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_07031461_aa.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_03231461_ca.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_03231461_aa.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_03231461_8a.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_03131461_8a.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_03031461_aa.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_02031461_ca.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_02031461_aa.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_02031461_8a.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_00000000_aa.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_00000000_8a.bin
[2011.11.30 01:23:22 | 000,000,434 | ---- | C] () -- C:\Windows\11317231_0B0f1461_ca.bin
[2011.11.30 01:23:22 | 000,000,434 | ---- | C] () -- C:\Windows\11317231_090F1461_ca.bin
[2011.11.30 01:23:22 | 000,000,376 | ---- | C] () -- C:\Windows\11317231_0B001461_aa.bin
[2011.11.30 01:23:22 | 000,000,376 | ---- | C] () -- C:\Windows\11317231_03131461_aa.bin
[2008.04.11 09:11:40 | 000,233,472 | ---- | C] () -- C:\Program Files\VC_RED.MSI
[2008.04.11 09:09:38 | 003,797,292 | ---- | C] () -- C:\Program Files\VC_RED.cab
[2008.04.11 09:07:18 | 000,005,686 | ---- | C] () -- C:\Program Files\vcredist.bmp
[2008.04.11 09:07:18 | 000,001,110 | ---- | C] () -- C:\Program Files\globdata.ini
[2008.04.11 09:07:18 | 000,000,843 | ---- | C] () -- C:\Program Files\install.ini
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

< End of report >

cosinus 23.01.2013 16:45
Malwarebytes Anti-Rootkit http://img.trojaner-board.de/malware...otkit/logo.png

Downloade dir bitte Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Entpacke das Archiv auf deinem Desktop.
  • Im neu erstellten Ordner starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Rheingold 23.01.2013 22:10
Über den link habe ich Malwarebytes Anti-Rootkit BETA runtergeladen.
Beim scan start erschien folgende Meldung:
"Registry value Appint_Dlls has been found, which may be caused by rootkit activity. Note: press 'No' button if you are not sure. If the tool crashes or termiantes unexpectedly during a system scan, restart the tool and press 'Yes' should this message appear again." Ich habe "No" gewählt. Den Neustart musst ich manuell durchführen. Der Start verlief in normaler Geschwindigkeit. Beim zweiten Scan gab es erneut Funde. Hier die beiden logs:

1.
Code:
Malwarebytes Anti-Rootkit BETA 1.01.0.1016

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 9.0.8112.16421

Java version: 1.6.0_33

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 1.995000 GHz
Memory total: 4183994368, free: 2042388480

------------ Kernel report ------------
    01/23/2013 21:11:39
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\system32\drivers\gfibto.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\DRIVERS\compbatt.sys
\SystemRoot\system32\DRIVERS\BATTC.SYS
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\msahci.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\system32\DRIVERS\stdcfltn.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\system32\DRIVERS\nvpciflt.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\DRIVERS\disk.sys
\SystemRoot\system32\DRIVERS\CLASSPNP.SYS
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\vwififlt.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\drivers\termdd.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\DRIVERS\nvkflt.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\drivers\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\system32\DRIVERS\avkmgr.sys
\SystemRoot\system32\DRIVERS\avipbb.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\drivers\wmiacpi.sys
\SystemRoot\system32\DRIVERS\nvlddmkm.sys
\SystemRoot\System32\Drivers\nvBridge.kmd
\SystemRoot\system32\DRIVERS\igdkmd64.sys
\SystemRoot\system32\DRIVERS\HECIx64.sys
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\drivers\HDAudBus.sys
\SystemRoot\system32\DRIVERS\AVer7231_x64.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\BdaSup.SYS
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\system32\DRIVERS\NETwNs64.sys
\SystemRoot\system32\DRIVERS\vwifibus.sys
\SystemRoot\system32\DRIVERS\nusb3xhc.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\Rt64win7.sys
\SystemRoot\system32\drivers\i8042prt.sys
\SystemRoot\system32\drivers\kbdclass.sys
\SystemRoot\system32\DRIVERS\SynTP.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\Accelern.sys
\SystemRoot\system32\DRIVERS\CmBatt.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\drivers\CompositeBus.sys
\SystemRoot\system32\DRIVERS\serscan.sys
\SystemRoot\system32\DRIVERS\CtClsFlt.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\drivers\swenum.sys
\SystemRoot\system32\DRIVERS\circlass.sys
\SystemRoot\system32\drivers\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\system32\DRIVERS\nusb3hub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\HdAudio.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\System32\Drivers\usbvideo.sys
\SystemRoot\system32\DRIVERS\qicflt.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_dumpata.sys
\SystemRoot\System32\Drivers\dump_msahci.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\DRIVERS\iBtFltCoex.sys
\SystemRoot\system32\DRIVERS\btmhsf.sys
\SystemRoot\System32\Drivers\BTHUSB.sys
\SystemRoot\System32\Drivers\bthport.sys
\SystemRoot\system32\DRIVERS\rfcomm.sys
\SystemRoot\system32\drivers\BthEnum.sys
\SystemRoot\system32\DRIVERS\bthpan.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\system32\DRIVERS\avgntflt.sys
\??\C:\Windows\system32\drivers\mbam.sys
\SystemRoot\system32\drivers\WudfPf.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\DRIVERS\vwifimp.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\??\C:\Windows\SysWOW64\CCInj64.sys
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\psi_mf.sys
\SystemRoot\system32\drivers\MSPQM.sys
\SystemRoot\system32\drivers\MSPCLOCK.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\mbamswissarmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
----------- End -----------
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa8004cf1790
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-0\
Lower Device Object: 0xfffffa8004815060
Lower Device Driver Name: \Driver\atapi\
Driver name found: atapi
Initialization returned 0x0
Port sub-driver loaded: \??\C:\Windows\System32\drivers\ataport.sys (0x0)
Load Function returned 0x0
Downloaded database version: v2013.01.23.09
Initializing...
Done!
<<<2>>>
Device number: 0, partition: 2
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xfffffa8004cf1790, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa8004cf12c0, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa8004cf1790, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa8004c08cb0, DeviceName: Unknown, DriverName: \Driver\stdcfltn\
DevicePointer: 0xfffffa8004815060, DeviceName: \Device\Ide\IdeDeviceP0T0L0-0\, DriverName: \Driver\atapi\
------------ End ----------
Upper DeviceData: 0xfffff8a0014eff00, 0xfffffa8004cf1790, 0xfffffa80043aa790
Lower DeviceData: 0xfffff8a00a558e10, 0xfffffa8004815060, 0xfffffa80049bbe40
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning directory: C:\Windows\system32\drivers...
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: C4255875

Partition information:

    Partition 0 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 2048  Numsec = 204800
    Partition file system is NTFS
    Partition is bootable

    Partition 1 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 206848  Numsec = 557135872

    Partition 2 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 557342720  Numsec = 419426304

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

Disk Size: 500107862016 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-976753168-976773168)...
Done!
Performing system, memory and registry scan...
Infected: HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\SYSTEMRESTORE|DisableConfig --> [Windows.Tool.Disabled]
Infected: HKLM\SOFTWARE\WOW6432NODE\POLICIES\MICROSOFT\WINDOWS NT\SYSTEMRESTORE|DisableConfig --> [Windows.Tool.Disabled]
Done!
Scan finished
Creating System Restore point...
Could not create restore point...
Scheduling clean up...
<<<2>>>
Device number: 0, partition: 2
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Removal successful. No system shutdown is required.
=======================================


---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.01.0.1016

(c) Malwarebytes Corporation 2011-2012
2.
Code:
Malwarebytes Anti-Rootkit BETA 1.01.0.1016

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 9.0.8112.16421

Java version: 1.6.0_33

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 1.995000 GHz
Memory total: 4183994368, free: 2042388480

------------ Kernel report ------------
    01/23/2013 21:11:39
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\system32\drivers\gfibto.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\DRIVERS\compbatt.sys
\SystemRoot\system32\DRIVERS\BATTC.SYS
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\msahci.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\system32\DRIVERS\stdcfltn.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\system32\DRIVERS\nvpciflt.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\DRIVERS\disk.sys
\SystemRoot\system32\DRIVERS\CLASSPNP.SYS
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\vwififlt.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\drivers\termdd.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\DRIVERS\nvkflt.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\drivers\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\system32\DRIVERS\avkmgr.sys
\SystemRoot\system32\DRIVERS\avipbb.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\drivers\wmiacpi.sys
\SystemRoot\system32\DRIVERS\nvlddmkm.sys
\SystemRoot\System32\Drivers\nvBridge.kmd
\SystemRoot\system32\DRIVERS\igdkmd64.sys
\SystemRoot\system32\DRIVERS\HECIx64.sys
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\drivers\HDAudBus.sys
\SystemRoot\system32\DRIVERS\AVer7231_x64.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\BdaSup.SYS
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\system32\DRIVERS\NETwNs64.sys
\SystemRoot\system32\DRIVERS\vwifibus.sys
\SystemRoot\system32\DRIVERS\nusb3xhc.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\Rt64win7.sys
\SystemRoot\system32\drivers\i8042prt.sys
\SystemRoot\system32\drivers\kbdclass.sys
\SystemRoot\system32\DRIVERS\SynTP.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\Accelern.sys
\SystemRoot\system32\DRIVERS\CmBatt.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\drivers\CompositeBus.sys
\SystemRoot\system32\DRIVERS\serscan.sys
\SystemRoot\system32\DRIVERS\CtClsFlt.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\drivers\swenum.sys
\SystemRoot\system32\DRIVERS\circlass.sys
\SystemRoot\system32\drivers\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\system32\DRIVERS\nusb3hub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\HdAudio.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\System32\Drivers\usbvideo.sys
\SystemRoot\system32\DRIVERS\qicflt.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_dumpata.sys
\SystemRoot\System32\Drivers\dump_msahci.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\DRIVERS\iBtFltCoex.sys
\SystemRoot\system32\DRIVERS\btmhsf.sys
\SystemRoot\System32\Drivers\BTHUSB.sys
\SystemRoot\System32\Drivers\bthport.sys
\SystemRoot\system32\DRIVERS\rfcomm.sys
\SystemRoot\system32\drivers\BthEnum.sys
\SystemRoot\system32\DRIVERS\bthpan.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\system32\DRIVERS\avgntflt.sys
\??\C:\Windows\system32\drivers\mbam.sys
\SystemRoot\system32\drivers\WudfPf.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\DRIVERS\vwifimp.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\??\C:\Windows\SysWOW64\CCInj64.sys
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\psi_mf.sys
\SystemRoot\system32\drivers\MSPQM.sys
\SystemRoot\system32\drivers\MSPCLOCK.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\mbamswissarmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
----------- End -----------
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa8004cf1790
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-0\
Lower Device Object: 0xfffffa8004815060
Lower Device Driver Name: \Driver\atapi\
Driver name found: atapi
Initialization returned 0x0
Port sub-driver loaded: \??\C:\Windows\System32\drivers\ataport.sys (0x0)
Load Function returned 0x0
Downloaded database version: v2013.01.23.09
Initializing...
Done!
<<<2>>>
Device number: 0, partition: 2
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xfffffa8004cf1790, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa8004cf12c0, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa8004cf1790, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa8004c08cb0, DeviceName: Unknown, DriverName: \Driver\stdcfltn\
DevicePointer: 0xfffffa8004815060, DeviceName: \Device\Ide\IdeDeviceP0T0L0-0\, DriverName: \Driver\atapi\
------------ End ----------
Upper DeviceData: 0xfffff8a0014eff00, 0xfffffa8004cf1790, 0xfffffa80043aa790
Lower DeviceData: 0xfffff8a00a558e10, 0xfffffa8004815060, 0xfffffa80049bbe40
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning directory: C:\Windows\system32\drivers...
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: C4255875

Partition information:

    Partition 0 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 2048  Numsec = 204800
    Partition file system is NTFS
    Partition is bootable

    Partition 1 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 206848  Numsec = 557135872

    Partition 2 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 557342720  Numsec = 419426304

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

Disk Size: 500107862016 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-976753168-976773168)...
Done!
Performing system, memory and registry scan...
Infected: HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\SYSTEMRESTORE|DisableConfig --> [Windows.Tool.Disabled]
Infected: HKLM\SOFTWARE\WOW6432NODE\POLICIES\MICROSOFT\WINDOWS NT\SYSTEMRESTORE|DisableConfig --> [Windows.Tool.Disabled]
Done!
Scan finished
Creating System Restore point...
Could not create restore point...
Scheduling clean up...
<<<2>>>
Device number: 0, partition: 2
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Removal successful. No system shutdown is required.
=======================================


---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.01.0.1016

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 9.0.8112.16421

Java version: 1.6.0_33

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 1.995000 GHz
Memory total: 4183994368, free: 2746236928

Removal queue found; removal started
Removal finished
=======================================
---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.01.0.1016

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 9.0.8112.16421

Java version: 1.6.0_33

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 1.995000 GHz
Memory total: 4183994368, free: 2266288128

------------ Kernel report ------------
    01/23/2013 21:33:55
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\system32\drivers\gfibto.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\DRIVERS\compbatt.sys
\SystemRoot\system32\DRIVERS\BATTC.SYS
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\msahci.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\system32\DRIVERS\stdcfltn.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\system32\DRIVERS\nvpciflt.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\DRIVERS\disk.sys
\SystemRoot\system32\DRIVERS\CLASSPNP.SYS
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\vwififlt.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\drivers\termdd.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\DRIVERS\nvkflt.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\drivers\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\system32\DRIVERS\avkmgr.sys
\SystemRoot\system32\DRIVERS\avipbb.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\drivers\wmiacpi.sys
\SystemRoot\system32\DRIVERS\nvlddmkm.sys
\SystemRoot\System32\Drivers\nvBridge.kmd
\SystemRoot\system32\DRIVERS\igdkmd64.sys
\SystemRoot\system32\DRIVERS\HECIx64.sys
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\drivers\HDAudBus.sys
\SystemRoot\system32\DRIVERS\AVer7231_x64.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\BdaSup.SYS
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\system32\DRIVERS\NETwNs64.sys
\SystemRoot\system32\DRIVERS\vwifibus.sys
\SystemRoot\system32\DRIVERS\nusb3xhc.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\Rt64win7.sys
\SystemRoot\system32\drivers\i8042prt.sys
\SystemRoot\system32\drivers\kbdclass.sys
\SystemRoot\system32\DRIVERS\SynTP.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\Accelern.sys
\SystemRoot\system32\DRIVERS\CmBatt.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\drivers\CompositeBus.sys
\SystemRoot\system32\DRIVERS\serscan.sys
\SystemRoot\system32\DRIVERS\CtClsFlt.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\drivers\swenum.sys
\SystemRoot\system32\DRIVERS\circlass.sys
\SystemRoot\system32\drivers\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\system32\DRIVERS\nusb3hub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\HdAudio.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\System32\Drivers\usbvideo.sys
\SystemRoot\system32\DRIVERS\qicflt.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_dumpata.sys
\SystemRoot\System32\Drivers\dump_msahci.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\system32\DRIVERS\iBtFltCoex.sys
\SystemRoot\system32\DRIVERS\btmhsf.sys
\SystemRoot\System32\Drivers\BTHUSB.sys
\SystemRoot\System32\Drivers\bthport.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\rfcomm.sys
\SystemRoot\system32\drivers\BthEnum.sys
\SystemRoot\system32\DRIVERS\bthpan.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\system32\DRIVERS\avgntflt.sys
\??\C:\Windows\system32\drivers\mbam.sys
\SystemRoot\system32\drivers\WudfPf.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\DRIVERS\vwifimp.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\drivers\peauth.sys
\??\C:\Windows\SysWOW64\CCInj64.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\psi_mf.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\mbamswissarmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
----------- End -----------
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa8004cf2790
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-0\
Lower Device Object: 0xfffffa8004ad8060
Lower Device Driver Name: \Driver\atapi\
Driver name found: atapi
Initialization returned 0x0
Port sub-driver loaded: \??\C:\Windows\System32\drivers\ataport.sys (0x0)
Load Function returned 0x0
Downloaded database version: v2013.01.23.10
Initializing...
Done!
<<<2>>>
Device number: 0, partition: 2
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xfffffa8004cf2790, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa8004cf22c0, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa8004cf2790, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa8004c089c0, DeviceName: Unknown, DriverName: \Driver\stdcfltn\
DevicePointer: 0xfffffa8004ad8060, DeviceName: \Device\Ide\IdeDeviceP0T0L0-0\, DriverName: \Driver\atapi\
------------ End ----------
Upper DeviceData: 0xfffff8a00b88c4e0, 0xfffffa8004cf2790, 0xfffffa8004277790
Lower DeviceData: 0xfffff8a00a5c6770, 0xfffffa8004ad8060, 0xfffffa800417ba30
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning directory: C:\Windows\system32\drivers...
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: C4255875

Partition information:

    Partition 0 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 2048  Numsec = 204800
    Partition file system is NTFS
    Partition is bootable

    Partition 1 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 206848  Numsec = 557135872

    Partition 2 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 557342720  Numsec = 419426304

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

Disk Size: 500107862016 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-976753168-976773168)...
Done!
Performing system, memory and registry scan...
Infected: HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\SYSTEMRESTORE|DisableConfig --> [Windows.Tool.Disabled]
Infected: HKLM\SOFTWARE\WOW6432NODE\POLICIES\MICROSOFT\WINDOWS NT\SYSTEMRESTORE|DisableConfig --> [Windows.Tool.Disabled]
Done!
Scan finished
Creating System Restore point...
Could not create restore point...
Scheduling clean up...
<<<2>>>
Device number: 0, partition: 2
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Removal successful. No system shutdown is required.
=======================================


---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.01.0.1016

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 9.0.8112.16421

Java version: 1.6.0_33

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 1.995000 GHz
Memory total: 4183994368, free: 2700341248

Removal queue found; removal started
Removal finished
=======================================
---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.01.0.1016

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 9.0.8112.16421

Java version: 1.6.0_33

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 1.995000 GHz
Memory total: 4183994368, free: 1764106240

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.01.0.1016

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 9.0.8112.16421

Java version: 1.6.0_33

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 1.995000 GHz
Memory total: 4183994368, free: 1936502784

------------ Kernel report ------------
    01/23/2013 22:05:17
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\system32\drivers\gfibto.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\DRIVERS\compbatt.sys
\SystemRoot\system32\DRIVERS\BATTC.SYS
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\msahci.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\system32\DRIVERS\stdcfltn.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\system32\DRIVERS\nvpciflt.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\DRIVERS\disk.sys
\SystemRoot\system32\DRIVERS\CLASSPNP.SYS
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\vwififlt.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\drivers\termdd.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\DRIVERS\nvkflt.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\drivers\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\system32\DRIVERS\avkmgr.sys
\SystemRoot\system32\DRIVERS\avipbb.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\drivers\wmiacpi.sys
\SystemRoot\system32\DRIVERS\nvlddmkm.sys
\SystemRoot\System32\Drivers\nvBridge.kmd
\SystemRoot\system32\DRIVERS\igdkmd64.sys
\SystemRoot\system32\DRIVERS\HECIx64.sys
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\drivers\HDAudBus.sys
\SystemRoot\system32\DRIVERS\AVer7231_x64.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\BdaSup.SYS
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\system32\DRIVERS\NETwNs64.sys
\SystemRoot\system32\DRIVERS\vwifibus.sys
\SystemRoot\system32\DRIVERS\nusb3xhc.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\Rt64win7.sys
\SystemRoot\system32\drivers\i8042prt.sys
\SystemRoot\system32\drivers\kbdclass.sys
\SystemRoot\system32\DRIVERS\SynTP.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\Accelern.sys
\SystemRoot\system32\DRIVERS\CmBatt.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\drivers\CompositeBus.sys
\SystemRoot\system32\DRIVERS\serscan.sys
\SystemRoot\system32\DRIVERS\CtClsFlt.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\drivers\swenum.sys
\SystemRoot\system32\DRIVERS\circlass.sys
\SystemRoot\system32\drivers\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\system32\DRIVERS\nusb3hub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\HdAudio.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\System32\Drivers\usbvideo.sys
\SystemRoot\system32\DRIVERS\qicflt.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_dumpata.sys
\SystemRoot\System32\Drivers\dump_msahci.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\system32\DRIVERS\iBtFltCoex.sys
\SystemRoot\system32\DRIVERS\btmhsf.sys
\SystemRoot\System32\Drivers\BTHUSB.sys
\SystemRoot\System32\Drivers\bthport.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\rfcomm.sys
\SystemRoot\system32\drivers\BthEnum.sys
\SystemRoot\system32\DRIVERS\bthpan.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\system32\DRIVERS\avgntflt.sys
\??\C:\Windows\system32\drivers\mbam.sys
\SystemRoot\system32\drivers\WudfPf.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\DRIVERS\vwifimp.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\psi_mf.sys
\??\C:\Windows\SysWOW64\CCInj64.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\mbamswissarmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
----------- End -----------
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa8004cd2790
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-0\
Lower Device Object: 0xfffffa800498e060
Lower Device Driver Name: \Driver\atapi\
Driver name found: atapi
Initialization returned 0x0
Port sub-driver loaded: \??\C:\Windows\System32\drivers\ataport.sys (0x0)
Load Function returned 0x0
=======================================

cosinus 24.01.2013 00:22
1. aswMBR

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehlalarm!
  • Starte die aswMBR.exe Vista und Win7 User aswMBR per Rechtsklick "als Administrator ausführen"
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.


2. TDSS-Killer

Download TDSS-Killer auf Desktop siehe => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition ( meistens Laufwerk C: ) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtg4nzy0ywy5/settings_2012-09-04.png

Rheingold 24.01.2013 07:02
Sorry, sorry, sorry! Den zweiten logfile von otl habe ich übersehen. :stirn:
Hier jetzt aber:

OTL EXTRAS Logfile:
Code:
OTL Extras logfile created on: 23.01.2013 15:54:38 - Run 2
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Jasmina.NICOJAS-PC\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,90 Gb Total Physical Memory | 1,99 Gb Available Physical Memory | 51,11% Memory free
7,79 Gb Paging File | 5,50 Gb Available in Paging File | 70,56% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 265,66 Gb Total Space | 80,75 Gb Free Space | 30,40% Space Free | Partition Type: NTFS
Drive D: | 200,00 Gb Total Space | 199,73 Gb Free Space | 99,87% Space Free | Partition Type: NTFS
 
Computer Name: NICOJAS-PC | User Name: Jasmina | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = ChromeHTML] -- Reg Error: Key error. File not found
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
[HKEY_USERS\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== System Restore Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
"DisableSR" = 1
"DisableConfig" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
"DisableSR" = 1
"DisableConfig" = 1
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03B9EF93-80A8-4845-BBEA-E57E652BBCAF}" = rport=445 | protocol=6 | dir=out | app=system |
"{06E9E081-AF16-48F3-A65C-45D38EFFFDC6}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{13482F04-C479-4714-A5ED-39793B8AAE1D}" = rport=139 | protocol=6 | dir=out | app=system |
"{13E37376-E86C-4019-A725-370DBA1C472E}" = rport=138 | protocol=17 | dir=out | app=system |
"{19ABAAFE-5469-4D69-ADA2-4699E51AAFCF}" = lport=445 | protocol=6 | dir=in | app=system |
"{22BA7DA7-E3C4-47BD-BD6A-B114541112F4}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{2AA89C74-81DA-40D8-903C-81F5681F1A55}" = lport=9322 | protocol=6 | dir=in | name=ekdiscovery |
"{34E72618-0DA7-47D5-A7A0-F15510D9E758}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{482FEDE2-F7D7-4FCF-BC03-256AAC6974E5}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{49716C09-3F9C-404E-B180-E4081D0BBDC8}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{4A808828-8225-46D2-87EC-5E577FAB1B3A}" = lport=139 | protocol=6 | dir=in | app=system |
"{6EEE79D5-2A03-486E-9097-D0C7BAD265DF}" = lport=9322 | protocol=6 | dir=in | name=ekdiscovery |
"{99CBA5AC-9892-45B9-8760-B588F1E908B0}" = lport=5353 | protocol=17 | dir=in | name=bonjour port 5353 |
"{A2DF74D5-A568-4A13-A040-D2D95D6C75DE}" = rport=137 | protocol=17 | dir=out | app=system |
"{A3589360-384E-4156-A3A9-B670DC44F140}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{ADCF185E-AB3F-49C7-B4C6-6FEECB08A98F}" = lport=137 | protocol=17 | dir=in | app=system |
"{D9814FB7-C5B3-41F3-913D-6FC368B5C6E6}" = lport=138 | protocol=17 | dir=in | app=system |
"{F82628F2-3F45-4F25-BAAA-14803BF0F409}" = lport=5353 | protocol=17 | dir=in | name=bonjour port 5353 |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00DE7700-6E5A-4350-9F44-2A7432769CCB}" = protocol=6 | dir=in | app=c:\windows\syswow64\msiexec.exe |
"{02F141FE-498D-4574-A66D-58E2561D793C}" = protocol=17 | dir=in | app=c:\program files (x86)\2k sports\nba 2k13\nba2k13.exe |
"{126782C9-2354-44F3-8F23-A92D102A4E93}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\center\kodak.statistics.exe |
"{2F2EB0A3-4B90-4E33-8C0C-80A6A9C83A72}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\firmware\kodakaioupdater.exe |
"{2F5BDC80-D4CF-46DA-BFFF-FB1A05C2693B}" = protocol=17 | dir=in | app=c:\program files (x86)\cyanide\gamecenter\gamecenter.exe |
"{300ACAB8-ACF5-4FC8-A2ED-1BF12C2151CD}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\center\networkprinterdiscovery.exe |
"{36C3CA04-80CA-4D39-B6C5-AF220F844087}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\center\kodak.statistics.exe |
"{3AB28388-7EB4-46AA-8C6D-806B6571D56D}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\center\aiohomecenter.exe |
"{3B630698-B25B-41DF-8EF9-E2B396B0B083}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\firmware\kodakaioupdater.exe |
"{3CAEF7AF-5FBE-4237-9D6F-D6C0A7991314}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\center\aiohomecenter.exe |
"{3E609762-8618-4993-A50C-77D22F878630}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{43CBC248-7E0B-477C-8DB0-449AE476C7D5}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\firmware\kodakaioupdater.exe |
"{45B64134-8F9D-49F1-8940-F8D85BA68411}" = protocol=6 | dir=in | app=c:\program files (x86)\2k sports\nba 2k13\nba2k13.exe |
"{461D9763-7840-401C-8EA8-A9016EAFB6A0}" = protocol=17 | dir=in | app=c:\programdata\kodak\installer\setup.exe |
"{4B4AC4D5-F226-4ED8-91F7-5BF8E74E2912}" = protocol=6 | dir=in | app=c:\windows\syswow64\muzapp.exe |
"{4D4EFD79-8431-489B-ACBF-22842823D940}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{5CE13E4F-212C-42A3-98D7-C10DCBBAEAB8}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\center\networkprinterdiscovery.exe |
"{6286D4F7-67FF-4293-AA87-AC04E642A996}" = protocol=6 | dir=in | app=c:\programdata\kodak\installer\setup.exe |
"{673EE027-9D91-408D-8E7F-F9EAE8AA5195}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\firmware\kodakaioupdater.exe |
"{7FBC02D6-A43E-46B5-B55E-F878996E72CA}" = protocol=6 | dir=in | app=c:\programdata\kodak\installer\setup.exe |
"{80514CFD-8048-4C14-B844-9891D4854D21}" = protocol=6 | dir=in | app=c:\program files (x86)\sweetim\communicator\sweetpacksupdatemanager.exe |
"{83AF232F-8E60-4AE4-91F3-177AADA4C95D}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\center\aiohomecenter.exe |
"{86B3BA1A-EB42-41EB-8BE5-ED2F3CCD803F}" = protocol=17 | dir=in | app=d:\tobit radio.fx\client\rfx-client.exe |
"{8A47FCBE-4950-4015-8D01-2C2AC9895ED7}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\center\kodak.statistics.exe |
"{8A76F869-12AA-4BBE-8D9F-B97FFECBF30E}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\center\aiohomecenter.exe |
"{91EB51CE-59DF-48E1-BAF4-52E98B8F4352}" = protocol=17 | dir=in | app=d:\tobit radio.fx\server\rfx-server.exe |
"{97EB7143-70C5-495B-B9AF-62423A6EB4CC}" = protocol=17 | dir=in | app=c:\windows\syswow64\msiexec.exe |
"{9B906E24-8273-4393-AA06-F8A6FDA9FFC3}" = protocol=17 | dir=in | app=c:\program files (x86)\sweetim\communicator\sweetpacksupdatemanager.exe |
"{9E64C8F7-38F7-4211-9F24-27502D9F9377}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\center\networkprinterdiscovery.exe |
"{A2834B87-C86E-4D08-90B2-DA67BCA1716B}" = protocol=6 | dir=in | app=c:\program files (x86)\cyanide\gamecenter\gamecenter.exe |
"{A301FAD5-5412-4D17-BFE7-FECBF23E370B}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{A7F89437-5CF4-4291-AC2D-3A780F3ABEE7}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{BD7E8F19-BBB9-4C22-A1A9-13145F003618}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{BE688A9C-1735-4E3E-A89C-BC83633D49E9}" = protocol=17 | dir=in | app=c:\windows\syswow64\muzapp.exe |
"{BF64C12D-723D-4411-A3FB-77E0F02E6A4A}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\center\kodak.statistics.exe |
"{C290BE6A-1286-4F6B-8429-B0EC7335FEE4}" = protocol=6 | dir=in | app=d:\tobit radio.fx\server\rfx-server.exe |
"{C8790961-8656-4860-9076-A2D6623D10E5}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\center\networkprinterdiscovery.exe |
"{CC860D3A-C81A-4786-878A-4D6E17556474}" = protocol=17 | dir=in | app=c:\windows\syswow64\muzapp.exe |
"{CD406032-BF04-4303-912E-D7130F577CF8}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{CD7240F0-B94F-46EF-926F-AAE573567F82}" = protocol=6 | dir=in | app=d:\tobit radio.fx\client\rfx-client.exe |
"{DC484A61-D39E-484F-ABAC-79D0B001A970}" = protocol=6 | dir=in | app=c:\windows\syswow64\muzapp.exe |
"{E590CA35-BF4B-43AB-AD11-E1DFA3E5E85F}" = dir=in | app=c:\program files (x86)\dell stage\videostage\videostage.exe |
"{EB9E90E3-6809-4C85-8486-954384E4415E}" = protocol=17 | dir=in | app=c:\programdata\kodak\installer\setup.exe |
"TCP Query User{2C129A0F-15ED-4EB5-B1D1-52762861834F}C:\users\nico.nicojas-pc\appdata\local\facebook\video\skype\facebookvideocalling.exe" = protocol=6 | dir=in | app=c:\users\nico.nicojas-pc\appdata\local\facebook\video\skype\facebookvideocalling.exe |
"TCP Query User{415EE727-2686-4681-A0CC-B633456BC9A1}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe |
"TCP Query User{44F9B41D-F81E-4237-B65C-495E923A0A91}C:\users\nico.nicojas-pc\appdata\local\facebook\video\skype\facebookvideocalling.exe" = protocol=6 | dir=in | app=c:\users\nico.nicojas-pc\appdata\local\facebook\video\skype\facebookvideocalling.exe |
"TCP Query User{56412238-720A-46B5-A739-61A80F922067}C:\users\nico.nicojas-pc\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\nico.nicojas-pc\appdata\roaming\spotify\spotify.exe |
"TCP Query User{9B9701E4-29D1-4FF2-979C-8597475BDD6F}C:\program files (x86)\ea sports\fifa 11\game\fifa.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ea sports\fifa 11\game\fifa.exe |
"TCP Query User{D1677699-5DF9-4125-9F3C-4687B71E4538}C:\program files (x86)\ea sports\fifa 11\game\fifa.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ea sports\fifa 11\game\fifa.exe |
"TCP Query User{E0CFE6E6-8D1F-4EA9-8CB2-172678AAC4F5}C:\users\nico.nicojas-pc\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\nico.nicojas-pc\appdata\roaming\spotify\spotify.exe |
"UDP Query User{01DE79D1-8DE7-4447-ADB8-56C8B3C7497B}C:\users\nico.nicojas-pc\appdata\local\facebook\video\skype\facebookvideocalling.exe" = protocol=17 | dir=in | app=c:\users\nico.nicojas-pc\appdata\local\facebook\video\skype\facebookvideocalling.exe |
"UDP Query User{2F8A7DF9-1087-41D1-8A2C-9992D60A33F1}C:\program files (x86)\ea sports\fifa 11\game\fifa.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ea sports\fifa 11\game\fifa.exe |
"UDP Query User{40F012E4-AE29-44CC-BD71-803C69499479}C:\users\nico.nicojas-pc\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\nico.nicojas-pc\appdata\roaming\spotify\spotify.exe |
"UDP Query User{5DEF9C85-2CF8-4430-B799-143CCE815566}C:\users\nico.nicojas-pc\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\nico.nicojas-pc\appdata\roaming\spotify\spotify.exe |
"UDP Query User{7D3AE024-0E92-4F74-A165-5F405D7115A1}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe |
"UDP Query User{BA636B01-B9F1-4665-9285-7B080D1B5368}C:\users\nico.nicojas-pc\appdata\local\facebook\video\skype\facebookvideocalling.exe" = protocol=17 | dir=in | app=c:\users\nico.nicojas-pc\appdata\local\facebook\video\skype\facebookvideocalling.exe |
"UDP Query User{FC56FE20-5872-4926-A640-6CA999CC5F9B}C:\program files (x86)\ea sports\fifa 11\game\fifa.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ea sports\fifa 11\game\fifa.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{0645A454-AD44-4F0D-99CF-6B762735AD1F}" = aioprnt
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)
"{27EF8E7F-88D1-4ec5-ADE2-7E447FDF114E}" = Kodak AIO Printer
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{87CF757E-C1F1-4D22-865C-00C6950B5258}" = Quickset64
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1" = PDF-Viewer
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Optimus" = NVIDIA Optimus 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}" = PlayReady PC Runtime amd64
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"GIMP-2_is1" = GIMP 2.8.2
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"SynTPDeinstKey" = Synaptics Pointing Device Driver
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D98F04D-11A1-4B64-A406-43292B9EEE90}" = Dell PhotoStage
"{1798D459-6B8B-474B-868D-1229EADA3B95}" = Adobe AIR
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}" = OpenOffice.org 3.4.1
"{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java(TM) 6 Update 33
"{26A24AE4-039D-4CA4-87B4-2F83217009FF}" = Java 7 Update 11
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{376348C2-E372-48BC-A138-E896757BD86A}" = aioscnnr
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3E90B7F4-1817-4405-B4A5-E4EA5EC0E2B3}" = Dell MusicStage
"{3FEA6CD1-EA13-4CE7-A74E-A74A4A0A7B5C}" = FIFA 11
"{56BA241F-580C-43D2-8403-947241AAE633}" = center
"{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6F545E5E-4595-11E2-93B6-B8AC6F97B88E}" = Google Earth
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D318C86-AF4C-409F-A6AC-7183FF4CF424}" = Internet-TV für Windows Media Center
"{9F06F464-479A-403E-AF92-70CBB8D674A1}" = PRE10STI64Installer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAECF7BA-E83B-4A10-87EA-DE0B333F8734}" = RealNetworks - Microsoft Visual C++ 2010 Runtime
"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
"{AF7EBCA4-9FAF-4DC8-8D09-67854BB84D34}" = RealDownloader
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B92C5909-1D37-4C51-8397-A28BB28E5DC3}" = Facebook Video Calling 1.2.0.287
"{BE94C681-68E2-4561-8ABC-8D2E799168B4}" = essentials
"{BFBCF96F-7361-486A-965C-54B17AC35421}" = ocr
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D96B6543-A0C0-4351-AF96-73DEF1DD6820}" = NBA 2K13
"{DA5BDB2A-12F0-4343-8351-21AAEB293990}" = PreReq
"{DCE0E79A-B9AC-41AC-98C1-7EF0538BCA7F}" = Dell VideoStage
"{DEACDFFA-D424-416F-B849-FA282F55B2CE}" = Cortona3D Viewer
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E0F274B7-592B-4669-8FB8-8D9825A09858}" = KODAK All-in-One Software
"{E2F57269-065E-4B19-8CDA-AB6C401FAF1A}" = Dell Stage
"{E4335E82-17B3-460F-9E70-39D9BC269DB3}" = Dell PhotoStage
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{EF53BFAB-4C10-40DB-A82D-9B07111715C6}" = aioscnnr
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics
"{F5266D28-E0B2-4130-BFC5-EE155AD514DC}" = Apple Application Support
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"ALDI Bestellsoftware" = ALDI Bestellsoftware 4.12.1
"Ashampoo Burning Studio 6 FREE_is1" = Ashampoo Burning Studio 6 FREE v.6.81
"Avira AntiVir Desktop" = Avira Free Antivirus
"Dell Webcam Central" = Dell Webcam Central
"ExpressBurn" = Express Burn
"ExpressRip" = Express Rip
"FLV Player" = FLV Player 2.0 (build 25)
"Free M4a to MP3 Converter_is1" = Free M4a to MP3 Converter 7.0
"Free YouTube to iPod Converter_is1" = Free YouTube to iPod Converter version 3.10.32.918
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.32.918
"InstallShield_{DCE0E79A-B9AC-41AC-98C1-7EF0538BCA7F}" = Dell VideoStage
"Kindersicherung_is1" = Kindersicherung 2012
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"MixPad" = MixPad Audiodatei-Mixer
"Mozilla Firefox 18.0.1 (x86 de)" = Mozilla Firefox 18.0.1 (x86 de)
"Mozilla Thunderbird 17.0.2 (x86 de)" = Mozilla Thunderbird 17.0.2 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"PrintProjects" = PrintProjects
"RealPlayer 16.0" = RealPlayer
"Secunia PSI" = Secunia PSI (3.0.0.6001)
"Tobit Radio.fx Server 1" = WDR RadioRecorder
"Video Converter" = Video Converter
"VLC media player" = VLC media player 2.0.5
"WavePad" = WavePad Audiobearbeitungs-Software
"WinLiveSuite" = Windows Live Essentials
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 24.10.2012 06:21:15 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 439
Description = Windows (2888) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk
 konnte nicht geschrieben werden. Fehler -1032.
 
Error - 24.10.2012 06:24:30 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 490
Description = Windows (2888) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 24.10.2012 06:24:30 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 439
Description = Windows (2888) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk
 konnte nicht geschrieben werden. Fehler -1032.
 
Error - 24.10.2012 06:26:43 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 490
Description = Windows (2888) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 24.10.2012 06:26:43 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 439
Description = Windows (2888) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk
 konnte nicht geschrieben werden. Fehler -1032.
 
Error - 24.10.2012 06:26:53 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 490
Description = Windows (2888) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 24.10.2012 06:26:53 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 439
Description = Windows (2888) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk
 konnte nicht geschrieben werden. Fehler -1032.
 
Error - 24.10.2012 06:27:03 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 490
Description = Windows (2888) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 24.10.2012 06:27:03 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 439
Description = Windows (2888) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk
 konnte nicht geschrieben werden. Fehler -1032.
 
Error - 24.10.2012 06:44:26 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 490
Description = Windows (2888) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 24.10.2012 06:44:26 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 439
Description = Windows (2888) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk
 konnte nicht geschrieben werden. Fehler -1032.
 
[ Media Center Events ]
Error - 20.03.2012 15:11:39 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 20:11:34 - Fehler beim Herstellen der Internetverbindung.  20:11:34
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 20.03.2012 16:11:42 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 21:11:42 - Fehler beim Herstellen der Internetverbindung.  21:11:42
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 20.03.2012 16:11:51 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 21:11:47 - Fehler beim Herstellen der Internetverbindung.  21:11:47
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 05.05.2012 14:52:38 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 20:44:58 - EpgListing.enc konnte nicht abgerufen werden (Fehler: HTTP-Status
 404: Die angeforderte URL ist auf diesem Server nicht vorhanden.  ) 
 
Error - 22.05.2012 14:13:50 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 20:13:50 - Fehler beim Herstellen der Internetverbindung.  20:13:50
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 22.05.2012 14:14:07 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 20:13:55 - Fehler beim Herstellen der Internetverbindung.  20:13:55
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 13.07.2012 14:26:21 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 20:26:21 - Fehler beim Herstellen der Internetverbindung.  20:26:21
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 13.07.2012 14:26:39 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 20:26:27 - Fehler beim Herstellen der Internetverbindung.  20:26:27
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 24.08.2012 15:46:57 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 21:46:57 - Fehler beim Herstellen der Internetverbindung.  21:46:57
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 24.08.2012 15:47:42 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 21:47:11 - Fehler beim Herstellen der Internetverbindung.  21:47:11
-    Serververbindung konnte nicht hergestellt werden.. 
 
[ System Events ]
Error - 23.01.2013 07:26:57 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7000
Description = Der Dienst "UAC-Dateivirtualisierung" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%2
 
Error - 23.01.2013 07:28:11 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  SBRE
 
Error - 23.01.2013 09:03:30 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7000
Description = Der Dienst "UAC-Dateivirtualisierung" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%2
 
Error - 23.01.2013 09:03:54 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  SBRE
 
Error - 23.01.2013 09:17:24 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7000
Description = Der Dienst "UAC-Dateivirtualisierung" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%2
 
Error - 23.01.2013 09:17:53 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  SBRE
 
Error - 23.01.2013 09:49:15 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7038
Description = Der Dienst "upnphost" konnte sich nicht als "NT AUTHORITY\LocalService"
 mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:  %%50    Vergewissern
 Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft
 Management Console (MMC).
 
Error - 23.01.2013 09:49:15 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7000
Description = Der Dienst "UPnP-Gerätehost" wurde aufgrund folgenden Fehlers nicht
 gestartet:  %%1069
 
Error - 23.01.2013 10:08:27 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7000
Description = Der Dienst "UAC-Dateivirtualisierung" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%2
 
Error - 23.01.2013 10:09:34 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  SBRE
 
 
< End of report >
--- --- ---

[/CODE]

Hallo,
hier die logfiles von aswMBR und TDSSKiller:

Code:
aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
Run date: 2013-01-24 07:38:06
-----------------------------
07:38:06.558    OS Version: Windows x64 6.1.7601 Service Pack 1
07:38:06.559    Number of processors: 8 586 0x2A07
07:38:06.559    ComputerName: NICOJAS-PC  UserName: Jasmina
07:38:08.408    Initialize success
07:41:01.326    AVAST engine defs: 13012301
07:43:32.582    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
07:43:32.597    Disk 0 Vendor: ST9500420AS D005SDM1 Size: 476940MB BusType: 11
07:43:32.628    Disk 0 MBR read successfully
07:43:32.628    Disk 0 MBR scan
07:43:32.628    Disk 0 Windows 7 default MBR code
07:43:32.644    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048
07:43:32.660    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      272039 MB offset 206848
07:43:32.675    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS      204798 MB offset 557342720
07:43:32.706    Disk 0 scanning C:\Windows\system32\drivers
07:43:44.365    Service scanning
07:44:06.468    Modules scanning
07:44:06.468    Disk 0 trace - called modules:
07:44:06.515    ntoskrnl.exe CLASSPNP.SYS disk.sys stdcfltn.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys
07:44:07.014    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004cd2790]
07:44:07.014    3 CLASSPNP.SYS[fffff88001b5843f] -> nt!IofCallDriver -> [0xfffffa8004be8890]
07:44:07.014    5 stdcfltn.sys[fffff88001a98c52] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa80049cd680]
07:44:07.981    AVAST engine scan C:\Windows
07:44:09.993    AVAST engine scan C:\Windows\system32
07:47:20.597    AVAST engine scan C:\Windows\system32\drivers
07:47:37.960    AVAST engine scan C:\Users\Jasmina.NICOJAS-PC
07:48:52.513    Disk 0 MBR has been saved successfully to "C:\Users\Jasmina.NICOJAS-PC\Desktop\Antivirus Logs etc\MBR.dat"
07:48:52.513    The log file has been saved successfully to "C:\Users\Jasmina.NICOJAS-PC\Desktop\Antivirus Logs etc\aswMBR.txt"

Code:
07:49:56.0573 4908  TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35
07:49:56.0830 4908  ============================================================
07:49:56.0831 4908  Current date / time: 2013/01/24 07:49:56.0830
07:49:56.0831 4908  SystemInfo:
07:49:56.0831 4908 
07:49:56.0831 4908  OS Version: 6.1.7601 ServicePack: 1.0
07:49:56.0831 4908  Product type: Workstation
07:49:56.0831 4908  ComputerName: NICOJAS-PC
07:49:56.0831 4908  UserName: Jasmina
07:49:56.0831 4908  Windows directory: C:\Windows
07:49:56.0831 4908  System windows directory: C:\Windows
07:49:56.0831 4908  Running under WOW64
07:49:56.0831 4908  Processor architecture: Intel x64
07:49:56.0831 4908  Number of processors: 8
07:49:56.0831 4908  Page size: 0x1000
07:49:56.0831 4908  Boot type: Normal boot
07:49:56.0831 4908  ============================================================
07:49:57.0915 4908  Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
07:49:57.0933 4908  ============================================================
07:49:57.0933 4908  \Device\Harddisk0\DR0:
07:49:57.0933 4908  MBR partitions:
07:49:57.0933 4908  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
07:49:57.0933 4908  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x21353800
07:49:57.0934 4908  \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x21386000, BlocksNum 0x18FFF000
07:49:57.0934 4908  ============================================================
07:49:57.0957 4908  C: <-> \Device\Harddisk0\DR0\Partition2
07:49:57.0996 4908  D: <-> \Device\Harddisk0\DR0\Partition3
07:49:57.0996 4908  ============================================================
07:49:57.0996 4908  Initialize success
07:49:57.0996 4908  ============================================================
07:50:10.0704 4872  ============================================================
07:50:10.0704 4872  Scan started
07:50:10.0704 4872  Mode: Manual; SigCheck; TDLFS;
07:50:10.0704 4872  ============================================================
07:50:11.0968 4872  ================ Scan system memory ========================
07:50:11.0968 4872  System memory - ok
07:50:11.0968 4872  ================ Scan services =============================
07:50:12.0093 4872  [ A87D604AEA360176311474C87A63BB88 ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
07:50:12.0124 4872  1394ohci - ok
07:50:12.0155 4872  [ E0065CBF1A25C015C218457D2CD522B9 ] Acceler        C:\Windows\system32\DRIVERS\Accelern.sys
07:50:12.0171 4872  Acceler - ok
07:50:12.0218 4872  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
07:50:12.0233 4872  ACPI - ok
07:50:12.0233 4872  [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi        C:\Windows\system32\drivers\acpipmi.sys
07:50:12.0249 4872  AcpiPmi - ok
07:50:12.0342 4872  [ 424877CB9D5517F980FF7BACA2EB379D ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
07:50:12.0358 4872  AdobeFlashPlayerUpdateSvc - ok
07:50:12.0389 4872  [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx        C:\Windows\system32\DRIVERS\adp94xx.sys
07:50:12.0405 4872  adp94xx - ok
07:50:12.0420 4872  [ 597F78224EE9224EA1A13D6350CED962 ] adpahci        C:\Windows\system32\DRIVERS\adpahci.sys
07:50:12.0436 4872  adpahci - ok
07:50:12.0436 4872  [ E109549C90F62FB570B9540C4B148E54 ] adpu320        C:\Windows\system32\DRIVERS\adpu320.sys
07:50:12.0452 4872  adpu320 - ok
07:50:12.0467 4872  [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc    C:\Windows\System32\aelupsvc.dll
07:50:12.0498 4872  AeLookupSvc - ok
07:50:12.0530 4872  [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD            C:\Windows\system32\drivers\afd.sys
07:50:12.0545 4872  AFD - ok
07:50:12.0561 4872  [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440          C:\Windows\system32\drivers\agp440.sys
07:50:12.0576 4872  agp440 - ok
07:50:12.0592 4872  [ 3290D6946B5E30E70414990574883DDB ] ALG            C:\Windows\System32\alg.exe
07:50:12.0608 4872  ALG - ok
07:50:12.0608 4872  [ 5812713A477A3AD7363C7438CA2EE038 ] aliide          C:\Windows\system32\drivers\aliide.sys
07:50:12.0623 4872  aliide - ok
07:50:12.0639 4872  [ 1FF8B4431C353CE385C875F194924C0C ] amdide          C:\Windows\system32\drivers\amdide.sys
07:50:12.0639 4872  amdide - ok
07:50:12.0654 4872  [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8          C:\Windows\system32\DRIVERS\amdk8.sys
07:50:12.0654 4872  AmdK8 - ok
07:50:12.0670 4872  [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys
07:50:12.0670 4872  AmdPPM - ok
07:50:12.0686 4872  [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata        C:\Windows\system32\drivers\amdsata.sys
07:50:12.0686 4872  amdsata - ok
07:50:12.0701 4872  [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs          C:\Windows\system32\DRIVERS\amdsbs.sys
07:50:12.0701 4872  amdsbs - ok
07:50:12.0732 4872  [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata        C:\Windows\system32\drivers\amdxata.sys
07:50:12.0732 4872  amdxata - ok
07:50:13.0076 4872  [ 0FA2D8304ECA29CA0AB7E3EE50FD585A ] AntiVirSchedulerService C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
07:50:13.0076 4872  AntiVirSchedulerService - ok
07:50:13.0138 4872  [ 5C69AAC8A59207DA9710FF2E42D6F80F ] AntiVirService  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
07:50:13.0138 4872  AntiVirService - ok
07:50:13.0200 4872  [ 89A69C3F2F319B43379399547526D952 ] AppID          C:\Windows\system32\drivers\appid.sys
07:50:13.0216 4872  AppID - ok
07:50:13.0263 4872  [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
07:50:13.0294 4872  AppIDSvc - ok
07:50:13.0325 4872  [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo        C:\Windows\System32\appinfo.dll
07:50:13.0356 4872  Appinfo - ok
07:50:13.0403 4872  [ C484F8CEB1717C540242531DB7845C4E ] arc            C:\Windows\system32\DRIVERS\arc.sys
07:50:13.0403 4872  arc - ok
07:50:13.0403 4872  [ 019AF6924AEFE7839F61C830227FE79C ] arcsas          C:\Windows\system32\DRIVERS\arcsas.sys
07:50:13.0419 4872  arcsas - ok
07:50:13.0434 4872  [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
07:50:13.0466 4872  AsyncMac - ok
07:50:13.0497 4872  [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi          C:\Windows\system32\drivers\atapi.sys
07:50:13.0497 4872  atapi - ok
07:50:13.0590 4872  [ 3EFD964D52221360AF0673CD61C2F4F5 ] atikmdag        C:\Windows\system32\drivers\atikmdag.sys
07:50:13.0653 4872  atikmdag - ok
07:50:13.0715 4872  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
07:50:13.0746 4872  AudioEndpointBuilder - ok
07:50:13.0793 4872  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv        C:\Windows\System32\Audiosrv.dll
07:50:13.0824 4872  AudioSrv - ok
07:50:13.0902 4872  [ 1D56DCD05784B1F1D9C6E2F529043279 ] AVer7231_x64    C:\Windows\system32\DRIVERS\AVer7231_x64.sys
07:50:13.0965 4872  AVer7231_x64 - ok
07:50:14.0012 4872  [ BFE9598EBC3934CF8D876A303849C896 ] avgntflt        C:\Windows\system32\DRIVERS\avgntflt.sys
07:50:14.0027 4872  avgntflt - ok
07:50:14.0074 4872  [ F74D86A9FB35FA5F24627B8DBBF3A9A4 ] avipbb          C:\Windows\system32\DRIVERS\avipbb.sys
07:50:14.0090 4872  avipbb - ok
07:50:14.0105 4872  [ CD0E732347BF09717E0BDDC0C66699AB ] avkmgr          C:\Windows\system32\DRIVERS\avkmgr.sys
07:50:14.0105 4872  avkmgr - ok
07:50:14.0152 4872  [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV        C:\Windows\System32\AxInstSV.dll
07:50:14.0183 4872  AxInstSV - ok
07:50:14.0230 4872  [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv        C:\Windows\system32\DRIVERS\bxvbda.sys
07:50:14.0261 4872  b06bdrv - ok
07:50:14.0292 4872  [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
07:50:14.0308 4872  b57nd60a - ok
07:50:14.0339 4872  [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC          C:\Windows\System32\bdesvc.dll
07:50:14.0370 4872  BDESVC - ok
07:50:14.0386 4872  [ 16A47CE2DECC9B099349A5F840654746 ] Beep            C:\Windows\system32\drivers\Beep.sys
07:50:14.0433 4872  Beep - ok
07:50:14.0511 4872  [ 82974D6A2FD19445CC5171FC378668A4 ] BFE            C:\Windows\System32\bfe.dll
07:50:14.0542 4872  BFE - ok
07:50:14.0589 4872  [ 1EA7969E3271CBC59E1730697DC74682 ] BITS            C:\Windows\System32\qmgr.dll
07:50:14.0620 4872  BITS - ok
07:50:14.0651 4872  [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
07:50:14.0651 4872  blbdrive - ok
07:50:14.0698 4872  [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
07:50:14.0714 4872  bowser - ok
07:50:14.0729 4872  [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo        C:\Windows\system32\DRIVERS\BrFiltLo.sys
07:50:14.0729 4872  BrFiltLo - ok
07:50:14.0729 4872  [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp        C:\Windows\system32\DRIVERS\BrFiltUp.sys
07:50:14.0745 4872  BrFiltUp - ok
07:50:14.0792 4872  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser        C:\Windows\System32\browser.dll
07:50:14.0792 4872  Browser - ok
07:50:14.0807 4872  [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid        C:\Windows\System32\Drivers\Brserid.sys
07:50:14.0807 4872  Brserid - ok
07:50:14.0823 4872  [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
07:50:14.0823 4872  BrSerWdm - ok
07:50:14.0838 4872  [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
07:50:14.0838 4872  BrUsbMdm - ok
07:50:14.0838 4872  [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
07:50:14.0854 4872  BrUsbSer - ok
07:50:14.0901 4872  [ CF98190A94F62E405C8CB255018B2315 ] BthEnum        C:\Windows\system32\drivers\BthEnum.sys
07:50:14.0916 4872  BthEnum - ok
07:50:14.0932 4872  [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys
07:50:14.0948 4872  BTHMODEM - ok
07:50:14.0979 4872  [ 02DD601B708DD0667E1331FA8518E9FF ] BthPan          C:\Windows\system32\DRIVERS\bthpan.sys
07:50:14.0979 4872  BthPan - ok
07:50:15.0010 4872  [ 738D0E9272F59EB7A1449C3EC118E6C4 ] BTHPORT        C:\Windows\System32\Drivers\BTHport.sys
07:50:15.0026 4872  BTHPORT - ok
07:50:15.0057 4872  [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv        C:\Windows\system32\bthserv.dll
07:50:15.0088 4872  bthserv - ok
07:50:15.0104 4872  [ F188B7394D81010767B6DF3178519A37 ] BTHUSB          C:\Windows\System32\Drivers\BTHUSB.sys
07:50:15.0119 4872  BTHUSB - ok
07:50:15.0166 4872  [ 40C6FEC49D1CC4D112368A2BCD2BCBB7 ] btmhsf          C:\Windows\system32\DRIVERS\btmhsf.sys
07:50:15.0182 4872  btmhsf - ok
07:50:15.0228 4872  [ B8BD2BB284668C84865658C77574381A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
07:50:15.0275 4872  cdfs - ok
07:50:15.0306 4872  [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom          C:\Windows\system32\DRIVERS\cdrom.sys
07:50:15.0322 4872  cdrom - ok
07:50:15.0369 4872  [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc    C:\Windows\System32\certprop.dll
07:50:15.0400 4872  CertPropSvc - ok
07:50:15.0431 4872  [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass        C:\Windows\system32\DRIVERS\circlass.sys
07:50:15.0447 4872  circlass - ok
07:50:15.0478 4872  [ FE1EC06F2253F691FE36217C592A0206 ] CLFS            C:\Windows\system32\CLFS.sys
07:50:15.0494 4872  CLFS - ok
07:50:15.0556 4872  [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
07:50:15.0556 4872  clr_optimization_v2.0.50727_32 - ok
07:50:15.0603 4872  [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
07:50:15.0618 4872  clr_optimization_v2.0.50727_64 - ok
07:50:15.0665 4872  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
07:50:15.0681 4872  clr_optimization_v4.0.30319_32 - ok
07:50:15.0696 4872  [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
07:50:15.0712 4872  clr_optimization_v4.0.30319_64 - ok
07:50:15.0728 4872  [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
07:50:15.0728 4872  CmBatt - ok
07:50:15.0759 4872  [ E19D3F095812725D88F9001985B94EDD ] cmdide          C:\Windows\system32\drivers\cmdide.sys
07:50:15.0774 4872  cmdide - ok
07:50:15.0806 4872  [ AAFCB52FE0037207FB6FBEA070D25EFE ] CNG            C:\Windows\system32\Drivers\cng.sys
07:50:15.0837 4872  CNG - ok
07:50:15.0868 4872  [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
07:50:15.0868 4872  Compbatt - ok
07:50:15.0915 4872  [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys
07:50:15.0915 4872  CompositeBus - ok
07:50:15.0930 4872  COMSysApp - ok
07:50:15.0946 4872  [ 1C827878A998C18847245FE1F34EE597 ] crcdisk        C:\Windows\system32\DRIVERS\crcdisk.sys
07:50:15.0962 4872  crcdisk - ok
07:50:15.0993 4872  [ 9C01375BE382E834CC26D1B7EAF2C4FE ] CryptSvc        C:\Windows\system32\cryptsvc.dll
07:50:16.0024 4872  CryptSvc - ok
07:50:16.0071 4872  [ FBE228ABEAB2BE13B9C3A3A112D4D8DC ] CtClsFlt        C:\Windows\system32\DRIVERS\CtClsFlt.sys
07:50:16.0086 4872  CtClsFlt - ok
07:50:16.0133 4872  [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch      C:\Windows\system32\rpcss.dll
07:50:16.0164 4872  DcomLaunch - ok
07:50:16.0196 4872  [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc      C:\Windows\System32\defragsvc.dll
07:50:16.0227 4872  defragsvc - ok
07:50:16.0274 4872  [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
07:50:16.0305 4872  DfsC - ok
07:50:16.0336 4872  dgderdrv - ok
07:50:16.0430 4872  [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp            C:\Windows\system32\dhcpcore.dll
07:50:16.0445 4872  Dhcp - ok
07:50:16.0461 4872  [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache        C:\Windows\system32\drivers\discache.sys
07:50:16.0508 4872  discache - ok
07:50:16.0523 4872  [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk            C:\Windows\system32\DRIVERS\disk.sys
07:50:16.0539 4872  Disk - ok
07:50:16.0570 4872  [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
07:50:16.0570 4872  Dnscache - ok
07:50:16.0617 4872  [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc        C:\Windows\System32\dot3svc.dll
07:50:16.0648 4872  dot3svc - ok
07:50:16.0742 4872  [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS            C:\Windows\system32\dps.dll
07:50:16.0773 4872  DPS - ok
07:50:16.0788 4872  [ 9B19F34400D24DF84C858A421C205754 ] drmkaud        C:\Windows\system32\drivers\drmkaud.sys
07:50:16.0804 4872  drmkaud - ok
07:50:16.0851 4872  [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl        C:\Windows\System32\drivers\dxgkrnl.sys
07:50:16.0882 4872  DXGKrnl - ok
07:50:16.0898 4872  [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost        C:\Windows\System32\eapsvc.dll
07:50:16.0944 4872  EapHost - ok
07:50:17.0007 4872  [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv          C:\Windows\system32\DRIVERS\evbda.sys
07:50:17.0116 4872  ebdrv - ok
07:50:17.0132 4872  [ C118A82CD78818C29AB228366EBF81C3 ] EFS            C:\Windows\System32\lsass.exe
07:50:17.0147 4872  EFS - ok
07:50:17.0272 4872  [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr        C:\Windows\ehome\ehRecvr.exe
07:50:17.0288 4872  ehRecvr - ok
07:50:17.0350 4872  [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched        C:\Windows\ehome\ehsched.exe
07:50:17.0350 4872  ehSched - ok
07:50:17.0381 4872  [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor        C:\Windows\system32\DRIVERS\elxstor.sys
07:50:17.0397 4872  elxstor - ok
07:50:17.0444 4872  [ 34A3C54752046E79A126E15C51DB409B ] ErrDev          C:\Windows\system32\drivers\errdev.sys
07:50:17.0444 4872  ErrDev - ok
07:50:17.0506 4872  [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem    C:\Windows\system32\es.dll
07:50:17.0537 4872  EventSystem - ok
07:50:17.0537 4872  [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat          C:\Windows\system32\drivers\exfat.sys
07:50:17.0568 4872  exfat - ok
07:50:17.0600 4872  [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat        C:\Windows\system32\drivers\fastfat.sys
07:50:17.0631 4872  fastfat - ok
07:50:17.0678 4872  [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax            C:\Windows\system32\fxssvc.exe
07:50:17.0693 4872  Fax - ok
07:50:17.0693 4872  [ D765D19CD8EF61F650C384F62FAC00AB ] fdc            C:\Windows\system32\DRIVERS\fdc.sys
07:50:17.0693 4872  fdc - ok
07:50:17.0724 4872  [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost        C:\Windows\system32\fdPHost.dll
07:50:17.0740 4872  fdPHost - ok
07:50:17.0756 4872  [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub        C:\Windows\system32\fdrespub.dll
07:50:17.0787 4872  FDResPub - ok
07:50:17.0787 4872  [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
07:50:17.0802 4872  FileInfo - ok
07:50:17.0818 4872  [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace      C:\Windows\system32\drivers\filetrace.sys
07:50:17.0849 4872  Filetrace - ok
07:50:17.0849 4872  [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
07:50:17.0849 4872  flpydisk - ok
07:50:17.0865 4872  [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
07:50:17.0880 4872  FltMgr - ok
07:50:17.0927 4872  [ 5C4CB4086FB83115B153E47ADD961A0C ] FontCache      C:\Windows\system32\FntCache.dll
07:50:17.0958 4872  FontCache - ok
07:50:18.0005 4872  [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
07:50:18.0021 4872  FontCache3.0.0.0 - ok
07:50:18.0036 4872  [ D43703496149971890703B4B1B723EAC ] FsDepends      C:\Windows\system32\drivers\FsDepends.sys
07:50:18.0052 4872  FsDepends - ok
07:50:18.0099 4872  [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
07:50:18.0114 4872  Fs_Rec - ok
07:50:18.0177 4872  [ 1F7B25B858FA27015169FE95E54108ED ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
07:50:18.0192 4872  fvevol - ok
07:50:18.0208 4872  [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx        C:\Windows\system32\DRIVERS\gagp30kx.sys
07:50:18.0208 4872  gagp30kx - ok
07:50:18.0270 4872  [ 14908F4F9005C29DE8F5587E271390EE ] gfibto          C:\Windows\system32\drivers\gfibto.sys
07:50:18.0286 4872  gfibto - ok
07:50:18.0333 4872  [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc          C:\Windows\System32\gpsvc.dll
07:50:18.0364 4872  gpsvc - ok
07:50:18.0426 4872  [ F02A533F517EB38333CB12A9E8963773 ] gupdate        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
07:50:18.0426 4872  gupdate - ok
07:50:18.0442 4872  [ F02A533F517EB38333CB12A9E8963773 ] gupdatem        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
07:50:18.0442 4872  gupdatem - ok
07:50:18.0458 4872  [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
07:50:18.0473 4872  hcw85cir - ok
07:50:18.0520 4872  [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
07:50:18.0536 4872  HdAudAddService - ok
07:50:18.0567 4872  [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus        C:\Windows\system32\drivers\HDAudBus.sys
07:50:18.0582 4872  HDAudBus - ok
07:50:18.0582 4872  [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt        C:\Windows\system32\DRIVERS\HidBatt.sys
07:50:18.0582 4872  HidBatt - ok
07:50:18.0598 4872  [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth          C:\Windows\system32\DRIVERS\hidbth.sys
07:50:18.0598 4872  HidBth - ok
07:50:18.0614 4872  [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr          C:\Windows\system32\DRIVERS\hidir.sys
07:50:18.0614 4872  HidIr - ok
07:50:18.0676 4872  [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv        C:\Windows\system32\hidserv.dll
07:50:18.0707 4872  hidserv - ok
07:50:18.0723 4872  [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
07:50:18.0738 4872  HidUsb - ok
07:50:18.0770 4872  [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc          C:\Windows\system32\kmsvc.dll
07:50:18.0801 4872  hkmsvc - ok
07:50:18.0832 4872  [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll
07:50:18.0863 4872  HomeGroupListener - ok
07:50:18.0894 4872  [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
07:50:18.0910 4872  HomeGroupProvider - ok
07:50:18.0941 4872  [ 502433044773567F6CE942F8E0A621CA ] HPMo4DE3        C:\Windows\system32\DRIVERS\HPMo4DE3.sys
07:50:18.0957 4872  HPMo4DE3 - ok
07:50:18.0988 4872  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
07:50:19.0004 4872  HpSAMD - ok
07:50:19.0050 4872  [ A635DDB3ED98953BB4D42079017B4E30 ] HPub4DE3        C:\Windows\system32\Drivers\HPub4DE3.sys
07:50:19.0050 4872  HPub4DE3 - ok
07:50:19.0144 4872  [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
07:50:19.0175 4872  HTTP - ok
07:50:19.0206 4872  [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
07:50:19.0206 4872  hwpolicy - ok
07:50:19.0238 4872  [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt        C:\Windows\system32\drivers\i8042prt.sys
07:50:19.0238 4872  i8042prt - ok
07:50:19.0269 4872  [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV        C:\Windows\system32\drivers\iaStorV.sys
07:50:19.0284 4872  iaStorV - ok
07:50:19.0316 4872  [ FC47F5CF561BF0FD897EFD1A9604DCCF ] iBtFltCoex      C:\Windows\system32\DRIVERS\iBtFltCoex.sys
07:50:19.0331 4872  iBtFltCoex - ok
07:50:19.0378 4872  [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc          C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
07:50:19.0394 4872  idsvc - ok
07:50:19.0628 4872  [ EFE5A0AF39A8E179624117C521F1E012 ] igfx            C:\Windows\system32\DRIVERS\igdkmd64.sys
07:50:19.0877 4872  igfx - ok
07:50:19.0893 4872  [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp          C:\Windows\system32\DRIVERS\iirsp.sys
07:50:19.0908 4872  iirsp - ok
07:50:19.0955 4872  [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT          C:\Windows\System32\ikeext.dll
07:50:19.0986 4872  IKEEXT - ok
07:50:20.0002 4872  [ F00F20E70C6EC3AA366910083A0518AA ] intelide        C:\Windows\system32\drivers\intelide.sys
07:50:20.0018 4872  intelide - ok
07:50:20.0033 4872  [ ADA036632C664CAA754079041CF1F8C1 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
07:50:20.0049 4872  intelppm - ok
07:50:20.0064 4872  [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum      C:\Windows\system32\ipbusenum.dll
07:50:20.0096 4872  IPBusEnum - ok
07:50:20.0189 4872  [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
07:50:20.0236 4872  IpFilterDriver - ok
07:50:20.0392 4872  [ 08C2957BB30058E663720C5606885653 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
07:50:20.0408 4872  iphlpsvc - ok
07:50:20.0470 4872  [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV        C:\Windows\system32\drivers\IPMIDrv.sys
07:50:20.0470 4872  IPMIDRV - ok
07:50:20.0486 4872  [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT          C:\Windows\system32\drivers\ipnat.sys
07:50:20.0517 4872  IPNAT - ok
07:50:20.0532 4872  [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys
07:50:20.0548 4872  IRENUM - ok
07:50:20.0579 4872  [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
07:50:20.0579 4872  isapnp - ok
07:50:20.0595 4872  [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
07:50:20.0610 4872  iScsiPrt - ok
07:50:20.0626 4872  [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass        C:\Windows\system32\drivers\kbdclass.sys
07:50:20.0642 4872  kbdclass - ok
07:50:20.0642 4872  [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid          C:\Windows\system32\drivers\kbdhid.sys
07:50:20.0657 4872  kbdhid - ok
07:50:20.0673 4872  [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso          C:\Windows\system32\lsass.exe
07:50:20.0688 4872  KeyIso - ok
07:50:20.0860 4872  [ 775C6D5D60146D7DB08A01CB596D7EC6 ] Kodak AiO Network Discovery Service C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe
07:50:20.0876 4872  Kodak AiO Network Discovery Service - ok
07:50:20.0938 4872  [ 17AFF68AB32F8671BC46612D35351099 ] Kodak AiO Status Monitor Service C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe
07:50:20.0954 4872  Kodak AiO Status Monitor Service - ok
07:50:20.0969 4872  [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
07:50:20.0985 4872  KSecDD - ok
07:50:21.0016 4872  [ 7EFB9333E4ECCE6AE4AE9D777D9E553E ] KSecPkg        C:\Windows\system32\Drivers\ksecpkg.sys
07:50:21.0032 4872  KSecPkg - ok
07:50:21.0047 4872  [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk        C:\Windows\system32\drivers\ksthunk.sys
07:50:21.0078 4872  ksthunk - ok
07:50:21.0234 4872  [ 3CA4073A107B42828732088957960643 ] ksupmgr        C:\Windows\SysWOW64\ksupmgr.exe
07:50:21.0266 4872  ksupmgr - ok
07:50:21.0297 4872  [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm          C:\Windows\system32\msdtckrm.dll
07:50:21.0328 4872  KtmRm - ok
07:50:21.0390 4872  [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer    C:\Windows\system32\srvsvc.dll
07:50:21.0422 4872  LanmanServer - ok
07:50:21.0468 4872  [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
07:50:21.0500 4872  LanmanWorkstation - ok
07:50:21.0562 4872  [ 1538831CF8AD2979A04C423779465827 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
07:50:21.0593 4872  lltdio - ok
07:50:21.0609 4872  [ C1185803384AB3FEED115F79F109427F ] lltdsvc        C:\Windows\System32\lltdsvc.dll
07:50:21.0640 4872  lltdsvc - ok
07:50:21.0656 4872  [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts        C:\Windows\System32\lmhsvc.dll
07:50:21.0687 4872  lmhosts - ok
07:50:21.0718 4872  [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC          C:\Windows\system32\DRIVERS\lsi_fc.sys
07:50:21.0734 4872  LSI_FC - ok
07:50:21.0734 4872  [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS        C:\Windows\system32\DRIVERS\lsi_sas.sys
07:50:21.0734 4872  LSI_SAS - ok
07:50:21.0749 4872  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2        C:\Windows\system32\DRIVERS\lsi_sas2.sys
07:50:21.0749 4872  LSI_SAS2 - ok
07:50:21.0749 4872  [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI        C:\Windows\system32\DRIVERS\lsi_scsi.sys
07:50:21.0765 4872  LSI_SCSI - ok
07:50:21.0780 4872  [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv          C:\Windows\system32\drivers\luafv.sys
07:50:21.0812 4872  luafv - ok
07:50:21.0874 4872  [ 92EB844D90615CB266F84C3202B8786E ] MBAMProtector  C:\Windows\system32\drivers\mbam.sys
07:50:21.0890 4872  MBAMProtector - ok
07:50:21.0952 4872  [ 1ACAA67676E9E7BDA5E0C41B6E0DECAF ] MBAMScheduler  C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
07:50:21.0968 4872  MBAMScheduler - ok
07:50:22.0030 4872  [ 916B8954AC3E06DC9E898AFFB41F3FB6 ] MBAMService    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
07:50:22.0046 4872  MBAMService - ok
07:50:22.0092 4872  [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc        C:\Windows\system32\Mcx2Svc.dll
07:50:22.0108 4872  Mcx2Svc - ok
07:50:22.0108 4872  [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas        C:\Windows\system32\DRIVERS\megasas.sys
07:50:22.0124 4872  megasas - ok
07:50:22.0202 4872  [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR          C:\Windows\system32\DRIVERS\MegaSR.sys
07:50:22.0217 4872  MegaSR - ok
07:50:22.0233 4872  [ A6518DCC42F7A6E999BB3BEA8FD87567 ] MEIx64          C:\Windows\system32\DRIVERS\HECIx64.sys
07:50:22.0248 4872  MEIx64 - ok
07:50:22.0264 4872  [ E40E80D0304A73E8D269F7141D77250B ] MMCSS          C:\Windows\system32\mmcss.dll
07:50:22.0295 4872  MMCSS - ok
07:50:22.0295 4872  [ 800BA92F7010378B09F9ED9270F07137 ] Modem          C:\Windows\system32\drivers\modem.sys
07:50:22.0326 4872  Modem - ok
07:50:22.0358 4872  [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor        C:\Windows\system32\DRIVERS\monitor.sys
07:50:22.0358 4872  monitor - ok
07:50:22.0389 4872  [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
07:50:22.0404 4872  mouclass - ok
07:50:22.0420 4872  [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
07:50:22.0436 4872  mouhid - ok
07:50:22.0467 4872  [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
07:50:22.0467 4872  mountmgr - ok
07:50:22.0529 4872  [ 9C3758018DED02F4AE53CCA1C5F084A2 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
07:50:22.0545 4872  MozillaMaintenance - ok
07:50:22.0592 4872  [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio            C:\Windows\system32\drivers\mpio.sys
07:50:22.0592 4872  mpio - ok
07:50:22.0607 4872  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
07:50:22.0638 4872  mpsdrv - ok
07:50:22.0701 4872  [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc          C:\Windows\system32\mpssvc.dll
07:50:22.0748 4872  MpsSvc - ok
07:50:22.0779 4872  [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
07:50:22.0794 4872  MRxDAV - ok
07:50:22.0810 4872  [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
07:50:22.0826 4872  mrxsmb - ok
07:50:22.0841 4872  [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
07:50:22.0857 4872  mrxsmb10 - ok
07:50:22.0872 4872  [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
07:50:22.0888 4872  mrxsmb20 - ok
07:50:22.0919 4872  [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci          C:\Windows\system32\drivers\msahci.sys
07:50:22.0935 4872  msahci - ok
07:50:22.0950 4872  [ DB801A638D011B9633829EB6F663C900 ] msdsm          C:\Windows\system32\drivers\msdsm.sys
07:50:22.0966 4872  msdsm - ok
07:50:22.0997 4872  [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC          C:\Windows\System32\msdtc.exe
07:50:23.0013 4872  MSDTC - ok
07:50:23.0091 4872  [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
07:50:23.0106 4872  Msfs - ok
07:50:23.0138 4872  [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf      C:\Windows\System32\drivers\mshidkmdf.sys
07:50:23.0153 4872  mshidkmdf - ok
07:50:23.0169 4872  [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
07:50:23.0184 4872  msisadrv - ok
07:50:23.0200 4872  [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI        C:\Windows\system32\iscsiexe.dll
07:50:23.0231 4872  MSiSCSI - ok
07:50:23.0231 4872  msiserver - ok
07:50:23.0262 4872  [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV        C:\Windows\system32\drivers\MSKSSRV.sys
07:50:23.0294 4872  MSKSSRV - ok
07:50:23.0325 4872  [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
07:50:23.0356 4872  MSPCLOCK - ok
07:50:23.0387 4872  [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM          C:\Windows\system32\drivers\MSPQM.sys
07:50:23.0418 4872  MSPQM - ok
07:50:23.0481 4872  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC          C:\Windows\system32\drivers\MsRPC.sys
07:50:23.0481 4872  MsRPC - ok
07:50:23.0496 4872  [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys
07:50:23.0512 4872  mssmbios - ok
07:50:23.0512 4872  [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE          C:\Windows\system32\drivers\MSTEE.sys
07:50:23.0543 4872  MSTEE - ok
07:50:23.0543 4872  [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig        C:\Windows\system32\DRIVERS\MTConfig.sys
07:50:23.0559 4872  MTConfig - ok
07:50:23.0574 4872  [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup            C:\Windows\system32\Drivers\mup.sys
07:50:23.0590 4872  Mup - ok
07:50:23.0606 4872  [ 582AC6D9873E31DFA28A4547270862DD ] napagent        C:\Windows\system32\qagentRT.dll
07:50:23.0637 4872  napagent - ok
07:50:23.0699 4872  [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP    C:\Windows\system32\DRIVERS\nwifi.sys
07:50:23.0715 4872  NativeWifiP - ok
07:50:23.0762 4872  [ 760E38053BF56E501D562B70AD796B88 ] NDIS            C:\Windows\system32\drivers\ndis.sys
07:50:23.0793 4872  NDIS - ok
07:50:23.0808 4872  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap        C:\Windows\system32\DRIVERS\ndiscap.sys
07:50:23.0840 4872  NdisCap - ok
07:50:23.0871 4872  [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
07:50:23.0902 4872  NdisTapi - ok
07:50:23.0949 4872  [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio        C:\Windows\system32\DRIVERS\ndisuio.sys
07:50:23.0980 4872  Ndisuio - ok
07:50:24.0011 4872  [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan        C:\Windows\system32\DRIVERS\ndiswan.sys
07:50:24.0042 4872  NdisWan - ok
07:50:24.0074 4872  [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy        C:\Windows\system32\drivers\NDProxy.sys
07:50:24.0105 4872  NDProxy - ok
07:50:24.0120 4872  [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS        C:\Windows\system32\DRIVERS\netbios.sys
07:50:24.0152 4872  NetBIOS - ok
07:50:24.0152 4872  [ 09594D1089C523423B32A4229263F068 ] NetBT          C:\Windows\system32\DRIVERS\netbt.sys
07:50:24.0183 4872  NetBT - ok
07:50:24.0198 4872  [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon        C:\Windows\system32\lsass.exe
07:50:24.0214 4872  Netlogon - ok
07:50:24.0245 4872  [ 847D3AE376C0817161A14A82C8922A9E ] Netman          C:\Windows\System32\netman.dll
07:50:24.0276 4872  Netman - ok
07:50:24.0308 4872  [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm        C:\Windows\System32\netprofm.dll
07:50:24.0339 4872  netprofm - ok
07:50:24.0370 4872  [ 3E5A36127E201DDF663176B66828FAFE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
07:50:24.0370 4872  NetTcpPortSharing - ok
07:50:24.0557 4872  [ 5D262402B0634C998F8CBCEAD7DD8676 ] NETwNs64        C:\Windows\system32\DRIVERS\NETwNs64.sys
07:50:24.0744 4872  NETwNs64 - ok
07:50:24.0760 4872  [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960        C:\Windows\system32\DRIVERS\nfrd960.sys
07:50:24.0776 4872  nfrd960 - ok
07:50:24.0822 4872  [ 8AD77806D336673F270DB31645267293 ] NlaSvc          C:\Windows\System32\nlasvc.dll
07:50:24.0822 4872  NlaSvc - ok
07:50:24.0854 4872  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
07:50:24.0885 4872  Npfs - ok
07:50:24.0900 4872  [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi            C:\Windows\system32\nsisvc.dll
07:50:24.0932 4872  nsi - ok
07:50:24.0932 4872  [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
07:50:24.0978 4872  nsiproxy - ok
07:50:25.0025 4872  [ E453ACF4E7D44E5530B5D5F2B9CA8563 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
07:50:25.0072 4872  Ntfs - ok
07:50:25.0088 4872  [ 9899284589F75FA8724FF3D16AED75C1 ] Null            C:\Windows\system32\drivers\Null.sys
07:50:25.0119 4872  Null - ok
07:50:25.0150 4872  [ 0EBC9D13CD96C15B1B18D8678A609E4B ] nusb3hub        C:\Windows\system32\DRIVERS\nusb3hub.sys
07:50:25.0166 4872  nusb3hub - ok
07:50:25.0197 4872  [ 7BDEC000D56D485021D9C1E63C2F81CA ] nusb3xhc        C:\Windows\system32\DRIVERS\nusb3xhc.sys
07:50:25.0212 4872  nusb3xhc - ok
07:50:25.0244 4872  [ 65E6BB06A644533118BE007E9601B2C2 ] nvkflt          C:\Windows\system32\DRIVERS\nvkflt.sys
07:50:25.0259 4872  nvkflt - ok
07:50:25.0680 4872  [ 5104BAC2DA2A5BDD86AC6B0708B00F06 ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys
07:50:26.0008 4872  nvlddmkm - ok
07:50:26.0039 4872  [ 918841B2454F4F2BD94479692079490B ] nvpciflt        C:\Windows\system32\DRIVERS\nvpciflt.sys
07:50:26.0039 4872  nvpciflt - ok
07:50:26.0055 4872  [ 0A92CB65770442ED0DC44834632F66AD ] nvraid          C:\Windows\system32\drivers\nvraid.sys
07:50:26.0070 4872  nvraid - ok
07:50:26.0102 4872  [ DAB0E87525C10052BF65F06152F37E4A ] nvstor          C:\Windows\system32\drivers\nvstor.sys
07:50:26.0117 4872  nvstor - ok
07:50:26.0180 4872  [ DDFAFCE89A5C93D04712B86F94E9FCBA ] nvsvc          C:\Windows\system32\nvvsvc.exe
07:50:26.0211 4872  nvsvc - ok
07:50:26.0273 4872  [ 84E035225474E48CD3A6A3CE52332095 ] nvUpdatusService C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
07:50:26.0304 4872  nvUpdatusService - ok
07:50:26.0320 4872  [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
07:50:26.0336 4872  nv_agp - ok
07:50:26.0367 4872  [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
07:50:26.0367 4872  ohci1394 - ok
07:50:26.0398 4872  [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
07:50:26.0429 4872  p2pimsvc - ok
07:50:26.0445 4872  [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc          C:\Windows\system32\p2psvc.dll
07:50:26.0460 4872  p2psvc - ok
07:50:26.0492 4872  [ 0086431C29C35BE1DBC43F52CC273887 ] Parport        C:\Windows\system32\DRIVERS\parport.sys
07:50:26.0492 4872  Parport - ok
07:50:26.0523 4872  [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr        C:\Windows\system32\drivers\partmgr.sys
07:50:26.0538 4872  partmgr - ok
07:50:26.0538 4872  [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc          C:\Windows\System32\pcasvc.dll
07:50:26.0554 4872  PcaSvc - ok
07:50:26.0570 4872  [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci            C:\Windows\system32\drivers\pci.sys
07:50:26.0585 4872  pci - ok
07:50:26.0601 4872  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide          C:\Windows\system32\drivers\pciide.sys
07:50:26.0616 4872  pciide - ok
07:50:26.0632 4872  [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys
07:50:26.0632 4872  pcmcia - ok
07:50:26.0648 4872  [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw            C:\Windows\system32\drivers\pcw.sys
07:50:26.0663 4872  pcw - ok
07:50:26.0694 4872  [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
07:50:26.0741 4872  PEAUTH - ok
07:50:26.0772 4872  [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost        C:\Windows\SysWow64\perfhost.exe
07:50:26.0788 4872  PerfHost - ok
07:50:26.0850 4872  [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla            C:\Windows\system32\pla.dll
07:50:26.0913 4872  pla - ok
07:50:26.0960 4872  [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
07:50:26.0975 4872  PlugPlay - ok
07:50:26.0991 4872  [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg    C:\Windows\system32\pnrpauto.dll
07:50:26.0991 4872  PNRPAutoReg - ok
07:50:27.0006 4872  [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc        C:\Windows\system32\pnrpsvc.dll
07:50:27.0022 4872  PNRPsvc - ok
07:50:27.0053 4872  [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent    C:\Windows\System32\ipsecsvc.dll
07:50:27.0100 4872  PolicyAgent - ok
07:50:27.0116 4872  [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power          C:\Windows\system32\umpo.dll
07:50:27.0147 4872  Power - ok
07:50:27.0194 4872  [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
07:50:27.0209 4872  PptpMiniport - ok
07:50:27.0240 4872  [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor      C:\Windows\system32\DRIVERS\processr.sys
07:50:27.0256 4872  Processor - ok
07:50:27.0287 4872  [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc        C:\Windows\system32\profsvc.dll
07:50:27.0318 4872  ProfSvc - ok
07:50:27.0318 4872  [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe
07:50:27.0334 4872  ProtectedStorage - ok
07:50:27.0381 4872  [ 0557CF5A2556BD58E26384169D72438D ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
07:50:27.0412 4872  Psched - ok
07:50:27.0490 4872  [ FB46E9A827A8799EBD7BFA9128C91F37 ] PSI            C:\Windows\system32\DRIVERS\psi_mf.sys
07:50:27.0490 4872  PSI - ok
07:50:27.0521 4872  [ 0928BD20273625622722FE1DE5BBDE57 ] qicflt          C:\Windows\system32\DRIVERS\qicflt.sys
07:50:27.0521 4872  qicflt - ok
07:50:27.0568 4872  [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300          C:\Windows\system32\DRIVERS\ql2300.sys
07:50:27.0630 4872  ql2300 - ok
07:50:27.0630 4872  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx          C:\Windows\system32\DRIVERS\ql40xx.sys
07:50:27.0646 4872  ql40xx - ok
07:50:27.0662 4872  [ 906191634E99AEA92C4816150BDA3732 ] QWAVE          C:\Windows\system32\qwave.dll
07:50:27.0677 4872  QWAVE - ok
07:50:27.0677 4872  [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
07:50:27.0693 4872  QWAVEdrv - ok
07:50:27.0896 4872  [ 138F7963118EC710C348819C08F72230 ] Radio.fx        D:\Tobit Radio.fx\Server\rfx-server.exe
07:50:27.0942 4872  Radio.fx - ok
07:50:27.0942 4872  [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
07:50:27.0974 4872  RasAcd - ok
07:50:28.0020 4872  [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn    C:\Windows\system32\DRIVERS\AgileVpn.sys
07:50:28.0052 4872  RasAgileVpn - ok
07:50:28.0067 4872  [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto        C:\Windows\System32\rasauto.dll
07:50:28.0098 4872  RasAuto - ok
07:50:28.0145 4872  [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp        C:\Windows\system32\DRIVERS\rasl2tp.sys
07:50:28.0176 4872  Rasl2tp - ok
07:50:28.0223 4872  [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan          C:\Windows\System32\rasmans.dll
07:50:28.0270 4872  RasMan - ok
07:50:28.0301 4872  [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
07:50:28.0332 4872  RasPppoe - ok
07:50:28.0332 4872  [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp        C:\Windows\system32\DRIVERS\rassstp.sys
07:50:28.0364 4872  RasSstp - ok
07:50:28.0379 4872  [ 77F665941019A1594D887A74F301FA2F ] rdbss          C:\Windows\system32\DRIVERS\rdbss.sys
07:50:28.0410 4872  rdbss - ok
07:50:28.0426 4872  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
07:50:28.0426 4872  rdpbus - ok
07:50:28.0442 4872  [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
07:50:28.0473 4872  RDPCDD - ok
07:50:28.0488 4872  [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
07:50:28.0520 4872  RDPENCDD - ok
07:50:28.0535 4872  [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
07:50:28.0566 4872  RDPREFMP - ok
07:50:28.0629 4872  [ 313F68E1A3E6345A4F47A36B07062F34 ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
07:50:28.0644 4872  RdpVideoMiniport - ok
07:50:28.0691 4872  [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD          C:\Windows\system32\drivers\RDPWD.sys
07:50:28.0707 4872  RDPWD - ok
07:50:28.0754 4872  [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
07:50:28.0769 4872  rdyboost - ok
07:50:28.0878 4872  [ A0FF419B61AE47E26ADF3BB15DB4F2FE ] RealNetworks Downloader Resolver Service C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
07:50:28.0894 4872  RealNetworks Downloader Resolver Service - ok
07:50:28.0941 4872  [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess    C:\Windows\System32\mprdim.dll
07:50:28.0956 4872  RemoteAccess - ok
07:50:29.0003 4872  [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
07:50:29.0034 4872  RemoteRegistry - ok
07:50:29.0081 4872  [ 3DD798846E2C28102B922C56E71B7932 ] RFCOMM          C:\Windows\system32\DRIVERS\rfcomm.sys
07:50:29.0097 4872  RFCOMM - ok
07:50:29.0097 4872  [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
07:50:29.0128 4872  RpcEptMapper - ok
07:50:29.0159 4872  [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator      C:\Windows\system32\locator.exe
07:50:29.0175 4872  RpcLocator - ok
07:50:29.0222 4872  [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs          C:\Windows\system32\rpcss.dll
07:50:29.0253 4872  RpcSs - ok
07:50:29.0268 4872  [ DDC86E4F8E7456261E637E3552E804FF ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
07:50:29.0300 4872  rspndr - ok
07:50:29.0378 4872  [ EE082E06A82FF630351D1E0EBBD3D8D0 ] RTL8167        C:\Windows\system32\DRIVERS\Rt64win7.sys
07:50:29.0393 4872  RTL8167 - ok
07:50:29.0424 4872  [ C118A82CD78818C29AB228366EBF81C3 ] SamSs          C:\Windows\system32\lsass.exe
07:50:29.0440 4872  SamSs - ok
07:50:29.0471 4872  [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
07:50:29.0487 4872  sbp2port - ok
07:50:29.0502 4872  SBRE - ok
07:50:29.0518 4872  [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr        C:\Windows\System32\SCardSvr.dll
07:50:29.0549 4872  SCardSvr - ok
07:50:29.0580 4872  [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
07:50:29.0612 4872  scfilter - ok
07:50:29.0658 4872  [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule        C:\Windows\system32\schedsvc.dll
07:50:29.0721 4872  Schedule - ok
07:50:29.0768 4872  [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc    C:\Windows\System32\certprop.dll
07:50:29.0799 4872  SCPolicySvc - ok
07:50:29.0846 4872  [ 111E0EBC0AD79CB0FA014B907B231CF0 ] sdbus          C:\Windows\system32\drivers\sdbus.sys
07:50:29.0861 4872  sdbus - ok
07:50:29.0908 4872  [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
07:50:29.0908 4872  SDRSVC - ok
07:50:29.0939 4872  [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
07:50:29.0970 4872  secdrv - ok
07:50:30.0033 4872  [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon        C:\Windows\system32\seclogon.dll
07:50:30.0064 4872  seclogon - ok
07:50:30.0204 4872  [ 306F9390976E41063D21AB9AB6D48122 ] Secunia PSI Agent C:\Program Files (x86)\Secunia\PSI\PSIA.exe
07:50:30.0220 4872  Secunia PSI Agent - ok
07:50:30.0314 4872  [ 29C852880E9634F8C6BD77A4E68B5B34 ] Secunia Update Agent C:\Program Files (x86)\Secunia\PSI\sua.exe
07:50:30.0329 4872  Secunia Update Agent - ok
07:50:30.0360 4872  [ C32AB8FA018EF34C0F113BD501436D21 ] SENS            C:\Windows\System32\sens.dll
07:50:30.0392 4872  SENS - ok
07:50:30.0423 4872  [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc        C:\Windows\system32\sensrsvc.dll
07:50:30.0423 4872  SensrSvc - ok
07:50:30.0438 4872  [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum        C:\Windows\system32\DRIVERS\serenum.sys
07:50:30.0454 4872  Serenum - ok
07:50:30.0454 4872  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial          C:\Windows\system32\DRIVERS\serial.sys
07:50:30.0470 4872  Serial - ok
07:50:30.0485 4872  [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse        C:\Windows\system32\DRIVERS\sermouse.sys
07:50:30.0501 4872  sermouse - ok
07:50:30.0563 4872  [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv      C:\Windows\system32\sessenv.dll
07:50:30.0579 4872  SessionEnv - ok
07:50:30.0626 4872  [ A554811BCD09279536440C964AE35BBF ] sffdisk        C:\Windows\system32\drivers\sffdisk.sys
07:50:30.0641 4872  sffdisk - ok
07:50:30.0657 4872  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
07:50:30.0657 4872  sffp_mmc - ok
07:50:30.0672 4872  [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd        C:\Windows\system32\drivers\sffp_sd.sys
07:50:30.0672 4872  sffp_sd - ok
07:50:30.0688 4872  [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy        C:\Windows\system32\DRIVERS\sfloppy.sys
07:50:30.0704 4872  sfloppy - ok
07:50:30.0735 4872  [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess    C:\Windows\System32\ipnathlp.dll
07:50:30.0766 4872  SharedAccess - ok
07:50:30.0828 4872  [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll
07:50:30.0875 4872  ShellHWDetection - ok
07:50:30.0953 4872  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2        C:\Windows\system32\DRIVERS\SiSRaid2.sys
07:50:30.0953 4872  SiSRaid2 - ok
07:50:30.0969 4872  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4        C:\Windows\system32\DRIVERS\sisraid4.sys
07:50:30.0969 4872  SiSRaid4 - ok
07:50:30.0984 4872  [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb            C:\Windows\system32\DRIVERS\smb.sys
07:50:31.0016 4872  Smb - ok
07:50:31.0078 4872  [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
07:50:31.0078 4872  SNMPTRAP - ok
07:50:31.0094 4872  [ B9E31E5CACDFE584F34F730A677803F9 ] spldr          C:\Windows\system32\drivers\spldr.sys
07:50:31.0094 4872  spldr - ok
07:50:31.0156 4872  [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler        C:\Windows\System32\spoolsv.exe
07:50:31.0172 4872  Spooler - ok
07:50:31.0281 4872  [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc          C:\Windows\system32\sppsvc.exe
07:50:31.0406 4872  sppsvc - ok
07:50:31.0437 4872  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify    C:\Windows\system32\sppuinotify.dll
07:50:31.0484 4872  sppuinotify - ok
07:50:31.0530 4872  [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv            C:\Windows\system32\DRIVERS\srv.sys
07:50:31.0546 4872  srv - ok
07:50:31.0562 4872  [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
07:50:31.0577 4872  srv2 - ok
07:50:31.0608 4872  [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
07:50:31.0624 4872  srvnet - ok
07:50:31.0640 4872  [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV        C:\Windows\System32\ssdpsrv.dll
07:50:31.0671 4872  SSDPSRV - ok
07:50:31.0718 4872  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc        C:\Windows\system32\sstpsvc.dll
07:50:31.0749 4872  SstpSvc - ok
07:50:31.0780 4872  [ 92E7F6666633D2DD91D527503DAA7BE0 ] stdcfltn        C:\Windows\system32\DRIVERS\stdcfltn.sys
07:50:31.0796 4872  stdcfltn - ok
07:50:31.0889 4872  [ F0359F7CE712D69ACEF0886BDB4792ED ] Stereo Service  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
07:50:31.0889 4872  Stereo Service - ok
07:50:31.0905 4872  [ F3817967ED533D08327DC73BC4D5542A ] stexstor        C:\Windows\system32\DRIVERS\stexstor.sys
07:50:31.0920 4872  stexstor - ok
07:50:31.0952 4872  [ DECACB6921DED1A38642642685D77DAC ] StillCam        C:\Windows\system32\DRIVERS\serscan.sys
07:50:31.0967 4872  StillCam - ok
07:50:32.0014 4872  [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc          C:\Windows\System32\wiaservc.dll
07:50:32.0045 4872  stisvc - ok
07:50:32.0123 4872  [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum          C:\Windows\system32\drivers\swenum.sys
07:50:32.0123 4872  swenum - ok
07:50:32.0139 4872  [ E08E46FDD841B7184194011CA1955A0B ] swprv          C:\Windows\System32\swprv.dll
07:50:32.0186 4872  swprv - ok
07:50:32.0248 4872  [ B0C7D4DCF4800DF2F2145B500D0161E8 ] SynTP          C:\Windows\system32\DRIVERS\SynTP.sys
07:50:32.0295 4872  SynTP - ok
07:50:32.0357 4872  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain        C:\Windows\system32\sysmain.dll
07:50:32.0420 4872  SysMain - ok
07:50:32.0451 4872  [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll
07:50:32.0466 4872  TabletInputService - ok
07:50:32.0529 4872  [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv        C:\Windows\System32\tapisrv.dll
07:50:32.0560 4872  TapiSrv - ok
07:50:32.0591 4872  [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS            C:\Windows\System32\tbssvc.dll
07:50:32.0622 4872  TBS - ok
07:50:32.0669 4872  [ 37608401DFDB388CAF66917F6B2D6FB0 ] Tcpip          C:\Windows\system32\drivers\tcpip.sys
07:50:32.0732 4872  Tcpip - ok
07:50:32.0763 4872  [ 37608401DFDB388CAF66917F6B2D6FB0 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
07:50:32.0794 4872  TCPIP6 - ok
07:50:32.0825 4872  [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
07:50:32.0841 4872  tcpipreg - ok
07:50:32.0856 4872  [ 3371D21011695B16333A3934340C4E7C ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
07:50:32.0872 4872  TDPIPE - ok
07:50:32.0903 4872  [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP          C:\Windows\system32\drivers\tdtcp.sys
07:50:32.0903 4872  TDTCP - ok
07:50:32.0950 4872  [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx            C:\Windows\system32\DRIVERS\tdx.sys
07:50:32.0981 4872  tdx - ok
07:50:33.0044 4872  [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD          C:\Windows\system32\drivers\termdd.sys
07:50:33.0059 4872  TermDD - ok
07:50:33.0075 4872  [ 2E648163254233755035B46DD7B89123 ] TermService    C:\Windows\System32\termsrv.dll
07:50:33.0122 4872  TermService - ok
07:50:33.0137 4872  [ F0344071948D1A1FA732231785A0664C ] Themes          C:\Windows\system32\themeservice.dll
07:50:33.0153 4872  Themes - ok
07:50:33.0168 4872  [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER    C:\Windows\system32\mmcss.dll
07:50:33.0200 4872  THREADORDER - ok
07:50:33.0215 4872  [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks          C:\Windows\System32\trkwks.dll
07:50:33.0246 4872  TrkWks - ok
07:50:33.0324 4872  [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
07:50:33.0340 4872  TrustedInstaller - ok
07:50:33.0387 4872  [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
07:50:33.0418 4872  tssecsrv - ok
07:50:33.0465 4872  [ 17C6B51CBCCDED95B3CC14E22791F85E ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
07:50:33.0465 4872  TsUsbFlt - ok
07:50:33.0512 4872  [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
07:50:33.0543 4872  tunnel - ok
07:50:33.0558 4872  [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys
07:50:33.0574 4872  uagp35 - ok
07:50:33.0590 4872  [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
07:50:33.0621 4872  udfs - ok
07:50:33.0636 4872  [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect      C:\Windows\system32\UI0Detect.exe
07:50:33.0652 4872  UI0Detect - ok
07:50:33.0668 4872  [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
07:50:33.0683 4872  uliagpkx - ok
07:50:33.0714 4872  [ DC54A574663A895C8763AF0FA1FF7561 ] umbus          C:\Windows\system32\drivers\umbus.sys
07:50:33.0714 4872  umbus - ok
07:50:33.0730 4872  [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys
07:50:33.0746 4872  UmPass - ok
07:50:33.0761 4872  [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost        C:\Windows\System32\upnphost.dll
07:50:33.0792 4872  upnphost - ok
07:50:33.0792 4872  [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp        C:\Windows\system32\DRIVERS\usbccgp.sys
07:50:33.0824 4872  usbccgp - ok
07:50:33.0839 4872  [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir          C:\Windows\system32\drivers\usbcir.sys
07:50:33.0855 4872  usbcir - ok
07:50:33.0870 4872  [ C025055FE7B87701EB042095DF1A2D7B ] usbehci        C:\Windows\system32\DRIVERS\usbehci.sys
07:50:33.0870 4872  usbehci - ok
07:50:33.0886 4872  [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
07:50:33.0902 4872  usbhub - ok
07:50:33.0917 4872  [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci        C:\Windows\system32\drivers\usbohci.sys
07:50:33.0933 4872  usbohci - ok
07:50:33.0948 4872  [ 73188F58FB384E75C4063D29413CEE3D ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
07:50:33.0964 4872  usbprint - ok
07:50:33.0995 4872  [ AAA2513C8AED8B54B189FD0C6B1634C0 ] usbscan        C:\Windows\system32\DRIVERS\usbscan.sys
07:50:34.0011 4872  usbscan - ok
07:50:34.0026 4872  [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR        C:\Windows\system32\DRIVERS\USBSTOR.SYS
07:50:34.0026 4872  USBSTOR - ok
07:50:34.0058 4872  [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci        C:\Windows\system32\drivers\usbuhci.sys
07:50:34.0073 4872  usbuhci - ok
07:50:34.0089 4872  [ 454800C2BC7F3927CE030141EE4F4C50 ] usbvideo        C:\Windows\System32\Drivers\usbvideo.sys
07:50:34.0104 4872  usbvideo - ok
07:50:34.0120 4872  [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms          C:\Windows\System32\uxsms.dll
07:50:34.0151 4872  UxSms - ok
07:50:34.0167 4872  [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc        C:\Windows\system32\lsass.exe
07:50:34.0167 4872  VaultSvc - ok
07:50:34.0182 4872  [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
07:50:34.0198 4872  vdrvroot - ok
07:50:34.0245 4872  [ 8D6B481601D01A456E75C3210F1830BE ] vds            C:\Windows\System32\vds.exe
07:50:34.0292 4872  vds - ok
07:50:34.0323 4872  [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga            C:\Windows\system32\DRIVERS\vgapnp.sys
07:50:34.0338 4872  vga - ok
07:50:34.0354 4872  [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave        C:\Windows\System32\drivers\vga.sys
07:50:34.0370 4872  VgaSave - ok
07:50:34.0401 4872  [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp          C:\Windows\system32\drivers\vhdmp.sys
07:50:34.0416 4872  vhdmp - ok
07:50:34.0448 4872  [ E5689D93FFE4E5D66C0178761240DD54 ] viaide          C:\Windows\system32\drivers\viaide.sys
07:50:34.0463 4872  viaide - ok
07:50:34.0494 4872  [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
07:50:34.0494 4872  volmgr - ok
07:50:34.0541 4872  [ A255814907C89BE58B79EF2F189B843B ] volmgrx        C:\Windows\system32\drivers\volmgrx.sys
07:50:34.0557 4872  volmgrx - ok
07:50:34.0572 4872  [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap        C:\Windows\system32\drivers\volsnap.sys
07:50:34.0588 4872  volsnap - ok
07:50:34.0619 4872  [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid        C:\Windows\system32\DRIVERS\vsmraid.sys
07:50:34.0619 4872  vsmraid - ok
07:50:34.0682 4872  [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS            C:\Windows\system32\vssvc.exe
07:50:34.0744 4872  VSS - ok
07:50:34.0760 4872  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus        C:\Windows\system32\DRIVERS\vwifibus.sys
07:50:34.0775 4872  vwifibus - ok
07:50:34.0791 4872  [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt        C:\Windows\system32\DRIVERS\vwififlt.sys
07:50:34.0791 4872  vwififlt - ok
07:50:34.0822 4872  [ 6A638FC4BFDDC4D9B186C28C91BD1A01 ] vwifimp        C:\Windows\system32\DRIVERS\vwifimp.sys
07:50:34.0822 4872  vwifimp - ok
07:50:34.0853 4872  [ 1C9D80CC3849B3788048078C26486E1A ] W32Time        C:\Windows\system32\w32time.dll
07:50:34.0884 4872  W32Time - ok
07:50:34.0900 4872  [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen        C:\Windows\system32\DRIVERS\wacompen.sys
07:50:34.0900 4872  WacomPen - ok
07:50:34.0931 4872  [ 356AFD78A6ED4457169241AC3965230C ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
07:50:34.0947 4872  WANARP - ok
07:50:34.0947 4872  [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
07:50:34.0978 4872  Wanarpv6 - ok
07:50:35.0025 4872  [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine        C:\Windows\system32\wbengine.exe
07:50:35.0072 4872  wbengine - ok
07:50:35.0087 4872  [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
07:50:35.0103 4872  WbioSrvc - ok
07:50:35.0150 4872  [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc        C:\Windows\System32\wcncsvc.dll
07:50:35.0165 4872  wcncsvc - ok
07:50:35.0212 4872  [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
07:50:35.0228 4872  WcsPlugInService - ok
07:50:35.0259 4872  [ 72889E16FF12BA0F235467D6091B17DC ] Wd              C:\Windows\system32\DRIVERS\wd.sys
07:50:35.0259 4872  Wd - ok
07:50:35.0321 4872  [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
07:50:35.0352 4872  Wdf01000 - ok
07:50:35.0368 4872  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost  C:\Windows\system32\wdi.dll
07:50:35.0384 4872  WdiServiceHost - ok
07:50:35.0384 4872  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost  C:\Windows\system32\wdi.dll
07:50:35.0399 4872  WdiSystemHost - ok
07:50:35.0430 4872  [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient      C:\Windows\System32\webclnt.dll
07:50:35.0446 4872  WebClient - ok
07:50:35.0462 4872  [ C749025A679C5103E575E3B48E092C43 ] Wecsvc          C:\Windows\system32\wecsvc.dll
07:50:35.0493 4872  Wecsvc - ok
07:50:35.0508 4872  [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport  C:\Windows\System32\wercplsupport.dll
07:50:35.0540 4872  wercplsupport - ok
07:50:35.0586 4872  [ 6D137963730144698CBD10F202E9F251 ] WerSvc          C:\Windows\System32\WerSvc.dll
07:50:35.0602 4872  WerSvc - ok
07:50:35.0649 4872  [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
07:50:35.0664 4872  WfpLwf - ok
07:50:35.0696 4872  [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
07:50:35.0696 4872  WIMMount - ok
07:50:35.0711 4872  WinDefend - ok
07:50:35.0711 4872  WinHttpAutoProxySvc - ok
07:50:35.0758 4872  [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt        C:\Windows\system32\wbem\WMIsvc.dll
07:50:35.0789 4872  Winmgmt - ok
07:50:35.0852 4872  [ BCB1310604AA415C4508708975B3931E ] WinRM          C:\Windows\system32\WsmSvc.dll
07:50:35.0930 4872  WinRM - ok
07:50:35.0976 4872  [ FE88B288356E7B47B74B13372ADD906D ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys
07:50:35.0992 4872  WinUsb - ok
07:50:36.0023 4872  [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc        C:\Windows\System32\wlansvc.dll
07:50:36.0054 4872  Wlansvc - ok
07:50:36.0164 4872  [ 2BACD71123F42CEA603F4E205E1AE337 ] wlidsvc        C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
07:50:36.0210 4872  wlidsvc - ok
07:50:36.0242 4872  [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi        C:\Windows\system32\drivers\wmiacpi.sys
07:50:36.0257 4872  WmiAcpi - ok
07:50:36.0273 4872  [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
07:50:36.0288 4872  wmiApSrv - ok
07:50:36.0335 4872  WMPNetworkSvc - ok
07:50:36.0351 4872  [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc          C:\Windows\System32\wpcsvc.dll
07:50:36.0351 4872  WPCSvc - ok
07:50:36.0398 4872  [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
07:50:36.0398 4872  WPDBusEnum - ok
07:50:36.0413 4872  [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl        C:\Windows\system32\drivers\ws2ifsl.sys
07:50:36.0444 4872  ws2ifsl - ok
07:50:36.0476 4872  [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc          C:\Windows\System32\wscsvc.dll
07:50:36.0476 4872  wscsvc - ok
07:50:36.0491 4872  WSearch - ok
07:50:36.0554 4872  [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv        C:\Windows\system32\wuaueng.dll
07:50:36.0616 4872  wuauserv - ok
07:50:36.0647 4872  [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
07:50:36.0678 4872  WudfPf - ok
07:50:36.0710 4872  [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
07:50:36.0710 4872  WUDFRd - ok
07:50:36.0741 4872  [ B20F051B03A966392364C83F009F7D17 ] wudfsvc        C:\Windows\System32\WUDFSvc.dll
07:50:36.0756 4872  wudfsvc - ok
07:50:36.0772 4872  [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc        C:\Windows\System32\wwansvc.dll
07:50:36.0788 4872  WwanSvc - ok
07:50:36.0834 4872  [ 2EE48CFCE7CA8E0DB4C44C7476C0943B ] xusb21          C:\Windows\system32\DRIVERS\xusb21.sys
07:50:36.0850 4872  xusb21 - ok
07:50:36.0866 4872  ================ Scan global ===============================
07:50:36.0897 4872  [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll
07:50:36.0928 4872  [ 9E479C2B605C25DA4971ABA36250FAEF ] C:\Windows\system32\winsrv.dll
07:50:36.0944 4872  [ 9E479C2B605C25DA4971ABA36250FAEF ] C:\Windows\system32\winsrv.dll
07:50:36.0975 4872  [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll
07:50:36.0990 4872  [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe
07:50:37.0006 4872  [Global] - ok
07:50:37.0006 4872  ================ Scan MBR ==================================
07:50:37.0006 4872  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
07:50:37.0380 4872  \Device\Harddisk0\DR0 - ok
07:50:37.0396 4872  ================ Scan VBR ==================================
07:50:37.0396 4872  [ BFAFC4D88AD23596A4FD81FFE8C83D3B ] \Device\Harddisk0\DR0\Partition1
07:50:37.0396 4872  \Device\Harddisk0\DR0\Partition1 - ok
07:50:37.0427 4872  [ ED6DE001831F836B7AB10CC4DD634146 ] \Device\Harddisk0\DR0\Partition2
07:50:37.0427 4872  \Device\Harddisk0\DR0\Partition2 - ok
07:50:37.0458 4872  [ 1615A093366FC82A8EFADBD48E23F6EF ] \Device\Harddisk0\DR0\Partition3
07:50:37.0458 4872  \Device\Harddisk0\DR0\Partition3 - ok
07:50:37.0458 4872  ============================================================
07:50:37.0458 4872  Scan finished
07:50:37.0458 4872  ============================================================
07:50:37.0458 4784  Detected object count: 0
07:50:37.0458 4784  Actual detected object count: 0
07:51:00.0396 3740  Deinitialize success
:dankeschoen:

cosinus 24.01.2013 10:34
Ist unauffällig :kaffee:

adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Falls der adwCleaner schon mal in der runtergeladen wurde, bitte die alte adwcleaner.exe löschen und neu runterladen!!
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Suche.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[Rx].txt. (x=fortlaufende Nummer)

Rheingold 24.01.2013 11:55
Gut! Hier dann der adwcleaner logfile.

Code:
# AdwCleaner v2.107 - Datei am 24/01/2013 um 11:51:57 erstellt
# Aktualisiert am 21/01/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : Jasmina - NICOJAS-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Jasmina.NICOJAS-PC\Desktop\adwcleaner.exe
# Option [Suche]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gefunden : C:\Program Files (x86)\Mozilla FireFox\searchplugins\Search_Results.xml
Ordner Gefunden : C:\Program Files (x86)\Conduit
Ordner Gefunden : C:\ProgramData\blekko toolbars
Ordner Gefunden : C:\ProgramData\boost_interprocess

***** [Registrierungsdatenbank] *****

Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gefunden : HKCU\Software\Ask.com.tmp
Schlüssel Gefunden : HKCU\Software\Conduit
Schlüssel Gefunden : HKCU\Software\DataMngr
Schlüssel Gefunden : HKCU\Software\InstallCore
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35B-6118-11DC-9C72-001320C79847}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35C-6118-11DC-9C72-001320C79847}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
Schlüssel Gefunden : HKLM\Software\Classes\Installer\Features\9EE58E3C298524145B73CBBED3CAC4D3
Schlüssel Gefunden : HKLM\Software\Classes\Installer\Products\9EE58E3C298524145B73CBBED3CAC4D3
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}
Schlüssel Gefunden : HKLM\Software\Conduit
Schlüssel Gefunden : HKLM\Software\Freeze.com
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SweetIM_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SweetIM_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
Schlüssel Gefunden : HKLM\SOFTWARE\DataMngr
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
Schlüssel Gefunden : HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
Wert Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [10]
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [10]

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16457

[HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.conduit.com?SearchSource=10&ctid=CT2481020&SSPV=IEOB12

-\\ Mozilla Firefox v18.0.1 (de)

-\\ Google Chrome v [Version kann nicht ermittelt werden]

*************************

AdwCleaner[R2].txt - [4345 octets] - [24/01/2013 11:51:57]

########## EOF - C:\AdwCleaner[R2].txt - [4405 octets] ##########

cosinus 24.01.2013 12:11
adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen
  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Löschen.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[Sx].txt. (x=fortlaufende Nummer)

Danach eine Kontrolle mit OTL bitte:
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Setze oben mittig den Haken bei Scanne alle Benutzer
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles in CODE-Tags hier in den Thread.

Rheingold 24.01.2013 16:32
ok. hier adwcleaner logfile:

Code:
# AdwCleaner v2.107 - Datei am 24/01/2013 um 16:26:38 erstellt
# Aktualisiert am 21/01/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : Jasmina - NICOJAS-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Jasmina.NICOJAS-PC\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gelöscht : C:\Program Files (x86)\Mozilla FireFox\searchplugins\Search_Results.xml
Ordner Gelöscht : C:\Program Files (x86)\Conduit
Ordner Gelöscht : C:\ProgramData\blekko toolbars
Ordner Gelöscht : C:\ProgramData\boost_interprocess

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\DataMngr
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Features\9EE58E3C298524145B73CBBED3CAC4D3
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Products\9EE58E3C298524145B73CBBED3CAC4D3
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\Freeze.com
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetIM_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetIM_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\DataMngr
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [10]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [10]

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16457

Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.conduit.com?SearchSource=10&ctid=CT2481020&SSPV=IEOB12 --> hxxp://www.google.com

-\\ Mozilla Firefox v18.0.1 (de)

-\\ Google Chrome v [Version kann nicht ermittelt werden]

*************************

AdwCleaner[S2].txt - [3695 octets] - [24/01/2013 16:26:38]

########## EOF - C:\AdwCleaner[S2].txt - [3755 octets] ##########

Rheingold 24.01.2013 16:48
die otl logs:

Code:
OTL logfile created on: 24.01.2013 16:36:14 - Run 3
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Jasmina.NICOJAS-PC\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,90 Gb Total Physical Memory | 1,85 Gb Available Physical Memory | 47,49% Memory free
7,79 Gb Paging File | 5,51 Gb Available in Paging File | 70,76% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 265,66 Gb Total Space | 80,18 Gb Free Space | 30,18% Space Free | Partition Type: NTFS
Drive D: | 200,00 Gb Total Space | 199,73 Gb Free Space | 99,87% Space Free | Partition Type: NTFS
 
Computer Name: NICOJAS-PC | User Name: Jasmina | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Jasmina.NICOJAS-PC\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe (RealNetworks, Inc.)
PRC - C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe ()
PRC - C:\Program Files (x86)\Secunia\PSI\psia.exe (Secunia)
PRC - C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
PRC - C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe (Eastman Kodak Company)
PRC - C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe (Eastman Kodak Company)
PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files (x86)\Dell Stage\Dell Stage\stage_secondary.exe ()
PRC - C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe ()
PRC - D:\Tobit Radio.fx\Server\rfx-server.exe ()
PRC - C:\Windows\tray\wintmr.exe (Salfeld Computer)
PRC - C:\Windows\SysWOW64\cc32\webtmr.exe (Salfeld Computer)
PRC - C:\Windows\SysWOW64\ccsync.exe (Salfeld Computer)
PRC - C:\Windows\SysWOW64\cchservice.exe (Salfeld Computer)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll ()
MOD - C:\Program Files (x86)\Dell Stage\Dell Stage\stage_secondary.exe ()
MOD - C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe ()
MOD - C:\Program Files (x86)\Dell Stage\Dell Stage\QtGui4.dll ()
MOD - C:\Program Files (x86)\Dell Stage\Dell Stage\QtCore4.dll ()
 
 
========== Services (SafeList) ==========
 
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (RealNetworks Downloader Resolver Service) -- C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe ()
SRV - (Secunia PSI Agent) -- C:\Program Files (x86)\Secunia\PSI\psia.exe (Secunia)
SRV - (Secunia Update Agent) -- C:\Program Files (x86)\Secunia\PSI\sua.exe (Secunia)
SRV - (Kodak AiO Network Discovery Service) -- C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe (Eastman Kodak Company)
SRV - (Kodak AiO Status Monitor Service) -- C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe (Eastman Kodak Company)
SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (Radio.fx) -- D:\Tobit Radio.fx\Server\rfx-server.exe ()
SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (ksupmgr) -- C:\Windows\SysWOW64\ksupmgr.exe (Salfeld Computer)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (gfibto) -- C:\Windows\SysNative\drivers\gfibto.sys (GFI Software)
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (nvpciflt) -- C:\Windows\SysNative\drivers\nvpciflt.sys (NVIDIA Corporation)
DRV:64bit: - (nvkflt) -- C:\Windows\SysNative\drivers\nvkflt.sys (NVIDIA Corporation)
DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (iBtFltCoex) -- C:\Windows\SysNative\drivers\iBtFltCoex.sys (Intel Corporation)
DRV:64bit: - (btmhsf) -- C:\Windows\SysNative\drivers\btmhsf.sys (Intel Corporation)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (HPub4DE3) -- C:\Windows\SysNative\drivers\HPub4DE3.sys (TPMX Electronics Ltd.)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (HPMo4DE3) -- C:\Windows\SysNative\drivers\HPMo4DE3.sys (TPMX Electronics Ltd.)
DRV:64bit: - (nusb3xhc) -- C:\Windows\SysNative\drivers\nusb3xhc.sys (Renesas Electronics Corporation)
DRV:64bit: - (nusb3hub) -- C:\Windows\SysNative\drivers\nusb3hub.sys (Renesas Electronics Corporation)
DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (NETwNs64) -- C:\Windows\SysNative\drivers\NETwNs64.sys (Intel Corporation)
DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (Acceler) -- C:\Windows\SysNative\drivers\Accelern.sys (ST Microelectronics)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (PSI) -- C:\Windows\SysNative\drivers\psi_mf.sys (Secunia)
DRV:64bit: - (AVer7231_x64) -- C:\Windows\SysNative\drivers\AVer7231_x64.sys (AVerMedia TECHNOLOGIES, Inc.)
DRV:64bit: - (stdcfltn) -- C:\Windows\SysNative\drivers\stdcfltn.sys (ST Microelectronics)
DRV:64bit: - (CtClsFlt) -- C:\Windows\SysNative\drivers\CtClsFlt.sys (Creative Technology Ltd.)
DRV:64bit: - (qicflt) -- C:\Windows\SysNative\drivers\qicflt.sys (Quanta Computer)
DRV:64bit: - (xusb21) -- C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (StillCam) -- C:\Windows\SysNative\drivers\serscan.sys (Microsoft Corporation)
DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =
 
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 71 C1 6B 32 28 28 CD 01  [binary data]
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\..\URLSearchHook: {5786d022-540e-4699-b350-b4be0ae94b79} - No CLSID value found
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No CLSID value found
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\..\SearchScopes\{DA35B54C-95B6-458E-9DF6-049E661E9F57}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=NCH2&o=APN10013&src=kw&q={searchTerms}&locale=&apn_ptnrs=^ACC&apn_dtid=^YYYYYY^YY^DE&apn_uid=419c7e26-339c-4d26-a298-3fa1e007def9&apn_sauid=00B8BEDE-E5ED-4356-9B52-D9ED2B658C14
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1005\..\SearchScopes,DefaultScope =
 
========== FireFox ==========
 
FF - prefs.js..CT2269050.browser.search.defaultthis.engineName: true
FF - prefs.js..CT2481020.browser.search.defaultthis.engineName: true
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Ashampoo DE Customized Web Search"
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledAddons: personas%40christopher.beard:1.6.2
FF - prefs.js..extensions.enabledAddons: %7B34712C68-7391-4c47-94F3-8F88D49AD632%7D:1.3.0
FF - prefs.js..extensions.enabledAddons: 2020Player_IKEA%402020Technologies.com:5.0.94.0
FF - prefs.js..extensions.enabledAddons: %7BCAFEEFAC-0016-0000-0033-ABCDEFFEDCBA%7D:6.0.33
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0.1
FF - prefs.js..keyword.URL: "hxxp://search.sweetim.com/search.asp?barid={FCC484FC-37F0-11E2-A636-BC77376D1A7C}&src=2&crg=3.09010003&q="
FF - prefs.js..network.proxy.type: 0
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_146.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\PDF Viewer\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\PDF Viewer\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.11.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@parallelgraphics.com/Cortona: C:\Program Files (x86)\Common Files\ParallelGraphics\Cortona\npcortona.dll (ParallelGraphics)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=16.0.0.282: C:\Program Files\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlchromebrowserrecordext;version=1.3.0: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlhtml5videoshim;version=1.3.0: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlpepperflashvideoshim;version=1.3.0: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=16.0.0.282: C:\Program Files\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@realnetworks.com/npdlplugin;version=1: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.124\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.124\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.5: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF - HKCU\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\PDF Viewer\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{34712C68-7391-4c47-94F3-8F88D49AD632}: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\ [2012.12.22 10:27:36 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.01.21 12:13:37 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.01.24 10:58:35 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2013.01.09 15:07:32 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2013.01.24 10:58:35 | 000,000,000 | ---D | M]
 
[2012.05.20 09:46:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\Extensions
[2013.01.14 08:34:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\Firefox\Profiles\zd0m12fn.default\extensions
[2013.01.14 08:34:21 | 000,000,000 | ---D | M] (20-20 3D Viewer - IKEA) -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\Firefox\Profiles\zd0m12fn.default\extensions\2020Player_IKEA@2020Technologies.com
[2012.11.08 11:39:07 | 000,000,000 | ---D | M] (Lavasoft Search Plugin) -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\Firefox\Profiles\zd0m12fn.default\extensions\jid1-yZwVFzbsyfMrqQ@jetpack
[2012.02.25 12:43:49 | 000,330,316 | ---- | M] () (No name found) -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\firefox\profiles\zd0m12fn.default\extensions\personas@christopher.beard.xpi
[2012.12.12 11:21:18 | 000,036,098 | ---- | M] () (No name found) -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\firefox\profiles\zd0m12fn.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
[2012.09.26 15:56:22 | 000,002,343 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\firefox\profiles\zd0m12fn.default\searchplugins\askcom.xml
[2012.11.01 14:48:38 | 000,000,915 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\firefox\profiles\zd0m12fn.default\searchplugins\conduit.xml
[2012.09.27 10:04:27 | 000,001,028 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\firefox\profiles\zd0m12fn.default\searchplugins\dvdvideosofttb-customized-web-search.xml
[2012.05.16 20:15:43 | 000,002,515 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\firefox\profiles\zd0m12fn.default\searchplugins\Search_Results.xml
[2013.01.19 12:34:33 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2013.01.19 12:34:33 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2012.12.22 10:27:36 | 000,000,000 | ---D | M] (RealDownloader) -- C:\PROGRAMDATA\REALNETWORKS\REALDOWNLOADER\BROWSERPLUGINS\FIREFOX\EXT
[2013.01.19 12:34:37 | 000,262,552 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.12.22 10:27:18 | 000,124,056 | ---- | M] (RealPlayer) -- C:\Program Files (x86)\mozilla firefox\plugins\nprpplugin.dll
[2013.01.05 16:11:17 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2013.01.05 16:11:17 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2013.01.05 16:11:17 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2013.01.05 16:11:17 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2013.01.05 16:11:17 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2013.01.05 16:11:17 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - homepage: hxxp://www.google.com/
CHR - homepage: hxxp://www.google.com/
CHR - Extension: YouTube = C:\Users\Jasmina.NICOJAS-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2_0\
CHR - Extension: Google-Suche = C:\Users\Jasmina.NICOJAS-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.14_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\Jasmina.NICOJAS-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
CHR - Extension: Google Mail = C:\Users\Jasmina.NICOJAS-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.3_0\
 
O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (RealNetworks Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [DellStage] C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe ()
O4:64bit: - HKLM..\Run: [EKIJ5000StatusMonitor] C:\Windows\SysNative\spool\drivers\x64\3\EKIJ5000MUI.exe (Eastman Kodak Company)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [QuickSet] C:\Programme\Dell\QuickSet\quickset.exe (Dell Inc.)
O4 - HKLM..\Run: [AccuWeatherWidget] C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe ()
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [ChicoSys] C:\Windows\SysWOW64\cc32\webtmr.exe (Salfeld Computer)
O4 - HKLM..\Run: [Conime] %windir%\system32\conime.exe File not found
O4 - HKLM..\Run: [EKIJ5000StatusMonitor] C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe File not found
O4 - HKLM..\Run: [EKStatusMonitor] C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe (Eastman Kodak Company)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\update\realsched.exe (RealNetworks, Inc.)
O4 - HKU\.DEFAULT..\Run: [CCWinTray] C:\Windows\tray\wintmr.exe (Salfeld Computer)
O4 - HKU\S-1-5-18..\Run: [CCWinTray] C:\Windows\tray\wintmr.exe (Salfeld Computer)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003..\Run: [CCWinTray] C:\Windows\tray\wintmr.exe (Salfeld Computer)
O4 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1005..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\.DEFAULT..\RunOnce: [KodakHomeCenter] C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe (Eastman Kodak Company)
O4 - HKU\S-1-5-18..\RunOnce: [KodakHomeCenter] C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe (Eastman Kodak Company)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1005..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Users\Jasmina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Users\Nico.NICOJAS-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Users\Nico.NICOJAS-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Users\Nico.NICOJAS-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 1
O7 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O7 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O7 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableClock = 0
O7 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableLockWorkstation = 0
O8:64bit: - Extra context menu item: Free YouTube to iPod Converter - C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetoipodconverter.htm ()
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Free YouTube to iPod Converter - C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetoipodconverter.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/DE/Core/Player/2020PlayerAX_IKEA_Win32.cab (20-20 3D Viewer for IKEA)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6FE6BAC3-E33E-46EB-8477-B5A8961B8F76}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.01.24 11:04:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF-XChange PDF Viewer
[2013.01.24 11:04:22 | 000,000,000 | ---D | C] -- C:\Program Files\PDF Viewer
[2013.01.24 10:57:31 | 019,443,001 | ---- | C] (Tracker Software Products Ltd                              ) -- C:\Program Files\PDFXVwer.exe
[2013.01.24 10:14:49 | 002,617,648 | ---- | C] (VS Revo Group Ltd.) -- C:\Users\Jasmina.NICOJAS-PC\Desktop\revosetup194.exe
[2013.01.23 21:06:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dienstprogramme
[2013.01.23 21:03:36 | 000,000,000 | ---D | C] -- C:\Users\Jasmina.NICOJAS-PC\Desktop\Malwarebytes Anti-Rootkit BETA
[2013.01.23 15:51:58 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Jasmina.NICOJAS-PC\Desktop\OTL.exe
[2013.01.23 14:20:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Secunia
[2013.01.23 14:14:20 | 003,137,416 | ---- | C] (Secunia) -- C:\Program Files\PSISetup6001.exe
[2013.01.23 07:43:56 | 000,000,000 | ---D | C] -- C:\Users\Jasmina.NICOJAS-PC\Desktop\Lernen Nico
[2013.01.21 12:13:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Toolbar Cleaner
[2013.01.20 17:37:17 | 000,000,000 | ---D | C] -- C:\Users\Jasmina.NICOJAS-PC\Desktop\Antivirus Logs etc
[2013.01.19 16:22:17 | 004,178,040 | ---- | C] (Piriform Ltd) -- C:\Program Files\ccsetup326.exe
[2013.01.19 16:16:26 | 000,000,000 | ---D | C] -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\Avira
[2013.01.19 16:12:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2013.01.19 16:12:28 | 000,129,216 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys
[2013.01.19 16:12:28 | 000,099,912 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2013.01.19 16:12:28 | 000,027,800 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2013.01.19 16:12:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2013.01.19 16:12:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira
[2013.01.19 12:34:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2013.01.18 09:13:07 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2013.01.18 09:13:07 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2013.01.18 09:13:07 | 000,095,648 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013.01.16 16:42:46 | 000,000,000 | ---D | C] -- C:\Program Files\Definitions
[2013.01.16 16:42:12 | 000,014,456 | ---- | C] (GFI Software) -- C:\Windows\SysNative\drivers\gfibto.sys
[2013.01.15 12:06:17 | 000,000,000 | ---D | C] -- C:\Users\Jasmina.NICOJAS-PC\Desktop\France
[2013.01.14 08:43:58 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\20-20 Technologies
[2013.01.10 08:31:56 | 020,151,664 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 18.0.exe
[2013.01.09 15:07:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Thunderbird
[2013.01.09 06:39:45 | 000,750,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll
[2013.01.09 06:39:45 | 000,492,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\win32spl.dll
[2013.01.09 06:39:33 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll
[2013.01.09 06:39:31 | 000,800,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\usp10.dll
[2013.01.09 06:39:20 | 002,746,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\gameux.dll
[2013.01.09 06:39:20 | 002,576,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\gameux.dll
[2013.01.09 06:39:20 | 000,441,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Wpc.dll
[2013.01.09 06:39:20 | 000,046,592 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\fpb.rs
[2013.01.09 06:39:20 | 000,046,592 | ---- | C] (Microsoft) -- C:\Windows\SysNative\fpb.rs
[2013.01.09 06:39:20 | 000,045,568 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\oflc-nz.rs
[2013.01.09 06:39:20 | 000,045,568 | ---- | C] (Microsoft) -- C:\Windows\SysNative\oflc-nz.rs
[2013.01.09 06:39:20 | 000,044,544 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\pegibbfc.rs
[2013.01.09 06:39:20 | 000,044,544 | ---- | C] (Microsoft) -- C:\Windows\SysNative\pegibbfc.rs
[2013.01.09 06:39:20 | 000,043,520 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\csrr.rs
[2013.01.09 06:39:20 | 000,043,520 | ---- | C] (Microsoft) -- C:\Windows\SysNative\csrr.rs
[2013.01.09 06:39:20 | 000,040,960 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\cob-au.rs
[2013.01.09 06:39:20 | 000,040,960 | ---- | C] (Microsoft) -- C:\Windows\SysNative\cob-au.rs
[2013.01.09 06:39:20 | 000,030,720 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\usk.rs
[2013.01.09 06:39:20 | 000,030,720 | ---- | C] (Microsoft) -- C:\Windows\SysNative\usk.rs
[2013.01.09 06:39:20 | 000,021,504 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\grb.rs
[2013.01.09 06:39:20 | 000,021,504 | ---- | C] (Microsoft) -- C:\Windows\SysNative\grb.rs
[2013.01.09 06:39:20 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\pegi-pt.rs
[2013.01.09 06:39:20 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysNative\pegi-pt.rs
[2013.01.09 06:39:20 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\pegi.rs
[2013.01.09 06:39:20 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysNative\pegi.rs
[2013.01.09 06:39:20 | 000,015,360 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\djctq.rs
[2013.01.09 06:39:20 | 000,015,360 | ---- | C] (Microsoft) -- C:\Windows\SysNative\djctq.rs
[2013.01.09 06:39:19 | 000,308,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Wpc.dll
[2013.01.09 06:39:19 | 000,051,712 | ---- | C] (Microsoft) -- C:\Windows\SysNative\esrb.rs
[2013.01.09 06:39:18 | 000,055,296 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\cero.rs
[2013.01.09 06:39:18 | 000,055,296 | ---- | C] (Microsoft) -- C:\Windows\SysNative\cero.rs
[2013.01.09 06:39:18 | 000,051,712 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\esrb.rs
[2013.01.09 06:39:18 | 000,023,552 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\oflc.rs
[2013.01.09 06:39:18 | 000,023,552 | ---- | C] (Microsoft) -- C:\Windows\SysNative\oflc.rs
[2013.01.09 06:39:18 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\pegi-fi.rs
[2013.01.09 06:39:18 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysNative\pegi-fi.rs
[2013.01.09 06:38:46 | 001,161,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll
[2013.01.09 06:38:46 | 000,424,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll
[2013.01.09 06:38:45 | 000,362,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll
[2013.01.09 06:38:45 | 000,338,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\conhost.exe
[2013.01.09 06:38:45 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll
[2013.01.09 06:38:45 | 000,215,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll
[2013.01.09 06:38:45 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll
[2013.01.09 06:38:45 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll
[2013.01.09 06:38:45 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll
[2013.01.09 06:38:45 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2013.01.09 06:38:45 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2013.01.09 06:38:45 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2013.01.09 06:38:45 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll
[2013.01.09 06:38:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2013.01.09 06:38:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2013.01.09 06:38:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2013.01.09 06:38:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2013.01.09 06:38:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2013.01.09 06:38:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2013.01.09 06:38:44 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe
[2013.01.09 06:38:44 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe
[2013.01.09 06:38:44 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2013.01.09 06:38:44 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe
[2013.01.09 06:38:16 | 000,068,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\taskhost.exe
[2013.01.06 11:45:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kodak
[2013.01.06 11:43:42 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\kodak
[2013.01.06 11:42:15 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\spool
[2013.01.06 11:35:42 | 010,000,984 | ---- | C] (Eastman Kodak Company) -- C:\Program Files\aio_install.exe
[2013.01.04 08:37:05 | 000,000,000 | ---D | C] -- C:\Users\Jasmina.NICOJAS-PC\AppData\Local\Programs
[2012.12.22 10:27:43 | 000,016,384 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\wmdmhelper.dll
[2012.12.22 10:27:42 | 001,115,376 | ---- | C] (Gracenote) -- C:\Program Files\cddbmusicid.dll
[2012.12.22 10:27:42 | 000,943,344 | ---- | C] (Gracenote) -- C:\Program Files\cddblink.dll
[2012.12.22 10:27:42 | 000,641,536 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rjbres.dll
[2012.12.22 10:27:42 | 000,370,176 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rjdlg.dll
[2012.12.22 10:27:42 | 000,139,264 | ---- | C] (Inner Media, Inc.) -- C:\Program Files\dunzip32.dll
[2012.12.22 10:27:42 | 000,045,568 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\ierjplug.dll
[2012.12.22 10:27:42 | 000,031,232 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rjprog.dll
[2012.12.22 10:27:42 | 000,008,704 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\fixrjb.exe
[2012.12.22 10:27:41 | 002,041,072 | ---- | C] (Gracenote, Inc.) -- C:\Program Files\cddbcontrol.dll
[2012.12.22 10:27:41 | 000,073,216 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\tsasdk.dll
[2012.12.22 10:27:41 | 000,044,544 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\mmcdda32.dll
[2012.12.22 10:27:41 | 000,022,528 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\tnetdtct.dll
[2012.12.22 10:27:40 | 009,159,680 | ---- | C] (MediaArea.net) -- C:\Program Files\mediainfo.dll
[2012.12.22 10:27:40 | 000,389,272 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\realcleaner.exe
[2012.12.22 10:27:40 | 000,056,320 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rpwa3260.dll
[2012.12.22 10:27:40 | 000,048,640 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\tpasdk.dll
[2012.12.22 10:27:40 | 000,044,736 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rpshellsearch.dll
[2012.12.22 10:27:31 | 000,383,640 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\realconverter.exe
[2012.12.22 10:27:31 | 000,354,968 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\convert.exe
[2012.12.22 10:27:23 | 000,719,360 | ---- | C] (Microsoft Corporation) -- C:\Program Files\dbghelp.dll
[2012.12.22 10:27:23 | 000,390,384 | ---- | C] (MainConcept GmbH) -- C:\Program Files\mc_enc_mp4v.dll
[2012.12.22 10:27:23 | 000,389,272 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\realtrimmer.exe
[2012.12.22 10:27:23 | 000,136,336 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\realshare.exe
[2012.12.22 10:27:23 | 000,115,200 | ---- | C] (RealPlayer) -- C:\Program Files\rpshellextension.dll
[2012.12.22 10:27:23 | 000,069,632 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rjwmapln.dll
[2012.12.22 10:27:22 | 000,047,616 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rpau3260.dll
[2012.12.22 10:27:18 | 000,030,368 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rndevicedbbuilder.exe
[2012.12.22 10:27:17 | 000,112,824 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rdsf3260.dll
[2012.12.22 10:27:17 | 000,087,552 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\hxaudiodevicehook.dll
[2012.12.22 10:27:17 | 000,086,016 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rpplugprot.dll
[2012.12.22 10:27:17 | 000,070,840 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rpshell.dll
[2012.12.22 10:27:17 | 000,017,080 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rphelperapp.exe
[2012.12.22 10:27:17 | 000,009,216 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\realjbox.exe
[2012.12.22 10:27:16 | 000,500,888 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\realplay.exe
[2012.12.22 08:43:14 | 000,766,272 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\RealPlayer16_de.exe
[2012.11.22 09:36:25 | 019,650,144 | ---- | C] (Mozilla) -- C:\Program Files\Thunderbird Setup 17.0.exe
[2012.11.22 09:35:36 | 019,231,504 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 17.0.exe
[2012.11.13 13:41:41 | 010,524,080 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Program Files\mbam-setup-1.65.0.1400.exe
[2012.11.13 11:16:01 | 000,895,464 | ---- | C] (Oracle Corporation) -- C:\Program Files (x86)\jxpiinstall.exe
[2012.11.13 10:15:40 | 018,090,960 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 16.0.2.exe
[2012.11.13 10:11:21 | 018,580,512 | ---- | C] (Mozilla) -- C:\Program Files\Thunderbird Setup 16.0.2.exe
[2012.11.02 13:40:21 | 000,955,488 | ---- | C] (NCH Software) -- C:\Program Files\wpsetup-5.18.exe
[2012.11.01 14:39:24 | 009,814,632 | ---- | C] (Ashampoo GmbH & Co. KG                                      ) -- C:\Program Files\ashampoo_burning_studio_6_free_6.81_3639.exe
[2012.10.15 15:25:45 | 005,922,048 | ---- | C] (ManiacTools.com                                            ) -- C:\Program Files\m4a-to-mp3-70converter.exe
[2012.09.20 06:45:49 | 008,782,120 | ---- | C] (Tobit.Software) -- C:\Program Files\radiorecorder-setup.exe
[2012.09.11 12:51:11 | 014,894,636 | ---- | C] (Gougelet Pierre-e                                          ) -- C:\Program Files\XnView1991-win-full-de.exe
[2012.09.07 06:33:50 | 017,653,976 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 15.0.1.exe
[2012.08.30 06:12:27 | 018,365,488 | ---- | C] (Mozilla) -- C:\Program Files\Thunderbird Setup 15.0.exe
[2012.08.30 06:10:52 | 017,655,464 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 15.0.exe
[2012.08.25 14:15:13 | 076,021,168 | ---- | C] (The GIMP Team                                              ) -- C:\Program Files\gimp-2.8.2-setup.exe
[2012.08.12 12:22:26 | 018,503,824 | ---- | C] (Mozilla) -- C:\Program Files\Thunderbird Setup 14.0.exe
[2012.06.12 06:31:47 | 013,107,424 | ---- | C] (Adobe Systems Inc.) -- C:\Program Files\Shockwave_Installer_Full.exe
[2012.06.12 06:09:52 | 018,362,696 | ---- | C] (Mozilla) -- C:\Program Files\Thunderbird Setup 13.0.exe
[2012.06.11 18:11:49 | 017,301,984 | ---- | C] (Adobe Systems Inc.) -- C:\Program Files\AdobeAIRInstaller.exe
[2012.06.11 17:27:14 | 016,418,456 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 13.0.exe
[2012.05.19 22:53:40 | 001,292,648 | ---- | C] (Microsoft Corporation) -- C:\Program Files\wlsetup-web_15.4.3555.exe
[2012.05.15 12:30:33 | 040,437,664 | ---- | C] (Apple Inc.) -- C:\Program Files\QuickTimeInstaller.exe
[2012.05.02 06:57:45 | 016,179,464 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 12.0.exe
[2012.04.30 17:46:07 | 017,449,712 | ---- | C] (Mozilla) -- C:\Program Files\Thunderbird Setup 12.0.1.exe
[2012.04.05 09:20:03 | 026,534,080 | ---- | C] (DVDVideoSoft Ltd.                                          ) -- C:\Program Files (x86)\FreeAudioCDBurner.exe
[2012.04.02 12:04:59 | 027,672,000 | ---- | C] (DVDVideoSoft Ltd.                                          ) -- C:\Program Files (x86)\FreeYouTubeToiPodConverter_3.10.17.exe
[2012.02.25 09:42:27 | 006,674,008 | ---- | C] (Adobe Systems Inc.) -- C:\Program Files (x86)\Shockwave_Installer_Slim.exe
[2012.02.25 09:40:38 | 039,401,336 | ---- | C] (Apple Inc.) -- C:\Program Files (x86)\QuickTimeInstaller.exe
[2012.02.25 09:39:34 | 028,038,592 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files (x86)\RealPlayer1502_de.exe
[2012.02.24 10:16:36 | 000,763,408 | ---- | C] (Google Inc.) -- C:\Program Files\GoogleEarthSetup.exe
[2008.04.11 09:09:24 | 000,093,200 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.1049.dll
[2008.04.11 07:03:48 | 000,562,688 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.exe
[2008.04.11 07:03:48 | 000,097,296 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.1036.dll
[2008.04.11 07:03:48 | 000,096,272 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.3082.dll
[2008.04.11 07:03:48 | 000,096,272 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.1031.dll
[2008.04.11 07:03:48 | 000,095,248 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.1040.dll
[2008.04.11 07:03:48 | 000,091,152 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.1033.dll
[2008.04.11 07:03:48 | 000,081,424 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.1041.dll
[2008.04.11 07:03:48 | 000,079,888 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.1042.dll
[2008.04.11 07:03:48 | 000,076,304 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.1028.dll
[2008.04.11 07:03:48 | 000,075,792 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.2052.dll
[4 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.01.24 16:36:28 | 000,001,226 | ---- | M] () -- C:\Windows\SysWow64\excltmp~.dat
[2013.01.24 16:29:02 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.01.24 16:27:52 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.01.24 16:27:49 | 3137,994,752 | -HS- | M] () -- C:\hiberfil.sys
[2013.01.24 16:27:10 | 000,014,208 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.01.24 16:27:10 | 000,014,208 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.01.24 16:27:06 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.01.24 11:58:04 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.01.24 11:49:17 | 000,574,315 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\adwcleaner.exe
[2013.01.24 10:58:04 | 019,443,001 | ---- | M] (Tracker Software Products Ltd                              ) -- C:\Program Files\PDFXVwer.exe
[2013.01.24 10:53:01 | 000,000,537 | ---- | M] () -- C:\Windows\wininit.ini
[2013.01.24 10:14:52 | 002,617,648 | ---- | M] (VS Revo Group Ltd.) -- C:\Users\Jasmina.NICOJAS-PC\Desktop\revosetup194.exe
[2013.01.24 09:53:56 | 000,002,767 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\AppData\Local\recently-used.xbel
[2013.01.24 09:23:00 | 000,001,156 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1835506289-3229931497-3952218681-1004UA.job
[2013.01.23 16:57:09 | 000,000,419 | ---- | M] () -- C:\NET.INI
[2013.01.23 15:52:00 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Jasmina.NICOJAS-PC\Desktop\OTL.exe
[2013.01.23 14:20:55 | 000,001,089 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
[2013.01.23 14:14:26 | 003,137,416 | ---- | M] (Secunia) -- C:\Program Files\PSISetup6001.exe
[2013.01.23 12:30:05 | 000,011,582 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\Elternsprechtag Jan 2013.odt
[2013.01.23 12:23:00 | 000,001,134 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1835506289-3229931497-3952218681-1004Core.job
[2013.01.22 16:01:13 | 000,013,934 | ---- | M] () -- C:\Windows\SysWow64\cchservice.err
[2013.01.21 14:58:54 | 000,009,086 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\Zu bezahlen.odt
[2013.01.21 14:52:29 | 000,008,371 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\Deutscher Bauernverband Praktikum.odt
[2013.01.21 12:14:10 | 000,014,456 | ---- | M] (GFI Software) -- C:\Windows\SysNative\drivers\gfibto.sys
[2013.01.19 16:22:18 | 004,178,040 | ---- | M] (Piriform Ltd) -- C:\Program Files\ccsetup326.exe
[2013.01.19 16:04:21 | 105,661,272 | ---- | M] () -- C:\Program Files\avira_free_antivirus_de.exe
[2013.01.19 15:32:44 | 000,016,227 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\Tabelle Test.odt
[2013.01.19 12:24:55 | 000,012,793 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Documents\Imperativ Übung Sätze 2.odt
[2013.01.19 12:24:25 | 000,013,615 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Documents\Imperativ Übung Verben 2.odt
[2013.01.19 12:23:47 | 000,016,176 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Documents\Imperativ Übung Sätze-Lösungen 2.odt
[2013.01.12 03:30:18 | 000,095,648 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013.01.12 03:26:16 | 000,174,496 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2013.01.12 03:24:49 | 000,174,496 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2013.01.10 08:33:13 | 000,001,130 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013.01.10 08:32:39 | 020,151,664 | ---- | M] (Mozilla) -- C:\Program Files\Firefox Setup 18.0.exe
[2013.01.10 08:29:37 | 017,301,984 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\AdobeAIRInstaller.exe
[2013.01.09 16:27:29 | 000,697,864 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2013.01.09 16:27:29 | 000,074,248 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013.01.09 12:09:59 | 000,424,008 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.01.09 12:01:30 | 001,520,734 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.01.09 12:01:30 | 000,654,400 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.01.09 12:01:30 | 000,616,242 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.01.09 12:01:30 | 000,130,240 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.01.09 12:01:30 | 000,106,622 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.01.08 12:15:31 | 000,008,726 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\HPG 19-02-2013.odt
[2013.01.06 11:51:05 | 000,008,465 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\trude.odt
[2013.01.06 11:35:52 | 010,000,984 | ---- | M] (Eastman Kodak Company) -- C:\Program Files\aio_install.exe
[2013.01.04 08:37:26 | 000,001,092 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[4 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.01.24 11:49:11 | 000,574,315 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\adwcleaner.exe
[2013.01.24 09:53:56 | 000,002,767 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\AppData\Local\recently-used.xbel
[2013.01.23 21:06:22 | 000,001,137 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Express Zip.lnk
[2013.01.23 14:20:55 | 000,001,089 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
[2013.01.23 14:20:55 | 000,001,052 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk
[2013.01.21 14:50:03 | 000,008,371 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\Deutscher Bauernverband Praktikum.odt
[2013.01.21 10:02:14 | 000,000,537 | ---- | C] () -- C:\Windows\wininit.ini
[2013.01.20 10:27:08 | 000,013,934 | ---- | C] () -- C:\Windows\SysWow64\cchservice.err
[2013.01.19 14:19:29 | 000,016,227 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\Tabelle Test.odt
[2013.01.19 12:24:53 | 000,012,793 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Documents\Imperativ Übung Sätze 2.odt
[2013.01.19 12:24:23 | 000,013,615 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Documents\Imperativ Übung Verben 2.odt
[2013.01.19 12:19:06 | 000,016,176 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Documents\Imperativ Übung Sätze-Lösungen 2.odt
[2013.01.16 14:56:19 | 000,011,582 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\Elternsprechtag Jan 2013.odt
[2013.01.13 17:50:56 | 000,009,086 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\Zu bezahlen.odt
[2013.01.07 10:22:14 | 000,008,726 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\HPG 19-02-2013.odt
[2012.12.30 12:54:17 | 000,008,465 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\trude.odt
[2012.12.22 10:27:42 | 000,002,851 | ---- | C] () -- C:\Program Files\cdroms.cfg
[2012.12.22 10:27:40 | 000,119,808 | ---- | C] () -- C:\Program Files\waiting.avi
[2012.12.22 10:27:40 | 000,067,473 | ---- | C] () -- C:\Program Files\realplay.chm
[2012.12.22 10:27:40 | 000,027,278 | ---- | C] () -- C:\Program Files\frw.bmp
[2012.12.22 10:27:40 | 000,016,296 | ---- | C] () -- C:\Program Files\realtfon.fon
[2012.12.22 10:27:31 | 000,476,724 | ---- | C] () -- C:\Program Files\converter.vs
[2012.12.22 10:27:23 | 000,045,428 | ---- | C] () -- C:\Program Files\sharemedia.vs
[2012.12.22 10:27:23 | 000,001,209 | ---- | C] () -- C:\Program Files\flvplay.swf
[2012.12.22 10:27:22 | 000,033,157 | ---- | C] () -- C:\Program Files\RealNetworks License.html
[2012.12.22 10:27:22 | 000,033,157 | ---- | C] () -- C:\Program Files\playrlic.html
[2012.12.22 10:27:21 | 001,109,306 | ---- | C] () -- C:\Program Files\normal.vs
[2012.12.22 10:27:21 | 000,061,495 | ---- | C] () -- C:\Program Files\ssimages.vs
[2012.12.22 10:27:21 | 000,000,480 | ---- | C] () -- C:\Program Files\keys.dat
[2012.12.22 10:27:17 | 000,001,161 | ---- | C] () -- C:\Program Files\autoplaylist.dat
[2012.12.22 10:27:17 | 000,000,043 | ---- | C] () -- C:\Program Files\strs23.dat
[2012.12.22 10:27:17 | 000,000,013 | ---- | C] () -- C:\Program Files\strs26.dat
[2012.12.22 10:27:16 | 000,427,405 | ---- | C] () -- C:\Program Files\calibrate.rv
[2012.12.22 10:27:16 | 000,017,846 | ---- | C] () -- C:\Program Files\videotest.rm
[2012.12.22 10:27:16 | 000,000,221 | ---- | C] () -- C:\Program Files\subscription.rnx
[2012.12.22 10:27:16 | 000,000,177 | ---- | C] () -- C:\Program Files\freeoffers.rnx
[2012.12.15 13:46:18 | 022,916,830 | ---- | C] () -- C:\Program Files\vlc-2.0.5-win32.exe
[2012.12.15 13:06:25 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2012.09.27 10:19:36 | 000,013,824 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.09.20 06:46:53 | 000,554,496 | ---- | C] () -- C:\Windows\SysWow64\dvmsg.dll
[2012.08.29 08:03:59 | 000,160,350 | ---- | C] () -- C:\Program Files\JavaRa.zip
[2012.08.29 07:42:01 | 009,672,192 | ---- | C] () -- C:\Program Files\Adobe_Flash_Player_AX_11.4.402.265_SPS.exe
[2012.08.29 07:41:24 | 015,567,360 | ---- | C] () -- C:\Program Files\Adobe_AIR_3.4.0.2540_SPS.exe
[2012.08.27 10:09:16 | 152,249,762 | ---- | C] () -- C:\Program Files\Apache_OpenOffice_incubating_3.4.1_Win_x86_install_de.exe
[2012.08.15 11:05:18 | 009,697,792 | ---- | C] () -- C:\Program Files\ShockwavePlayer_11.6.6.636_SPS.exe
[2012.07.15 09:39:36 | 022,657,136 | ---- | C] () -- C:\Program Files\vlc-2.0.2-win32.exe
[2012.06.27 07:54:46 | 009,679,360 | ---- | C] () -- C:\Program Files\Shockwaveplayer_11.6.4.634.exe
[2012.06.17 18:54:57 | 000,000,271 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\burnaware.ini
[2012.06.12 06:48:02 | 007,656,960 | ---- | C] () -- C:\Program Files\cortona3d.msi
[2012.06.12 06:05:13 | 000,441,829 | ---- | C] () -- C:\Program Files\ade-tb-13.0.c.xpi
[2012.06.11 08:53:53 | 000,000,085 | -HS- | C] () -- C:\ProgramData\.zreglib
[2012.05.29 09:37:28 | 151,893,470 | ---- | C] () -- C:\Program Files\Apache_OpenOffice_incubating_3.4.0_Win_x86_install_de.exe
[2012.05.23 17:49:32 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2012.05.23 17:49:32 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2012.05.23 17:49:32 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2012.05.23 17:49:32 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2012.05.22 06:51:22 | 000,338,432 | ---- | C] () -- C:\Windows\SysWow64\sqlite36_engine.dll
[2012.05.19 14:32:36 | 000,278,643 | ---- | C] () -- C:\Program Files\fast_video_download-4.1.6-fx.zip
[2012.05.19 14:22:36 | 196,941,888 | ---- | C] () -- C:\Program Files\ALDI Bestellsoftware Setup.exe
[2012.05.11 07:57:44 | 029,272,056 | ---- | C] () -- C:\Program Files\SaalDesignSoftware2.9.2.exe
[2012.05.05 16:00:03 | 004,998,707 | ---- | C] () -- C:\Program Files\flvplayer_setup20_25.exe
[2012.03.27 12:48:40 | 000,253,952 | ---- | C] () -- C:\Program Files\OOo_3.3.9567.500.exe
[2012.02.25 09:57:51 | 000,155,536 | ---- | C] () -- C:\Windows\SysWow64\dllcinx.exe
[2012.02.25 09:57:49 | 000,000,626 | ---- | C] () -- C:\Windows\SysWow64\nochook.ini
[2012.02.25 09:38:55 | 004,998,707 | ---- | C] () -- C:\Program Files (x86)\flvplayer_setup20_25.exe
[2012.02.24 16:59:09 | 000,001,226 | ---- | C] () -- C:\Windows\SysWow64\excltmp~.dat
[2012.02.24 16:58:29 | 000,000,140 | -H-- | C] () -- C:\Windows\SysWow64\ctlsw.ini
[2012.02.24 16:58:29 | 000,000,091 | ---- | C] () -- C:\Windows\SysWow64\SWCTL.DLL
[2012.02.24 11:05:44 | 018,980,864 | ---- | C] () -- C:\Program Files\SkypeSetup_5.8.0.156.msi
[2012.02.24 10:48:18 | 031,870,976 | ---- | C] () -- C:\Program Files\PXCViewer_x6425201.msi
[2012.02.24 10:47:54 | 001,376,768 | ---- | C] () -- C:\Program Files\7z920-x64.msi
[2012.02.24 10:35:22 | 105,661,272 | ---- | C] () -- C:\Program Files\avira_free_antivirus_de.exe
[2012.02.24 10:15:24 | 168,166,968 | ---- | C] () -- C:\Program Files\OOo_3.3.0_Win_x86_install-wJRE_de.exe
[2012.02.22 08:07:19 | 000,066,856 | ---- | C] () -- C:\Windows\SysWow64\SynTPEnhPS.dll
[2011.11.30 01:26:12 | 000,960,940 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin
[2011.11.30 01:26:09 | 000,213,332 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin
[2011.11.30 01:26:04 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_89001461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_6B071461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_5B011461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_49001461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_3B011461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_33011461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2B071461_ca.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2B071461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2B071461_8a.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2A0F1461_ca.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2A071461_ca.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2A071461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2A071461_8a.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2A031461_ca.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2A031461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_1C011461_61.bin
[2011.11.30 01:23:23 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_A3031461_ca.bin
[2011.11.30 01:23:23 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_A3031461_aa.bin
[2011.11.30 01:23:23 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_A3031461_8a.bin
[2011.11.30 01:23:23 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_83231461_ca.bin
[2011.11.30 01:23:23 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_83231461_aa.bin
[2011.11.30 01:23:23 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_83231461_8a.bin
[2011.11.30 01:23:23 | 000,000,436 | ---- | C] () -- C:\Windows\11317231_1C0F1461_41.bin
[2011.11.30 01:23:23 | 000,000,434 | ---- | C] () -- C:\Windows\11317231_890F1461_ca.bin
[2011.11.30 01:23:23 | 000,000,434 | ---- | C] () -- C:\Windows\11317231_3B0f1461_ca.bin
[2011.11.30 01:23:23 | 000,000,434 | ---- | C] () -- C:\Windows\11317231_2B0f1461_ca.bin
[2011.11.30 01:23:23 | 000,000,434 | ---- | C] () -- C:\Windows\11317231_29001461_ca.bin
[2011.11.30 01:23:23 | 000,000,412 | ---- | C] () -- C:\Windows\11317231_180F1461_ca.bin
[2011.11.30 01:23:23 | 000,000,412 | ---- | C] () -- C:\Windows\11317231_18071461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_14001461_61.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_13011461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_110F1461_ca.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_110F1461_8a.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_11071461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_11071461_8a.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0B071461_ca.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0B071461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0B071461_8a.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0B011461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A0F1461_ca.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A071461_ca.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A071461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A071461_8a.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A031461_ca.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A031461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A011461_ca.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A011461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_09001461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_08071461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_060F1461_ca.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_06071461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_06071461_8a.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_03011461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_03011461_8a.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_02011461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_02011461_8a.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_010F1461_ca.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_010F1461_8a.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_01071461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_01071461_8a.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_07031461_aa.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_03231461_ca.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_03231461_aa.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_03231461_8a.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_03131461_8a.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_03031461_aa.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_02031461_ca.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_02031461_aa.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_02031461_8a.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_00000000_aa.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_00000000_8a.bin
[2011.11.30 01:23:22 | 000,000,434 | ---- | C] () -- C:\Windows\11317231_0B0f1461_ca.bin
[2011.11.30 01:23:22 | 000,000,434 | ---- | C] () -- C:\Windows\11317231_090F1461_ca.bin
[2011.11.30 01:23:22 | 000,000,376 | ---- | C] () -- C:\Windows\11317231_0B001461_aa.bin
[2011.11.30 01:23:22 | 000,000,376 | ---- | C] () -- C:\Windows\11317231_03131461_aa.bin
[2008.04.11 09:11:40 | 000,233,472 | ---- | C] () -- C:\Program Files\VC_RED.MSI
[2008.04.11 09:09:38 | 003,797,292 | ---- | C] () -- C:\Program Files\VC_RED.cab
[2008.04.11 09:07:18 | 000,005,686 | ---- | C] () -- C:\Program Files\vcredist.bmp
[2008.04.11 09:07:18 | 000,001,110 | ---- | C] () -- C:\Program Files\globdata.ini
[2008.04.11 09:07:18 | 000,000,843 | ---- | C] () -- C:\Program Files\install.ini
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

< End of report >


Code:
OTL Extras logfile created on: 24.01.2013 16:36:14 - Run 3
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Jasmina.NICOJAS-PC\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,90 Gb Total Physical Memory | 1,85 Gb Available Physical Memory | 47,49% Memory free
7,79 Gb Paging File | 5,51 Gb Available in Paging File | 70,76% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 265,66 Gb Total Space | 80,18 Gb Free Space | 30,18% Space Free | Partition Type: NTFS
Drive D: | 200,00 Gb Total Space | 199,73 Gb Free Space | 99,87% Space Free | Partition Type: NTFS
 
Computer Name: NICOJAS-PC | User Name: Jasmina | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = ChromeHTML] -- Reg Error: Key error. File not found
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
[HKEY_USERS\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== System Restore Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
"DisableSR" = 1
"DisableConfig" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
"DisableSR" = 1
"DisableConfig" = 1
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03B9EF93-80A8-4845-BBEA-E57E652BBCAF}" = rport=445 | protocol=6 | dir=out | app=system |
"{06E9E081-AF16-48F3-A65C-45D38EFFFDC6}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{13482F04-C479-4714-A5ED-39793B8AAE1D}" = rport=139 | protocol=6 | dir=out | app=system |
"{13E37376-E86C-4019-A725-370DBA1C472E}" = rport=138 | protocol=17 | dir=out | app=system |
"{19ABAAFE-5469-4D69-ADA2-4699E51AAFCF}" = lport=445 | protocol=6 | dir=in | app=system |
"{22BA7DA7-E3C4-47BD-BD6A-B114541112F4}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{2AA89C74-81DA-40D8-903C-81F5681F1A55}" = lport=9322 | protocol=6 | dir=in | name=ekdiscovery |
"{34E72618-0DA7-47D5-A7A0-F15510D9E758}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{482FEDE2-F7D7-4FCF-BC03-256AAC6974E5}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{49716C09-3F9C-404E-B180-E4081D0BBDC8}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{4A808828-8225-46D2-87EC-5E577FAB1B3A}" = lport=139 | protocol=6 | dir=in | app=system |
"{6EEE79D5-2A03-486E-9097-D0C7BAD265DF}" = lport=9322 | protocol=6 | dir=in | name=ekdiscovery |
"{99CBA5AC-9892-45B9-8760-B588F1E908B0}" = lport=5353 | protocol=17 | dir=in | name=bonjour port 5353 |
"{A2DF74D5-A568-4A13-A040-D2D95D6C75DE}" = rport=137 | protocol=17 | dir=out | app=system |
"{A3589360-384E-4156-A3A9-B670DC44F140}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{ADCF185E-AB3F-49C7-B4C6-6FEECB08A98F}" = lport=137 | protocol=17 | dir=in | app=system |
"{D9814FB7-C5B3-41F3-913D-6FC368B5C6E6}" = lport=138 | protocol=17 | dir=in | app=system |
"{F82628F2-3F45-4F25-BAAA-14803BF0F409}" = lport=5353 | protocol=17 | dir=in | name=bonjour port 5353 |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00DE7700-6E5A-4350-9F44-2A7432769CCB}" = protocol=6 | dir=in | app=c:\windows\syswow64\msiexec.exe |
"{02F141FE-498D-4574-A66D-58E2561D793C}" = protocol=17 | dir=in | app=c:\program files (x86)\2k sports\nba 2k13\nba2k13.exe |
"{126782C9-2354-44F3-8F23-A92D102A4E93}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\center\kodak.statistics.exe |
"{2F2EB0A3-4B90-4E33-8C0C-80A6A9C83A72}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\firmware\kodakaioupdater.exe |
"{2F5BDC80-D4CF-46DA-BFFF-FB1A05C2693B}" = protocol=17 | dir=in | app=c:\program files (x86)\cyanide\gamecenter\gamecenter.exe |
"{300ACAB8-ACF5-4FC8-A2ED-1BF12C2151CD}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\center\networkprinterdiscovery.exe |
"{36C3CA04-80CA-4D39-B6C5-AF220F844087}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\center\kodak.statistics.exe |
"{3AB28388-7EB4-46AA-8C6D-806B6571D56D}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\center\aiohomecenter.exe |
"{3B630698-B25B-41DF-8EF9-E2B396B0B083}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\firmware\kodakaioupdater.exe |
"{3CAEF7AF-5FBE-4237-9D6F-D6C0A7991314}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\center\aiohomecenter.exe |
"{3E609762-8618-4993-A50C-77D22F878630}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{43CBC248-7E0B-477C-8DB0-449AE476C7D5}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\firmware\kodakaioupdater.exe |
"{45B64134-8F9D-49F1-8940-F8D85BA68411}" = protocol=6 | dir=in | app=c:\program files (x86)\2k sports\nba 2k13\nba2k13.exe |
"{461D9763-7840-401C-8EA8-A9016EAFB6A0}" = protocol=17 | dir=in | app=c:\programdata\kodak\installer\setup.exe |
"{4B4AC4D5-F226-4ED8-91F7-5BF8E74E2912}" = protocol=6 | dir=in | app=c:\windows\syswow64\muzapp.exe |
"{4D4EFD79-8431-489B-ACBF-22842823D940}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{5CE13E4F-212C-42A3-98D7-C10DCBBAEAB8}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\center\networkprinterdiscovery.exe |
"{6286D4F7-67FF-4293-AA87-AC04E642A996}" = protocol=6 | dir=in | app=c:\programdata\kodak\installer\setup.exe |
"{673EE027-9D91-408D-8E7F-F9EAE8AA5195}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\firmware\kodakaioupdater.exe |
"{7FBC02D6-A43E-46B5-B55E-F878996E72CA}" = protocol=6 | dir=in | app=c:\programdata\kodak\installer\setup.exe |
"{80514CFD-8048-4C14-B844-9891D4854D21}" = protocol=6 | dir=in | app=c:\program files (x86)\sweetim\communicator\sweetpacksupdatemanager.exe |
"{83AF232F-8E60-4AE4-91F3-177AADA4C95D}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\center\aiohomecenter.exe |
"{86B3BA1A-EB42-41EB-8BE5-ED2F3CCD803F}" = protocol=17 | dir=in | app=d:\tobit radio.fx\client\rfx-client.exe |
"{8A47FCBE-4950-4015-8D01-2C2AC9895ED7}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\center\kodak.statistics.exe |
"{8A76F869-12AA-4BBE-8D9F-B97FFECBF30E}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\center\aiohomecenter.exe |
"{91EB51CE-59DF-48E1-BAF4-52E98B8F4352}" = protocol=17 | dir=in | app=d:\tobit radio.fx\server\rfx-server.exe |
"{97EB7143-70C5-495B-B9AF-62423A6EB4CC}" = protocol=17 | dir=in | app=c:\windows\syswow64\msiexec.exe |
"{9B906E24-8273-4393-AA06-F8A6FDA9FFC3}" = protocol=17 | dir=in | app=c:\program files (x86)\sweetim\communicator\sweetpacksupdatemanager.exe |
"{9E64C8F7-38F7-4211-9F24-27502D9F9377}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\center\networkprinterdiscovery.exe |
"{A2834B87-C86E-4D08-90B2-DA67BCA1716B}" = protocol=6 | dir=in | app=c:\program files (x86)\cyanide\gamecenter\gamecenter.exe |
"{A301FAD5-5412-4D17-BFE7-FECBF23E370B}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{A7F89437-5CF4-4291-AC2D-3A780F3ABEE7}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{BD7E8F19-BBB9-4C22-A1A9-13145F003618}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{BE688A9C-1735-4E3E-A89C-BC83633D49E9}" = protocol=17 | dir=in | app=c:\windows\syswow64\muzapp.exe |
"{BF64C12D-723D-4411-A3FB-77E0F02E6A4A}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\center\kodak.statistics.exe |
"{C290BE6A-1286-4F6B-8429-B0EC7335FEE4}" = protocol=6 | dir=in | app=d:\tobit radio.fx\server\rfx-server.exe |
"{C8790961-8656-4860-9076-A2D6623D10E5}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\center\networkprinterdiscovery.exe |
"{CC860D3A-C81A-4786-878A-4D6E17556474}" = protocol=17 | dir=in | app=c:\windows\syswow64\muzapp.exe |
"{CD406032-BF04-4303-912E-D7130F577CF8}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{CD7240F0-B94F-46EF-926F-AAE573567F82}" = protocol=6 | dir=in | app=d:\tobit radio.fx\client\rfx-client.exe |
"{DC484A61-D39E-484F-ABAC-79D0B001A970}" = protocol=6 | dir=in | app=c:\windows\syswow64\muzapp.exe |
"{E590CA35-BF4B-43AB-AD11-E1DFA3E5E85F}" = dir=in | app=c:\program files (x86)\dell stage\videostage\videostage.exe |
"{EB9E90E3-6809-4C85-8486-954384E4415E}" = protocol=17 | dir=in | app=c:\programdata\kodak\installer\setup.exe |
"TCP Query User{2C129A0F-15ED-4EB5-B1D1-52762861834F}C:\users\nico.nicojas-pc\appdata\local\facebook\video\skype\facebookvideocalling.exe" = protocol=6 | dir=in | app=c:\users\nico.nicojas-pc\appdata\local\facebook\video\skype\facebookvideocalling.exe |
"TCP Query User{415EE727-2686-4681-A0CC-B633456BC9A1}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe |
"TCP Query User{44F9B41D-F81E-4237-B65C-495E923A0A91}C:\users\nico.nicojas-pc\appdata\local\facebook\video\skype\facebookvideocalling.exe" = protocol=6 | dir=in | app=c:\users\nico.nicojas-pc\appdata\local\facebook\video\skype\facebookvideocalling.exe |
"TCP Query User{56412238-720A-46B5-A739-61A80F922067}C:\users\nico.nicojas-pc\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\nico.nicojas-pc\appdata\roaming\spotify\spotify.exe |
"TCP Query User{9B9701E4-29D1-4FF2-979C-8597475BDD6F}C:\program files (x86)\ea sports\fifa 11\game\fifa.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ea sports\fifa 11\game\fifa.exe |
"TCP Query User{D1677699-5DF9-4125-9F3C-4687B71E4538}C:\program files (x86)\ea sports\fifa 11\game\fifa.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ea sports\fifa 11\game\fifa.exe |
"TCP Query User{E0CFE6E6-8D1F-4EA9-8CB2-172678AAC4F5}C:\users\nico.nicojas-pc\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\nico.nicojas-pc\appdata\roaming\spotify\spotify.exe |
"UDP Query User{01DE79D1-8DE7-4447-ADB8-56C8B3C7497B}C:\users\nico.nicojas-pc\appdata\local\facebook\video\skype\facebookvideocalling.exe" = protocol=17 | dir=in | app=c:\users\nico.nicojas-pc\appdata\local\facebook\video\skype\facebookvideocalling.exe |
"UDP Query User{2F8A7DF9-1087-41D1-8A2C-9992D60A33F1}C:\program files (x86)\ea sports\fifa 11\game\fifa.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ea sports\fifa 11\game\fifa.exe |
"UDP Query User{40F012E4-AE29-44CC-BD71-803C69499479}C:\users\nico.nicojas-pc\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\nico.nicojas-pc\appdata\roaming\spotify\spotify.exe |
"UDP Query User{5DEF9C85-2CF8-4430-B799-143CCE815566}C:\users\nico.nicojas-pc\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\nico.nicojas-pc\appdata\roaming\spotify\spotify.exe |
"UDP Query User{7D3AE024-0E92-4F74-A165-5F405D7115A1}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe |
"UDP Query User{BA636B01-B9F1-4665-9285-7B080D1B5368}C:\users\nico.nicojas-pc\appdata\local\facebook\video\skype\facebookvideocalling.exe" = protocol=17 | dir=in | app=c:\users\nico.nicojas-pc\appdata\local\facebook\video\skype\facebookvideocalling.exe |
"UDP Query User{FC56FE20-5872-4926-A640-6CA999CC5F9B}C:\program files (x86)\ea sports\fifa 11\game\fifa.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ea sports\fifa 11\game\fifa.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{0645A454-AD44-4F0D-99CF-6B762735AD1F}" = aioprnt
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)
"{27EF8E7F-88D1-4ec5-ADE2-7E447FDF114E}" = Kodak AIO Printer
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{87CF757E-C1F1-4D22-865C-00C6950B5258}" = Quickset64
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1" = PDF-Viewer
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Optimus" = NVIDIA Optimus 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}" = PlayReady PC Runtime amd64
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"GIMP-2_is1" = GIMP 2.8.2
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"SynTPDeinstKey" = Synaptics Pointing Device Driver
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D98F04D-11A1-4B64-A406-43292B9EEE90}" = Dell PhotoStage
"{1798D459-6B8B-474B-868D-1229EADA3B95}" = Adobe AIR
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}" = OpenOffice.org 3.4.1
"{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java(TM) 6 Update 33
"{26A24AE4-039D-4CA4-87B4-2F83217009FF}" = Java 7 Update 11
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{376348C2-E372-48BC-A138-E896757BD86A}" = aioscnnr
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3E90B7F4-1817-4405-B4A5-E4EA5EC0E2B3}" = Dell MusicStage
"{3FEA6CD1-EA13-4CE7-A74E-A74A4A0A7B5C}" = FIFA 11
"{56BA241F-580C-43D2-8403-947241AAE633}" = center
"{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6F545E5E-4595-11E2-93B6-B8AC6F97B88E}" = Google Earth
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D318C86-AF4C-409F-A6AC-7183FF4CF424}" = Internet-TV für Windows Media Center
"{9F06F464-479A-403E-AF92-70CBB8D674A1}" = PRE10STI64Installer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAECF7BA-E83B-4A10-87EA-DE0B333F8734}" = RealNetworks - Microsoft Visual C++ 2010 Runtime
"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
"{AF7EBCA4-9FAF-4DC8-8D09-67854BB84D34}" = RealDownloader
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B92C5909-1D37-4C51-8397-A28BB28E5DC3}" = Facebook Video Calling 1.2.0.287
"{BE94C681-68E2-4561-8ABC-8D2E799168B4}" = essentials
"{BFBCF96F-7361-486A-965C-54B17AC35421}" = ocr
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D96B6543-A0C0-4351-AF96-73DEF1DD6820}" = NBA 2K13
"{DA5BDB2A-12F0-4343-8351-21AAEB293990}" = PreReq
"{DCE0E79A-B9AC-41AC-98C1-7EF0538BCA7F}" = Dell VideoStage
"{DEACDFFA-D424-416F-B849-FA282F55B2CE}" = Cortona3D Viewer
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E0F274B7-592B-4669-8FB8-8D9825A09858}" = KODAK All-in-One Software
"{E2F57269-065E-4B19-8CDA-AB6C401FAF1A}" = Dell Stage
"{E4335E82-17B3-460F-9E70-39D9BC269DB3}" = Dell PhotoStage
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{EF53BFAB-4C10-40DB-A82D-9B07111715C6}" = aioscnnr
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics
"{F5266D28-E0B2-4130-BFC5-EE155AD514DC}" = Apple Application Support
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"ALDI Bestellsoftware" = ALDI Bestellsoftware 4.12.1
"Ashampoo Burning Studio 6 FREE_is1" = Ashampoo Burning Studio 6 FREE v.6.81
"Avira AntiVir Desktop" = Avira Free Antivirus
"Dell Webcam Central" = Dell Webcam Central
"ExpressBurn" = Express Burn
"ExpressRip" = Express Rip
"ExpressZip" = Express Zip
"FLV Player" = FLV Player 2.0 (build 25)
"Free M4a to MP3 Converter_is1" = Free M4a to MP3 Converter 7.0
"Free YouTube to iPod Converter_is1" = Free YouTube to iPod Converter version 3.10.32.918
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.32.918
"InstallShield_{DCE0E79A-B9AC-41AC-98C1-7EF0538BCA7F}" = Dell VideoStage
"Kindersicherung_is1" = Kindersicherung 2012
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"MixPad" = MixPad Audiodatei-Mixer
"Mozilla Firefox 18.0.1 (x86 de)" = Mozilla Firefox 18.0.1 (x86 de)
"Mozilla Thunderbird 17.0.2 (x86 de)" = Mozilla Thunderbird 17.0.2 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"PrintProjects" = PrintProjects
"RealPlayer 16.0" = RealPlayer
"Secunia PSI" = Secunia PSI (3.0.0.6001)
"Tobit Radio.fx Server 1" = WDR RadioRecorder
"Video Converter" = Video Converter
"VLC media player" = VLC media player 2.0.5
"WavePad" = WavePad Audiobearbeitungs-Software
"WinLiveSuite" = Windows Live Essentials
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 24.10.2012 06:21:15 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 439
Description = Windows (2888) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk
 konnte nicht geschrieben werden. Fehler -1032.
 
Error - 24.10.2012 06:24:30 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 490
Description = Windows (2888) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 24.10.2012 06:24:30 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 439
Description = Windows (2888) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk
 konnte nicht geschrieben werden. Fehler -1032.
 
Error - 24.10.2012 06:26:43 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 490
Description = Windows (2888) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 24.10.2012 06:26:43 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 439
Description = Windows (2888) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk
 konnte nicht geschrieben werden. Fehler -1032.
 
Error - 24.10.2012 06:26:53 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 490
Description = Windows (2888) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 24.10.2012 06:26:53 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 439
Description = Windows (2888) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk
 konnte nicht geschrieben werden. Fehler -1032.
 
Error - 24.10.2012 06:27:03 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 490
Description = Windows (2888) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 24.10.2012 06:27:03 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 439
Description = Windows (2888) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk
 konnte nicht geschrieben werden. Fehler -1032.
 
Error - 24.10.2012 06:44:26 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 490
Description = Windows (2888) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 24.10.2012 06:44:26 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 439
Description = Windows (2888) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk
 konnte nicht geschrieben werden. Fehler -1032.
 
[ Media Center Events ]
Error - 20.03.2012 15:11:39 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 20:11:34 - Fehler beim Herstellen der Internetverbindung.  20:11:34
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 20.03.2012 16:11:42 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 21:11:42 - Fehler beim Herstellen der Internetverbindung.  21:11:42
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 20.03.2012 16:11:51 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 21:11:47 - Fehler beim Herstellen der Internetverbindung.  21:11:47
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 05.05.2012 14:52:38 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 20:44:58 - EpgListing.enc konnte nicht abgerufen werden (Fehler: HTTP-Status
 404: Die angeforderte URL ist auf diesem Server nicht vorhanden.  ) 
 
Error - 22.05.2012 14:13:50 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 20:13:50 - Fehler beim Herstellen der Internetverbindung.  20:13:50
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 22.05.2012 14:14:07 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 20:13:55 - Fehler beim Herstellen der Internetverbindung.  20:13:55
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 13.07.2012 14:26:21 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 20:26:21 - Fehler beim Herstellen der Internetverbindung.  20:26:21
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 13.07.2012 14:26:39 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 20:26:27 - Fehler beim Herstellen der Internetverbindung.  20:26:27
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 24.08.2012 15:46:57 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 21:46:57 - Fehler beim Herstellen der Internetverbindung.  21:46:57
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 24.08.2012 15:47:42 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 21:47:11 - Fehler beim Herstellen der Internetverbindung.  21:47:11
-    Serververbindung konnte nicht hergestellt werden.. 
 
[ System Events ]
Error - 24.01.2013 02:20:57 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7000
Description = Der Dienst "UAC-Dateivirtualisierung" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%2
 
Error - 24.01.2013 02:21:31 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  SBRE
 
Error - 24.01.2013 05:23:15 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7000
Description = Der Dienst "UAC-Dateivirtualisierung" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%2
 
Error - 24.01.2013 05:23:48 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  SBRE
 
Error - 24.01.2013 06:59:46 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7000
Description = Der Dienst "UAC-Dateivirtualisierung" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%2
 
Error - 24.01.2013 07:00:14 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  SBRE
 
Error - 24.01.2013 11:21:45 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7000
Description = Der Dienst "UAC-Dateivirtualisierung" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%2
 
Error - 24.01.2013 11:21:57 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  SBRE
 
Error - 24.01.2013 11:27:53 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7000
Description = Der Dienst "UAC-Dateivirtualisierung" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%2
 
Error - 24.01.2013 11:29:49 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  SBRE
 
 
< End of report >

cosinus 24.01.2013 16:54
Hm, da ist immer noch Toolbar-Müll drin
Bitte mal den aktuellen adwCleaner runterladen, also die alte adwcleaner löschen und neu runterladen

adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Falls der adwCleaner schon mal in der runtergeladen wurde, bitte die alte adwcleaner.exe löschen und neu runterladen!!
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Suche.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[Rx].txt. (x=fortlaufende Nummer)

Rheingold 24.01.2013 16:57
so, gleich kommt hoffentlich der richtige. sorry

cosinus 24.01.2013 17:05
Falsches Log, bitte das richtige posten

Rheingold 24.01.2013 17:06
:headbang:sorry

cosinus 24.01.2013 17:07
Wieso jetzt schon wieder OTL??? :confused:

Rheingold 24.01.2013 17:19
weil die seite bei mir zwischendurch nicht richtig geladen hat und die logs dann zwei Mal gepostet wurden.

cosinus 24.01.2013 17:22
Ok, mach bitte mit meiner letzten Anweisung weiter

Rheingold 24.01.2013 17:32
so, jetzt aber.

Code:
# AdwCleaner v2.107 - Datei am 24/01/2013 um 17:16:18 erstellt
# Aktualisiert am 21/01/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : Jasmina - NICOJAS-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Jasmina.NICOJAS-PC\Desktop\adwcleaner.exe
# Option [Suche]


**** [Dienste] ****


***** [Dateien / Ordner] *****


***** [Registrierungsdatenbank] *****


***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16457

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v18.0.1 (de)

-\\ Google Chrome v [Version kann nicht ermittelt werden]

*************************

AdwCleaner[R3].txt - [678 octets] - [24/01/2013 17:16:18]

########## EOF - C:\AdwCleaner[R3].txt - [737 octets] ##########
Muss jetzt weg. Danke schon mal /noch mal und bis später.

Jasmina

cosinus 24.01.2013 22:04
Ok, danke, der adwCleaner erkennt die Einträge noch nicht, machen wir mit OTL weg

Fixen mit OTL

  • Starte bitte die OTL.exe.
  • Kopiere nun den Inhalt aus der Codebox in die Textbox.
Code:
:OTL
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\..\SearchScopes\{DA35B54C-95B6-458E-9DF6-049E661E9F57}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=NCH2&o=APN10013&src=kw&q={searchTerms}&locale=&apn_ptnrs=^ACC&apn_dtid=^YYYYYY^YY^DE&apn_uid=419c7e26-339c-4d26-a298-3fa1e007def9&apn_sauid=00B8BEDE-E5ED-4356-9B52-D9ED2B658C14
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Ashampoo DE Customized Web Search"
FF - prefs.js..keyword.URL: "http://search.sweetim.com/search.asp?barid={FCC484FC-37F0-11E2-A636-BC77376D1A7C}&src=2&crg=3.09010003&q="
[2012.09.26 15:56:22 | 000,002,343 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\firefox\profiles\zd0m12fn.default\searchplugins\askcom.xml
[2012.11.01 14:48:38 | 000,000,915 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\firefox\profiles\zd0m12fn.default\searchplugins\conduit.xml
[2012.09.27 10:04:27 | 000,001,028 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\firefox\profiles\zd0m12fn.default\searchplugins\dvdvideosofttb-customized-web-search.xml
[2012.05.16 20:15:43 | 000,002,515 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\firefox\profiles\zd0m12fn.default\searchplugins\Search_Results.xml
[2013.01.24 16:36:28 | 000,001,226 | ---- | M] () -- C:\Windows\SysWow64\excltmp~.dat
:Files
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[resethosts]
  • Solltest du deinen Benutzernamen z. B. durch "*****" unkenntlich gemacht haben, so füge an entsprechender Stelle deinen richtigen Benutzernamen ein. Andernfalls wird der Fix nicht funktionieren.
  • Schließe bitte nun alle Programme.
  • Klicke nun bitte auf den Fix Button.
  • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
  • Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
    ( Auch zu finden unter C:\_OTL\MovedFiles\<Uhrzeit_Datum>.txt)
    Kopiere nun den Inhalt hier in Deinen Thread

Rheingold 25.01.2013 07:45
So, hier der logfile /otl von heute früh. :kaffee:

Code:
All processes killed
========== OTL ==========
Registry key HKEY_USERS\S-1-5-21-1835506289-3229931497-3952218681-1003\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_USERS\S-1-5-21-1835506289-3229931497-3952218681-1003\Software\Microsoft\Internet Explorer\SearchScopes\{DA35B54C-95B6-458E-9DF6-049E661E9F57}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DA35B54C-95B6-458E-9DF6-049E661E9F57}\ not found.
Prefs.js: "Ask.com" removed from browser.search.defaultengine
Prefs.js: "Ask.com" removed from browser.search.defaultenginename
Prefs.js: "Ask.com" removed from browser.search.order.1
Prefs.js: "Ashampoo DE Customized Web Search" removed from browser.search.selectedEngine
Prefs.js: "hxxp://search.sweetim.com/search.asp?barid={FCC484FC-37F0-11E2-A636-BC77376D1A7C}&src=2&crg=3.09010003&q=" removed from keyword.URL
C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\firefox\profiles\zd0m12fn.default\searchplugins\askcom.xml moved successfully.
C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\firefox\profiles\zd0m12fn.default\searchplugins\conduit.xml moved successfully.
C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\firefox\profiles\zd0m12fn.default\searchplugins\dvdvideosofttb-customized-web-search.xml moved successfully.
C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\firefox\profiles\zd0m12fn.default\searchplugins\Search_Results.xml moved successfully.
C:\Windows\SysWOW64\excltmp~.dat moved successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\Jasmina.NICOJAS-PC\Desktop\cmd.bat deleted successfully.
C:\Users\Jasmina.NICOJAS-PC\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrator
->Temp folder emptied: 287966 bytes
->Temporary Internet Files folder emptied: 10516996 bytes
->FireFox cache emptied: 89196389 bytes
->Flash cache emptied: 456 bytes
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 58264 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Jasmina
->Temp folder emptied: 111551178 bytes
->Temporary Internet Files folder emptied: 31827118 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 137320938 bytes
->Flash cache emptied: 1088 bytes
 
User: Jasmina.NICOJAS-PC
->Temp folder emptied: 136659968 bytes
->Temporary Internet Files folder emptied: 138752803 bytes
->Java cache emptied: 9013623 bytes
->FireFox cache emptied: 72277625 bytes
->Google Chrome cache emptied: 7095861 bytes
->Flash cache emptied: 59045 bytes
 
User: Nico
 
User: Nico.NICOJAS-PC
->Temp folder emptied: 583720 bytes
->Temporary Internet Files folder emptied: 60538540 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 447034990 bytes
->Flash cache emptied: 4147 bytes
 
User: Public
 
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56504 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 7404 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50568 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 1.195,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.69.0 log created on 01252013_072816

Files\Folders moved on Reboot...
C:\Users\Jasmina.NICOJAS-PC\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

cosinus 25.01.2013 12:22
Eine neue Kontrolle mit OTL bitte:
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Setze oben mittig den Haken bei Scanne alle Benutzer
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles hier in CODE-Tags in den Thread.

Rheingold 25.01.2013 15:15
1. logfile

Code:
OTL logfile created on: 25.01.2013 15:04:03 - Run 4
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Jasmina.NICOJAS-PC\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,90 Gb Total Physical Memory | 2,20 Gb Available Physical Memory | 56,42% Memory free
7,79 Gb Paging File | 5,73 Gb Available in Paging File | 73,55% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 265,66 Gb Total Space | 81,54 Gb Free Space | 30,69% Space Free | Partition Type: NTFS
Drive D: | 200,00 Gb Total Space | 199,73 Gb Free Space | 99,87% Space Free | Partition Type: NTFS
 
Computer Name: NICOJAS-PC | User Name: Jasmina | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Jasmina.NICOJAS-PC\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe ()
PRC - C:\Program Files (x86)\Secunia\PSI\psia.exe (Secunia)
PRC - C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
PRC - C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe (Eastman Kodak Company)
PRC - C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe (Eastman Kodak Company)
PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files (x86)\Dell Stage\Dell Stage\stage_secondary.exe ()
PRC - C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe ()
PRC - D:\Tobit Radio.fx\Server\rfx-server.exe ()
PRC - C:\Windows\tray\wintmr.exe (Salfeld Computer)
PRC - C:\Windows\SysWOW64\cc32\webtmr.exe (Salfeld Computer)
PRC - C:\Windows\SysWOW64\ccsync.exe (Salfeld Computer)
PRC - C:\Windows\SysWOW64\cchservice.exe (Salfeld Computer)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll ()
MOD - C:\Program Files (x86)\Dell Stage\Dell Stage\stage_secondary.exe ()
MOD - C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe ()
MOD - C:\Program Files (x86)\Dell Stage\Dell Stage\QtGui4.dll ()
MOD - C:\Program Files (x86)\Dell Stage\Dell Stage\QtCore4.dll ()
 
 
========== Services (SafeList) ==========
 
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (RealNetworks Downloader Resolver Service) -- C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe ()
SRV - (Secunia PSI Agent) -- C:\Program Files (x86)\Secunia\PSI\psia.exe (Secunia)
SRV - (Secunia Update Agent) -- C:\Program Files (x86)\Secunia\PSI\sua.exe (Secunia)
SRV - (Kodak AiO Network Discovery Service) -- C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe (Eastman Kodak Company)
SRV - (Kodak AiO Status Monitor Service) -- C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe (Eastman Kodak Company)
SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (Radio.fx) -- D:\Tobit Radio.fx\Server\rfx-server.exe ()
SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (ksupmgr) -- C:\Windows\SysWOW64\ksupmgr.exe (Salfeld Computer)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (gfibto) -- C:\Windows\SysNative\drivers\gfibto.sys (GFI Software)
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (nvpciflt) -- C:\Windows\SysNative\drivers\nvpciflt.sys (NVIDIA Corporation)
DRV:64bit: - (nvkflt) -- C:\Windows\SysNative\drivers\nvkflt.sys (NVIDIA Corporation)
DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (iBtFltCoex) -- C:\Windows\SysNative\drivers\iBtFltCoex.sys (Intel Corporation)
DRV:64bit: - (btmhsf) -- C:\Windows\SysNative\drivers\btmhsf.sys (Intel Corporation)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (HPub4DE3) -- C:\Windows\SysNative\drivers\HPub4DE3.sys (TPMX Electronics Ltd.)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (HPMo4DE3) -- C:\Windows\SysNative\drivers\HPMo4DE3.sys (TPMX Electronics Ltd.)
DRV:64bit: - (nusb3xhc) -- C:\Windows\SysNative\drivers\nusb3xhc.sys (Renesas Electronics Corporation)
DRV:64bit: - (nusb3hub) -- C:\Windows\SysNative\drivers\nusb3hub.sys (Renesas Electronics Corporation)
DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (NETwNs64) -- C:\Windows\SysNative\drivers\NETwNs64.sys (Intel Corporation)
DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (Acceler) -- C:\Windows\SysNative\drivers\Accelern.sys (ST Microelectronics)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (PSI) -- C:\Windows\SysNative\drivers\psi_mf.sys (Secunia)
DRV:64bit: - (AVer7231_x64) -- C:\Windows\SysNative\drivers\AVer7231_x64.sys (AVerMedia TECHNOLOGIES, Inc.)
DRV:64bit: - (stdcfltn) -- C:\Windows\SysNative\drivers\stdcfltn.sys (ST Microelectronics)
DRV:64bit: - (CtClsFlt) -- C:\Windows\SysNative\drivers\CtClsFlt.sys (Creative Technology Ltd.)
DRV:64bit: - (qicflt) -- C:\Windows\SysNative\drivers\qicflt.sys (Quanta Computer)
DRV:64bit: - (xusb21) -- C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (StillCam) -- C:\Windows\SysNative\drivers\serscan.sys (Microsoft Corporation)
DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =
 
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 71 C1 6B 32 28 28 CD 01  [binary data]
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\..\URLSearchHook: {5786d022-540e-4699-b350-b4be0ae94b79} - No CLSID value found
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No CLSID value found
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1005\..\SearchScopes,DefaultScope =
 
========== FireFox ==========
 
FF - prefs.js..CT2269050.browser.search.defaultthis.engineName: true
FF - prefs.js..CT2481020.browser.search.defaultthis.engineName: true
FF - prefs.js..browser.search.defaultengine: ""
FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.order.1: ""
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledAddons: personas%40christopher.beard:1.6.2
FF - prefs.js..extensions.enabledAddons: %7B34712C68-7391-4c47-94F3-8F88D49AD632%7D:1.3.0
FF - prefs.js..extensions.enabledAddons: 2020Player_IKEA%402020Technologies.com:5.0.94.0
FF - prefs.js..extensions.enabledAddons: %7BCAFEEFAC-0016-0000-0033-ABCDEFFEDCBA%7D:6.0.33
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0.1
FF - prefs.js..network.proxy.type: 0
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_146.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\PDF Viewer\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\PDF Viewer\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.11.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@parallelgraphics.com/Cortona: C:\Program Files (x86)\Common Files\ParallelGraphics\Cortona\npcortona.dll (ParallelGraphics)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=16.0.0.282: C:\Program Files\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlchromebrowserrecordext;version=1.3.0: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlhtml5videoshim;version=1.3.0: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlpepperflashvideoshim;version=1.3.0: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=16.0.0.282: C:\Program Files\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@realnetworks.com/npdlplugin;version=1: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.124\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.124\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.5: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF - HKCU\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\PDF Viewer\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{34712C68-7391-4c47-94F3-8F88D49AD632}: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\ [2012.12.22 10:27:36 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.01.21 12:13:37 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.01.24 10:58:35 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2013.01.09 15:07:32 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2013.01.24 10:58:35 | 000,000,000 | ---D | M]
 
[2012.05.20 09:46:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\Extensions
[2013.01.14 08:34:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\Firefox\Profiles\zd0m12fn.default\extensions
[2013.01.14 08:34:21 | 000,000,000 | ---D | M] (20-20 3D Viewer - IKEA) -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\Firefox\Profiles\zd0m12fn.default\extensions\2020Player_IKEA@2020Technologies.com
[2012.11.08 11:39:07 | 000,000,000 | ---D | M] (Lavasoft Search Plugin) -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\Firefox\Profiles\zd0m12fn.default\extensions\jid1-yZwVFzbsyfMrqQ@jetpack
[2012.02.25 12:43:49 | 000,330,316 | ---- | M] () (No name found) -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\firefox\profiles\zd0m12fn.default\extensions\personas@christopher.beard.xpi
[2012.12.12 11:21:18 | 000,036,098 | ---- | M] () (No name found) -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\firefox\profiles\zd0m12fn.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
[2013.01.19 12:34:33 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2013.01.19 12:34:33 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2012.12.22 10:27:36 | 000,000,000 | ---D | M] (RealDownloader) -- C:\PROGRAMDATA\REALNETWORKS\REALDOWNLOADER\BROWSERPLUGINS\FIREFOX\EXT
[2013.01.19 12:34:37 | 000,262,552 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.12.22 10:27:18 | 000,124,056 | ---- | M] (RealPlayer) -- C:\Program Files (x86)\mozilla firefox\plugins\nprpplugin.dll
[2013.01.05 16:11:17 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2013.01.05 16:11:17 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2013.01.05 16:11:17 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2013.01.05 16:11:17 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2013.01.05 16:11:17 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2013.01.05 16:11:17 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - homepage: hxxp://www.google.com/
CHR - homepage: hxxp://www.google.com/
CHR - Extension: YouTube = C:\Users\Jasmina.NICOJAS-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2_0\
CHR - Extension: Google-Suche = C:\Users\Jasmina.NICOJAS-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.14_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\Jasmina.NICOJAS-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
CHR - Extension: Google Mail = C:\Users\Jasmina.NICOJAS-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.3_0\
 
O1 HOSTS File: ([2013.01.25 07:29:55 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1      localhost
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (RealNetworks Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [DellStage] C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe ()
O4:64bit: - HKLM..\Run: [EKIJ5000StatusMonitor] C:\Windows\SysNative\spool\drivers\x64\3\EKIJ5000MUI.exe (Eastman Kodak Company)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [QuickSet] C:\Programme\Dell\QuickSet\quickset.exe (Dell Inc.)
O4 - HKLM..\Run: [AccuWeatherWidget] C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe ()
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [ChicoSys] C:\Windows\SysWOW64\cc32\webtmr.exe (Salfeld Computer)
O4 - HKLM..\Run: [Conime] %windir%\system32\conime.exe File not found
O4 - HKLM..\Run: [EKIJ5000StatusMonitor] C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe File not found
O4 - HKLM..\Run: [EKStatusMonitor] C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe (Eastman Kodak Company)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\update\realsched.exe (RealNetworks, Inc.)
O4 - HKU\.DEFAULT..\Run: [CCWinTray] C:\Windows\tray\wintmr.exe (Salfeld Computer)
O4 - HKU\S-1-5-18..\Run: [CCWinTray] C:\Windows\tray\wintmr.exe (Salfeld Computer)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003..\Run: [CCWinTray] C:\Windows\tray\wintmr.exe (Salfeld Computer)
O4 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1005..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\.DEFAULT..\RunOnce: [KodakHomeCenter] C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe (Eastman Kodak Company)
O4 - HKU\S-1-5-18..\RunOnce: [KodakHomeCenter] C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe (Eastman Kodak Company)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1005..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Users\Jasmina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Users\Nico.NICOJAS-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Users\Nico.NICOJAS-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Users\Nico.NICOJAS-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 1
O7 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O7 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O7 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableClock = 0
O7 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableLockWorkstation = 0
O8:64bit: - Extra context menu item: Free YouTube to iPod Converter - C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetoipodconverter.htm ()
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Free YouTube to iPod Converter - C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetoipodconverter.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/DE/Core/Player/2020PlayerAX_IKEA_Win32.cab (20-20 3D Viewer for IKEA)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6FE6BAC3-E33E-46EB-8477-B5A8961B8F76}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.01.25 07:28:16 | 000,000,000 | ---D | C] -- C:\_OTL
[2013.01.24 11:04:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF-XChange PDF Viewer
[2013.01.24 11:04:22 | 000,000,000 | ---D | C] -- C:\Program Files\PDF Viewer
[2013.01.24 10:57:31 | 019,443,001 | ---- | C] (Tracker Software Products Ltd                              ) -- C:\Program Files\PDFXVwer.exe
[2013.01.24 10:14:49 | 002,617,648 | ---- | C] (VS Revo Group Ltd.) -- C:\Users\Jasmina.NICOJAS-PC\Desktop\revosetup194.exe
[2013.01.23 21:06:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dienstprogramme
[2013.01.23 21:03:36 | 000,000,000 | ---D | C] -- C:\Users\Jasmina.NICOJAS-PC\Desktop\Malwarebytes Anti-Rootkit BETA
[2013.01.23 15:51:58 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Jasmina.NICOJAS-PC\Desktop\OTL.exe
[2013.01.23 14:20:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Secunia
[2013.01.23 14:14:20 | 003,137,416 | ---- | C] (Secunia) -- C:\Program Files\PSISetup6001.exe
[2013.01.23 07:43:56 | 000,000,000 | ---D | C] -- C:\Users\Jasmina.NICOJAS-PC\Desktop\Lernen Nico
[2013.01.21 12:13:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Toolbar Cleaner
[2013.01.20 17:37:17 | 000,000,000 | ---D | C] -- C:\Users\Jasmina.NICOJAS-PC\Desktop\Antivirus Logs etc
[2013.01.19 16:22:17 | 004,178,040 | ---- | C] (Piriform Ltd) -- C:\Program Files\ccsetup326.exe
[2013.01.19 16:16:26 | 000,000,000 | ---D | C] -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\Avira
[2013.01.19 16:12:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2013.01.19 16:12:28 | 000,129,216 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys
[2013.01.19 16:12:28 | 000,099,912 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2013.01.19 16:12:28 | 000,027,800 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2013.01.19 16:12:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2013.01.19 16:12:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira
[2013.01.19 12:34:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2013.01.18 09:13:07 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2013.01.18 09:13:07 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2013.01.18 09:13:07 | 000,095,648 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013.01.16 16:42:46 | 000,000,000 | ---D | C] -- C:\Program Files\Definitions
[2013.01.16 16:42:12 | 000,014,456 | ---- | C] (GFI Software) -- C:\Windows\SysNative\drivers\gfibto.sys
[2013.01.15 12:06:17 | 000,000,000 | ---D | C] -- C:\Users\Jasmina.NICOJAS-PC\Desktop\France
[2013.01.14 08:43:58 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\20-20 Technologies
[2013.01.10 08:31:56 | 020,151,664 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 18.0.exe
[2013.01.09 15:07:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Thunderbird
[2013.01.09 06:39:45 | 000,750,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll
[2013.01.09 06:39:45 | 000,492,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\win32spl.dll
[2013.01.09 06:39:33 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll
[2013.01.09 06:39:31 | 000,800,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\usp10.dll
[2013.01.09 06:39:20 | 002,746,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\gameux.dll
[2013.01.09 06:39:20 | 002,576,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\gameux.dll
[2013.01.09 06:39:20 | 000,441,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Wpc.dll
[2013.01.09 06:39:20 | 000,046,592 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\fpb.rs
[2013.01.09 06:39:20 | 000,046,592 | ---- | C] (Microsoft) -- C:\Windows\SysNative\fpb.rs
[2013.01.09 06:39:20 | 000,045,568 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\oflc-nz.rs
[2013.01.09 06:39:20 | 000,045,568 | ---- | C] (Microsoft) -- C:\Windows\SysNative\oflc-nz.rs
[2013.01.09 06:39:20 | 000,044,544 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\pegibbfc.rs
[2013.01.09 06:39:20 | 000,044,544 | ---- | C] (Microsoft) -- C:\Windows\SysNative\pegibbfc.rs
[2013.01.09 06:39:20 | 000,043,520 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\csrr.rs
[2013.01.09 06:39:20 | 000,043,520 | ---- | C] (Microsoft) -- C:\Windows\SysNative\csrr.rs
[2013.01.09 06:39:20 | 000,040,960 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\cob-au.rs
[2013.01.09 06:39:20 | 000,040,960 | ---- | C] (Microsoft) -- C:\Windows\SysNative\cob-au.rs
[2013.01.09 06:39:20 | 000,030,720 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\usk.rs
[2013.01.09 06:39:20 | 000,030,720 | ---- | C] (Microsoft) -- C:\Windows\SysNative\usk.rs
[2013.01.09 06:39:20 | 000,021,504 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\grb.rs
[2013.01.09 06:39:20 | 000,021,504 | ---- | C] (Microsoft) -- C:\Windows\SysNative\grb.rs
[2013.01.09 06:39:20 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\pegi-pt.rs
[2013.01.09 06:39:20 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysNative\pegi-pt.rs
[2013.01.09 06:39:20 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\pegi.rs
[2013.01.09 06:39:20 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysNative\pegi.rs
[2013.01.09 06:39:20 | 000,015,360 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\djctq.rs
[2013.01.09 06:39:20 | 000,015,360 | ---- | C] (Microsoft) -- C:\Windows\SysNative\djctq.rs
[2013.01.09 06:39:19 | 000,308,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Wpc.dll
[2013.01.09 06:39:19 | 000,051,712 | ---- | C] (Microsoft) -- C:\Windows\SysNative\esrb.rs
[2013.01.09 06:39:18 | 000,055,296 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\cero.rs
[2013.01.09 06:39:18 | 000,055,296 | ---- | C] (Microsoft) -- C:\Windows\SysNative\cero.rs
[2013.01.09 06:39:18 | 000,051,712 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\esrb.rs
[2013.01.09 06:39:18 | 000,023,552 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\oflc.rs
[2013.01.09 06:39:18 | 000,023,552 | ---- | C] (Microsoft) -- C:\Windows\SysNative\oflc.rs
[2013.01.09 06:39:18 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\pegi-fi.rs
[2013.01.09 06:39:18 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysNative\pegi-fi.rs
[2013.01.09 06:38:46 | 001,161,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll
[2013.01.09 06:38:46 | 000,424,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll
[2013.01.09 06:38:45 | 000,362,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll
[2013.01.09 06:38:45 | 000,338,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\conhost.exe
[2013.01.09 06:38:45 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll
[2013.01.09 06:38:45 | 000,215,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll
[2013.01.09 06:38:45 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll
[2013.01.09 06:38:45 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll
[2013.01.09 06:38:45 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll
[2013.01.09 06:38:45 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2013.01.09 06:38:45 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2013.01.09 06:38:45 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2013.01.09 06:38:45 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll
[2013.01.09 06:38:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2013.01.09 06:38:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2013.01.09 06:38:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2013.01.09 06:38:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2013.01.09 06:38:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2013.01.09 06:38:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2013.01.09 06:38:44 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe
[2013.01.09 06:38:44 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe
[2013.01.09 06:38:44 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2013.01.09 06:38:44 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe
[2013.01.09 06:38:16 | 000,068,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\taskhost.exe
[2013.01.06 11:45:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kodak
[2013.01.06 11:43:42 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\kodak
[2013.01.06 11:42:15 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\spool
[2013.01.06 11:35:42 | 010,000,984 | ---- | C] (Eastman Kodak Company) -- C:\Program Files\aio_install.exe
[2013.01.04 08:37:05 | 000,000,000 | ---D | C] -- C:\Users\Jasmina.NICOJAS-PC\AppData\Local\Programs
[2012.12.22 10:27:43 | 000,016,384 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\wmdmhelper.dll
[2012.12.22 10:27:42 | 001,115,376 | ---- | C] (Gracenote) -- C:\Program Files\cddbmusicid.dll
[2012.12.22 10:27:42 | 000,943,344 | ---- | C] (Gracenote) -- C:\Program Files\cddblink.dll
[2012.12.22 10:27:42 | 000,641,536 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rjbres.dll
[2012.12.22 10:27:42 | 000,370,176 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rjdlg.dll
[2012.12.22 10:27:42 | 000,139,264 | ---- | C] (Inner Media, Inc.) -- C:\Program Files\dunzip32.dll
[2012.12.22 10:27:42 | 000,045,568 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\ierjplug.dll
[2012.12.22 10:27:42 | 000,031,232 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rjprog.dll
[2012.12.22 10:27:42 | 000,008,704 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\fixrjb.exe
[2012.12.22 10:27:41 | 002,041,072 | ---- | C] (Gracenote, Inc.) -- C:\Program Files\cddbcontrol.dll
[2012.12.22 10:27:41 | 000,073,216 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\tsasdk.dll
[2012.12.22 10:27:41 | 000,044,544 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\mmcdda32.dll
[2012.12.22 10:27:41 | 000,022,528 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\tnetdtct.dll
[2012.12.22 10:27:40 | 009,159,680 | ---- | C] (MediaArea.net) -- C:\Program Files\mediainfo.dll
[2012.12.22 10:27:40 | 000,389,272 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\realcleaner.exe
[2012.12.22 10:27:40 | 000,056,320 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rpwa3260.dll
[2012.12.22 10:27:40 | 000,048,640 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\tpasdk.dll
[2012.12.22 10:27:40 | 000,044,736 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rpshellsearch.dll
[2012.12.22 10:27:31 | 000,383,640 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\realconverter.exe
[2012.12.22 10:27:31 | 000,354,968 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\convert.exe
[2012.12.22 10:27:23 | 000,719,360 | ---- | C] (Microsoft Corporation) -- C:\Program Files\dbghelp.dll
[2012.12.22 10:27:23 | 000,390,384 | ---- | C] (MainConcept GmbH) -- C:\Program Files\mc_enc_mp4v.dll
[2012.12.22 10:27:23 | 000,389,272 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\realtrimmer.exe
[2012.12.22 10:27:23 | 000,136,336 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\realshare.exe
[2012.12.22 10:27:23 | 000,115,200 | ---- | C] (RealPlayer) -- C:\Program Files\rpshellextension.dll
[2012.12.22 10:27:23 | 000,069,632 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rjwmapln.dll
[2012.12.22 10:27:22 | 000,047,616 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rpau3260.dll
[2012.12.22 10:27:18 | 000,030,368 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rndevicedbbuilder.exe
[2012.12.22 10:27:17 | 000,112,824 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rdsf3260.dll
[2012.12.22 10:27:17 | 000,087,552 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\hxaudiodevicehook.dll
[2012.12.22 10:27:17 | 000,086,016 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rpplugprot.dll
[2012.12.22 10:27:17 | 000,070,840 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rpshell.dll
[2012.12.22 10:27:17 | 000,017,080 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rphelperapp.exe
[2012.12.22 10:27:17 | 000,009,216 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\realjbox.exe
[2012.12.22 10:27:16 | 000,500,888 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\realplay.exe
[2012.12.22 08:43:14 | 000,766,272 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\RealPlayer16_de.exe
[2012.11.22 09:36:25 | 019,650,144 | ---- | C] (Mozilla) -- C:\Program Files\Thunderbird Setup 17.0.exe
[2012.11.22 09:35:36 | 019,231,504 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 17.0.exe
[2012.11.13 13:41:41 | 010,524,080 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Program Files\mbam-setup-1.65.0.1400.exe
[2012.11.13 11:16:01 | 000,895,464 | ---- | C] (Oracle Corporation) -- C:\Program Files (x86)\jxpiinstall.exe
[2012.11.13 10:15:40 | 018,090,960 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 16.0.2.exe
[2012.11.13 10:11:21 | 018,580,512 | ---- | C] (Mozilla) -- C:\Program Files\Thunderbird Setup 16.0.2.exe
[2012.11.02 13:40:21 | 000,955,488 | ---- | C] (NCH Software) -- C:\Program Files\wpsetup-5.18.exe
[2012.11.01 14:39:24 | 009,814,632 | ---- | C] (Ashampoo GmbH & Co. KG                                      ) -- C:\Program Files\ashampoo_burning_studio_6_free_6.81_3639.exe
[2012.10.15 15:25:45 | 005,922,048 | ---- | C] (ManiacTools.com                                            ) -- C:\Program Files\m4a-to-mp3-70converter.exe
[2012.09.20 06:45:49 | 008,782,120 | ---- | C] (Tobit.Software) -- C:\Program Files\radiorecorder-setup.exe
[2012.09.11 12:51:11 | 014,894,636 | ---- | C] (Gougelet Pierre-e                                          ) -- C:\Program Files\XnView1991-win-full-de.exe
[2012.09.07 06:33:50 | 017,653,976 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 15.0.1.exe
[2012.08.30 06:12:27 | 018,365,488 | ---- | C] (Mozilla) -- C:\Program Files\Thunderbird Setup 15.0.exe
[2012.08.30 06:10:52 | 017,655,464 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 15.0.exe
[2012.08.25 14:15:13 | 076,021,168 | ---- | C] (The GIMP Team                                              ) -- C:\Program Files\gimp-2.8.2-setup.exe
[2012.08.12 12:22:26 | 018,503,824 | ---- | C] (Mozilla) -- C:\Program Files\Thunderbird Setup 14.0.exe
[2012.06.12 06:31:47 | 013,107,424 | ---- | C] (Adobe Systems Inc.) -- C:\Program Files\Shockwave_Installer_Full.exe
[2012.06.12 06:09:52 | 018,362,696 | ---- | C] (Mozilla) -- C:\Program Files\Thunderbird Setup 13.0.exe
[2012.06.11 18:11:49 | 017,301,984 | ---- | C] (Adobe Systems Inc.) -- C:\Program Files\AdobeAIRInstaller.exe
[2012.06.11 17:27:14 | 016,418,456 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 13.0.exe
[2012.05.19 22:53:40 | 001,292,648 | ---- | C] (Microsoft Corporation) -- C:\Program Files\wlsetup-web_15.4.3555.exe
[2012.05.15 12:30:33 | 040,437,664 | ---- | C] (Apple Inc.) -- C:\Program Files\QuickTimeInstaller.exe
[2012.05.02 06:57:45 | 016,179,464 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 12.0.exe
[2012.04.30 17:46:07 | 017,449,712 | ---- | C] (Mozilla) -- C:\Program Files\Thunderbird Setup 12.0.1.exe
[2012.04.05 09:20:03 | 026,534,080 | ---- | C] (DVDVideoSoft Ltd.                                          ) -- C:\Program Files (x86)\FreeAudioCDBurner.exe
[2012.04.02 12:04:59 | 027,672,000 | ---- | C] (DVDVideoSoft Ltd.                                          ) -- C:\Program Files (x86)\FreeYouTubeToiPodConverter_3.10.17.exe
[2012.02.25 09:42:27 | 006,674,008 | ---- | C] (Adobe Systems Inc.) -- C:\Program Files (x86)\Shockwave_Installer_Slim.exe
[2012.02.25 09:40:38 | 039,401,336 | ---- | C] (Apple Inc.) -- C:\Program Files (x86)\QuickTimeInstaller.exe
[2012.02.25 09:39:34 | 028,038,592 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files (x86)\RealPlayer1502_de.exe
[2012.02.24 10:16:36 | 000,763,408 | ---- | C] (Google Inc.) -- C:\Program Files\GoogleEarthSetup.exe
[2008.04.11 09:09:24 | 000,093,200 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.1049.dll
[2008.04.11 07:03:48 | 000,562,688 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.exe
[2008.04.11 07:03:48 | 000,097,296 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.1036.dll
[2008.04.11 07:03:48 | 000,096,272 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.3082.dll
[2008.04.11 07:03:48 | 000,096,272 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.1031.dll
[2008.04.11 07:03:48 | 000,095,248 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.1040.dll
[2008.04.11 07:03:48 | 000,091,152 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.1033.dll
[2008.04.11 07:03:48 | 000,081,424 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.1041.dll
[2008.04.11 07:03:48 | 000,079,888 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.1042.dll
[2008.04.11 07:03:48 | 000,076,304 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.1028.dll
[2008.04.11 07:03:48 | 000,075,792 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.2052.dll
 
========== Files - Modified Within 30 Days ==========
 
[2013.01.25 15:04:36 | 000,001,226 | ---- | M] () -- C:\Windows\SysWow64\excltmp~.dat
[2013.01.25 15:03:16 | 000,014,208 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.01.25 15:03:16 | 000,014,208 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.01.25 14:58:00 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.01.25 14:56:39 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.01.25 14:55:31 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.01.25 14:55:28 | 3137,994,752 | -HS- | M] () -- C:\hiberfil.sys
[2013.01.25 11:27:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.01.25 11:20:46 | 000,008,802 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\Zu bezahlen.odt
[2013.01.25 09:23:00 | 000,001,156 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1835506289-3229931497-3952218681-1004UA.job
[2013.01.25 07:29:55 | 000,000,098 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\Hosts
[2013.01.24 17:15:51 | 000,574,315 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\adwcleaner.exe
[2013.01.24 10:58:04 | 019,443,001 | ---- | M] (Tracker Software Products Ltd                              ) -- C:\Program Files\PDFXVwer.exe
[2013.01.24 10:53:01 | 000,000,537 | ---- | M] () -- C:\Windows\wininit.ini
[2013.01.24 10:14:52 | 002,617,648 | ---- | M] (VS Revo Group Ltd.) -- C:\Users\Jasmina.NICOJAS-PC\Desktop\revosetup194.exe
[2013.01.24 09:53:56 | 000,002,767 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\AppData\Local\recently-used.xbel
[2013.01.23 16:57:09 | 000,000,419 | ---- | M] () -- C:\NET.INI
[2013.01.23 15:52:00 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Jasmina.NICOJAS-PC\Desktop\OTL.exe
[2013.01.23 14:20:55 | 000,001,089 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
[2013.01.23 14:14:26 | 003,137,416 | ---- | M] (Secunia) -- C:\Program Files\PSISetup6001.exe
[2013.01.23 12:30:05 | 000,011,582 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\Elternsprechtag Jan 2013.odt
[2013.01.23 12:23:00 | 000,001,134 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1835506289-3229931497-3952218681-1004Core.job
[2013.01.22 16:01:13 | 000,013,934 | ---- | M] () -- C:\Windows\SysWow64\cchservice.err
[2013.01.21 14:52:29 | 000,008,371 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\Deutscher Bauernverband Praktikum.odt
[2013.01.21 12:14:10 | 000,014,456 | ---- | M] (GFI Software) -- C:\Windows\SysNative\drivers\gfibto.sys
[2013.01.19 16:22:18 | 004,178,040 | ---- | M] (Piriform Ltd) -- C:\Program Files\ccsetup326.exe
[2013.01.19 16:04:21 | 105,661,272 | ---- | M] () -- C:\Program Files\avira_free_antivirus_de.exe
[2013.01.19 12:24:55 | 000,012,793 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Documents\Imperativ Übung Sätze 2.odt
[2013.01.19 12:24:25 | 000,013,615 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Documents\Imperativ Übung Verben 2.odt
[2013.01.19 12:23:47 | 000,016,176 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Documents\Imperativ Übung Sätze-Lösungen 2.odt
[2013.01.12 03:30:18 | 000,095,648 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013.01.12 03:26:16 | 000,174,496 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2013.01.12 03:24:49 | 000,174,496 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2013.01.10 08:33:13 | 000,001,130 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013.01.10 08:32:39 | 020,151,664 | ---- | M] (Mozilla) -- C:\Program Files\Firefox Setup 18.0.exe
[2013.01.10 08:29:37 | 017,301,984 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\AdobeAIRInstaller.exe
[2013.01.09 16:27:29 | 000,697,864 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2013.01.09 16:27:29 | 000,074,248 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013.01.09 12:09:59 | 000,424,008 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.01.09 12:01:30 | 001,520,734 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.01.09 12:01:30 | 000,654,400 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.01.09 12:01:30 | 000,616,242 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.01.09 12:01:30 | 000,130,240 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.01.09 12:01:30 | 000,106,622 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.01.08 12:15:31 | 000,008,726 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\HPG 19-02-2013.odt
[2013.01.06 11:51:05 | 000,008,465 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\trude.odt
[2013.01.06 11:35:52 | 010,000,984 | ---- | M] (Eastman Kodak Company) -- C:\Program Files\aio_install.exe
[2013.01.04 08:37:26 | 000,001,092 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
 
========== Files Created - No Company Name ==========
 
[2013.01.25 07:30:50 | 000,001,226 | ---- | C] () -- C:\Windows\SysWow64\excltmp~.dat
[2013.01.24 17:15:44 | 000,574,315 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\adwcleaner.exe
[2013.01.24 09:53:56 | 000,002,767 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\AppData\Local\recently-used.xbel
[2013.01.23 21:06:22 | 000,001,137 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Express Zip.lnk
[2013.01.23 14:20:55 | 000,001,089 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
[2013.01.23 14:20:55 | 000,001,052 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk
[2013.01.21 14:50:03 | 000,008,371 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\Deutscher Bauernverband Praktikum.odt
[2013.01.21 10:02:14 | 000,000,537 | ---- | C] () -- C:\Windows\wininit.ini
[2013.01.20 10:27:08 | 000,013,934 | ---- | C] () -- C:\Windows\SysWow64\cchservice.err
[2013.01.19 12:24:53 | 000,012,793 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Documents\Imperativ Übung Sätze 2.odt
[2013.01.19 12:24:23 | 000,013,615 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Documents\Imperativ Übung Verben 2.odt
[2013.01.19 12:19:06 | 000,016,176 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Documents\Imperativ Übung Sätze-Lösungen 2.odt
[2013.01.16 14:56:19 | 000,011,582 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\Elternsprechtag Jan 2013.odt
[2013.01.13 17:50:56 | 000,008,802 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\Zu bezahlen.odt
[2013.01.07 10:22:14 | 000,008,726 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\HPG 19-02-2013.odt
[2012.12.30 12:54:17 | 000,008,465 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\trude.odt
[2012.12.22 10:27:42 | 000,002,851 | ---- | C] () -- C:\Program Files\cdroms.cfg
[2012.12.22 10:27:40 | 000,119,808 | ---- | C] () -- C:\Program Files\waiting.avi
[2012.12.22 10:27:40 | 000,067,473 | ---- | C] () -- C:\Program Files\realplay.chm
[2012.12.22 10:27:40 | 000,027,278 | ---- | C] () -- C:\Program Files\frw.bmp
[2012.12.22 10:27:40 | 000,016,296 | ---- | C] () -- C:\Program Files\realtfon.fon
[2012.12.22 10:27:31 | 000,476,724 | ---- | C] () -- C:\Program Files\converter.vs
[2012.12.22 10:27:23 | 000,045,428 | ---- | C] () -- C:\Program Files\sharemedia.vs
[2012.12.22 10:27:23 | 000,001,209 | ---- | C] () -- C:\Program Files\flvplay.swf
[2012.12.22 10:27:22 | 000,033,157 | ---- | C] () -- C:\Program Files\RealNetworks License.html
[2012.12.22 10:27:22 | 000,033,157 | ---- | C] () -- C:\Program Files\playrlic.html
[2012.12.22 10:27:21 | 001,109,306 | ---- | C] () -- C:\Program Files\normal.vs
[2012.12.22 10:27:21 | 000,061,495 | ---- | C] () -- C:\Program Files\ssimages.vs
[2012.12.22 10:27:21 | 000,000,480 | ---- | C] () -- C:\Program Files\keys.dat
[2012.12.22 10:27:17 | 000,001,161 | ---- | C] () -- C:\Program Files\autoplaylist.dat
[2012.12.22 10:27:17 | 000,000,043 | ---- | C] () -- C:\Program Files\strs23.dat
[2012.12.22 10:27:17 | 000,000,013 | ---- | C] () -- C:\Program Files\strs26.dat
[2012.12.22 10:27:16 | 000,427,405 | ---- | C] () -- C:\Program Files\calibrate.rv
[2012.12.22 10:27:16 | 000,017,846 | ---- | C] () -- C:\Program Files\videotest.rm
[2012.12.22 10:27:16 | 000,000,221 | ---- | C] () -- C:\Program Files\subscription.rnx
[2012.12.22 10:27:16 | 000,000,177 | ---- | C] () -- C:\Program Files\freeoffers.rnx
[2012.12.15 13:46:18 | 022,916,830 | ---- | C] () -- C:\Program Files\vlc-2.0.5-win32.exe
[2012.12.15 13:06:25 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2012.09.27 10:19:36 | 000,013,824 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.09.20 06:46:53 | 000,554,496 | ---- | C] () -- C:\Windows\SysWow64\dvmsg.dll
[2012.08.29 08:03:59 | 000,160,350 | ---- | C] () -- C:\Program Files\JavaRa.zip
[2012.08.29 07:42:01 | 009,672,192 | ---- | C] () -- C:\Program Files\Adobe_Flash_Player_AX_11.4.402.265_SPS.exe
[2012.08.29 07:41:24 | 015,567,360 | ---- | C] () -- C:\Program Files\Adobe_AIR_3.4.0.2540_SPS.exe
[2012.08.27 10:09:16 | 152,249,762 | ---- | C] () -- C:\Program Files\Apache_OpenOffice_incubating_3.4.1_Win_x86_install_de.exe
[2012.08.15 11:05:18 | 009,697,792 | ---- | C] () -- C:\Program Files\ShockwavePlayer_11.6.6.636_SPS.exe
[2012.07.15 09:39:36 | 022,657,136 | ---- | C] () -- C:\Program Files\vlc-2.0.2-win32.exe
[2012.06.27 07:54:46 | 009,679,360 | ---- | C] () -- C:\Program Files\Shockwaveplayer_11.6.4.634.exe
[2012.06.17 18:54:57 | 000,000,271 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\burnaware.ini
[2012.06.12 06:48:02 | 007,656,960 | ---- | C] () -- C:\Program Files\cortona3d.msi
[2012.06.12 06:05:13 | 000,441,829 | ---- | C] () -- C:\Program Files\ade-tb-13.0.c.xpi
[2012.06.11 08:53:53 | 000,000,085 | -HS- | C] () -- C:\ProgramData\.zreglib
[2012.05.29 09:37:28 | 151,893,470 | ---- | C] () -- C:\Program Files\Apache_OpenOffice_incubating_3.4.0_Win_x86_install_de.exe
[2012.05.23 17:49:32 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2012.05.23 17:49:32 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2012.05.23 17:49:32 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2012.05.23 17:49:32 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2012.05.22 06:51:22 | 000,338,432 | ---- | C] () -- C:\Windows\SysWow64\sqlite36_engine.dll
[2012.05.19 14:32:36 | 000,278,643 | ---- | C] () -- C:\Program Files\fast_video_download-4.1.6-fx.zip
[2012.05.19 14:22:36 | 196,941,888 | ---- | C] () -- C:\Program Files\ALDI Bestellsoftware Setup.exe
[2012.05.11 07:57:44 | 029,272,056 | ---- | C] () -- C:\Program Files\SaalDesignSoftware2.9.2.exe
[2012.05.05 16:00:03 | 004,998,707 | ---- | C] () -- C:\Program Files\flvplayer_setup20_25.exe
[2012.03.27 12:48:40 | 000,253,952 | ---- | C] () -- C:\Program Files\OOo_3.3.9567.500.exe
[2012.02.25 09:57:51 | 000,155,536 | ---- | C] () -- C:\Windows\SysWow64\dllcinx.exe
[2012.02.25 09:57:49 | 000,000,626 | ---- | C] () -- C:\Windows\SysWow64\nochook.ini
[2012.02.25 09:38:55 | 004,998,707 | ---- | C] () -- C:\Program Files (x86)\flvplayer_setup20_25.exe
[2012.02.24 16:58:29 | 000,000,140 | -H-- | C] () -- C:\Windows\SysWow64\ctlsw.ini
[2012.02.24 16:58:29 | 000,000,091 | ---- | C] () -- C:\Windows\SysWow64\SWCTL.DLL
[2012.02.24 11:05:44 | 018,980,864 | ---- | C] () -- C:\Program Files\SkypeSetup_5.8.0.156.msi
[2012.02.24 10:48:18 | 031,870,976 | ---- | C] () -- C:\Program Files\PXCViewer_x6425201.msi
[2012.02.24 10:47:54 | 001,376,768 | ---- | C] () -- C:\Program Files\7z920-x64.msi
[2012.02.24 10:35:22 | 105,661,272 | ---- | C] () -- C:\Program Files\avira_free_antivirus_de.exe
[2012.02.24 10:15:24 | 168,166,968 | ---- | C] () -- C:\Program Files\OOo_3.3.0_Win_x86_install-wJRE_de.exe
[2012.02.22 08:07:19 | 000,066,856 | ---- | C] () -- C:\Windows\SysWow64\SynTPEnhPS.dll
[2011.11.30 01:26:12 | 000,960,940 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin
[2011.11.30 01:26:09 | 000,213,332 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin
[2011.11.30 01:26:04 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_89001461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_6B071461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_5B011461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_49001461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_3B011461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_33011461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2B071461_ca.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2B071461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2B071461_8a.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2A0F1461_ca.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2A071461_ca.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2A071461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2A071461_8a.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2A031461_ca.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2A031461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_1C011461_61.bin
[2011.11.30 01:23:23 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_A3031461_ca.bin
[2011.11.30 01:23:23 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_A3031461_aa.bin
[2011.11.30 01:23:23 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_A3031461_8a.bin
[2011.11.30 01:23:23 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_83231461_ca.bin
[2011.11.30 01:23:23 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_83231461_aa.bin
[2011.11.30 01:23:23 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_83231461_8a.bin
[2011.11.30 01:23:23 | 000,000,436 | ---- | C] () -- C:\Windows\11317231_1C0F1461_41.bin
[2011.11.30 01:23:23 | 000,000,434 | ---- | C] () -- C:\Windows\11317231_890F1461_ca.bin
[2011.11.30 01:23:23 | 000,000,434 | ---- | C] () -- C:\Windows\11317231_3B0f1461_ca.bin
[2011.11.30 01:23:23 | 000,000,434 | ---- | C] () -- C:\Windows\11317231_2B0f1461_ca.bin
[2011.11.30 01:23:23 | 000,000,434 | ---- | C] () -- C:\Windows\11317231_29001461_ca.bin
[2011.11.30 01:23:23 | 000,000,412 | ---- | C] () -- C:\Windows\11317231_180F1461_ca.bin
[2011.11.30 01:23:23 | 000,000,412 | ---- | C] () -- C:\Windows\11317231_18071461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_14001461_61.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_13011461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_110F1461_ca.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_110F1461_8a.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_11071461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_11071461_8a.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0B071461_ca.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0B071461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0B071461_8a.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0B011461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A0F1461_ca.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A071461_ca.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A071461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A071461_8a.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A031461_ca.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A031461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A011461_ca.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A011461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_09001461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_08071461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_060F1461_ca.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_06071461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_06071461_8a.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_03011461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_03011461_8a.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_02011461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_02011461_8a.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_010F1461_ca.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_010F1461_8a.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_01071461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_01071461_8a.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_07031461_aa.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_03231461_ca.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_03231461_aa.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_03231461_8a.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_03131461_8a.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_03031461_aa.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_02031461_ca.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_02031461_aa.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_02031461_8a.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_00000000_aa.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_00000000_8a.bin
[2011.11.30 01:23:22 | 000,000,434 | ---- | C] () -- C:\Windows\11317231_0B0f1461_ca.bin
[2011.11.30 01:23:22 | 000,000,434 | ---- | C] () -- C:\Windows\11317231_090F1461_ca.bin
[2011.11.30 01:23:22 | 000,000,376 | ---- | C] () -- C:\Windows\11317231_0B001461_aa.bin
[2011.11.30 01:23:22 | 000,000,376 | ---- | C] () -- C:\Windows\11317231_03131461_aa.bin
[2008.04.11 09:11:40 | 000,233,472 | ---- | C] () -- C:\Program Files\VC_RED.MSI
[2008.04.11 09:09:38 | 003,797,292 | ---- | C] () -- C:\Program Files\VC_RED.cab
[2008.04.11 09:07:18 | 000,005,686 | ---- | C] () -- C:\Program Files\vcredist.bmp
[2008.04.11 09:07:18 | 000,001,110 | ---- | C] () -- C:\Program Files\globdata.ini
[2008.04.11 09:07:18 | 000,000,843 | ---- | C] () -- C:\Program Files\install.ini
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

< End of report >
2.

Code:
OTL Extras logfile created on: 25.01.2013 15:04:03 - Run 4
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Jasmina.NICOJAS-PC\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,90 Gb Total Physical Memory | 2,20 Gb Available Physical Memory | 56,42% Memory free
7,79 Gb Paging File | 5,73 Gb Available in Paging File | 73,55% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 265,66 Gb Total Space | 81,54 Gb Free Space | 30,69% Space Free | Partition Type: NTFS
Drive D: | 200,00 Gb Total Space | 199,73 Gb Free Space | 99,87% Space Free | Partition Type: NTFS
 
Computer Name: NICOJAS-PC | User Name: Jasmina | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = ChromeHTML] -- Reg Error: Key error. File not found
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
[HKEY_USERS\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== System Restore Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
"DisableSR" = 1
"DisableConfig" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
"DisableSR" = 1
"DisableConfig" = 1
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03B9EF93-80A8-4845-BBEA-E57E652BBCAF}" = rport=445 | protocol=6 | dir=out | app=system |
"{06E9E081-AF16-48F3-A65C-45D38EFFFDC6}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{13482F04-C479-4714-A5ED-39793B8AAE1D}" = rport=139 | protocol=6 | dir=out | app=system |
"{13E37376-E86C-4019-A725-370DBA1C472E}" = rport=138 | protocol=17 | dir=out | app=system |
"{19ABAAFE-5469-4D69-ADA2-4699E51AAFCF}" = lport=445 | protocol=6 | dir=in | app=system |
"{22BA7DA7-E3C4-47BD-BD6A-B114541112F4}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{2AA89C74-81DA-40D8-903C-81F5681F1A55}" = lport=9322 | protocol=6 | dir=in | name=ekdiscovery |
"{34E72618-0DA7-47D5-A7A0-F15510D9E758}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{482FEDE2-F7D7-4FCF-BC03-256AAC6974E5}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{49716C09-3F9C-404E-B180-E4081D0BBDC8}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{4A808828-8225-46D2-87EC-5E577FAB1B3A}" = lport=139 | protocol=6 | dir=in | app=system |
"{6EEE79D5-2A03-486E-9097-D0C7BAD265DF}" = lport=9322 | protocol=6 | dir=in | name=ekdiscovery |
"{99CBA5AC-9892-45B9-8760-B588F1E908B0}" = lport=5353 | protocol=17 | dir=in | name=bonjour port 5353 |
"{A2DF74D5-A568-4A13-A040-D2D95D6C75DE}" = rport=137 | protocol=17 | dir=out | app=system |
"{A3589360-384E-4156-A3A9-B670DC44F140}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{ADCF185E-AB3F-49C7-B4C6-6FEECB08A98F}" = lport=137 | protocol=17 | dir=in | app=system |
"{D9814FB7-C5B3-41F3-913D-6FC368B5C6E6}" = lport=138 | protocol=17 | dir=in | app=system |
"{F82628F2-3F45-4F25-BAAA-14803BF0F409}" = lport=5353 | protocol=17 | dir=in | name=bonjour port 5353 |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00DE7700-6E5A-4350-9F44-2A7432769CCB}" = protocol=6 | dir=in | app=c:\windows\syswow64\msiexec.exe |
"{02F141FE-498D-4574-A66D-58E2561D793C}" = protocol=17 | dir=in | app=c:\program files (x86)\2k sports\nba 2k13\nba2k13.exe |
"{126782C9-2354-44F3-8F23-A92D102A4E93}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\center\kodak.statistics.exe |
"{2F2EB0A3-4B90-4E33-8C0C-80A6A9C83A72}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\firmware\kodakaioupdater.exe |
"{2F5BDC80-D4CF-46DA-BFFF-FB1A05C2693B}" = protocol=17 | dir=in | app=c:\program files (x86)\cyanide\gamecenter\gamecenter.exe |
"{300ACAB8-ACF5-4FC8-A2ED-1BF12C2151CD}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\center\networkprinterdiscovery.exe |
"{36C3CA04-80CA-4D39-B6C5-AF220F844087}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\center\kodak.statistics.exe |
"{3AB28388-7EB4-46AA-8C6D-806B6571D56D}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\center\aiohomecenter.exe |
"{3B630698-B25B-41DF-8EF9-E2B396B0B083}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\firmware\kodakaioupdater.exe |
"{3CAEF7AF-5FBE-4237-9D6F-D6C0A7991314}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\center\aiohomecenter.exe |
"{3E609762-8618-4993-A50C-77D22F878630}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{43CBC248-7E0B-477C-8DB0-449AE476C7D5}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\firmware\kodakaioupdater.exe |
"{45B64134-8F9D-49F1-8940-F8D85BA68411}" = protocol=6 | dir=in | app=c:\program files (x86)\2k sports\nba 2k13\nba2k13.exe |
"{461D9763-7840-401C-8EA8-A9016EAFB6A0}" = protocol=17 | dir=in | app=c:\programdata\kodak\installer\setup.exe |
"{4B4AC4D5-F226-4ED8-91F7-5BF8E74E2912}" = protocol=6 | dir=in | app=c:\windows\syswow64\muzapp.exe |
"{4D4EFD79-8431-489B-ACBF-22842823D940}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{5CE13E4F-212C-42A3-98D7-C10DCBBAEAB8}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\center\networkprinterdiscovery.exe |
"{6286D4F7-67FF-4293-AA87-AC04E642A996}" = protocol=6 | dir=in | app=c:\programdata\kodak\installer\setup.exe |
"{673EE027-9D91-408D-8E7F-F9EAE8AA5195}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\firmware\kodakaioupdater.exe |
"{7FBC02D6-A43E-46B5-B55E-F878996E72CA}" = protocol=6 | dir=in | app=c:\programdata\kodak\installer\setup.exe |
"{80514CFD-8048-4C14-B844-9891D4854D21}" = protocol=6 | dir=in | app=c:\program files (x86)\sweetim\communicator\sweetpacksupdatemanager.exe |
"{83AF232F-8E60-4AE4-91F3-177AADA4C95D}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\center\aiohomecenter.exe |
"{86B3BA1A-EB42-41EB-8BE5-ED2F3CCD803F}" = protocol=17 | dir=in | app=d:\tobit radio.fx\client\rfx-client.exe |
"{8A47FCBE-4950-4015-8D01-2C2AC9895ED7}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\center\kodak.statistics.exe |
"{8A76F869-12AA-4BBE-8D9F-B97FFECBF30E}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\center\aiohomecenter.exe |
"{91EB51CE-59DF-48E1-BAF4-52E98B8F4352}" = protocol=17 | dir=in | app=d:\tobit radio.fx\server\rfx-server.exe |
"{97EB7143-70C5-495B-B9AF-62423A6EB4CC}" = protocol=17 | dir=in | app=c:\windows\syswow64\msiexec.exe |
"{9B906E24-8273-4393-AA06-F8A6FDA9FFC3}" = protocol=17 | dir=in | app=c:\program files (x86)\sweetim\communicator\sweetpacksupdatemanager.exe |
"{9E64C8F7-38F7-4211-9F24-27502D9F9377}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\center\networkprinterdiscovery.exe |
"{A2834B87-C86E-4D08-90B2-DA67BCA1716B}" = protocol=6 | dir=in | app=c:\program files (x86)\cyanide\gamecenter\gamecenter.exe |
"{A301FAD5-5412-4D17-BFE7-FECBF23E370B}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{A7F89437-5CF4-4291-AC2D-3A780F3ABEE7}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{BD7E8F19-BBB9-4C22-A1A9-13145F003618}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{BE688A9C-1735-4E3E-A89C-BC83633D49E9}" = protocol=17 | dir=in | app=c:\windows\syswow64\muzapp.exe |
"{BF64C12D-723D-4411-A3FB-77E0F02E6A4A}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\center\kodak.statistics.exe |
"{C290BE6A-1286-4F6B-8429-B0EC7335FEE4}" = protocol=6 | dir=in | app=d:\tobit radio.fx\server\rfx-server.exe |
"{C8790961-8656-4860-9076-A2D6623D10E5}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\center\networkprinterdiscovery.exe |
"{CC860D3A-C81A-4786-878A-4D6E17556474}" = protocol=17 | dir=in | app=c:\windows\syswow64\muzapp.exe |
"{CD406032-BF04-4303-912E-D7130F577CF8}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{CD7240F0-B94F-46EF-926F-AAE573567F82}" = protocol=6 | dir=in | app=d:\tobit radio.fx\client\rfx-client.exe |
"{DC484A61-D39E-484F-ABAC-79D0B001A970}" = protocol=6 | dir=in | app=c:\windows\syswow64\muzapp.exe |
"{E590CA35-BF4B-43AB-AD11-E1DFA3E5E85F}" = dir=in | app=c:\program files (x86)\dell stage\videostage\videostage.exe |
"{EB9E90E3-6809-4C85-8486-954384E4415E}" = protocol=17 | dir=in | app=c:\programdata\kodak\installer\setup.exe |
"TCP Query User{2C129A0F-15ED-4EB5-B1D1-52762861834F}C:\users\nico.nicojas-pc\appdata\local\facebook\video\skype\facebookvideocalling.exe" = protocol=6 | dir=in | app=c:\users\nico.nicojas-pc\appdata\local\facebook\video\skype\facebookvideocalling.exe |
"TCP Query User{415EE727-2686-4681-A0CC-B633456BC9A1}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe |
"TCP Query User{44F9B41D-F81E-4237-B65C-495E923A0A91}C:\users\nico.nicojas-pc\appdata\local\facebook\video\skype\facebookvideocalling.exe" = protocol=6 | dir=in | app=c:\users\nico.nicojas-pc\appdata\local\facebook\video\skype\facebookvideocalling.exe |
"TCP Query User{56412238-720A-46B5-A739-61A80F922067}C:\users\nico.nicojas-pc\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\nico.nicojas-pc\appdata\roaming\spotify\spotify.exe |
"TCP Query User{9B9701E4-29D1-4FF2-979C-8597475BDD6F}C:\program files (x86)\ea sports\fifa 11\game\fifa.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ea sports\fifa 11\game\fifa.exe |
"TCP Query User{D1677699-5DF9-4125-9F3C-4687B71E4538}C:\program files (x86)\ea sports\fifa 11\game\fifa.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ea sports\fifa 11\game\fifa.exe |
"TCP Query User{E0CFE6E6-8D1F-4EA9-8CB2-172678AAC4F5}C:\users\nico.nicojas-pc\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\nico.nicojas-pc\appdata\roaming\spotify\spotify.exe |
"UDP Query User{01DE79D1-8DE7-4447-ADB8-56C8B3C7497B}C:\users\nico.nicojas-pc\appdata\local\facebook\video\skype\facebookvideocalling.exe" = protocol=17 | dir=in | app=c:\users\nico.nicojas-pc\appdata\local\facebook\video\skype\facebookvideocalling.exe |
"UDP Query User{2F8A7DF9-1087-41D1-8A2C-9992D60A33F1}C:\program files (x86)\ea sports\fifa 11\game\fifa.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ea sports\fifa 11\game\fifa.exe |
"UDP Query User{40F012E4-AE29-44CC-BD71-803C69499479}C:\users\nico.nicojas-pc\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\nico.nicojas-pc\appdata\roaming\spotify\spotify.exe |
"UDP Query User{5DEF9C85-2CF8-4430-B799-143CCE815566}C:\users\nico.nicojas-pc\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\nico.nicojas-pc\appdata\roaming\spotify\spotify.exe |
"UDP Query User{7D3AE024-0E92-4F74-A165-5F405D7115A1}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe |
"UDP Query User{BA636B01-B9F1-4665-9285-7B080D1B5368}C:\users\nico.nicojas-pc\appdata\local\facebook\video\skype\facebookvideocalling.exe" = protocol=17 | dir=in | app=c:\users\nico.nicojas-pc\appdata\local\facebook\video\skype\facebookvideocalling.exe |
"UDP Query User{FC56FE20-5872-4926-A640-6CA999CC5F9B}C:\program files (x86)\ea sports\fifa 11\game\fifa.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ea sports\fifa 11\game\fifa.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{0645A454-AD44-4F0D-99CF-6B762735AD1F}" = aioprnt
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)
"{27EF8E7F-88D1-4ec5-ADE2-7E447FDF114E}" = Kodak AIO Printer
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{87CF757E-C1F1-4D22-865C-00C6950B5258}" = Quickset64
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1" = PDF-Viewer
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Optimus" = NVIDIA Optimus 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}" = PlayReady PC Runtime amd64
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"GIMP-2_is1" = GIMP 2.8.2
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"SynTPDeinstKey" = Synaptics Pointing Device Driver
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D98F04D-11A1-4B64-A406-43292B9EEE90}" = Dell PhotoStage
"{1798D459-6B8B-474B-868D-1229EADA3B95}" = Adobe AIR
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}" = OpenOffice.org 3.4.1
"{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java(TM) 6 Update 33
"{26A24AE4-039D-4CA4-87B4-2F83217009FF}" = Java 7 Update 11
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{376348C2-E372-48BC-A138-E896757BD86A}" = aioscnnr
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3E90B7F4-1817-4405-B4A5-E4EA5EC0E2B3}" = Dell MusicStage
"{3FEA6CD1-EA13-4CE7-A74E-A74A4A0A7B5C}" = FIFA 11
"{56BA241F-580C-43D2-8403-947241AAE633}" = center
"{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6F545E5E-4595-11E2-93B6-B8AC6F97B88E}" = Google Earth
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D318C86-AF4C-409F-A6AC-7183FF4CF424}" = Internet-TV für Windows Media Center
"{9F06F464-479A-403E-AF92-70CBB8D674A1}" = PRE10STI64Installer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAECF7BA-E83B-4A10-87EA-DE0B333F8734}" = RealNetworks - Microsoft Visual C++ 2010 Runtime
"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
"{AF7EBCA4-9FAF-4DC8-8D09-67854BB84D34}" = RealDownloader
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B92C5909-1D37-4C51-8397-A28BB28E5DC3}" = Facebook Video Calling 1.2.0.287
"{BE94C681-68E2-4561-8ABC-8D2E799168B4}" = essentials
"{BFBCF96F-7361-486A-965C-54B17AC35421}" = ocr
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D96B6543-A0C0-4351-AF96-73DEF1DD6820}" = NBA 2K13
"{DA5BDB2A-12F0-4343-8351-21AAEB293990}" = PreReq
"{DCE0E79A-B9AC-41AC-98C1-7EF0538BCA7F}" = Dell VideoStage
"{DEACDFFA-D424-416F-B849-FA282F55B2CE}" = Cortona3D Viewer
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E0F274B7-592B-4669-8FB8-8D9825A09858}" = KODAK All-in-One Software
"{E2F57269-065E-4B19-8CDA-AB6C401FAF1A}" = Dell Stage
"{E4335E82-17B3-460F-9E70-39D9BC269DB3}" = Dell PhotoStage
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{EF53BFAB-4C10-40DB-A82D-9B07111715C6}" = aioscnnr
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics
"{F5266D28-E0B2-4130-BFC5-EE155AD514DC}" = Apple Application Support
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"ALDI Bestellsoftware" = ALDI Bestellsoftware 4.12.1
"Ashampoo Burning Studio 6 FREE_is1" = Ashampoo Burning Studio 6 FREE v.6.81
"Avira AntiVir Desktop" = Avira Free Antivirus
"Dell Webcam Central" = Dell Webcam Central
"ExpressBurn" = Express Burn
"ExpressRip" = Express Rip
"ExpressZip" = Express Zip
"FLV Player" = FLV Player 2.0 (build 25)
"Free M4a to MP3 Converter_is1" = Free M4a to MP3 Converter 7.0
"Free YouTube to iPod Converter_is1" = Free YouTube to iPod Converter version 3.10.32.918
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.32.918
"InstallShield_{DCE0E79A-B9AC-41AC-98C1-7EF0538BCA7F}" = Dell VideoStage
"Kindersicherung_is1" = Kindersicherung 2012
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"MixPad" = MixPad Audiodatei-Mixer
"Mozilla Firefox 18.0.1 (x86 de)" = Mozilla Firefox 18.0.1 (x86 de)
"Mozilla Thunderbird 17.0.2 (x86 de)" = Mozilla Thunderbird 17.0.2 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"PrintProjects" = PrintProjects
"RealPlayer 16.0" = RealPlayer
"Secunia PSI" = Secunia PSI (3.0.0.6001)
"Tobit Radio.fx Server 1" = WDR RadioRecorder
"Video Converter" = Video Converter
"VLC media player" = VLC media player 2.0.5
"WavePad" = WavePad Audiobearbeitungs-Software
"WinLiveSuite" = Windows Live Essentials
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 24.10.2012 06:21:15 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 439
Description = Windows (2888) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk
 konnte nicht geschrieben werden. Fehler -1032.
 
Error - 24.10.2012 06:24:30 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 490
Description = Windows (2888) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 24.10.2012 06:24:30 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 439
Description = Windows (2888) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk
 konnte nicht geschrieben werden. Fehler -1032.
 
Error - 24.10.2012 06:26:43 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 490
Description = Windows (2888) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 24.10.2012 06:26:43 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 439
Description = Windows (2888) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk
 konnte nicht geschrieben werden. Fehler -1032.
 
Error - 24.10.2012 06:26:53 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 490
Description = Windows (2888) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 24.10.2012 06:26:53 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 439
Description = Windows (2888) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk
 konnte nicht geschrieben werden. Fehler -1032.
 
Error - 24.10.2012 06:27:03 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 490
Description = Windows (2888) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 24.10.2012 06:27:03 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 439
Description = Windows (2888) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk
 konnte nicht geschrieben werden. Fehler -1032.
 
Error - 24.10.2012 06:44:26 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 490
Description = Windows (2888) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 24.10.2012 06:44:26 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 439
Description = Windows (2888) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk
 konnte nicht geschrieben werden. Fehler -1032.
 
[ Media Center Events ]
Error - 20.03.2012 15:11:39 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 20:11:34 - Fehler beim Herstellen der Internetverbindung.  20:11:34
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 20.03.2012 16:11:42 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 21:11:42 - Fehler beim Herstellen der Internetverbindung.  21:11:42
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 20.03.2012 16:11:51 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 21:11:47 - Fehler beim Herstellen der Internetverbindung.  21:11:47
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 05.05.2012 14:52:38 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 20:44:58 - EpgListing.enc konnte nicht abgerufen werden (Fehler: HTTP-Status
 404: Die angeforderte URL ist auf diesem Server nicht vorhanden.  ) 
 
Error - 22.05.2012 14:13:50 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 20:13:50 - Fehler beim Herstellen der Internetverbindung.  20:13:50
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 22.05.2012 14:14:07 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 20:13:55 - Fehler beim Herstellen der Internetverbindung.  20:13:55
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 13.07.2012 14:26:21 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 20:26:21 - Fehler beim Herstellen der Internetverbindung.  20:26:21
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 13.07.2012 14:26:39 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 20:26:27 - Fehler beim Herstellen der Internetverbindung.  20:26:27
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 24.08.2012 15:46:57 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 21:46:57 - Fehler beim Herstellen der Internetverbindung.  21:46:57
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 24.08.2012 15:47:42 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 21:47:11 - Fehler beim Herstellen der Internetverbindung.  21:47:11
-    Serververbindung konnte nicht hergestellt werden.. 
 
[ System Events ]
Error - 25.01.2013 02:29:55 | Computer Name = NicoJas-Pc | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
 
Error - 25.01.2013 02:30:36 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7000
Description = Der Dienst "UAC-Dateivirtualisierung" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%2
 
Error - 25.01.2013 02:31:09 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  SBRE
 
Error - 25.01.2013 06:26:51 | Computer Name = NicoJas-Pc | Source = DCOM | ID = 10010
Description =
 
Error - 25.01.2013 06:51:20 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7000
Description = Der Dienst "UAC-Dateivirtualisierung" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%2
 
Error - 25.01.2013 06:51:54 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  SBRE
 
Error - 25.01.2013 07:01:24 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7000
Description = Der Dienst "UAC-Dateivirtualisierung" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%2
 
Error - 25.01.2013 07:02:01 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  SBRE
 
Error - 25.01.2013 09:55:32 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7000
Description = Der Dienst "UAC-Dateivirtualisierung" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%2
 
Error - 25.01.2013 09:56:10 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  SBRE
 
 
< End of report >
danke vielmals und bis später,

jasmina

cosinus 25.01.2013 15:49
Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle einen Quickscan mit Malwarebytes - denk bitte vorher daran, Malwarebytes über den Updatebutton zu aktualisieren

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Rheingold 25.01.2013 22:29
Okay, mache ich.

Malwarebytes meldet immer noch einen Fund. Unten der logfile. Eset schaffe ich erst morgen. :sleepy:

Code:
Malwarebytes Anti-Malware 1.70.0.1100
www.malwarebytes.org

Datenbank Version: v2013.01.25.07

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Jasmina :: NICOJAS-PC [Administrator]

25.01.2013 22:22:09
MBAM-log-2013-01-25 (22-26-15).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM | P2P
Deaktivierte Suchlaufeinstellungen:
Durchsuchte Objekte: 303284
Laufzeit: 3 Minute(n), 36 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 1
HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore|DisableConfig (Windows.Tool.Disabled) -> Bösartig: (1) Gut: (0) -> Keine Aktion durchgeführt.

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Hallo,
hier nun der log vom eset scanner.
Viele Grüße, Jasmina :kaffee:

Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6889
# api_version=3.0.2
# EOSSerial=02c4373600dc4248b1aa8d94034e57dc
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-01-26 08:27:50
# local_time=2013-01-26 09:27:50 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 96 9740 224612160 2525 0
# compatibility_mode=5893 16776573 100 94 9776 110818720 0 0
# scanned=217272
# found=0
# cleaned=0
# scan_time=5291
ESETSmartInstaller@High as downloader log:
all ok

cosinus 26.01.2013 21:36
Sieht soweit ok aus, Malwarebytes hat nur gemeckert, dass deine Systemwiederherstellung deaktiv ist. Diese bitte aktivieren.

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Rheingold 27.01.2013 20:31
Hallo Cosinus,
das ist ja super!
Allerdings, an der Systemwiederherstellung habe ich m.W. nie was eingestellt.
Ich kann sie auch nicht aktivieren, weil dann kommt die Meldung: "Die Systemwiederherstellung wurde vom Systemadministrator deaktivert."
Aber ich bin auf dem Admin-Konto. Habe zur Aktivierung der vollständigen Administratorenrechte Folgendes ausgeführt:

1. auf “Start” geklickt
2. im Feld “Programme/Dateien durchsuchen“, cmd eingegeben
3. mit rechter Maustaste als Administrator cmd.exe” ausgeführt
4. im Command-Shell Fenster folgendes eingeben -> net user Administrator /active:yes
5. mit “Enter” bestätigt

Aber das hat nichts geändert. Was bedeutet das und was kann ich nun tun?

Viele Grüße
Jasmina :confused:

cosinus 28.01.2013 11:53
Downloade dir bitte Farbar's Service Scanner
  • Starte das Tool mit Doppelklick auf die FSS.exe
  • Gehe sicher, dass folgende Optionen angehakt sind.
    • Internet Services
    • Windows Firewall
    • System Restore
    • SecurityCenter / ActionCenter
  • Klicke auf Scan.
  • Wenn das Tool fertig ist, wird es eine FSS.txt in dem Verzeichnis erstellen, wo das Tool gelaufen ist.
Poste bitte den Inhalt hier.

Rheingold 28.01.2013 13:11
okay, mache ich!

So, hier Fss Ergebnisse:

Code:
Farbar Service Scanner Version: 16-01-2013
Ran by Jasmina (administrator) on 28-01-2013 at 13:14:37
Running from "C:\Users\Jasmina.NICOJAS-PC\Desktop"
Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Attempt to access Google IP returned error. Google IP is offline
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
"DisableSR"=DWORD:1
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
"DisableConfig"=DWORD:1


Action Center:
============

Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit


**** End of log ****

cosinus 28.01.2013 14:08

Fixen mit OTL

  • Starte bitte die OTL.exe.
  • Kopiere nun den Inhalt aus der Codebox in die Textbox.
Code:
:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
"DisableSR"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
"DisableConfig"=-
  • Solltest du deinen Benutzernamen z. B. durch "*****" unkenntlich gemacht haben, so füge an entsprechender Stelle deinen richtigen Benutzernamen ein. Andernfalls wird der Fix nicht funktionieren.
  • Schließe bitte nun alle Programme.
  • Klicke nun bitte auf den Fix Button.
  • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
  • Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
    ( Auch zu finden unter C:\_OTL\MovedFiles\<Uhrzeit_Datum>.txt)
    Kopiere nun den Inhalt hier in Deinen Thread

Rheingold 28.01.2013 14:26
habe ich gemacht. hier otl:
Code:
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore\\DisableSR deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore\\DisableConfig deleted successfully.
 
OTL by OldTimer - Version 3.2.69.0 log created on 01282013_142445

cosinus 28.01.2013 14:28
Geht die SWH nun wieder?

Rheingold 28.01.2013 14:32
Ja, ich kann sie auf jeden Fall wieder in der Systemsteuerung aktivieren und deaktivieren! Danke vielmals! Jetzt solllte alles okay sein, oder?


Jasmina

cosinus 28.01.2013 14:38
Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter.

Combofix entfernen: Start/Ausführen (Tastenkombination WIN+R), dort den Befehl combofix /uninstall eintippen und ausführen

Mit Hilfe von OTL kannst du auch viele andere Tools entfernen: Starte dazu einfach OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.

Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.


Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate
Windows XP:Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.
Windows Vista/7: Start, Systemsteuerung, Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks findest du hier => Browsers and Plugins - FilePony.de

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein großes Sicherheitsrisiko, daher solltest Du die alten Versionen deinstallieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software (bzw. Programme und Funktionen) und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

Rheingold 28.01.2013 17:59
Secunia und PDF-XChange Viewer habe ich schon, Windows Update auch, zur Aktualisierung von Java nutze ich JavaRa, ich hoffe, dass ist okay.

Die anderen Sachen überprüfe ich jetzt.

Hallo Cosinus,
alles erledigt.

Ich habe jetzt noch mal einen Scan mit Malwarebytes durchgeführt und die Meldung kommt immer noch. Was soll ich damit machen? EInfach ignorieren?

Viele Grüße
Jasmina

Code:
Malwarebytes Anti-Malware 1.70.0.1100
www.malwarebytes.org

Datenbank Version: v2013.01.28.07

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Jasmina :: NICOJAS-PC [Administrator]

28.01.2013 18:06:04
MBAM-log-2013-01-28 (18-25-12).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM | P2P
Deaktivierte Suchlaufeinstellungen:
Durchsuchte Objekte: 303853
Laufzeit: 4 Minute(n), 2 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 1
HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore|DisableConfig (Windows.Tool.Disabled) -> Bösartig: (1) Gut: (0) -> Keine Aktion durchgeführt.

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

cosinus 28.01.2013 22:38
Ja ist die SWH denn nun wieder inaktiv :confused:

Rheingold 29.01.2013 08:56
Hallo,
ja, die ist wieder inaktiv: "Computerschutz, Systemeigenschaften: Systemwiederherstellung wurde vom Administrator deaktiviert"

Viele Grüße,
Jasmina

cosinus 29.01.2013 12:41
Auman :stirn:

Malwarebytes Anti-Rootkit http://img.trojaner-board.de/malware...otkit/logo.png

Downloade dir bitte Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Entpacke das Archiv auf deinem Desktop.
  • Im neu erstellten Ordner starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Rheingold 29.01.2013 15:36
Kein Problem, Geduld habe ich auf jeden Fall! :-)

Allerdings habe ich noch was festgestellt. Der PC ist nicht mehr im abgesicherten Modus zu straten. D.h., er fährt hoch, bis zur Auswahl der Benutzerkonten und fährt nach max. 5 Sekunden automatisch wieder runter. :eek:

VG, Jasmina

cosinus 29.01.2013 15:48
Eins nach dem anderen. Ich denke da ist immer noch was aktiuv, aber mal sehen ob wir das finden

Rheingold 29.01.2013 15:55
Zitat:
Zitat von cosinus (Beitrag 1001147)
Eins nach dem anderen. Ich denke da ist immer noch was aktiuv, aber mal sehen ob wir das finden
okay:daumenhoc

Habe ich gemacht. Die Infektion war bem zweiten Druchlauf wieder da.
1. logfile:

Code:
Malwarebytes Anti-Rootkit BETA 1.01.0.1017
www.malwarebytes.org

Database version: v2013.01.29.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Administrator :: NICOJAS-PC [administrator]

29.01.2013 16:30:46
mbar-log-2013-01-29 (16-30-46).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 31219
Time elapsed: 11 minute(s), 42 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 2
HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\SYSTEMRESTORE|DisableConfig (Windows.Tool.Disabled) -> Bad: (1) Good: (0) -> Delete on reboot.
HKLM\SOFTWARE\WOW6432NODE\POLICIES\MICROSOFT\WINDOWS NT\SYSTEMRESTORE|DisableConfig (Windows.Tool.Disabled) -> Bad: (1) Good: (0) -> Delete on reboot.

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
2. logfile

Code:
Malwarebytes Anti-Rootkit BETA 1.01.0.1017
www.malwarebytes.org

Database version: v2013.01.29.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Administrator :: NICOJAS-PC [administrator]

29.01.2013 16:53:27
mbar-log-2013-01-29 (16-53-27).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 31206
Time elapsed: 12 minute(s), 47 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 2
HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\SYSTEMRESTORE|DisableConfig (Windows.Tool.Disabled) -> Bad: (1) Good: (0) -> Delete on reboot.
HKLM\SOFTWARE\WOW6432NODE\POLICIES\MICROSOFT\WINDOWS NT\SYSTEMRESTORE|DisableConfig (Windows.Tool.Disabled) -> Bad: (1) Good: (0) -> Delete on reboot.

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

cosinus 29.01.2013 20:27
Rechner bitte neu starten, neue Kontrolle mit FSS

Downloade dir bitte Farbar's Service Scanner
  • Starte das Tool mit Doppelklick auf die FSS.exe
  • Gehe sicher, dass folgende Optionen angehakt sind.
    • Internet Services
    • Windows Firewall
    • System Restore
    • SecurityCenter / ActionCenter
  • Klicke auf Scan.
  • Wenn das Tool fertig ist, wird es eine FSS.txt in dem Verzeichnis erstellen, wo das Tool gelaufen ist.
Poste bitte den Inhalt hier.

Rheingold 29.01.2013 22:52
okay hier ist das ergebnis:

Code:
Farbar Service Scanner Version: 16-01-2013
Ran by Jasmina (administrator) on 29-01-2013 at 22:49:59
Running from "C:\Users\Jasmina.NICOJAS-PC\Desktop"
Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Attempt to access Google IP returned error. Google IP is offline
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
"DisableSR"=DWORD:1
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
"DisableConfig"=DWORD:1


Action Center:
============

Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit


**** End of log ****

cosinus 30.01.2013 11:08
Hm, ich glaub ich bin das Thema falsch angegangen.

Starte bitte mal regedit über Start/Ausführen.
Navigiere nach HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
Im Rechten Teilfenster bitte auf DisableSR doppelt klicken, den Wert 1 bitte umändern in 0 ("null")

Vgl bitte Windowspage - Tipps - Systemwiederherstellung - Für alle Laufwerke erzwingen/deaktivieren

Starte nachdem du den Wert von 1 auf 0 geändert hast Windows neu und überprüfe ob die SWH noch aktiv ist.

Rheingold 30.01.2013 11:24
Hallo Cosinus,
mache ich!

Danke!
Jasmina

Wenn ich den Wert auf 0 setze, sind die Buttons Systemwiederherstellung und Erstellen (Wiederherstellungspunkt) aktiv, Konfigurieren ist inaktiv, Schutz für C "Ein".

Allerdings: nach kurzer Zeit / PC-Aktivität und nach Neustart ist der Wert wieder auf 1 gesetzt und die Systemwiederherstellung ist inaktiv (Wert bei C steht aber auf "Ein")

Viele Grüße
Jasmina

P.s.: mein Pfad dahin ist:
HKEY_LOCAL_MACHINE
Software
Policies
Microsoft
Windows NT
SystemRestore

Ich hoffe, das ist okay.

cosinus 30.01.2013 14:34
Irgendwas merkt diese Änderung und macht es wieder rückgängig :pfui:

Du könntest mal mit dieser Kaspersky Rescue Disk das System scannen => http://www.trojaner-board.de/83997-k...scue-disk.html
Vorteil: Das System wird über ein anderes Betriebssystem gescannt, damit wird sichergestellt, dass kein evtl. aktiver Schädling die Scanergebnisse beeinflussen kann.

Rheingold 31.01.2013 07:11
Hallo,
bei dem Scan gestern ist kein Befall festgestellt worden. Das Abspeichern des Berichts habe ich aber nicht hinbekommen. Ich lasse den Scan noch mal durchlaufen und poste dann den Bericht.

Viele Grüße
Jasmina :kaffee:

cosinus 31.01.2013 09:20
Bitte mal ein Log mit CF machen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Rheingold 31.01.2013 14:57
hier der log von combofix.
Viele Grüße, Jasmina

Code:
ComboFix 13-01-31.01 - Jasmina 31.01.2013  14:27:10.2.8 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.3990.2139 [GMT 1:00]
ausgeführt von:: c:\users\Jasmina.NICOJAS-PC\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-12-28 bis 2013-01-31  ))))))))))))))))))))))))))))))
.
.
2013-01-31 13:30 . 2013-01-31 13:30        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp
2013-01-31 13:30 . 2013-01-31 13:30        --------        d-----w-        c:\users\Nico.NICOJAS-PC\AppData\Local\temp
2013-01-31 13:30 . 2013-01-31 13:30        --------        d-----w-        c:\users\Jasmina\AppData\Local\temp
2013-01-31 13:30 . 2013-01-31 13:30        --------        d-----w-        c:\users\Default\AppData\Local\temp
2013-01-31 13:30 . 2013-01-31 13:30        --------        d-----w-        c:\users\Administrator\AppData\Local\temp
2013-01-30 16:37 . 2013-01-30 21:35        --------        d---a-w-        C:\Kaspersky Rescue Disk 10.0
2013-01-30 15:02 . 2013-01-30 15:02        834544        ----a-w-        c:\windows\system32\drivers\sptd.sys
2013-01-30 15:02 . 2013-01-30 15:02        --------        d-----w-        c:\program files (x86)\LSoft Technologies
2013-01-30 15:00 . 2013-01-30 15:00        5053696        ----a-w-        c:\program files\IsoBurner-Setup.exe
2013-01-30 08:55 . 2013-01-31 06:07        --------        d---a-w-        C:\Navilog1
2013-01-30 08:55 . 2013-01-30 08:57        --------        d-----w-        c:\program files (x86)\Navilog1
2013-01-29 14:25 . 2009-07-13 23:15        246216        ----a-w-        c:\windows\SysWow64\wdrvhook.dll
2013-01-29 12:11 . 2013-01-08 05:32        9161176        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{12095963-45D2-48C9-83D1-8045FF56CE55}\mpengine.dll
2013-01-29 11:06 . 2013-01-29 11:06        --------        d-----w-        C:\Device
2013-01-29 10:41 . 2013-01-29 10:41        --------        d-----w-        c:\users\Administrator\AppData\Local\Programs
2013-01-29 09:15 . 2013-01-29 09:15        --------        d-----w-        c:\users\Administrator\AppData\Roaming\TuneUp Software
2013-01-29 09:15 . 2013-01-29 09:24        --------        d-sh--w-        c:\programdata\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}
2013-01-29 08:44 . 2013-01-29 08:44        --------        d-----w-        c:\users\Administrator\AppData\Roaming\SpeedMaxPc
2013-01-29 08:44 . 2013-01-29 08:44        --------        d-----w-        c:\users\Administrator\AppData\Roaming\DriverCure
2013-01-29 08:44 . 2013-01-29 09:17        --------        d-----w-        c:\programdata\SpeedMaxPc
2013-01-28 07:48 . 2013-01-28 07:48        --------        d-----w-        c:\users\Jasmina.NICOJAS-PC\AppData\Local\Diagnostics
2013-01-27 15:58 . 2013-01-27 15:58        --------        d-----w-        c:\users\Administrator\AppData\Roaming\Malwarebytes
2013-01-27 08:15 . 2013-01-27 08:15        --------        d-----w-        c:\users\Administrator\AppData\Local\Macromedia
2013-01-27 08:15 . 2013-01-27 08:15        --------        d-----w-        c:\users\Administrator\AppData\Roaming\RealNetworks
2013-01-27 07:17 . 2013-01-27 07:17        --------        d-----w-        c:\users\Administrator\AppData\Roaming\Avira
2013-01-24 10:04 . 2013-01-24 10:04        --------        d-----w-        c:\program files\PDF Viewer
2013-01-24 09:57 . 2013-01-24 09:58        19443001        ----a-w-        c:\program files\PDFXVwer.exe
2013-01-23 13:20 . 2013-01-23 13:20        --------        d-----w-        c:\program files (x86)\Secunia
2013-01-23 13:14 . 2013-01-23 13:14        3137416        ----a-w-        c:\program files\PSISetup6001.exe
2013-01-21 11:13 . 2013-01-21 11:13        --------        d-----w-        c:\program files (x86)\Toolbar Cleaner
2013-01-20 18:34 . 2013-01-20 18:34        --------        d-----w-        c:\users\Nico.NICOJAS-PC\AppData\Roaming\Avira
2013-01-19 15:22 . 2013-01-19 15:22        4178040        ----a-w-        c:\program files\ccsetup326.exe
2013-01-19 15:16 . 2013-01-19 15:16        --------        d-----w-        c:\users\Jasmina.NICOJAS-PC\AppData\Roaming\Avira
2013-01-19 15:12 . 2013-01-19 15:12        --------        d-----w-        c:\programdata\Avira
2013-01-19 15:12 . 2013-01-19 15:12        --------        d-----w-        c:\program files (x86)\Avira
2013-01-19 15:12 . 2012-12-03 14:36        129216        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2013-01-19 15:12 . 2012-12-03 14:36        99912        ----a-w-        c:\windows\system32\drivers\avgntflt.sys
2013-01-19 15:12 . 2012-11-16 19:17        27800        ----a-w-        c:\windows\system32\drivers\avkmgr.sys
2013-01-18 08:13 . 2013-01-12 02:30        95648        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-01-16 20:01 . 2013-01-16 21:16        --------        d-----w-        c:\users\Nico.NICOJAS-PC\AppData\Roaming\Ad-Aware Antivirus
2013-01-16 20:01 . 2013-01-16 20:01        --------        d-----w-        c:\users\Nico.NICOJAS-PC\AppData\Local\adawarebp
2013-01-16 15:42 . 2013-01-16 15:42        --------        d-----w-        c:\program files\Definitions
2013-01-16 15:42 . 2013-01-21 11:14        14456        ----a-w-        c:\windows\system32\drivers\gfibto.sys
2013-01-14 07:43 . 2013-01-14 07:43        --------        d-----w-        c:\windows\SysWow64\20-20 Technologies
2013-01-10 07:31 . 2013-01-10 07:32        20151664        ----a-w-        c:\program files\Firefox Setup 18.0.exe
2013-01-09 14:07 . 2013-01-09 16:15        --------        d-----w-        c:\program files (x86)\Mozilla Thunderbird
2013-01-09 05:38 . 2012-11-30 05:41        424448        ----a-w-        c:\windows\system32\KernelBase.dll
2013-01-06 10:48 . 2012-10-08 09:06        261632        ----a-w-        c:\windows\system32\Spool\prtprocs\x64\EKIJ5000PPR.dll
2013-01-06 10:43 . 2013-01-06 10:44        --------        d-----w-        c:\windows\SysWow64\kodak
2013-01-06 10:42 . 2013-01-06 10:42        --------        d-----w-        c:\windows\SysWow64\spool
2013-01-06 10:35 . 2013-01-06 10:35        10000984        ----a-w-        c:\program files\aio_install.exe
2013-01-04 07:37 . 2013-01-04 07:37        --------        d-----w-        c:\users\Jasmina.NICOJAS-PC\AppData\Local\Programs
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-01-19 15:04 . 2012-02-24 09:35        105661272        ----a-w-        c:\program files\avira_free_antivirus_de.exe
2013-01-10 07:29 . 2012-06-11 17:11        17301984        ----a-w-        c:\program files\AdobeAIRInstaller.exe
2013-01-09 15:27 . 2012-06-10 11:52        74248        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-01-09 15:27 . 2012-06-10 11:52        697864        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2013-01-09 10:58 . 2012-02-24 10:44        67599240        ----a-w-        c:\windows\system32\MRT.exe
2012-12-22 09:27 . 2012-12-22 09:27        16384        ----a-w-        c:\program files\wmdmhelper.dll
2012-12-22 09:27 . 2012-12-22 09:27        943344        ----a-w-        c:\program files\cddblink.dll
2012-12-22 09:27 . 2012-12-22 09:27        8704        ----a-w-        c:\program files\fixrjb.exe
2012-12-22 09:27 . 2012-12-22 09:27        641536        ----a-w-        c:\program files\rjbres.dll
2012-12-22 09:27 . 2012-12-22 09:27        45568        ----a-w-        c:\program files\ierjplug.dll
2012-12-22 09:27 . 2012-12-22 09:27        370176        ----a-w-        c:\program files\rjdlg.dll
2012-12-22 09:27 . 2012-12-22 09:27        31232        ----a-w-        c:\program files\rjprog.dll
2012-12-22 09:27 . 2012-12-22 09:27        139264        ----a-w-        c:\program files\dunzip32.dll
2012-12-22 09:27 . 2012-12-22 09:27        1115376        ----a-w-        c:\program files\cddbmusicid.dll
2012-12-22 09:27 . 2012-12-22 09:27        73216        ----a-w-        c:\program files\tsasdk.dll
2012-12-22 09:27 . 2012-12-22 09:27        44544        ----a-w-        c:\program files\mmcdda32.dll
2012-12-22 09:27 . 2012-12-22 09:27        22528        ----a-w-        c:\program files\tnetdtct.dll
2012-12-22 09:27 . 2012-12-22 09:27        2041072        ----a-w-        c:\program files\cddbcontrol.dll
2012-12-22 09:27 . 2012-12-22 09:27        9159680        ----a-w-        c:\program files\mediainfo.dll
2012-12-22 09:27 . 2012-12-22 09:27        56320        ----a-w-        c:\program files\rpwa3260.dll
2012-12-22 09:27 . 2012-12-22 09:27        48640        ----a-w-        c:\program files\tpasdk.dll
2012-12-22 09:27 . 2012-12-22 09:27        44736        ----a-w-        c:\program files\rpshellsearch.dll
2012-12-22 09:27 . 2012-12-22 09:27        389272        ----a-w-        c:\program files\realcleaner.exe
2012-12-22 09:27 . 2012-12-22 09:27        16296        ----a-w-        c:\program files\realtfon.fon
2012-12-22 09:27 . 2012-12-22 09:27        383640        ----a-w-        c:\program files\realconverter.exe
2012-12-22 09:27 . 2012-12-22 09:27        354968        ----a-w-        c:\program files\convert.exe
2012-12-22 09:27 . 2012-12-22 09:27        719360        ----a-w-        c:\program files\dbghelp.dll
2012-12-22 09:27 . 2012-12-22 09:27        69632        ----a-w-        c:\program files\rjwmapln.dll
2012-12-22 09:27 . 2012-12-22 09:27        390384        ----a-w-        c:\program files\mc_enc_mp4v.dll
2012-12-22 09:27 . 2012-12-22 09:27        389272        ----a-w-        c:\program files\realtrimmer.exe
2012-12-22 09:27 . 2012-12-22 09:27        136336        ----a-w-        c:\program files\realshare.exe
2012-12-22 09:27 . 2012-12-22 09:27        115200        ----a-w-        c:\program files\rpshellextension.dll
2012-12-22 09:27 . 2012-12-22 09:27        47616        ----a-w-        c:\program files\rpau3260.dll
2012-12-22 09:27 . 2012-12-22 09:27        30368        ----a-w-        c:\program files\rndevicedbbuilder.exe
2012-12-22 09:27 . 2012-12-22 09:27        9216        ----a-w-        c:\program files\realjbox.exe
2012-12-22 09:27 . 2012-12-22 09:27        87552        ----a-w-        c:\program files\hxaudiodevicehook.dll
2012-12-22 09:27 . 2012-12-22 09:27        86016        ----a-w-        c:\program files\rpplugprot.dll
2012-12-22 09:27 . 2012-12-22 09:27        70840        ----a-w-        c:\program files\rpshell.dll
2012-12-22 09:27 . 2012-12-22 09:27        17080        ----a-w-        c:\program files\rphelperapp.exe
2012-12-22 09:27 . 2012-12-22 09:27        112824        ----a-w-        c:\program files\rdsf3260.dll
2012-12-22 09:27 . 2012-12-22 09:27        500888        ----a-w-        c:\program files\realplay.exe
2012-12-22 09:27 . 2012-12-22 09:27        499712        ----a-w-        c:\windows\SysWow64\msvcp71.dll
2012-12-22 09:27 . 2012-12-22 09:27        348160        ----a-w-        c:\windows\SysWow64\msvcr71.dll
2012-12-22 07:43 . 2012-12-22 07:43        766272        ----a-w-        c:\program files\RealPlayer16_de.exe
2012-12-16 17:11 . 2012-12-21 11:57        46080        ----a-w-        c:\windows\system32\atmlib.dll
2012-12-16 14:45 . 2012-12-21 11:57        367616        ----a-w-        c:\windows\system32\atmfd.dll
2012-12-16 14:13 . 2012-12-21 11:57        295424        ----a-w-        c:\windows\SysWow64\atmfd.dll
2012-12-16 14:13 . 2012-12-21 11:57        34304        ----a-w-        c:\windows\SysWow64\atmlib.dll
2012-12-15 12:46 . 2012-12-15 12:46        22916830        ----a-w-        c:\program files\vlc-2.0.5-win32.exe
2012-12-01 11:43 . 2012-11-22 08:36        19650144        ----a-w-        c:\program files\Thunderbird Setup 17.0.exe
2012-11-30 04:45 . 2013-01-09 05:38        44032        ----a-w-        c:\windows\apppatch\acwow64.dll
2012-11-29 09:27 . 2012-02-25 08:16        800824        ----a-w-        c:\users\Default\AppData\Roaming\DPInst.exe
2012-11-29 09:27 . 2012-02-25 08:16        36352        ----a-w-        c:\users\Default\AppData\Roaming\PnPutil.exe
2012-11-29 09:27 . 2012-02-25 08:16        106496        ----a-w-        c:\users\Default\AppData\Roaming\gacutil.exe
2012-11-28 09:35 . 2012-06-11 16:47        859072        ----a-w-        c:\windows\SysWow64\npdeployJava1.dll
2012-11-28 09:35 . 2012-02-24 09:55        779704        ----a-w-        c:\windows\SysWow64\deployJava1.dll
2012-11-26 12:52 . 2012-02-24 09:16        763408        ----a-w-        c:\program files\GoogleEarthSetup.exe
2012-11-22 08:36 . 2012-11-22 08:35        19231504        ----a-w-        c:\program files\Firefox Setup 17.0.exe
2012-11-14 07:06 . 2012-12-12 12:38        17811968        ----a-w-        c:\windows\system32\mshtml.dll
2012-11-14 06:32 . 2012-12-12 12:38        10925568        ----a-w-        c:\windows\system32\ieframe.dll
2012-11-14 06:11 . 2012-12-12 12:38        2312704        ----a-w-        c:\windows\system32\jscript9.dll
2012-11-14 06:04 . 2012-12-12 12:38        1346048        ----a-w-        c:\windows\system32\urlmon.dll
2012-11-14 06:04 . 2012-12-12 12:38        1392128        ----a-w-        c:\windows\system32\wininet.dll
2012-11-14 06:02 . 2012-12-12 12:38        1494528        ----a-w-        c:\windows\system32\inetcpl.cpl
2012-11-14 06:02 . 2012-12-12 12:38        237056        ----a-w-        c:\windows\system32\url.dll
2012-11-14 05:59 . 2012-12-12 12:38        85504        ----a-w-        c:\windows\system32\jsproxy.dll
2012-11-14 05:58 . 2012-12-12 12:38        816640        ----a-w-        c:\windows\system32\jscript.dll
2012-11-14 05:57 . 2012-12-12 12:38        599040        ----a-w-        c:\windows\system32\vbscript.dll
2012-11-14 05:57 . 2012-12-12 12:38        173056        ----a-w-        c:\windows\system32\ieUnatt.exe
2012-11-14 05:55 . 2012-12-12 12:38        2144768        ----a-w-        c:\windows\system32\iertutil.dll
2012-11-14 05:55 . 2012-12-12 12:38        729088        ----a-w-        c:\windows\system32\msfeeds.dll
2012-11-14 05:53 . 2012-12-12 12:38        96768        ----a-w-        c:\windows\system32\mshtmled.dll
2012-11-14 05:52 . 2012-12-12 12:38        2382848        ----a-w-        c:\windows\system32\mshtml.tlb
2012-11-14 05:46 . 2012-12-12 12:38        248320        ----a-w-        c:\windows\system32\ieui.dll
2012-11-14 02:09 . 2012-12-12 12:38        1800704        ----a-w-        c:\windows\SysWow64\jscript9.dll
2012-11-14 01:58 . 2012-12-12 12:38        1427968        ----a-w-        c:\windows\SysWow64\inetcpl.cpl
2012-11-14 01:57 . 2012-12-12 12:38        1129472        ----a-w-        c:\windows\SysWow64\wininet.dll
2012-11-14 01:49 . 2012-12-12 12:38        142848        ----a-w-        c:\windows\SysWow64\ieUnatt.exe
2012-11-14 01:48 . 2012-12-12 12:38        420864        ----a-w-        c:\windows\SysWow64\vbscript.dll
2012-11-14 01:44 . 2012-12-12 12:38        2382848        ----a-w-        c:\windows\SysWow64\mshtml.tlb
2012-11-13 10:16 . 2012-11-13 10:16        895464        ----a-w-        c:\program files (x86)\jxpiinstall.exe
2012-11-13 09:16 . 2012-11-13 09:15        18090960        ----a-w-        c:\program files\Firefox Setup 16.0.2.exe
2012-11-13 09:11 . 2012-11-13 09:11        18580512        ----a-w-        c:\program files\Thunderbird Setup 16.0.2.exe
2012-11-09 11:03 . 2012-11-02 12:40        955488        ----a-w-        c:\program files\wpsetup-5.18.exe
2012-11-09 05:45 . 2012-12-12 09:56        2048        ----a-w-        c:\windows\system32\tzres.dll
2012-11-09 04:42 . 2012-12-12 09:56        2048        ----a-w-        c:\windows\SysWow64\tzres.dll
2012-11-08 17:05 . 2012-05-15 11:30        40437664        ----a-w-        c:\program files\QuickTimeInstaller.exe
2012-11-08 10:29 . 2012-11-08 10:29        1402312        ----a-w-        c:\windows\SysWow64\msxml4.dll
2012-11-01 13:39 . 2012-11-01 13:39        9814632        ----a-w-        c:\program files\ashampoo_burning_studio_6_free_6.81_3639.exe
2012-10-26 08:20 . 2012-06-12 05:31        13107424        ----a-w-        c:\program files\Shockwave_Installer_Full.exe
2012-10-15 14:25 . 2012-10-15 14:25        5922048        ----a-w-        c:\program files\m4a-to-mp3-70converter.exe
2012-09-20 05:45 . 2012-09-20 05:45        8782120        ----a-w-        c:\program files\radiorecorder-setup.exe
2012-09-11 11:51 . 2012-09-11 11:51        14894636        ----a-w-        c:\program files\XnView1991-win-full-de.exe
2012-09-07 05:34 . 2012-09-07 05:33        17653976        ----a-w-        c:\program files\Firefox Setup 15.0.1.exe
2012-08-30 05:12 . 2012-08-30 05:12        18365488        ----a-w-        c:\program files\Thunderbird Setup 15.0.exe
2012-08-30 05:12 . 2012-08-30 05:10        17655464        ----a-w-        c:\program files\Firefox Setup 15.0.exe
2012-08-29 06:44 . 2012-08-29 06:41        15567360        ----a-w-        c:\program files\Adobe_AIR_3.4.0.2540_SPS.exe
2012-08-29 06:42 . 2012-08-29 06:42        9672192        ----a-w-        c:\program files\Adobe_Flash_Player_AX_11.4.402.265_SPS.exe
2012-08-27 09:13 . 2012-08-27 09:09        152249762        ----a-w-        c:\program files\Apache_OpenOffice_incubating_3.4.1_Win_x86_install_de.exe
2012-08-25 13:42 . 2012-08-25 13:15        76021168        ----a-w-        c:\program files\gimp-2.8.2-setup.exe
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CCWinTray"="c:\windows\tray\wintmr.exe" [2009-07-13 6129792]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-11 59280]
"ChicoSys"="c:\windows\SysWOW64\cc32\webtmr.exe" [2009-07-13 5930112]
"AccuWeatherWidget"="c:\program files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" [2012-02-01 968048]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888]
"TkBellExe"="c:\program files\update\realsched.exe" [2012-12-22 295072]
"EKStatusMonitor"="c:\program files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe" [2012-10-15 2844608]
"EKIJ5000StatusMonitor"="c:\windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe" [2012-10-08 3182080]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-12-04 384800]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CCWinTray"="c:\windows\tray\wintmr.exe" [2009-07-13 6129792]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"KodakHomeCenter"="c:\program files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe" [2012-10-19 2235840]
.
c:\users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]
.
c:\users\Nico.NICOJAS-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]
OpenOffice.org 3.4.1.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]
OpenOffice.org 3.4.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]
.
c:\users\Jasmina.NICOJAS-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.4.1.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Secunia PSI Tray.lnk - c:\program files (x86)\Secunia\PSI\psi_tray.exe [2012-11-26 573024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"HideFastUserSwitching"= 1 (0x1)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableClock"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux3"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute        REG_MULTI_SZ          autocheck autochk *\0\0sdnclean64.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ksupmgr]
@="Service"
.
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 ksupmgr;File-/Update Service;c:\windows\SysWOW64\ksupmgr.exe [2010-08-25 765592]
R2 Secunia Update Agent;Secunia Update Agent;c:\program files (x86)\Secunia\PSI\sua.exe [2012-11-26 659040]
R3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [x]
R3 HPMo4DE3;Mouse Suite Driver_4DE3 (WDF Version);c:\windows\system32\DRIVERS\HPMo4DE3.sys [2011-03-09 25088]
R3 HPub4DE3;USB Mouse Low Filter Driver_4DE3 (WDF Version);c:\windows\system32\Drivers\HPub4DE3.sys [2011-04-12 18432]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
S0 gfibto;gfibto;c:\windows\system32\drivers\gfibto.sys [2013-01-21 14456]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys [2012-10-08 30056]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2013-01-30 834544]
S0 stdcfltn;Disk Class Filter Driver for Accelerometer;c:\windows\system32\DRIVERS\stdcfltn.sys [2010-08-20 21616]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2012-11-16 27800]
S1 nvkflt;nvkflt;c:\windows\system32\DRIVERS\nvkflt.sys [2012-10-08 284008]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-12-04 85280]
S2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files (x86)\Kodak\AiO\Center\EKAiOHostService.exe [2012-10-19 395200]
S2 Kodak AiO Status Monitor Service;Kodak AiO Status Monitor Service;c:\program files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe [2012-10-15 779200]
S2 Radio.fx;Radio.fx Server;d:\tobit radio.fx\Server\rfx-server.exe [2011-11-18 3673944]
S2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [2012-11-29 38608]
S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe [2012-11-26 1225312]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-10-02 382824]
S3 Acceler;Accelerometer Service;c:\windows\system32\DRIVERS\Accelern.sys [2010-12-13 27760]
S3 AVer7231_x64;AVerMedia 7231 capture service;c:\windows\system32\DRIVERS\AVer7231_x64.sys [2010-08-27 1800576]
S3 btmhsf;btmhsf;c:\windows\system32\DRIVERS\btmhsf.sys [2011-11-15 327168]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2010-08-12 175168]
S3 iBtFltCoex;iBtFltCoex;c:\windows\system32\DRIVERS\iBtFltCoex.sys [2011-12-09 60416]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2011-02-10 82432]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2011-02-10 181760]
S3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2010-09-01 17976]
S3 qicflt;upper Device Filter Driver;c:\windows\system32\DRIVERS\qicflt.sys [2010-07-02 29288]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - Chico
.
Inhalt des "geplante Tasks" Ordners
.
2013-01-31 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-10 15:27]
.
2013-01-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-24 09:50]
.
2013-01-31 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-24 09:50]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-12 167960]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-12 391704]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-12 418328]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"DellStage"="c:\program files (x86)\Dell Stage\Dell Stage\stage_primary.exe" [2012-02-01 2195824]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-09-20 444904]
"EKIJ5000StatusMonitor"="c:\windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe" [2012-10-08 3182080]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Free YouTube to iPod Converter - c:\users\Jasmina.NICOJAS-PC\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetoipodconverter.htm
IE: Free YouTube to MP3 Converter - c:\users\Jasmina.NICOJAS-PC\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Jasmina.NICOJAS-PC\AppData\Roaming\Mozilla\Firefox\Profiles\zd0m12fn.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - www.google.de
FF - prefs.js: network.proxy.type - 0
FF - ExtSQL: 2012-12-22 10:27; {34712C68-7391-4c47-94F3-8F88D49AD632}; c:\programdata\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-Kindersicherung_is1 - c:\program files (x86)\Salfeld\Kisi\unins000.exe
AddRemove-Video Converter - c:\program files (x86)\SweetPacks\VideoConverter\uninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_146_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_146_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_146_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_146_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-01-31  14:34:12
ComboFix-quarantined-files.txt  2013-01-31 13:34
ComboFix2.txt  2013-01-31 13:19
.
Vor Suchlauf: 16 Verzeichnis(se), 93.262.176.256 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 93.176.926.208 Bytes frei
.
- - End Of File - - 6EABE821B16AF5F9DB44009171FF54EB

cosinus 31.01.2013 15:03
Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.


Code:
Dirlook::
C:\Device

File::
c:\windows\system32\drivers\dgderdrv.sys

Driver::
dgderdrv
3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Rheingold 31.01.2013 15:47
hier der logfile.
Avira hat sich beim Neustart automatisch wieder geöffnet. Ich hoffe, das ist kein Problem.

Code:
ComboFix 13-01-31.01 - Jasmina 31.01.2013  15:30:09.4.8 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.3990.2306 [GMT 1:00]
ausgeführt von:: C:\Users\Jasmina.NICOJAS-PC\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: C:\Users\Jasmina.NICOJAS-PC\Desktop\CFScript.txt
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FILE ::
"c:\windows\system32\drivers\dgderdrv.sys"


((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))


C:\Windows\SysWow64\SWCTL.DLL


(((((((((((((((((((((((((((((((((((((((  Treiber/Dienste  )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_dgderdrv


(((((((((((((((((((((((  Dateien erstellt von 2012-12-28 bis 2013-01-31  ))))))))))))))))))))))))))))))


2013-01-31 14:35:27 . 2013-01-31 14:35:27        --------        d-----w-        C:\Users\UpdatusUser\AppData\Local\temp
2013-01-31 14:35:27 . 2013-01-31 14:35:27        --------        d-----w-        C:\Users\Nico.NICOJAS-PC\AppData\Local\temp
2013-01-31 14:35:27 . 2013-01-31 14:35:27        --------        d-----w-        C:\Users\Jasmina\AppData\Local\temp
2013-01-31 14:35:27 . 2013-01-31 14:35:27        --------        d-----w-        C:\Users\Default\AppData\Local\temp
2013-01-31 14:35:27 . 2013-01-31 14:35:27        --------        d-----w-        C:\Users\Administrator\AppData\Local\temp
2013-01-30 16:37:33 . 2013-01-30 21:35:26        --------        d---a-w-        C:\Kaspersky Rescue Disk 10.0
2013-01-30 15:02:13 . 2013-01-30 15:02:13        834544        ----a-w-        C:\Windows\system32\drivers\sptd.sys
2013-01-30 15:02:04 . 2013-01-30 15:02:04        --------        d-----w-        C:\Program Files (x86)\LSoft Technologies
2013-01-30 15:00:48 . 2013-01-30 15:00:50        5053696        ----a-w-        C:\Program Files\IsoBurner-Setup.exe
2013-01-30 08:55:05 . 2013-01-31 06:07:59        --------        d---a-w-        C:\Navilog1
2013-01-30 08:55:05 . 2013-01-30 08:57:31        --------        d-----w-        C:\Program Files (x86)\Navilog1
2013-01-29 14:25:41 . 2009-07-13 23:15:34        246216        ----a-w-        C:\Windows\SysWow64\wdrvhook.dll
2013-01-29 12:11:45 . 2013-01-08 05:32:08        9161176        ----a-w-        C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{12095963-45D2-48C9-83D1-8045FF56CE55}\mpengine.dll
2013-01-29 11:06:05 . 2013-01-29 11:06:05        --------        d-----w-        C:\Device
2013-01-29 10:41:09 . 2013-01-29 10:41:09        --------        d-----w-        C:\Users\Administrator\AppData\Local\Programs
2013-01-29 09:15:46 . 2013-01-29 09:15:46        --------        d-----w-        C:\Users\Administrator\AppData\Roaming\TuneUp Software
2013-01-29 09:15:18 . 2013-01-29 09:24:34        --------        d-sh--w-        C:\ProgramData\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}
2013-01-29 08:44:12 . 2013-01-29 08:44:12        --------        d-----w-        C:\Users\Administrator\AppData\Roaming\SpeedMaxPc
2013-01-29 08:44:12 . 2013-01-29 08:44:12        --------        d-----w-        C:\Users\Administrator\AppData\Roaming\DriverCure
2013-01-29 08:44:01 . 2013-01-29 09:17:55        --------        d-----w-        C:\ProgramData\SpeedMaxPc
2013-01-28 07:48:25 . 2013-01-28 07:48:25        --------        d-----w-        C:\Users\Jasmina.NICOJAS-PC\AppData\Local\Diagnostics
2013-01-27 15:58:41 . 2013-01-27 15:58:41        --------        d-----w-        C:\Users\Administrator\AppData\Roaming\Malwarebytes
2013-01-27 08:15:44 . 2013-01-27 08:15:44        --------        d-----w-        C:\Users\Administrator\AppData\Local\Macromedia
2013-01-27 08:15:11 . 2013-01-27 08:15:11        --------        d-----w-        C:\Users\Administrator\AppData\Roaming\RealNetworks
2013-01-27 07:17:31 . 2013-01-27 07:17:31        --------        d-----w-        C:\Users\Administrator\AppData\Roaming\Avira
2013-01-24 10:04:22 . 2013-01-24 10:04:28        --------        d-----w-        C:\Program Files\PDF Viewer
2013-01-24 09:57:31 . 2013-01-24 09:58:04        19443001        ----a-w-        C:\Program Files\PDFXVwer.exe
2013-01-23 13:20:46 . 2013-01-23 13:20:46        --------        d-----w-        C:\Program Files (x86)\Secunia
2013-01-23 13:14:20 . 2013-01-23 13:14:26        3137416        ----a-w-        C:\Program Files\PSISetup6001.exe
2013-01-21 11:13:31 . 2013-01-21 11:13:31        --------        d-----w-        C:\Program Files (x86)\Toolbar Cleaner
2013-01-20 18:34:16 . 2013-01-20 18:34:16        --------        d-----w-        C:\Users\Nico.NICOJAS-PC\AppData\Roaming\Avira
2013-01-19 15:22:17 . 2013-01-19 15:22:18        4178040        ----a-w-        C:\Program Files\ccsetup326.exe
2013-01-19 15:16:26 . 2013-01-19 15:16:26        --------        d-----w-        C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\Avira
2013-01-19 15:12:28 . 2013-01-19 15:12:28        --------        d-----w-        C:\ProgramData\Avira
2013-01-19 15:12:28 . 2013-01-19 15:12:28        --------        d-----w-        C:\Program Files (x86)\Avira
2013-01-19 15:12:28 . 2012-12-03 14:36:36        129216        ----a-w-        C:\Windows\system32\drivers\avipbb.sys
2013-01-19 15:12:28 . 2012-12-03 14:36:35        99912        ----a-w-        C:\Windows\system32\drivers\avgntflt.sys
2013-01-19 15:12:28 . 2012-11-16 19:17:15        27800        ----a-w-        C:\Windows\system32\drivers\avkmgr.sys
2013-01-18 08:13:07 . 2013-01-12 02:30:18        95648        ----a-w-        C:\Windows\SysWow64\WindowsAccessBridge-32.dll
2013-01-16 20:01:01 . 2013-01-16 21:16:04        --------        d-----w-        C:\Users\Nico.NICOJAS-PC\AppData\Roaming\Ad-Aware Antivirus
2013-01-16 20:01:00 . 2013-01-16 20:01:02        --------        d-----w-        C:\Users\Nico.NICOJAS-PC\AppData\Local\adawarebp
2013-01-16 15:42:46 . 2013-01-16 15:42:46        --------        d-----w-        C:\Program Files\Definitions
2013-01-16 15:42:12 . 2013-01-21 11:14:10        14456        ----a-w-        C:\Windows\system32\drivers\gfibto.sys
2013-01-14 07:43:58 . 2013-01-14 07:43:58        --------        d-----w-        C:\Windows\SysWow64\20-20 Technologies
2013-01-10 07:31:56 . 2013-01-10 07:32:39        20151664        ----a-w-        C:\Program Files\Firefox Setup 18.0.exe
2013-01-09 14:07:32 . 2013-01-09 16:15:10        --------        d-----w-        C:\Program Files (x86)\Mozilla Thunderbird
2013-01-09 05:38:46 . 2012-11-30 05:41:07        424448        ----a-w-        C:\Windows\system32\KernelBase.dll
2013-01-06 10:48:16 . 2012-10-08 09:06:12        261632        ----a-w-        C:\Windows\system32\Spool\prtprocs\x64\EKIJ5000PPR.dll
2013-01-06 10:43:42 . 2013-01-06 10:44:05        --------        d-----w-        C:\Windows\SysWow64\kodak
2013-01-06 10:42:15 . 2013-01-06 10:42:15        --------        d-----w-        C:\Windows\SysWow64\spool
2013-01-06 10:35:42 . 2013-01-06 10:35:52        10000984        ----a-w-        C:\Program Files\aio_install.exe
2013-01-04 07:37:05 . 2013-01-04 07:37:05        --------        d-----w-        C:\Users\Jasmina.NICOJAS-PC\AppData\Local\Programs
.


((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))

2013-01-19 15:04:21 . 2012-02-24 09:35:22        105661272        ----a-w-        C:\Program Files\avira_free_antivirus_de.exe
2013-01-10 07:29:37 . 2012-06-11 17:11:49        17301984        ----a-w-        C:\Program Files\AdobeAIRInstaller.exe
2013-01-09 15:27:29 . 2012-06-10 11:52:15        74248        ----a-w-        C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2013-01-09 15:27:29 . 2012-06-10 11:52:15        697864        ----a-w-        C:\Windows\SysWow64\FlashPlayerApp.exe
2013-01-09 10:58:19 . 2012-02-24 10:44:46        67599240        ----a-w-        C:\Windows\system32\MRT.exe
2012-12-22 09:27:43 . 2012-12-22 09:27:43        16384        ----a-w-        C:\Program Files\wmdmhelper.dll
2012-12-22 09:27:42 . 2012-12-22 09:27:42        943344        ----a-w-        C:\Program Files\cddblink.dll
2012-12-22 09:27:42 . 2012-12-22 09:27:42        8704        ----a-w-        C:\Program Files\fixrjb.exe
2012-12-22 09:27:42 . 2012-12-22 09:27:42        641536        ----a-w-        C:\Program Files\rjbres.dll
2012-12-22 09:27:42 . 2012-12-22 09:27:42        45568        ----a-w-        C:\Program Files\ierjplug.dll
2012-12-22 09:27:42 . 2012-12-22 09:27:42        370176        ----a-w-        C:\Program Files\rjdlg.dll
2012-12-22 09:27:42 . 2012-12-22 09:27:42        31232        ----a-w-        C:\Program Files\rjprog.dll
2012-12-22 09:27:42 . 2012-12-22 09:27:42        139264        ----a-w-        C:\Program Files\dunzip32.dll
2012-12-22 09:27:42 . 2012-12-22 09:27:42        1115376        ----a-w-        C:\Program Files\cddbmusicid.dll
2012-12-22 09:27:41 . 2012-12-22 09:27:41        73216        ----a-w-        C:\Program Files\tsasdk.dll
2012-12-22 09:27:41 . 2012-12-22 09:27:41        44544        ----a-w-        C:\Program Files\mmcdda32.dll
2012-12-22 09:27:41 . 2012-12-22 09:27:41        22528        ----a-w-        C:\Program Files\tnetdtct.dll
2012-12-22 09:27:41 . 2012-12-22 09:27:41        2041072        ----a-w-        C:\Program Files\cddbcontrol.dll
2012-12-22 09:27:40 . 2012-12-22 09:27:40        9159680        ----a-w-        C:\Program Files\mediainfo.dll
2012-12-22 09:27:40 . 2012-12-22 09:27:40        56320        ----a-w-        C:\Program Files\rpwa3260.dll
2012-12-22 09:27:40 . 2012-12-22 09:27:40        48640        ----a-w-        C:\Program Files\tpasdk.dll
2012-12-22 09:27:40 . 2012-12-22 09:27:40        44736        ----a-w-        C:\Program Files\rpshellsearch.dll
2012-12-22 09:27:40 . 2012-12-22 09:27:40        389272        ----a-w-        C:\Program Files\realcleaner.exe
2012-12-22 09:27:40 . 2012-12-22 09:27:40        16296        ----a-w-        C:\Program Files\realtfon.fon
2012-12-22 09:27:31 . 2012-12-22 09:27:31        383640        ----a-w-        C:\Program Files\realconverter.exe
2012-12-22 09:27:31 . 2012-12-22 09:27:31        354968        ----a-w-        C:\Program Files\convert.exe
2012-12-22 09:27:23 . 2012-12-22 09:27:23        719360        ----a-w-        C:\Program Files\dbghelp.dll
2012-12-22 09:27:23 . 2012-12-22 09:27:23        69632        ----a-w-        C:\Program Files\rjwmapln.dll
2012-12-22 09:27:23 . 2012-12-22 09:27:23        390384        ----a-w-        C:\Program Files\mc_enc_mp4v.dll
2012-12-22 09:27:23 . 2012-12-22 09:27:23        389272        ----a-w-        C:\Program Files\realtrimmer.exe
2012-12-22 09:27:23 . 2012-12-22 09:27:23        136336        ----a-w-        C:\Program Files\realshare.exe
2012-12-22 09:27:23 . 2012-12-22 09:27:23        115200        ----a-w-        C:\Program Files\rpshellextension.dll
2012-12-22 09:27:22 . 2012-12-22 09:27:22        47616        ----a-w-        C:\Program Files\rpau3260.dll
2012-12-22 09:27:18 . 2012-12-22 09:27:18        30368        ----a-w-        C:\Program Files\rndevicedbbuilder.exe
2012-12-22 09:27:17 . 2012-12-22 09:27:17        9216        ----a-w-        C:\Program Files\realjbox.exe
2012-12-22 09:27:17 . 2012-12-22 09:27:17        87552        ----a-w-        C:\Program Files\hxaudiodevicehook.dll
2012-12-22 09:27:17 . 2012-12-22 09:27:17        86016        ----a-w-        C:\Program Files\rpplugprot.dll
2012-12-22 09:27:17 . 2012-12-22 09:27:17        70840        ----a-w-        C:\Program Files\rpshell.dll
2012-12-22 09:27:17 . 2012-12-22 09:27:17        17080        ----a-w-        C:\Program Files\rphelperapp.exe
2012-12-22 09:27:17 . 2012-12-22 09:27:17        112824        ----a-w-        C:\Program Files\rdsf3260.dll
2012-12-22 09:27:16 . 2012-12-22 09:27:16        500888        ----a-w-        C:\Program Files\realplay.exe
2012-12-22 09:27:13 . 2012-12-22 09:27:13        499712        ----a-w-        C:\Windows\SysWow64\msvcp71.dll
2012-12-22 09:27:13 . 2012-12-22 09:27:13        348160        ----a-w-        C:\Windows\SysWow64\msvcr71.dll
2012-12-22 07:43:16 . 2012-12-22 07:43:14        766272        ----a-w-        C:\Program Files\RealPlayer16_de.exe
2012-12-16 17:11:22 . 2012-12-21 11:57:09        46080        ----a-w-        C:\Windows\system32\atmlib.dll
2012-12-16 14:45:03 . 2012-12-21 11:57:08        367616        ----a-w-        C:\Windows\system32\atmfd.dll
2012-12-16 14:13:28 . 2012-12-21 11:57:08        295424        ----a-w-        C:\Windows\SysWow64\atmfd.dll
2012-12-16 14:13:20 . 2012-12-21 11:57:09        34304        ----a-w-        C:\Windows\SysWow64\atmlib.dll
2012-12-15 12:46:35 . 2012-12-15 12:46:18        22916830        ----a-w-        C:\Program Files\vlc-2.0.5-win32.exe
2012-12-01 11:43:32 . 2012-11-22 08:36:25        19650144        ----a-w-        C:\Program Files\Thunderbird Setup 17.0.exe
2012-11-30 04:45:10 . 2013-01-09 05:38:45        44032        ----a-w-        C:\Windows\apppatch\acwow64.dll
2012-11-29 09:27:38 . 2012-02-25 08:16:44        800824        ----a-w-        C:\Users\Default\AppData\Roaming\DPInst.exe
2012-11-29 09:27:38 . 2012-02-25 08:16:44        36352        ----a-w-        C:\Users\Default\AppData\Roaming\PnPutil.exe
2012-11-29 09:27:38 . 2012-02-25 08:16:44        106496        ----a-w-        C:\Users\Default\AppData\Roaming\gacutil.exe
2012-11-28 09:35:43 . 2012-06-11 16:47:33        859072        ----a-w-        C:\Windows\SysWow64\npdeployJava1.dll
2012-11-28 09:35:38 . 2012-02-24 09:55:37        779704        ----a-w-        C:\Windows\SysWow64\deployJava1.dll
2012-11-26 12:52:49 . 2012-02-24 09:16:36        763408        ----a-w-        C:\Program Files\GoogleEarthSetup.exe
2012-11-22 08:36:18 . 2012-11-22 08:35:36        19231504        ----a-w-        C:\Program Files\Firefox Setup 17.0.exe
2012-11-14 07:06:18 . 2012-12-12 12:38:11        17811968        ----a-w-        C:\Windows\system32\mshtml.dll
2012-11-14 06:32:33 . 2012-12-12 12:38:10        10925568        ----a-w-        C:\Windows\system32\ieframe.dll
2012-11-14 06:11:44 . 2012-12-12 12:38:14        2312704        ----a-w-        C:\Windows\system32\jscript9.dll
2012-11-14 06:04:44 . 2012-12-12 12:38:15        1346048        ----a-w-        C:\Windows\system32\urlmon.dll
2012-11-14 06:04:11 . 2012-12-12 12:38:14        1392128        ----a-w-        C:\Windows\system32\wininet.dll
2012-11-14 06:02:49 . 2012-12-12 12:38:14        1494528        ----a-w-        C:\Windows\system32\inetcpl.cpl
2012-11-14 06:02:04 . 2012-12-12 12:38:15        237056        ----a-w-        C:\Windows\system32\url.dll
2012-11-14 05:59:52 . 2012-12-12 12:38:14        85504        ----a-w-        C:\Windows\system32\jsproxy.dll
2012-11-14 05:58:36 . 2012-12-12 12:38:13        816640        ----a-w-        C:\Windows\system32\jscript.dll
2012-11-14 05:57:46 . 2012-12-12 12:38:13        599040        ----a-w-        C:\Windows\system32\vbscript.dll
2012-11-14 05:57:35 . 2012-12-12 12:38:15        173056        ----a-w-        C:\Windows\system32\ieUnatt.exe
2012-11-14 05:55:45 . 2012-12-12 12:38:13        2144768        ----a-w-        C:\Windows\system32\iertutil.dll
2012-11-14 05:55:26 . 2012-12-12 12:38:14        729088        ----a-w-        C:\Windows\system32\msfeeds.dll
2012-11-14 05:53:22 . 2012-12-12 12:38:16        96768        ----a-w-        C:\Windows\system32\mshtmled.dll
2012-11-14 05:52:40 . 2012-12-12 12:38:16        2382848        ----a-w-        C:\Windows\system32\mshtml.tlb
2012-11-14 05:46:25 . 2012-12-12 12:38:15        248320        ----a-w-        C:\Windows\system32\ieui.dll
2012-11-14 02:09:22 . 2012-12-12 12:38:13        1800704        ----a-w-        C:\Windows\SysWow64\jscript9.dll
2012-11-14 01:58:15 . 2012-12-12 12:38:15        1427968        ----a-w-        C:\Windows\SysWow64\inetcpl.cpl
2012-11-14 01:57:37 . 2012-12-12 12:38:14        1129472        ----a-w-        C:\Windows\SysWow64\wininet.dll
2012-11-14 01:49:25 . 2012-12-12 12:38:15        142848        ----a-w-        C:\Windows\SysWow64\ieUnatt.exe
2012-11-14 01:48:27 . 2012-12-12 12:38:15        420864        ----a-w-        C:\Windows\SysWow64\vbscript.dll
2012-11-14 01:44:42 . 2012-12-12 12:38:16        2382848        ----a-w-        C:\Windows\SysWow64\mshtml.tlb
2012-11-13 10:16:10 . 2012-11-13 10:16:01        895464        ----a-w-        C:\Program Files (x86)\jxpiinstall.exe
2012-11-13 09:16:02 . 2012-11-13 09:15:40        18090960        ----a-w-        C:\Program Files\Firefox Setup 16.0.2.exe
2012-11-13 09:11:53 . 2012-11-13 09:11:21        18580512        ----a-w-        C:\Program Files\Thunderbird Setup 16.0.2.exe
2012-11-09 11:03:02 . 2012-11-02 12:40:21        955488        ----a-w-        C:\Program Files\wpsetup-5.18.exe
2012-11-09 05:45:09 . 2012-12-12 09:56:37        2048        ----a-w-        C:\Windows\system32\tzres.dll
2012-11-09 04:42:49 . 2012-12-12 09:56:37        2048        ----a-w-        C:\Windows\SysWow64\tzres.dll
2012-11-08 17:05:38 . 2012-05-15 11:30:33        40437664        ----a-w-        C:\Program Files\QuickTimeInstaller.exe
2012-11-08 10:29:12 . 2012-11-08 10:29:12        1402312        ----a-w-        C:\Windows\SysWow64\msxml4.dll
2012-11-01 13:39:33 . 2012-11-01 13:39:24        9814632        ----a-w-        C:\Program Files\ashampoo_burning_studio_6_free_6.81_3639.exe
2012-10-26 08:20:23 . 2012-06-12 05:31:47        13107424        ----a-w-        C:\Program Files\Shockwave_Installer_Full.exe
2012-10-15 14:25:53 . 2012-10-15 14:25:45        5922048        ----a-w-        C:\Program Files\m4a-to-mp3-70converter.exe
2012-09-20 05:45:52 . 2012-09-20 05:45:49        8782120        ----a-w-        C:\Program Files\radiorecorder-setup.exe
2012-09-11 11:51:29 . 2012-09-11 11:51:11        14894636        ----a-w-        C:\Program Files\XnView1991-win-full-de.exe
2012-09-07 05:34:07 . 2012-09-07 05:33:50        17653976        ----a-w-        C:\Program Files\Firefox Setup 15.0.1.exe
2012-08-30 05:12:36 . 2012-08-30 05:12:27        18365488        ----a-w-        C:\Program Files\Thunderbird Setup 15.0.exe
2012-08-30 05:12:16 . 2012-08-30 05:10:52        17655464        ----a-w-        C:\Program Files\Firefox Setup 15.0.exe
2012-08-29 06:44:01 . 2012-08-29 06:41:24        15567360        ----a-w-        C:\Program Files\Adobe_AIR_3.4.0.2540_SPS.exe
2012-08-29 06:42:11 . 2012-08-29 06:42:01        9672192        ----a-w-        C:\Program Files\Adobe_Flash_Player_AX_11.4.402.265_SPS.exe
2012-08-27 09:13:03 . 2012-08-27 09:09:16        152249762        ----a-w-        C:\Program Files\Apache_OpenOffice_incubating_3.4.1_Win_x86_install_de.exe
2012-08-25 13:42:05 . 2012-08-25 13:15:13        76021168        ----a-w-        C:\Program Files\gimp-2.8.2-setup.exe


((((((((((((((((((((((((((((((((((((((((((((  Look  )))))))))))))))))))))))))))))))))))))))))))))))))))))))))

---- Directory of C:\Device ----



((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))


*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CCWinTray"="C:\Windows\tray\wintmr.exe" [2009-07-13 23:15:34 6129792]

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"APSDaemon"="C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-11 20:56:08 59280]
"ChicoSys"="C:\Windows\SysWOW64\cc32\webtmr.exe" [2009-07-13 23:15:34 5930112]
"AccuWeatherWidget"="C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" [2012-02-01 10:50:58 968048]
"QuickTime Task"="C:\Program Files (x86)\QuickTime\QTTask.exe" [2012-10-25 02:12:14 421888]
"TkBellExe"="C:\Program Files\update\realsched.exe" [2012-12-22 09:27:15 295072]
"EKStatusMonitor"="C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe" [2012-10-15 10:58:24 2844608]
"EKIJ5000StatusMonitor"="C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe" [2012-10-08 09:06:08 3182080]
"avgnt"="C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-12-04 14:36:48 384800]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CCWinTray"="C:\Windows\tray\wintmr.exe" [2009-07-13 23:15:34 6129792]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"KodakHomeCenter"="C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe" [2012-10-19 14:01:34 2235840]

C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]

C:\Users\Nico.NICOJAS-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]
OpenOffice.org 3.4.1.lnk - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]
OpenOffice.org 3.4.lnk - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]

C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.4.1.lnk - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Secunia PSI Tray.lnk - C:\Program Files (x86)\Secunia\PSI\psi_tray.exe [2012-11-26 573024]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"HideFastUserSwitching"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableClock"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux3"=wdmaud.drv

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute        REG_MULTI_SZ          autocheck autochk *\0\0sdnclean64.exe

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ksupmgr]
@="Service"

R1 SBRE;SBRE;C:\Windows\system32\drivers\SBREdrv.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 13:27:14 138576]
R2 ksupmgr;File-/Update Service;C:\Windows\SysWOW64\ksupmgr.exe [2010-08-25 08:56:38 765592]
R2 Secunia Update Agent;Secunia Update Agent;C:\Program Files (x86)\Secunia\PSI\sua.exe [2012-11-26 14:09:20 659040]
R3 HPMo4DE3;Mouse Suite Driver_4DE3 (WDF Version);C:\Windows\system32\DRIVERS\HPMo4DE3.sys [2011-03-09 09:44:44 25088]
R3 HPub4DE3;USB Mouse Low Filter Driver_4DE3 (WDF Version);C:\Windows\system32\Drivers\HPub4DE3.sys [2011-04-12 10:45:50 18432]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\system32\drivers\rdpvideominiport.sys [2012-08-23 14:10:20 19456]
R3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys [2012-08-23 14:07:35 57856]
S0 gfibto;gfibto;C:\Windows\system32\drivers\gfibto.sys [2013-01-21 11:14:10 14456]
S0 nvpciflt;nvpciflt;C:\Windows\system32\DRIVERS\nvpciflt.sys [2012-10-08 09:42:36 30056]
S0 sptd;sptd;C:\Windows\System32\Drivers\sptd.sys [2013-01-30 15:02:13 834544]
S0 stdcfltn;Disk Class Filter Driver for Accelerometer;C:\Windows\system32\DRIVERS\stdcfltn.sys [2010-08-20 10:05:12 21616]
S1 avkmgr;avkmgr;C:\Windows\system32\DRIVERS\avkmgr.sys [2012-11-16 19:17:15 27800]
S1 nvkflt;nvkflt;C:\Windows\system32\DRIVERS\nvkflt.sys [2012-10-08 09:42:14 284008]
S2 AntiVirSchedulerService;Avira Planer;C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2012-12-04 11:13:51 85280]
S2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe [2012-10-19 13:51:08 395200]
S2 Kodak AiO Status Monitor Service;Kodak AiO Status Monitor Service;C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe [2012-10-15 10:58:22 779200]
S2 Radio.fx;Radio.fx Server;D:\Tobit Radio.fx\Server\rfx-server.exe [2011-11-18 12:51:12 3673944]
S2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [2012-11-29 19:31:04 38608]
S2 Secunia PSI Agent;Secunia PSI Agent;C:\Program Files (x86)\Secunia\PSI\PSIA.exe [2012-11-26 14:09:22 1225312]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-10-02 11:15:38 382824]
S3 Acceler;Accelerometer Service;C:\Windows\system32\DRIVERS\Accelern.sys [2010-12-13 07:34:14 27760]
S3 AVer7231_x64;AVerMedia 7231 capture service;C:\Windows\system32\DRIVERS\AVer7231_x64.sys [2010-08-27 09:42:00 1800576]
S3 btmhsf;btmhsf;C:\Windows\system32\DRIVERS\btmhsf.sys [2011-11-15 00:13:00 327168]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;C:\Windows\system32\DRIVERS\CtClsFlt.sys [2010-08-12 09:51:30 175168]
S3 iBtFltCoex;iBtFltCoex;C:\Windows\system32\DRIVERS\iBtFltCoex.sys [2011-12-09 18:45:00 60416]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\Windows\system32\DRIVERS\nusb3hub.sys [2011-02-10 12:52:34 82432]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\Windows\system32\DRIVERS\nusb3xhc.sys [2011-02-10 12:52:34 181760]
S3 PSI;PSI;C:\Windows\system32\DRIVERS\psi_mf.sys [2010-09-01 08:30:58 17976]
S3 qicflt;upper Device Filter Driver;C:\Windows\system32\DRIVERS\qicflt.sys [2010-07-02 00:46:58 29288]
S3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 05:34:52 539240]


--- Andere Dienste/Treiber im Speicher ---

*Deregistered* - Chico

Inhalt des "geplante Tasks" Ordners

2013-01-31 C:\Windows\Tasks\Adobe Flash Player Updater.job
- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-10 11:52:15 . 2013-01-09 15:27:30]

2013-01-31 C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-02-24 09:50:39 . 2012-02-24 09:50:37]

2013-01-31 C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-02-24 09:50:39 . 2012-02-24 09:50:37]


--------- X64 Entries -----------


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\Windows\system32\igfxtray.exe" [2011-02-12 04:15:48 167960]
"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2011-02-12 04:15:38 391704]
"Persistence"="C:\Windows\system32\igfxpers.exe" [2011-02-12 04:15:44 418328]
"SynTPEnh"="C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"DellStage"="C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe" [2012-02-01 10:50:02 2195824]
"AdobeAAMUpdater-1.0"="C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-09-20 05:27:44 444904]
"EKIJ5000StatusMonitor"="C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe" [2012-10-08 09:06:08 3182080]

------- Zusätzlicher Suchlauf -------

uLocal Page = C:\Windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mLocal Page = C:\Windows\SysWOW64\blank.htm
IE: Free YouTube to iPod Converter - C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetoipodconverter.htm
IE: Free YouTube to MP3 Converter - C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\Mozilla\Firefox\Profiles\zd0m12fn.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - www.google.de
FF - prefs.js: network.proxy.type - 0
FF - ExtSQL: 2012-12-22 10:27; {34712C68-7391-4c47-94F3-8F88D49AD632}; C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true

- - - - Entfernte verwaiste Registrierungseinträge - - - -

AddRemove-Kindersicherung_is1 - C:\Program Files (x86)\Salfeld\Kisi\unins000.exe
AddRemove-Video Converter - C:\Program Files (x86)\SweetPacks\VideoConverter\uninstall.exe

cosinus 31.01.2013 15:59
Ist die SWH nun wieder aktiv und bleibt sie es auch?

Rheingold 31.01.2013 16:19
Hallo Cosinus,
System und Sicherheit/System/Computerschutz/Systemeigenschaften steht der Schutz für Laufwerk C und D auf „ein“
Konfigurieren ist nicht möglich.

Unter Systemsteuerung/Alle Systemsteuerungselemente/Wiederherstellung ist der Button "Systemwiederherstellung" nicht aktiv.
Allerdings kann ich über den Button "Erweiterte Wiederherstellungsmethoden" entweder
"Windwos neu installieren" oder den Button "Verwenden Sie ein zuvor erstelltes Systemabbild, um den Computer wiederherzustellen" auswählen. Beide sind aktiv. Aber ich habe nichts ausgeführt.

Kompliziert finde ich.

cosinus 31.01.2013 16:22
Downloade dir bitte Farbar's Service Scanner
  • Starte das Tool mit Doppelklick auf die FSS.exe
  • Gehe sicher, dass folgende Optionen angehakt sind.
    • Internet Services
    • Windows Firewall
    • System Restore
    • SecurityCenter / ActionCenter
  • Klicke auf Scan.
  • Wenn das Tool fertig ist, wird es eine FSS.txt in dem Verzeichnis erstellen, wo das Tool gelaufen ist.
Poste bitte den Inhalt hier.

Rheingold 31.01.2013 16:41
So, hier ist der log von FSS:

Code:
Farbar Service Scanner Version: 30-01-2013
Ran by Jasmina (administrator) on 31-01-2013 at 16:38:57
Running from "C:\Users\Jasmina.NICOJAS-PC\Desktop"
Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Attempt to access Google IP returned error. Google IP is offline
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
"DisableSR"=DWORD:1
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
"DisableConfig"=DWORD:1


Action Center:
============

Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit


**** End of log ****

cosinus 31.01.2013 17:00
Bitte mach nun ein Log mit GMER und poste es

Rheingold 31.01.2013 17:48
Habe ich gemacht. Hier das Ergebnis!
Uuups, das sind zu viele Zeichen. Ich poste das jetzt einfach in zwei Teilen.

:dankeschoen:

Code:
GMER 2.0.18454 - http://www.gmer.net
Rootkit scan 2013-01-31 17:41:07
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST9500420AS rev.D005SDM1 465,76GB
Running: gmer_2.0.18454.exe; Driver: C:\Users\JASMIN~1.NIC\AppData\Local\Temp\awliyfob.sys


---- Kernel code sections - GMER 2.0 ----

.text  C:\Windows\system32\DRIVERS\USBPORT.SYS!DllUnload                                                                                                                                                                            fffff8800ff6fd64 12 bytes {MOV RAX, 0xfffffa80055422a0; JMP RAX}

---- User code sections - GMER 2.0 ----

.text  C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe[1860] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                  0000000075811401 2 bytes [81, 75]
.text  C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe[1860] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                    0000000075811419 2 bytes [81, 75]
.text  C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe[1860] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                  0000000075811431 2 bytes [81, 75]
.text  C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe[1860] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                  000000007581144a 2 bytes [81, 75]
.text  ...                                                                                                                                                                                                                          * 9
.text  C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe[1860] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                      00000000758114dd 2 bytes [81, 75]
.text  C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe[1860] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                              00000000758114f5 2 bytes [81, 75]
.text  C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe[1860] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                      000000007581150d 2 bytes [81, 75]
.text  C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe[1860] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                              0000000075811525 2 bytes [81, 75]
.text  C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe[1860] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                    000000007581153d 2 bytes [81, 75]
.text  C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe[1860] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                          0000000075811555 2 bytes [81, 75]
.text  C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe[1860] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                  000000007581156d 2 bytes [81, 75]
.text  C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe[1860] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                    0000000075811585 2 bytes [81, 75]
.text  C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe[1860] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                        000000007581159d 2 bytes [81, 75]
.text  C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe[1860] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                    00000000758115b5 2 bytes [81, 75]
.text  C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe[1860] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                  00000000758115cd 2 bytes [81, 75]
.text  C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe[1860] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                              00000000758116b2 2 bytes [81, 75]
.text  C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe[1860] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                              00000000758116bd 2 bytes [81, 75]
.text  C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[1928] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                0000000075811401 2 bytes [81, 75]
.text  C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[1928] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                  0000000075811419 2 bytes [81, 75]
.text  C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[1928] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                0000000075811431 2 bytes [81, 75]
.text  C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[1928] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                000000007581144a 2 bytes [81, 75]
.text  ...                                                                                                                                                                                                                          * 9
.text  C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[1928] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                  00000000758114dd 2 bytes [81, 75]
.text  C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[1928] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                            00000000758114f5 2 bytes [81, 75]
.text  C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[1928] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                  000000007581150d 2 bytes [81, 75]
.text  C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[1928] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                            0000000075811525 2 bytes [81, 75]
.text  C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[1928] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                  000000007581153d 2 bytes [81, 75]
.text  C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[1928] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                      0000000075811555 2 bytes [81, 75]
.text  C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[1928] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                000000007581156d 2 bytes [81, 75]
.text  C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[1928] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                  0000000075811585 2 bytes [81, 75]
.text  C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[1928] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                    000000007581159d 2 bytes [81, 75]
.text  C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[1928] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                  00000000758115b5 2 bytes [81, 75]
.text  C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[1928] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                00000000758115cd 2 bytes [81, 75]
.text  C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[1928] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                            00000000758116b2 2 bytes [81, 75]
.text  C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe[1928] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                            00000000758116bd 2 bytes [81, 75]
.text  D:\Tobit Radio.fx\Server\rfx-server.exe[1520] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter                                                                                                                  0000000075fd87b1 5 bytes JMP 0000000100641870
.text  D:\Tobit Radio.fx\Server\rfx-server.exe[1520] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                                        0000000075811401 2 bytes [81, 75]
.text  D:\Tobit Radio.fx\Server\rfx-server.exe[1520] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                                          0000000075811419 2 bytes [81, 75]
.text  D:\Tobit Radio.fx\Server\rfx-server.exe[1520] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                                        0000000075811431 2 bytes [81, 75]
.text  D:\Tobit Radio.fx\Server\rfx-server.exe[1520] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                                        000000007581144a 2 bytes [81, 75]
.text  ...                                                                                                                                                                                                                          * 9
.text  D:\Tobit Radio.fx\Server\rfx-server.exe[1520] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                          00000000758114dd 2 bytes [81, 75]
.text  D:\Tobit Radio.fx\Server\rfx-server.exe[1520] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                                    00000000758114f5 2 bytes [81, 75]
.text  D:\Tobit Radio.fx\Server\rfx-server.exe[1520] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                          000000007581150d 2 bytes [81, 75]
.text  D:\Tobit Radio.fx\Server\rfx-server.exe[1520] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                                    0000000075811525 2 bytes [81, 75]
.text  D:\Tobit Radio.fx\Server\rfx-server.exe[1520] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                                          000000007581153d 2 bytes [81, 75]
.text  D:\Tobit Radio.fx\Server\rfx-server.exe[1520] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                              0000000075811555 2 bytes [81, 75]
.text  D:\Tobit Radio.fx\Server\rfx-server.exe[1520] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                                        000000007581156d 2 bytes [81, 75]
.text  D:\Tobit Radio.fx\Server\rfx-server.exe[1520] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                                          0000000075811585 2 bytes [81, 75]
.text  D:\Tobit Radio.fx\Server\rfx-server.exe[1520] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                            000000007581159d 2 bytes [81, 75]
.text  D:\Tobit Radio.fx\Server\rfx-server.exe[1520] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                                          00000000758115b5 2 bytes [81, 75]
.text  D:\Tobit Radio.fx\Server\rfx-server.exe[1520] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                                        00000000758115cd 2 bytes [81, 75]
.text  D:\Tobit Radio.fx\Server\rfx-server.exe[1520] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                                    00000000758116b2 2 bytes [81, 75]
.text  D:\Tobit Radio.fx\Server\rfx-server.exe[1520] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                                    00000000758116bd 2 bytes [81, 75]
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1732] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                                    0000000075811401 2 bytes [81, 75]
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1732] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                                      0000000075811419 2 bytes [81, 75]
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1732] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                                    0000000075811431 2 bytes [81, 75]
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1732] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                                    000000007581144a 2 bytes [81, 75]
.text  ...                                                                                                                                                                                                                          * 9
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1732] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                      00000000758114dd 2 bytes [81, 75]
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1732] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                                00000000758114f5 2 bytes [81, 75]
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1732] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                      000000007581150d 2 bytes [81, 75]
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1732] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                                0000000075811525 2 bytes [81, 75]
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1732] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                                      000000007581153d 2 bytes [81, 75]
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1732] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                          0000000075811555 2 bytes [81, 75]
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1732] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                                    000000007581156d 2 bytes [81, 75]
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1732] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                                      0000000075811585 2 bytes [81, 75]
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1732] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                        000000007581159d 2 bytes [81, 75]
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1732] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                                      00000000758115b5 2 bytes [81, 75]
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1732] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                                    00000000758115cd 2 bytes [81, 75]
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1732] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                                00000000758116b2 2 bytes [81, 75]
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1732] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                                00000000758116bd 2 bytes [81, 75]
.text  C:\Windows\system32\taskhost.exe[2368] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                                                                                                              000007fefd349aa5 3 bytes [65, 65, 06]
.text  C:\Windows\SysWOW64\cchservice.exe[2648] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                                            0000000075811401 2 bytes [81, 75]
.text  C:\Windows\SysWOW64\cchservice.exe[2648] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                                              0000000075811419 2 bytes [81, 75]
.text  C:\Windows\SysWOW64\cchservice.exe[2648] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                                            0000000075811431 2 bytes [81, 75]
.text  C:\Windows\SysWOW64\cchservice.exe[2648] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                                            000000007581144a 2 bytes [81, 75]
.text  ...                                                                                                                                                                                                                          * 9
.text  C:\Windows\SysWOW64\cchservice.exe[2648] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                                00000000758114dd 2 bytes [81, 75]
.text  C:\Windows\SysWOW64\cchservice.exe[2648] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                                        00000000758114f5 2 bytes [81, 75]
.text  C:\Windows\SysWOW64\cchservice.exe[2648] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                                000000007581150d 2 bytes [81, 75]
.text  C:\Windows\SysWOW64\cchservice.exe[2648] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                                        0000000075811525 2 bytes [81, 75]
.text  C:\Windows\SysWOW64\cchservice.exe[2648] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                                              000000007581153d 2 bytes [81, 75]
.text  C:\Windows\SysWOW64\cchservice.exe[2648] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                                    0000000075811555 2 bytes [81, 75]
.text  C:\Windows\SysWOW64\cchservice.exe[2648] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                                            000000007581156d 2 bytes [81, 75]
.text  C:\Windows\SysWOW64\cchservice.exe[2648] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                                              0000000075811585 2 bytes [81, 75]
.text  C:\Windows\SysWOW64\cchservice.exe[2648] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                                  000000007581159d 2 bytes [81, 75]
.text  C:\Windows\SysWOW64\cchservice.exe[2648] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                                              00000000758115b5 2 bytes [81, 75]
.text  C:\Windows\SysWOW64\cchservice.exe[2648] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                                            00000000758115cd 2 bytes [81, 75]
.text  C:\Windows\SysWOW64\cchservice.exe[2648] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                                        00000000758116b2 2 bytes [81, 75]
.text  C:\Windows\SysWOW64\cchservice.exe[2648] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                                        00000000758116bd 2 bytes [81, 75]
.text  C:\Windows\system32\Dwm.exe[2708] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                                                                                                                    000007fefd349aa5 3 bytes [65, 65, 21]
.text  C:\Windows\Explorer.EXE[2704] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                                                                                                                        000007fefd349aa5 3 bytes [65, 65, 06]
.text  C:\Windows\System32\hkcmd.exe[3452] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                                                                                                                  000007fefd349aa5 3 bytes [65, 65, 06]
.text  C:\Windows\System32\igfxpers.exe[3460] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                                                                                                              000007fefd349aa5 3 bytes [65, 65, 82]
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3528] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                                                                                                  000007fefd349aa5 3 bytes [65, 65, 06]
.text  C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3640] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                                                                                              000007fefd349aa5 3 bytes [65, 65, 06]
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3888] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                                                                                        000007fefd349aa5 3 bytes [65, 65, 06]
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[3268] C:\Windows\syswow64\kernel32.dll!TerminateThread                                                                                                                      0000000075fd7a17 6 bytes {JMP QWORD [RIP+0x71a6001e]}
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[3268] C:\Windows\syswow64\kernel32.dll!TerminateProcess                                                                                                                      0000000075fed7ea 6 bytes {JMP QWORD [RIP+0x71ac001e]}
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[3268] C:\Windows\syswow64\kernel32.dll!SuspendThread                                                                                                                        0000000075ff7d66 6 bytes {JMP QWORD [RIP+0x71a3001e]}
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[3268] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493                                                                                                                0000000075312c91 4 bytes {CALL QWORD [RIP+0x1e000a]}
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[3268] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                                0000000075811401 2 bytes [81, 75]
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[3268] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                                  0000000075811419 2 bytes [81, 75]
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[3268] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                                0000000075811431 2 bytes [81, 75]
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[3268] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                                000000007581144a 2 bytes [81, 75]
.text  ...                                                                                                                                                                                                                          * 9
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[3268] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                  00000000758114dd 2 bytes [81, 75]
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[3268] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                            00000000758114f5 2 bytes [81, 75]
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[3268] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                  000000007581150d 2 bytes [81, 75]
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[3268] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                            0000000075811525 2 bytes [81, 75]
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[3268] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                                  000000007581153d 2 bytes [81, 75]
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[3268] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                      0000000075811555 2 bytes [81, 75]
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[3268] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                                000000007581156d 2 bytes [81, 75]
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[3268] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                                  0000000075811585 2 bytes [81, 75]
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[3268] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                    000000007581159d 2 bytes [81, 75]
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[3268] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                                  00000000758115b5 2 bytes [81, 75]
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[3268] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                                00000000758115cd 2 bytes [81, 75]
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[3268] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                            00000000758116b2 2 bytes [81, 75]
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[3268] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                            00000000758116bd 2 bytes [81, 75]
.text  C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3480] C:\Windows\syswow64\kernel32.dll!TerminateThread                                                                                                          0000000075fd7a17 6 bytes {JMP QWORD [RIP+0x71a6001e]}
.text  C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3480] C:\Windows\syswow64\kernel32.dll!TerminateProcess                                                                                                          0000000075fed7ea 6 bytes {JMP QWORD [RIP+0x71ac001e]}
.text  C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3480] C:\Windows\syswow64\kernel32.dll!SuspendThread                                                                                                            0000000075ff7d66 6 bytes {JMP QWORD [RIP+0x71a3001e]}
.text  C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3480] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493                                                                                                    0000000075312c91 4 bytes {CALL QWORD [RIP+0x26000a]}
.text  C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2912] C:\Windows\syswow64\kernel32.dll!TerminateThread                                                                                                          0000000075fd7a17 6 bytes {JMP QWORD [RIP+0x71a7001e]}
.text  C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2912] C:\Windows\syswow64\kernel32.dll!TerminateProcess                                                                                                          0000000075fed7ea 6 bytes {JMP QWORD [RIP+0x71ad001e]}
.text  C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2912] C:\Windows\syswow64\kernel32.dll!SuspendThread                                                                                                            0000000075ff7d66 6 bytes {JMP QWORD [RIP+0x71a4001e]}
.text  C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2912] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493                                                                                                    0000000075312c91 4 bytes {CALL QWORD [RIP+0x2fc000a]}
.text  C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2912] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                    0000000075811401 2 bytes [81, 75]
.text  C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2912] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                      0000000075811419 2 bytes [81, 75]
.text  C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2912] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                    0000000075811431 2 bytes [81, 75]
.text  C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2912] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                    000000007581144a 2 bytes [81, 75]
.text  ...                                                                                                                                                                                                                          * 9
.text  C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2912] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                      00000000758114dd 2 bytes [81, 75]
.text  C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2912] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                00000000758114f5 2 bytes [81, 75]
.text  C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2912] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                      000000007581150d 2 bytes [81, 75]
.text  C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2912] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                0000000075811525 2 bytes [81, 75]
.text  C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2912] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                      000000007581153d 2 bytes [81, 75]
.text  C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2912] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                          0000000075811555 2 bytes [81, 75]
.text  C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2912] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                    000000007581156d 2 bytes [81, 75]
.text  C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2912] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                      0000000075811585 2 bytes [81, 75]
.text  C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2912] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                        000000007581159d 2 bytes [81, 75]
.text  C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2912] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                      00000000758115b5 2 bytes [81, 75]
.text  C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2912] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                    00000000758115cd 2 bytes [81, 75]
.text  C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2912] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                00000000758116b2 2 bytes [81, 75]
.text  C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2912] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                00000000758116bd 2 bytes [81, 75]
.text  C:\Program Files\Update\realsched.exe[3232] C:\Windows\syswow64\kernel32.dll!TerminateThread                                                                                                                                0000000075fd7a17 6 bytes {JMP QWORD [RIP+0x71a8001e]}
.text  C:\Program Files\Update\realsched.exe[3232] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter                                                                                                                    0000000075fd87b1 5 bytes [33, C0, C2, 04, 00]
.text  C:\Program Files\Update\realsched.exe[3232] C:\Windows\syswow64\kernel32.dll!TerminateProcess                                                                                                                                0000000075fed7ea 6 bytes {JMP QWORD [RIP+0x71ae001e]}
.text  C:\Program Files\Update\realsched.exe[3232] C:\Windows\syswow64\kernel32.dll!SuspendThread                                                                                                                                  0000000075ff7d66 6 bytes {JMP QWORD [RIP+0x71a5001e]}
.text  C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe[148] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                                                                                        000007fefd349aa5 3 bytes [65, 65, 06]
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3704] C:\Windows\syswow64\kernel32.dll!TerminateThread                                                                                                                0000000075fd7a17 6 bytes {JMP QWORD [RIP+0x71a8001e]}
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3704] C:\Windows\syswow64\kernel32.dll!TerminateProcess                                                                                                              0000000075fed7ea 6 bytes {JMP QWORD [RIP+0x71ae001e]}
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3704] C:\Windows\syswow64\kernel32.dll!SuspendThread                                                                                                                  0000000075ff7d66 6 bytes {JMP QWORD [RIP+0x71a5001e]}
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4616] C:\Windows\syswow64\kernel32.dll!TerminateThread                                                                                              0000000075fd7a17 6 bytes {JMP QWORD [RIP+0x71a0001e]}
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4616] C:\Windows\syswow64\kernel32.dll!TerminateProcess                                                                                            0000000075fed7ea 6 bytes {JMP QWORD [RIP+0x71ac001e]}
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4616] C:\Windows\syswow64\kernel32.dll!SuspendThread                                                                                                0000000075ff7d66 6 bytes {JMP QWORD [RIP+0x719d001e]}
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4616] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493                                                                                      0000000075312c91 4 bytes {CALL QWORD [RIP+0x57000a]}
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4616] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                      0000000075811401 2 bytes [81, 75]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4616] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                        0000000075811419 2 bytes [81, 75]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4616] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                      0000000075811431 2 bytes [81, 75]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4616] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                      000000007581144a 2 bytes [81, 75]
.text  ...                                                                                                                                                                                                                          * 9
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4616] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                          00000000758114dd 2 bytes [81, 75]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4616] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                  00000000758114f5 2 bytes [81, 75]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4616] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                          000000007581150d 2 bytes [81, 75]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4616] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                  0000000075811525 2 bytes [81, 75]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4616] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                        000000007581153d 2 bytes [81, 75]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4616] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                              0000000075811555 2 bytes [81, 75]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4616] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                      000000007581156d 2 bytes [81, 75]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4616] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                        0000000075811585 2 bytes [81, 75]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4616] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                            000000007581159d 2 bytes [81, 75]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4616] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                        00000000758115b5 2 bytes [81, 75]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4616] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                      00000000758115cd 2 bytes [81, 75]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4616] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                  00000000758116b2 2 bytes [81, 75]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4616] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                  00000000758116bd 2 bytes [81, 75]

---- Kernel IAT/EAT - GMER 2.0 ----

IAT    C:\Windows\system32\drivers\pci.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack]                                                                                                                                                [fffff880010bb650] \SystemRoot\System32\Drivers\sprn.sys [unknown section]
IAT    C:\Windows\system32\drivers\pci.sys[ntoskrnl.exe!IoDetachDevice]                                                                                                                                                            [fffff880010bb5dc] \SystemRoot\System32\Drivers\sprn.sys [unknown section]
IAT    C:\Windows\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortBufferUshort]                                                                                                                                              [fffff8800108635c] \SystemRoot\System32\Drivers\sprn.sys [unknown section]
IAT    C:\Windows\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUchar]                                                                                                                                                      [fffff88001086224] \SystemRoot\System32\Drivers\sprn.sys [unknown section]
IAT    C:\Windows\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortUchar]                                                                                                                                                    [fffff88001086a24] \SystemRoot\System32\Drivers\sprn.sys [unknown section]
IAT    C:\Windows\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortBufferUshort]                                                                                                                                              [fffff88001086ba0] \SystemRoot\System32\Drivers\sprn.sys [unknown section]

---- User IAT/EAT - GMER 2.0 ----

IAT    C:\Windows\system32\taskhost.exe[2368] @ C:\Windows\system32\taskhost.exe[KERNEL32.dll!TerminateProcess]                                                                                                                    [80000000]
IAT    C:\Windows\system32\taskhost.exe[2368] @ C:\Windows\system32\GDI32.dll[KERNEL32.dll!TerminateProcess]                                                                                                                        [80000000]
IAT    C:\Windows\system32\taskhost.exe[2368] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!TerminateProcess]                                                                                                                      [80000000]
IAT    C:\Windows\system32\taskhost.exe[2368] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!TerminateProcess]                                                                                                                    [80000000]
IAT    C:\Windows\system32\taskhost.exe[2368] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!TerminateThread]                                                                                                                      [80030000]
IAT    C:\Windows\system32\taskhost.exe[2368] @ C:\Windows\system32\IMM32.DLL[KERNEL32.dll!TerminateProcess]                                                                                                                        [80000000]
IAT    C:\Windows\system32\taskhost.exe[2368] @ C:\Windows\system32\dwmapi.dll[KERNEL32.dll!TerminateProcess]                                                                                                                      [80000000]
IAT    C:\Windows\system32\taskhost.exe[2368] @ C:\Windows\system32\dwmapi.dll[KERNEL32.dll!TerminateThread]                                                                                                                        [80030000]
IAT    C:\Windows\system32\taskhost.exe[2368] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!TerminateProcess]                                                                                                                      [80000000]
IAT    C:\Windows\system32\taskhost.exe[2368] @ C:\Windows\system32\WINSTA.dll[KERNEL32.dll!TerminateProcess]                                                                                                                      [80000000]
IAT    C:\Windows\system32\taskhost.exe[2368] @ C:\Windows\System32\PlaySndSrv.dll[KERNEL32.dll!TerminateProcess]                                                                                                                  [80000000]
IAT    C:\Windows\system32\taskhost.exe[2368] @ C:\Windows\system32\WINMM.dll[KERNEL32.dll!TerminateProcess]                                                                                                                        [80000000]
IAT    C:\Windows\system32\taskhost.exe[2368] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!TerminateProcess]                                                                                                                      [80000000]
IAT    C:\Windows\system32\taskhost.exe[2368] @ C:\Windows\System32\nlaapi.dll[KERNEL32.dll!TerminateProcess]                                                                                                                      [80000000]
IAT    C:\Windows\system32\taskhost.exe[2368] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!TerminateProcess]                                                                                                                      [80000000]
IAT    C:\Windows\system32\taskhost.exe[2368] @ C:\Windows\system32\dsrole.dll[KERNEL32.dll!TerminateProcess]                                                                                                                      [80000000]
IAT    C:\Windows\system32\taskhost.exe[2368] @ C:\Windows\system32\MMDevAPI.DLL[KERNEL32.dll!TerminateProcess]                                                                                                                    [80000000]
IAT    C:\Windows\system32\taskhost.exe[2368] @ C:\Windows\system32\PROPSYS.dll[KERNEL32.dll!TerminateProcess]                                                                                                                      [80000000]
IAT    C:\Windows\system32\taskhost.exe[2368] @ C:\Windows\system32\wdmaud.drv[KERNEL32.dll!TerminateProcess]                                                                                                                      [80000000]
IAT    C:\Windows\system32\taskhost.exe[2368] @ C:\Windows\system32\CFGMGR32.dll[KERNEL32.dll!TerminateProcess]                                                                                                                    [80000000]
IAT    C:\Windows\system32\taskhost.exe[2368] @ C:\Windows\system32\AUDIOSES.DLL[KERNEL32.dll!TerminateProcess]                                                                                                                    [80000000]
IAT    C:\Windows\system32\taskhost.exe[2368] @ C:\Windows\system32\msacm32.drv[KERNEL32.dll!TerminateProcess]                                                                                                                      [80000000]
IAT    C:\Windows\system32\taskhost.exe[2368] @ C:\Windows\system32\midimap.dll[KERNEL32.dll!TerminateProcess]                                                                                                                      [80000000]
IAT    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2664] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmSetAppId]                                              [7fef71a2750] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2664] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmSetMachineId]                                          [7fef71a2b98] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2664] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmWriteSharedMachineId]                                  [7fef71a7de0] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2664] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmCreateNewId]                                          [7fef71a8130] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2664] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmReadSharedMachineId]                                  [7fef71a1908] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2664] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmGetSession]                                            [7fef71a1c00] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2664] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmStartUpload]                                          [7fef71a81d8] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2664] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmSet]                                                  [7fef71a2878] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2664] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmAddToStreamString]                                    [7fef71a7a5c] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2664] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmIncrement]                                            [7fef71a6c48] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2664] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmAddToStreamDWord]                                      [7fef71a77bc] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2664] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmSetAppVersion]                                        [7fef71a7064] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2664] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmStartSession]                                          [7fef71a6544] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2664] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmEndSession]                                            [7fef71a5e30] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT    C:\Windows\system32\Dwm.exe[2708] @ C:\Windows\system32\Dwm.exe[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\system32\Dwm.exe[2708] @ C:\Windows\system32\Dwm.exe[KERNEL32.dll!TerminateThread]                                                                                                                                [80030000]
IAT    C:\Windows\system32\Dwm.exe[2708] @ C:\Windows\system32\GDI32.dll[KERNEL32.dll!TerminateProcess]                                                                                                                            [80000000]
IAT    C:\Windows\system32\Dwm.exe[2708] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!TerminateProcess]                                                                                                                            [80000000]
IAT    C:\Windows\system32\Dwm.exe[2708] @ C:\Windows\system32\IMM32.dll[KERNEL32.dll!TerminateProcess]                                                                                                                            [80000000]
IAT    C:\Windows\system32\Dwm.exe[2708] @ C:\Windows\system32\dwmredir.dll[KERNEL32.dll!TerminateThread]                                                                                                                          [80030000]
IAT    C:\Windows\system32\Dwm.exe[2708] @ C:\Windows\system32\dwmredir.dll[KERNEL32.dll!TerminateProcess]                                                                                                                          [80000000]
IAT    C:\Windows\system32\Dwm.exe[2708] @ C:\Windows\system32\dwmcore.dll[KERNEL32.dll!TerminateThread]                                                                                                                            [80030000]
IAT    C:\Windows\system32\Dwm.exe[2708] @ C:\Windows\system32\dwmcore.dll[KERNEL32.dll!TerminateProcess]                                                                                                                          [80000000]
IAT    C:\Windows\system32\Dwm.exe[2708] @ C:\Windows\system32\WindowsCodecs.dll[KERNEL32.dll!TerminateThread]                                                                                                                      [80030000]
IAT    C:\Windows\system32\Dwm.exe[2708] @ C:\Windows\system32\WindowsCodecs.dll[KERNEL32.dll!TerminateProcess]                                                                                                                    [80000000]
IAT    C:\Windows\system32\Dwm.exe[2708] @ C:\Windows\system32\d3d10_1.dll[KERNEL32.dll!TerminateProcess]                                                                                                                          [80000000]
IAT    C:\Windows\system32\Dwm.exe[2708] @ C:\Windows\system32\d3d10_1core.dll[KERNEL32.dll!TerminateProcess]                                                                                                                      [80000000]
IAT    C:\Windows\system32\Dwm.exe[2708] @ C:\Windows\system32\dxgi.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\system32\Dwm.exe[2708] @ C:\Windows\system32\VERSION.dll[KERNEL32.dll!TerminateProcess]                                                                                                                          [80000000]
IAT    C:\Windows\system32\Dwm.exe[2708] @ C:\Windows\system32\dwmapi.dll[KERNEL32.dll!TerminateProcess]                                                                                                                            [80000000]
IAT    C:\Windows\system32\Dwm.exe[2708] @ C:\Windows\system32\dwmapi.dll[KERNEL32.dll!TerminateThread]                                                                                                                            [80030000]
IAT    C:\Windows\system32\Dwm.exe[2708] @ C:\Windows\system32\PSAPI.DLL[KERNEL32.dll!TerminateProcess]                                                                                                                            [80000000]
IAT    C:\Windows\system32\Dwm.exe[2708] @ C:\Windows\system32\uDWM.dll[KERNEL32.dll!TerminateThread]                                                                                                                              [80030000]
IAT    C:\Windows\system32\Dwm.exe[2708] @ C:\Windows\system32\uDWM.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\system32\Dwm.exe[2708] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!TerminateProcess]                                                                                                                          [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\Explorer.EXE[KERNEL32.dll!TerminateProcess]                                                                                                                                      [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\Explorer.EXE[KERNEL32.dll!TerminateThread]                                                                                                                                        [80030000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\GDI32.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!TerminateThread]                                                                                                                              [80030000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\EXPLORERFRAME.dll[KERNEL32.dll!TerminateProcess]                                                                                                                        [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\DUser.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\DUI70.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\IMM32.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\CFGMGR32.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\dwmapi.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\dwmapi.dll[KERNEL32.dll!TerminateThread]                                                                                                                                [80030000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_2b253c8271ec7765\gdiplus.dll[KERNEL32.dll!TerminateProcess]                                          [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\Secur32.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\PROPSYS.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\WINSTA.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\WindowsCodecs.dll[KERNEL32.dll!TerminateThread]                                                                                                                          [80030000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\WindowsCodecs.dll[KERNEL32.dll!TerminateProcess]                                                                                                                        [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\apphelp.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\EhStorShell.dll[KERNEL32.dll!TerminateProcess]                                                                                                                          [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\ntshrui.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\srvcli.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\IconCodecService.dll[KERNEL32.dll!TerminateProcess]                                                                                                                      [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\SndVolSSO.DLL[KERNEL32.dll!TerminateProcess]                                                                                                                            [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\HID.DLL[KERNEL32.dll!TerminateProcess]                                                                                                                                  [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\System32\MMDevApi.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\timedate.cpl[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\ATL.DLL[KERNEL32.dll!TerminateProcess]                                                                                                                                  [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\actxprxy.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\ntmarta.dll[KERNEL32.dll!TerminateThread]                                                                                                                                [80030000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\ntmarta.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\WLDAP32.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\System32\shdocvw.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\LINKINFO.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\System32\gameux.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\System32\XmlLite.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\System32\wer.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                  [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\msls31.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll[KERNEL32.dll!TerminateProcess]

Rheingold 31.01.2013 17:49
Code:
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\authui.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\msiltcfg.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\VERSION.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\msi.dll[KERNEL32.dll!TerminateThread]                                                                                                                                    [80030000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\msi.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                  [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\urlmon.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\urlmon.dll[KERNEL32.dll!TerminateThread]                                                                                                                                [80030000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\iertutil.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\iertutil.dll[KERNEL32.dll!TerminateThread]                                                                                                                              [80030000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\WININET.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\WINMM.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\wdmaud.drv[KERNEL32.dll!TerminateProcess]                                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\AUDIOSES.DLL[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\msacm32.drv[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\midimap.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\MsftEdit.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\netutils.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\System32\SyncCenter.dll[KERNEL32.dll!TerminateProcess]                                                                                                                            [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\stobject.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\BatMeter.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\prnfldr.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\dxp.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                  [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\Syncreg.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\ehome\ehSSO.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                    [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\System32\netshell.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\System32\nlaapi.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\System32\AltTab.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\System32\pnidui.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\System32\QUtil.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\System32\wevtapi.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\wpdshserviceobj.dll[KERNEL32.dll!TerminateProcess]                                                                                                                      [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\System32\Actioncenter.dll[KERNEL32.dll!TerminateProcess]                                                                                                                          [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\fxsst.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\fxsst.dll[KERNEL32.dll!TerminateThread]                                                                                                                                  [80030000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\FXSAPI.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\PortableDeviceTypes.dll[KERNEL32.dll!TerminateProcess]                                                                                                                  [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\PortableDeviceApi.dll[KERNEL32.dll!TerminateProcess]                                                                                                                    [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\System32\srchadmin.dll[KERNEL32.dll!TerminateProcess]                                                                                                                            [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\System32\UIAnimation.dll[KERNEL32.dll!TerminateProcess]                                                                                                                          [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\credssp.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\wlanutil.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\System32\QAgent.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\imapi2.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\System32\hgcpl.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\System32\provsvc.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\wkscli.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Program Files\Internet Explorer\ieproxy.dll[KERNEL32.dll!TerminateProcess]                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\MPR.dll[KERNEL32.dll!TerminateThread]                                                                                                                                    [80030000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\MPR.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                  [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\PSAPI.DLL[KERNEL32.dll!TerminateProcess]                                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\ieframe.DLL[KERNEL32.dll!TerminateThread]                                                                                                                                [80030000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\ieframe.DLL[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\ieframe.DLL[KERNEL32.dll!SuspendThread]                                                                                                                                  [80060000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\System32\werconcpl.dll[KERNEL32.dll!TerminateProcess]                                                                                                                            [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\System32\msxml6.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\System32\msxml6.dll[KERNEL32.dll!SuspendThread]                                                                                                                                  [80060000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\rasman.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\rtutils.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\System32\hcproviders.dll[KERNEL32.dll!TerminateProcess]                                                                                                                          [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\SPPC.DLL[KERNEL32.dll!TerminateProcess]                                                                                                                                  [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\WinSATAPI.dll[KERNEL32.dll!TerminateThread]                                                                                                                              [80030000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\WinSATAPI.dll[KERNEL32.dll!TerminateProcess]                                                                                                                            [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\dxgi.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                  [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\twext.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\COMDLG32.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Program Files (x86)\NCH Software\ExpressZip\ezcm64.dll[KERNEL32.dll!TerminateProcess]                                                                                                    [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\syncui.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\SYNCENG.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\acppage.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\sfc_os.DLL[KERNEL32.dll!TerminateProcess]                                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\NetworkExplorer.dll[KERNEL32.dll!TerminateProcess]                                                                                                                      [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\DeviceCenter.dll[KERNEL32.dll!TerminateProcess]                                                                                                                          [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\System32\msxml3.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\System32\msxml3.dll[KERNEL32.dll!SuspendThread]                                                                                                                                  [80060000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\System32\FirewallAPI.dll[KERNEL32.dll!TerminateProcess]                                                                                                                          [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\EhStorAPI.dll[KERNEL32.dll!TerminateProcess]                                                                                                                            [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\System32\HelpPaneProxy.dll[KERNEL32.dll!TerminateProcess]                                                                                                                        [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\thumbcache.dll[KERNEL32.dll!TerminateProcess]                                                                                                                            [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\van.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                  [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\RasMM.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\WWanMM.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\WlanMM.dll[KERNEL32.dll!TerminateProcess]                                                                                                                                [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\OneX.DLL[KERNEL32.dll!TerminateProcess]                                                                                                                                  [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\eappprxy.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\Explorer.EXE[2704] @ C:\Windows\system32\eappcfg.dll[KERNEL32.dll!TerminateProcess]                                                                                                                              [80000000]
IAT    C:\Windows\System32\hkcmd.exe[3452] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!TerminateProcess]                                                                                                                          [80000000]
IAT    C:\Windows\System32\hkcmd.exe[3452] @ C:\Windows\system32\GDI32.dll[KERNEL32.dll!TerminateProcess]                                                                                                                          [80000000]
IAT    C:\Windows\System32\hkcmd.exe[3452] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!TerminateProcess]                                                                                                                        [80000000]
IAT    C:\Windows\System32\hkcmd.exe[3452] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!TerminateThread]                                                                                                                        [80030000]
IAT    C:\Windows\System32\hkcmd.exe[3452] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!TerminateProcess]                                                                                                                        [80000000]
IAT    C:\Windows\System32\hkcmd.exe[3452] @ C:\Windows\system32\IMM32.DLL[KERNEL32.dll!TerminateProcess]                                                                                                                          [80000000]
IAT    C:\Windows\System32\hkcmd.exe[3452] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!TerminateProcess]                                                                                                                        [80000000]
IAT    C:\Windows\System32\hkcmd.exe[3452] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!TerminateProcess]                                                                                                                          [80000000]
IAT    C:\Windows\System32\hkcmd.exe[3452] @ C:\Windows\System32\dwmapi.dll[KERNEL32.dll!TerminateProcess]                                                                                                                          [80000000]
IAT    C:\Windows\System32\hkcmd.exe[3452] @ C:\Windows\System32\dwmapi.dll[KERNEL32.dll!TerminateThread]                                                                                                                          [80030000]
IAT    C:\Windows\System32\igfxpers.exe[3460] @ C:\Windows\system32\CFGMGR32.dll[KERNEL32.dll!TerminateProcess]                                                                                                                    [80000000]
IAT    C:\Windows\System32\igfxpers.exe[3460] @ C:\Windows\system32\GDI32.dll[KERNEL32.dll!TerminateProcess]                                                                                                                        [80000000]
IAT    C:\Windows\System32\igfxpers.exe[3460] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!TerminateProcess]                                                                                                                      [80000000]
IAT    C:\Windows\System32\igfxpers.exe[3460] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!TerminateProcess]                                                                                                                    [80000000]
IAT    C:\Windows\System32\igfxpers.exe[3460] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!TerminateThread]                                                                                                                      [80030000]
IAT    C:\Windows\System32\igfxpers.exe[3460] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!TerminateProcess]                                                                                                                      [80000000]
IAT    C:\Windows\System32\igfxpers.exe[3460] @ C:\Windows\system32\IMM32.DLL[KERNEL32.dll!TerminateProcess]                                                                                                                        [80000000]
IAT    C:\Windows\System32\igfxpers.exe[3460] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!TerminateProcess]                                                                                                                      [80000000]
IAT    C:\Windows\System32\igfxpers.exe[3460] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!TerminateProcess]                                                                                                                      [80000000]
IAT    C:\Windows\System32\igfxpers.exe[3460] @ C:\Windows\System32\dwmapi.dll[KERNEL32.dll!TerminateProcess]                                                                                                                      [80000000]
IAT    C:\Windows\System32\igfxpers.exe[3460] @ C:\Windows\System32\dwmapi.dll[KERNEL32.dll!TerminateThread]                                                                                                                        [80030000]
IAT    C:\Windows\System32\igfxpers.exe[3460] @ C:\Windows\System32\IccLibDll_x64.dll[KERNEL32.dll!TerminateProcess]                                                                                                                [80000000]
IAT    C:\Windows\System32\igfxpers.exe[3460] @ C:\Windows\system32\PSAPI.DLL[KERNEL32.dll!TerminateProcess]                                                                                                                        [80000000]
IAT    C:\Windows\System32\igfxpers.exe[3460] @ C:\Windows\System32\WINSTA.dll[KERNEL32.dll!TerminateProcess]                                                                                                                      [80000000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3528] @ C:\Windows\system32\VERSION.dll[KERNEL32.dll!TerminateProcess]                                                                                                        [80000000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3528] @ C:\Windows\system32\WINMM.dll[KERNEL32.dll!TerminateProcess]                                                                                                          [80000000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3528] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!TerminateProcess]                                                                                                          [80000000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3528] @ C:\Windows\system32\GDI32.dll[KERNEL32.dll!TerminateProcess]                                                                                                          [80000000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3528] @ C:\Windows\system32\PSAPI.DLL[KERNEL32.dll!TerminateProcess]                                                                                                          [80000000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3528] @ C:\Windows\system32\netutils.dll[KERNEL32.dll!TerminateProcess]                                                                                                        [80000000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3528] @ C:\Windows\system32\srvcli.dll[KERNEL32.dll!TerminateProcess]                                                                                                          [80000000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3528] @ C:\Windows\system32\wkscli.dll[KERNEL32.dll!TerminateProcess]                                                                                                          [80000000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3528] @ C:\Windows\system32\COMDLG32.dll[KERNEL32.dll!TerminateProcess]                                                                                                        [80000000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3528] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!TerminateProcess]                                                                                                        [80000000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3528] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\COMCTL32.dll[KERNEL32.dll!TerminateProcess]          [80000000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3528] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!TerminateProcess]                                                                                                        [80000000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3528] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!TerminateThread]                                                                                                        [80030000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3528] @ C:\Windows\system32\IMM32.DLL[KERNEL32.dll!TerminateProcess]                                                                                                          [80000000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3528] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!TerminateProcess]                                                                                                        [80000000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3528] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!TerminateProcess]                                                                                                          [80000000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3528] @ C:\Windows\system32\dwmapi.dll[KERNEL32.dll!TerminateProcess]                                                                                                          [80000000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3528] @ C:\Windows\system32\dwmapi.dll[KERNEL32.dll!TerminateThread]                                                                                                          [80030000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3528] @ C:\Windows\System32\MMDevApi.dll[KERNEL32.dll!TerminateProcess]                                                                                                        [80000000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3528] @ C:\Windows\System32\PROPSYS.dll[KERNEL32.dll!TerminateProcess]                                                                                                        [80000000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3528] @ C:\Windows\system32\CFGMGR32.dll[KERNEL32.dll!TerminateProcess]                                                                                                        [80000000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3528] @ C:\Windows\system32\ntmarta.dll[KERNEL32.dll!TerminateThread]                                                                                                          [80030000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3528] @ C:\Windows\system32\ntmarta.dll[KERNEL32.dll!TerminateProcess]                                                                                                        [80000000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3528] @ C:\Windows\system32\WLDAP32.dll[KERNEL32.dll!TerminateProcess]                                                                                                        [80000000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3528] @ C:\Windows\system32\urlmon.dll[KERNEL32.dll!TerminateProcess]                                                                                                          [80000000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3528] @ C:\Windows\system32\urlmon.dll[KERNEL32.dll!TerminateThread]                                                                                                          [80030000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3528] @ C:\Windows\system32\iertutil.dll[KERNEL32.dll!TerminateProcess]                                                                                                        [80000000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3528] @ C:\Windows\system32\iertutil.dll[KERNEL32.dll!TerminateThread]                                                                                                        [80030000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3528] @ C:\Windows\system32\WININET.dll[KERNEL32.dll!TerminateProcess]                                                                                                        [80000000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3528] @ C:\Windows\system32\Secur32.dll[KERNEL32.dll!TerminateProcess]                                                                                                        [80000000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3528] @ C:\Windows\system32\AUDIOSES.DLL[KERNEL32.dll!TerminateProcess]                                                                                                        [80000000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3528] @ C:\Windows\system32\apphelp.dll[KERNEL32.dll!TerminateProcess]                                                                                                        [80000000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3528] @ C:\Windows\system32\WINSTA.dll[KERNEL32.dll!TerminateProcess]                                                                                                          [80000000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3640] @ C:\Windows\system32\PSAPI.DLL[KERNEL32.dll!TerminateProcess]                                                                                                        [80000000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3640] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!TerminateProcess]                                                                                                      [80000000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3640] @ C:\Windows\system32\GDI32.dll[KERNEL32.dll!TerminateProcess]                                                                                                        [80000000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3640] @ C:\Windows\system32\IMM32.DLL[KERNEL32.dll!TerminateProcess]                                                                                                        [80000000]
IAT    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3640] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!TerminateProcess]                                                                                                      [80000000]
IAT    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3888] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\COMCTL32.dll[KERNEL32.dll!TerminateProcess]  [80000000]
IAT    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3888] @ C:\Windows\system32\GDI32.dll[KERNEL32.dll!TerminateProcess]                                                                                                  [80000000]
IAT    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3888] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!TerminateProcess]                                                                                                [80000000]
IAT    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3888] @ C:\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_2b253c8271ec7765\gdiplus.dll[KERNEL32.dll!TerminateProcess]            [80000000]
IAT    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3888] @ C:\Windows\system32\VERSION.dll[KERNEL32.dll!TerminateProcess]                                                                                                [80000000]
IAT    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3888] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!TerminateProcess]                                                                                                [80000000]
IAT    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3888] @ C:\Windows\system32\COMDLG32.dll[KERNEL32.dll!TerminateProcess]                                                                                              [80000000]
IAT    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3888] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!TerminateProcess]                                                                                              [80000000]
IAT    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3888] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!TerminateThread]                                                                                                [80030000]
IAT    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3888] @ C:\Windows\system32\WINMM.dll[KERNEL32.dll!TerminateProcess]                                                                                                  [80000000]
IAT    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3888] @ C:\Windows\system32\IMM32.dll[KERNEL32.dll!TerminateProcess]                                                                                                  [80000000]
IAT    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3888] @ C:\Windows\system32\dwmapi.dll[KERNEL32.dll!TerminateProcess]                                                                                                [80000000]
IAT    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3888] @ C:\Windows\system32\dwmapi.dll[KERNEL32.dll!TerminateThread]                                                                                                  [80030000]
IAT    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3888] @ C:\Windows\system32\NLAapi.dll[KERNEL32.dll!TerminateProcess]                                                                                                [80000000]
IAT    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3888] @ C:\Windows\system32\wshbth.dll[KERNEL32.dll!TerminateProcess]                                                                                                [80000000]
IAT    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3888] @ C:\Windows\System32\winrnr.dll[KERNEL32.dll!TerminateProcess]                                                                                                [80000000]
IAT    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3888] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL[KERNEL32.dll!TerminateProcess]                                                        [80000000]
IAT    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3888] @ C:\Windows\system32\PSAPI.DLL[KERNEL32.dll!TerminateProcess]                                                                                                  [80000000]
IAT    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3888] @ C:\Windows\System32\fwpuclnt.dll[KERNEL32.dll!TerminateProcess]                                                                                              [80000000]
IAT    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3888] @ C:\Windows\system32\WINSTA.dll[KERNEL32.dll!TerminateProcess]                                                                                                [80000000]
IAT    C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe[148] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!TerminateProcess]                                                                                                [80000000]
IAT    C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe[148] @ C:\Windows\system32\GDI32.dll[KERNEL32.dll!TerminateProcess]                                                                                                  [80000000]
IAT    C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe[148] @ C:\Windows\system32\COMDLG32.dll[KERNEL32.dll!TerminateProcess]                                                                                              [80000000]
IAT    C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe[148] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!TerminateProcess]                                                                                                [80000000]
IAT    C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe[148] @ C:\Windows\system32\oledlg.dll[KERNEL32.dll!TerminateProcess]                                                                                                [80000000]
IAT    C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe[148] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!TerminateProcess]                                                                                              [80000000]
IAT    C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe[148] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!TerminateThread]                                                                                                [80030000]
IAT    C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe[148] @ C:\Windows\system32\WINMM.dll[KERNEL32.dll!TerminateProcess]                                                                                                  [80000000]
IAT    C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe[148] @ C:\Windows\system32\PSAPI.DLL[KERNEL32.dll!TerminateProcess]                                                                                                  [80000000]
IAT    C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe[148] @ C:\Windows\system32\VERSION.dll[KERNEL32.dll!TerminateProcess]                                                                                                [80000000]
IAT    C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe[148] @ C:\Windows\system32\IMM32.DLL[KERNEL32.dll!TerminateProcess]                                                                                                  [80000000]
IAT    C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe[148] @ C:\Windows\system32\dwmapi.dll[KERNEL32.dll!TerminateProcess]                                                                                                [80000000]
IAT    C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe[148] @ C:\Windows\system32\dwmapi.dll[KERNEL32.dll!TerminateThread]                                                                                                  [80030000]
IAT    C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe[148] @ C:\Windows\system32\WINSTA.dll[KERNEL32.dll!TerminateProcess]                                                                                                [80000000]

---- Devices - GMER 2.0 ----

Device  \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0                                                                                                                                                                                  fffffa80049d62c0
Device  \Driver\atapi \Device\Ide\IdePort0                                                                                                                                                                                          fffffa80049d62c0
Device  \Driver\atapi \Device\Ide\IdePort1                                                                                                                                                                                          fffffa80049d62c0
Device  \Driver\atapi \Device\Ide\IdePort2                                                                                                                                                                                          fffffa80049d62c0
Device  \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-1                                                                                                                                                                                  fffffa80049d62c0
Device  \FileSystem\Ntfs \Ntfs                                                                                                                                                                                                      fffffa80049dc2c0
Device  \Driver\usbehci \Device\USBPDO-1                                                                                                                                                                                            fffffa80055532c0
Device  \Driver\cdrom \Device\CdRom0                                                                                                                                                                                                fffffa80053032c0
Device  \Driver\NetBT \Device\NetBT_Tcpip_{ED1D7B55-04AB-40A4-B957-EBC1E80911D4}                                                                                                                                                    fffffa80053b52c0
Device  \Driver\usbehci \Device\USBFDO-0                                                                                                                                                                                            fffffa80055532c0
Device  \Driver\NetBT \Device\NetBT_Tcpip_{1DE9DE4B-D0FC-47E6-BC06-204E2E20AB45}                                                                                                                                                    fffffa80053b52c0
Device  \Driver\usbehci \Device\USBFDO-1                                                                                                                                                                                            fffffa80055532c0
Device  \Driver\volmgr \Device\HarddiskVolume1                                                                                                                                                                                      fffffa80049d22c0
Device  \Driver\volmgr \Device\FtControl                                                                                                                                                                                            fffffa80049d22c0
Device  \Driver\volmgr \Device\VolMgrControl                                                                                                                                                                                        fffffa80049d22c0
Device  \Driver\volmgr \Device\HarddiskVolume2                                                                                                                                                                                      fffffa80049d22c0
Device  \Driver\volmgr \Device\HarddiskVolume3                                                                                                                                                                                      fffffa80049d22c0
Device  \Driver\NetBT \Device\NetBT_Tcpip_{6FE6BAC3-E33E-46EB-8477-B5A8961B8F76}                                                                                                                                                    fffffa80053b52c0
Device  \Driver\NetBT \Device\NetBt_Wins_Export                                                                                                                                                                                      fffffa80053b52c0
Device  \Driver\NetBT \Device\NetBT_Tcpip_{D6E59064-F253-4315-9797-CC562B8FC2D9}                                                                                                                                                    fffffa80053b52c0
Device  \Driver\atapi \Device\ScsiPort0                                                                                                                                                                                              fffffa80049d62c0
Device  \Driver\usbehci \Device\USBPDO-0                                                                                                                                                                                            fffffa80055532c0
Device  \Driver\atapi \Device\ScsiPort1                                                                                                                                                                                              fffffa80049d62c0
Device  \Driver\atapi \Device\ScsiPort2                                                                                                                                                                                              fffffa80049d62c0

---- Trace I/O - GMER 2.0 ----

Trace  ntoskrnl.exe CLASSPNP.SYS disk.sys stdcfltn.sys >>UNKNOWN [0xfffffa80049d62c0]<< sprn.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys                                                                                        fffffa80049d62c0
Trace  1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004d78790]                                                                                                                                                              fffffa8004d78790
Trace  3 CLASSPNP.SYS[fffff8800180143f] -> nt!IofCallDriver -> [0xfffffa8004c95cb0]                                                                                                                                                fffffa8004c95cb0
Trace  5 stdcfltn.sys[fffff88001b19c52] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8004b42680]                                                                                                                    fffffa8004b42680
Trace  \Driver\atapi[0xfffffa8004aa0dd0] -> IRP_MJ_CREATE -> 0xfffffa80049d62c0                                                                                                                                                    fffffa80049d62c0

---- Registry - GMER 2.0 ----

Reg    HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\bc77376d1a7c                                                                                                                                                 
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s1                                                                                                                                                                          771343423
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s2                                                                                                                                                                          285507792
Reg    HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\bc77376d1a7c (not active ControlSet)                                                                                                                             

---- EOF - GMER 2.0 ----

cosinus 01.02.2013 09:38
Bitte hab noch etwas Geduld, das ist hier ein sehr schwieriger Fall. Ich berate das gerade mit meinen anderen Kollegen.

Rheingold 01.02.2013 09:43
Kein Problem. Ich bin dir (bzw. euch) sehr dankbar, dass du so viel Zeit und Energie investierst!

Herzliche Grüße
Jasmina

Hallo Cosinus,
ich habe noch mal einen Scan mit Avira gemacht. Und da kam eine Meldung zu einem versteckten , dass beim Rootkitscan gefunden wurde. So weit ich mich erinnere war die Meldung vorher noch nicht da.

Ich poste dir hier mal den Bericht. Vielleicht nützt es ja was?

Code:

Avira Free Antivirus
Erstellungsdatum der Reportdatei: Freitag, 1. Februar 2013  15:29


Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer  : Avira Free Antivirus
Seriennummer  : 0000149996-ADJIE-0000001
Plattform      : Windows 7 Home Premium
Windowsversion : (Service Pack 1)  [6.1.7601]
Boot Modus    : Normal gebootet
Benutzername  : Administrator
Computername  : NICOJAS-PC

Versionsinformationen:
BUILD.DAT      : 13.0.0.2890    48567 Bytes  05.12.2012 17:11:00
AVSCAN.EXE    : 13.6.0.402    639264 Bytes  04.12.2012 14:37:47
AVSCANRC.DLL  : 13.4.0.360    64800 Bytes  28.11.2012 14:09:15
LUKE.DLL      : 13.6.0.400    67360 Bytes  04.12.2012 11:13:05
AVSCPLR.DLL    : 13.6.0.402    93984 Bytes  04.12.2012 14:37:55
AVREG.DLL      : 13.6.0.406    248096 Bytes  04.12.2012 17:40:31
avlode.dll    : 13.6.1.402    428832 Bytes  04.12.2012 14:36:57
avlode.rdf    : 13.0.0.36      10917 Bytes  29.01.2013 13:12:36
VBASE000.VDF  : 7.10.0.0    19875328 Bytes  06.11.2009 13:50:29
VBASE001.VDF  : 7.11.0.0    13342208 Bytes  14.12.2010 13:50:31
VBASE002.VDF  : 7.11.19.170 14374912 Bytes  20.12.2011 13:50:34
VBASE003.VDF  : 7.11.21.238  4472832 Bytes  01.02.2012 13:50:36
VBASE004.VDF  : 7.11.26.44  4329472 Bytes  28.03.2012 13:50:37
VBASE005.VDF  : 7.11.34.116  4034048 Bytes  29.06.2012 13:42:40
VBASE006.VDF  : 7.11.41.250  4902400 Bytes  06.09.2012 13:42:40
VBASE007.VDF  : 7.11.50.230  3904512 Bytes  22.11.2012 12:43:11
VBASE008.VDF  : 7.11.55.142  2214912 Bytes  03.01.2013 15:13:05
VBASE009.VDF  : 7.11.55.143    2048 Bytes  03.01.2013 15:13:05
VBASE010.VDF  : 7.11.55.144    2048 Bytes  03.01.2013 15:13:05
VBASE011.VDF  : 7.11.55.145    2048 Bytes  03.01.2013 15:13:05
VBASE012.VDF  : 7.11.55.146    2048 Bytes  03.01.2013 15:13:05
VBASE013.VDF  : 7.11.55.196  260096 Bytes  04.01.2013 15:13:05
VBASE014.VDF  : 7.11.56.23    206848 Bytes  07.01.2013 15:13:06
VBASE015.VDF  : 7.11.56.83    186880 Bytes  08.01.2013 15:13:06
VBASE016.VDF  : 7.11.56.145  135168 Bytes  09.01.2013 15:13:06
VBASE017.VDF  : 7.11.56.211  139776 Bytes  11.01.2013 15:13:07
VBASE018.VDF  : 7.11.57.11    153088 Bytes  13.01.2013 15:13:07
VBASE019.VDF  : 7.11.57.75    165888 Bytes  15.01.2013 15:13:07
VBASE020.VDF  : 7.11.57.163  190976 Bytes  17.01.2013 15:13:08
VBASE021.VDF  : 7.11.57.219  119808 Bytes  18.01.2013 15:13:08
VBASE022.VDF  : 7.11.58.7    167936 Bytes  21.01.2013 18:46:05
VBASE023.VDF  : 7.11.58.49    140288 Bytes  22.01.2013 19:19:22
VBASE024.VDF  : 7.11.58.119  137728 Bytes  24.01.2013 06:07:19
VBASE025.VDF  : 7.11.58.175  132608 Bytes  25.01.2013 06:45:30
VBASE026.VDF  : 7.11.58.213  116736 Bytes  27.01.2013 13:27:52
VBASE027.VDF  : 7.11.59.68  1887744 Bytes  31.01.2013 12:54:48
VBASE028.VDF  : 7.11.59.69      2048 Bytes  31.01.2013 12:54:48
VBASE029.VDF  : 7.11.59.70      2048 Bytes  31.01.2013 12:54:48
VBASE030.VDF  : 7.11.59.71      2048 Bytes  31.01.2013 12:54:48
VBASE031.VDF  : 7.11.59.100  101888 Bytes  01.02.2013 12:03:56
Engineversion  : 8.2.10.244
AEVDF.DLL      : 8.1.2.10      102772 Bytes  19.09.2012 13:42:55
AESCRIPT.DLL  : 8.1.4.86      467323 Bytes  31.01.2013 18:55:40
AESCN.DLL      : 8.1.10.0      131445 Bytes  19.01.2013 15:13:15
AESBX.DLL      : 8.2.5.12      606578 Bytes  28.08.2012 15:58:06
AERDL.DLL      : 8.2.0.88      643444 Bytes  19.01.2013 15:13:15
AEPACK.DLL    : 8.3.1.2      819574 Bytes  19.01.2013 15:13:15
AEOFFICE.DLL  : 8.1.2.50      201084 Bytes  05.11.2012 14:00:38
AEHEUR.DLL    : 8.1.4.192    5710199 Bytes  31.01.2013 18:55:40
AEHELP.DLL    : 8.1.25.2      258423 Bytes  12.10.2012 14:52:32
AEGEN.DLL      : 8.1.6.16      434549 Bytes  25.01.2013 06:07:20
AEEXP.DLL      : 8.3.0.18      188789 Bytes  31.01.2013 18:55:40
AEEMU.DLL      : 8.1.3.2      393587 Bytes  19.09.2012 13:42:55
AECORE.DLL    : 8.1.30.0      201079 Bytes  19.01.2013 15:13:10
AEBB.DLL      : 8.1.1.4        53619 Bytes  05.11.2012 14:00:38
AVWINLL.DLL    : 13.4.0.163    25888 Bytes  19.09.2012 17:09:30
AVPREF.DLL    : 13.4.0.360    50464 Bytes  28.11.2012 14:05:52
AVREP.DLL      : 13.4.0.360    177952 Bytes  28.11.2012 14:06:10
AVARKT.DLL    : 13.6.0.402    260384 Bytes  04.12.2012 14:36:03
AVEVTLOG.DLL  : 13.6.0.400    167200 Bytes  04.12.2012 11:04:02
SQLITE3.DLL    : 3.7.0.1      397088 Bytes  19.09.2012 17:17:40
AVSMTP.DLL    : 13.4.0.163    62240 Bytes  19.09.2012 17:08:54
NETNT.DLL      : 13.4.0.360    15648 Bytes  28.11.2012 14:07:51
RCIMAGE.DLL    : 13.4.0.360  4780832 Bytes  28.11.2012 14:09:40
RCTEXT.DLL    : 13.4.0.360    68384 Bytes  28.11.2012 14:09:40

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Suche nach Rootkits und aktiver Malware
Konfigurationsdatei...................: C:\ProgramData\Avira\AntiVir Desktop\PROFILES\rootkit.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: ein
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: vollständig
Abweichende Gefahrenkategorien........: +JOKE,

Beginn des Suchlaufs: Freitag, 1. Februar 2013  15:29

Der Suchlauf nach versteckten Objekten wird begonnen.
Versteckter Treiber
  [HINWEIS]  Eine Speicherveränderung wurde entdeckt, die möglicherweise zur versteckten Dateizugriffen missbraucht werden könnte.

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'svchost.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvSCPAPISvr.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '73' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '99' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '157' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '64' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '86' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '95' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '77' Modul(e) wurden durchsucht
Durchsuche Prozess 'EKAiOHostService.exe' - '88' Modul(e) wurden durchsucht
Durchsuche Prozess 'EKPrinterSDK.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamscheduler.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamservice.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'rfx-server.exe' - '71' Modul(e) wurden durchsucht
Durchsuche Prozess 'cchservice.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'rndlresolversvc.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'ccsync.exe' - '67' Modul(e) wurden durchsucht
Durchsuche Prozess 'PSIA.exe' - '72' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSVC.EXE' - '75' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '88' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSvcM.exe' - '17' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '150' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamgui.exe' - '41' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvxdsync.exe' - '54' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '41' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxtray.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'hkcmd.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxpers.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'SynTPEnh.exe' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'stage_primary.exe' - '92' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvtray.exe' - '54' Modul(e) wurden durchsucht
Durchsuche Prozess 'SynTPHelper.exe' - '19' Modul(e) wurden durchsucht
Durchsuche Prozess 'EKIJ5000MUI.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'wintmr.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'psi_tray.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'soffice.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'soffice.bin' - '97' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '89' Modul(e) wurden durchsucht
Durchsuche Prozess 'stage_secondary.exe' - '80' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '64' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'daemonu.exe' - '65' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '118' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '118' Modul(e) wurden durchsucht
Durchsuche Prozess 'vssvc.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'webtmr.exe' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchProtocolHost.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchFilterHost.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '65' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '30' Modul(e) wurden durchsucht

Untersuchung der Systemdateien wird begonnen:
Signiert -> 'C:\Windows\system32\svchost.exe'
Signiert -> 'C:\Windows\system32\winlogon.exe'
Signiert -> 'C:\Windows\explorer.exe'
Signiert -> 'C:\Windows\system32\smss.exe'
Signiert -> 'C:\Windows\system32\wininet.DLL'
Signiert -> 'C:\Windows\system32\wsock32.DLL'
Signiert -> 'C:\Windows\system32\ws2_32.DLL'
Signiert -> 'C:\Windows\system32\services.exe'
Signiert -> 'C:\Windows\system32\lsass.exe'
Signiert -> 'C:\Windows\system32\csrss.exe'
Signiert -> 'C:\Windows\system32\drivers\kbdclass.sys'
Signiert -> 'C:\Windows\system32\spoolsv.exe'
Signiert -> 'C:\Windows\system32\alg.exe'
Signiert -> 'C:\Windows\system32\wuauclt.exe'
Signiert -> 'C:\Windows\system32\advapi32.DLL'
Signiert -> 'C:\Windows\system32\user32.DLL'
Signiert -> 'C:\Windows\system32\gdi32.DLL'
Signiert -> 'C:\Windows\system32\kernel32.DLL'
Signiert -> 'C:\Windows\system32\ntdll.DLL'
Signiert -> 'C:\Windows\system32\ntoskrnl.exe'
Signiert -> 'C:\Windows\system32\ctfmon.exe'
Die Systemdateien wurden durchsucht ('21' Dateien)

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '2980' Dateien ).



Ende des Suchlaufs: Freitag, 1. Februar 2013  15:42
Benötigte Zeit: 12:32 Minute(n)

Der Suchlauf wurde vollständig durchgeführt.

      5 Verzeichnisse wurden überprüft
  6722 Dateien wurden geprüft
      0 Viren bzw. unerwünschte Programme wurden gefunden
      0 Dateien wurden als verdächtig eingestuft
      0 Dateien wurden gelöscht
      0 Viren bzw. unerwünschte Programme wurden repariert
      0 Dateien wurden in die Quarantäne verschoben
      0 Dateien wurden umbenannt
      0 Dateien konnten nicht durchsucht werden
  6722 Dateien ohne Befall
    48 Archive wurden durchsucht
      0 Warnungen
      1 Hinweise
 793371 Objekte wurden beim Rootkitscan durchsucht
      1 Versteckte Objekte wurden gefunden

cosinus 01.02.2013 17:04
Zitat:
"Kindersicherung_is1" = Kindersicherung 2012
Hast du diese Kindersicherung noch installiert? Wenn ja bitte deinstallieren und schauen ob das Phänomen mit der SWH immer noch ist

Rheingold 01.02.2013 18:54
Juchhuuuu! Du bist ein Held! :taenzer: :applaus:
Ja, es war die Saalfeld KiSi. Ich habe sie nicht deinstalliert, sondern erst mal die Einstellungen geändert. Ich vermute, dass das mit dem letzten update entstanden ist. Werde mich mal mit der Firma in Verbindung setzen weil ich mich NIE selber aus dem Zugriff auf das System ausgeschlossen habe.
Es tut mir wirklich sehr, sehr leid, dass du wegen so was so viel Arbeit mit mir hattest. Entschuldige bitte! :heulen:

Also es funktioniert wieder die Systemwiederherstellung, abgesicherter Modus und die Einstellungen in der Registry sind auch wieder geändert.
Danke, danke, danke 1000 Mal danke.

Jetzt habe ich nur noch das Problem, dass sich bei Firefox immer Werbefenster öffnen, obwohl ich die Pop ups bei den Einstellungen abgehakt habe. Kannst du mir da einen Tipp geben?

:dankeschoen:

cosinus 01.02.2013 19:11
Sehr geil, ich hatte das irgendwie schon vermutet, dann aber warum auch immer verdrängt. Bin wohl hier zu sehr im Multitasking :blabla:

adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).


Danach eine Kontrolle mit OTL bitte:
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Setze oben mittig den Haken bei Scanne alle Benutzer
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles in CODE-Tags hier in den Thread.

Rheingold 02.02.2013 08:55
Hallo Cosinus,
alles erledigt. Hier die Ergebnisse:
:kaffee:

Code:
# AdwCleaner v2.109 - Datei am 02/02/2013 um 08:58:56 erstellt
# Aktualisiert am 26/01/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : Jasmina - NICOJAS-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Jasmina.NICOJAS-PC\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****


***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16457

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v18.0.1 (de)

-\\ Google Chrome v [Version kann nicht ermittelt werden]

*************************

AdwCleaner[R4].txt - [965 octets] - [02/02/2013 08:24:06]
AdwCleaner[R5].txt - [1024 octets] - [02/02/2013 08:25:44]
AdwCleaner[S3].txt - [959 octets] - [02/02/2013 08:58:56]

########## EOF - C:\AdwCleaner[S3].txt - [1018 octets] ##########
Code:
OTL logfile created on: 02.02.2013 09:03:21 - Run 7
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Jasmina.NICOJAS-PC\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,90 Gb Total Physical Memory | 2,28 Gb Available Physical Memory | 58,54% Memory free
7,79 Gb Paging File | 5,93 Gb Available in Paging File | 76,10% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 265,66 Gb Total Space | 85,14 Gb Free Space | 32,05% Space Free | Partition Type: NTFS
Drive D: | 200,00 Gb Total Space | 199,45 Gb Free Space | 99,72% Space Free | Partition Type: NTFS
 
Computer Name: NICOJAS-PC | User Name: Jasmina | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Jasmina.NICOJAS-PC\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe ()
PRC - C:\Program Files (x86)\Secunia\PSI\psia.exe (Secunia)
PRC - C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
PRC - C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe (Eastman Kodak Company)
PRC - C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe (Eastman Kodak Company)
PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files (x86)\Dell Stage\Dell Stage\stage_secondary.exe ()
PRC - C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe ()
PRC - D:\Tobit Radio.fx\Server\rfx-server.exe ()
PRC - C:\Windows\SysWOW64\cchservice.exe (Salfeld Computer)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll ()
MOD - C:\Program Files (x86)\Dell Stage\Dell Stage\stage_secondary.exe ()
MOD - C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe ()
MOD - C:\Program Files (x86)\Dell Stage\Dell Stage\QtGui4.dll ()
MOD - C:\Program Files (x86)\Dell Stage\Dell Stage\QtCore4.dll ()
 
 
========== Services (SafeList) ==========
 
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (RealNetworks Downloader Resolver Service) -- C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe ()
SRV - (Secunia PSI Agent) -- C:\Program Files (x86)\Secunia\PSI\psia.exe (Secunia)
SRV - (Secunia Update Agent) -- C:\Program Files (x86)\Secunia\PSI\sua.exe (Secunia)
SRV - (Kodak AiO Network Discovery Service) -- C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe (Eastman Kodak Company)
SRV - (Kodak AiO Status Monitor Service) -- C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe (Eastman Kodak Company)
SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (Radio.fx) -- D:\Tobit Radio.fx\Server\rfx-server.exe ()
SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (ksupmgr) -- C:\Windows\SysWOW64\ksupmgr.exe (Salfeld Computer)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys ()
DRV:64bit: - (gfibto) -- C:\Windows\SysNative\drivers\gfibto.sys (GFI Software)
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (nvpciflt) -- C:\Windows\SysNative\drivers\nvpciflt.sys (NVIDIA Corporation)
DRV:64bit: - (nvkflt) -- C:\Windows\SysNative\drivers\nvkflt.sys (NVIDIA Corporation)
DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (iBtFltCoex) -- C:\Windows\SysNative\drivers\iBtFltCoex.sys (Intel Corporation)
DRV:64bit: - (btmhsf) -- C:\Windows\SysNative\drivers\btmhsf.sys (Intel Corporation)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (HPub4DE3) -- C:\Windows\SysNative\drivers\HPub4DE3.sys (TPMX Electronics Ltd.)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (HPMo4DE3) -- C:\Windows\SysNative\drivers\HPMo4DE3.sys (TPMX Electronics Ltd.)
DRV:64bit: - (nusb3xhc) -- C:\Windows\SysNative\drivers\nusb3xhc.sys (Renesas Electronics Corporation)
DRV:64bit: - (nusb3hub) -- C:\Windows\SysNative\drivers\nusb3hub.sys (Renesas Electronics Corporation)
DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (NETwNs64) -- C:\Windows\SysNative\drivers\NETwNs64.sys (Intel Corporation)
DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (Acceler) -- C:\Windows\SysNative\drivers\Accelern.sys (ST Microelectronics)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (PSI) -- C:\Windows\SysNative\drivers\psi_mf.sys (Secunia)
DRV:64bit: - (AVer7231_x64) -- C:\Windows\SysNative\drivers\AVer7231_x64.sys (AVerMedia TECHNOLOGIES, Inc.)
DRV:64bit: - (stdcfltn) -- C:\Windows\SysNative\drivers\stdcfltn.sys (ST Microelectronics)
DRV:64bit: - (CtClsFlt) -- C:\Windows\SysNative\drivers\CtClsFlt.sys (Creative Technology Ltd.)
DRV:64bit: - (qicflt) -- C:\Windows\SysNative\drivers\qicflt.sys (Quanta Computer)
DRV:64bit: - (xusb21) -- C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (StillCam) -- C:\Windows\SysNative\drivers\serscan.sys (Microsoft Corporation)
DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =
 
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 71 C1 6B 32 28 28 CD 01  [binary data]
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-21-1835506289-3229931497-3952218681-1005\..\SearchScopes,DefaultScope =
 
========== FireFox ==========
 
FF - prefs.js..CT2269050.browser.search.defaultthis.engineName: true
FF - prefs.js..CT2481020.browser.search.defaultthis.engineName: true
FF - prefs.js..browser.search.defaultengine: ""
FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.order.1: ""
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledAddons: personas%40christopher.beard:1.6.2
FF - prefs.js..extensions.enabledAddons: %7BCAFEEFAC-0016-0000-0033-ABCDEFFEDCBA%7D:6.0.33
FF - prefs.js..extensions.enabledAddons: %7B34712C68-7391-4c47-94F3-8F88D49AD632%7D:1.3.0
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0.1
FF - prefs.js..network.proxy.type: 0
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_146.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\PDF Viewer\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\PDF Viewer\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.11.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@parallelgraphics.com/Cortona: C:\Program Files (x86)\Common Files\ParallelGraphics\Cortona\npcortona.dll (ParallelGraphics)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=16.0.0.282: C:\Program Files\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlchromebrowserrecordext;version=1.3.0: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlhtml5videoshim;version=1.3.0: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlpepperflashvideoshim;version=1.3.0: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=16.0.0.282: C:\Program Files\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@realnetworks.com/npdlplugin;version=1: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.124\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.124\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.5: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF - HKCU\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\PDF Viewer\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{34712C68-7391-4c47-94F3-8F88D49AD632}: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\ [2012.12.22 10:27:36 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.01.21 12:13:37 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.01.24 10:58:35 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2013.01.09 15:07:32 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2013.01.24 10:58:35 | 000,000,000 | ---D | M]
 
[2012.05.20 09:46:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\Extensions
[2013.01.29 15:10:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\Firefox\Profiles\zd0m12fn.default\extensions
[2012.11.08 11:39:07 | 000,000,000 | ---D | M] (Lavasoft Search Plugin) -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\Firefox\Profiles\zd0m12fn.default\extensions\jid1-yZwVFzbsyfMrqQ@jetpack
[2012.02.25 12:43:49 | 000,330,316 | ---- | M] () (No name found) -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\firefox\profiles\zd0m12fn.default\extensions\personas@christopher.beard.xpi
[2012.12.12 11:21:18 | 000,036,098 | ---- | M] () (No name found) -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\mozilla\firefox\profiles\zd0m12fn.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
[2013.01.19 12:34:33 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2013.01.19 12:34:33 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2012.12.22 10:27:36 | 000,000,000 | ---D | M] (RealDownloader) -- C:\PROGRAMDATA\REALNETWORKS\REALDOWNLOADER\BROWSERPLUGINS\FIREFOX\EXT
[2013.01.19 12:34:37 | 000,262,552 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.12.22 10:27:18 | 000,124,056 | ---- | M] (RealPlayer) -- C:\Program Files (x86)\mozilla firefox\plugins\nprpplugin.dll
[2013.01.05 16:11:17 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2013.01.05 16:11:17 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2013.01.05 16:11:17 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2013.01.05 16:11:17 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2013.01.05 16:11:17 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2013.01.05 16:11:17 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - homepage: http://www.google.com/
CHR - homepage: http://www.google.com/
CHR - Extension: YouTube = C:\Users\Jasmina.NICOJAS-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2_0\
CHR - Extension: Google-Suche = C:\Users\Jasmina.NICOJAS-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.14_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\Jasmina.NICOJAS-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
CHR - Extension: Google Mail = C:\Users\Jasmina.NICOJAS-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.3_0\
 
O1 HOSTS File: ([2013.01.31 15:35:28 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (RealNetworks Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [DellStage] C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe ()
O4:64bit: - HKLM..\Run: [EKIJ5000StatusMonitor] C:\Windows\SysNative\spool\drivers\x64\3\EKIJ5000MUI.exe (Eastman Kodak Company)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [AccuWeatherWidget] C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe ()
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [ChicoSys] C:\Windows\SysWOW64\cc32\webtmr.exe (Salfeld Computer)
O4 - HKLM..\Run: [Conime] %windir%\system32\conime.exe File not found
O4 - HKLM..\Run: [EKIJ5000StatusMonitor] C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe File not found
O4 - HKLM..\Run: [EKStatusMonitor] C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe (Eastman Kodak Company)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\update\realsched.exe (RealNetworks, Inc.)
O4 - HKU\.DEFAULT..\Run: [CCWinTray] C:\Windows\tray\wintmr.exe (Salfeld Computer)
O4 - HKU\S-1-5-18..\Run: [CCWinTray] C:\Windows\tray\wintmr.exe (Salfeld Computer)
O4 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003..\Run: [CCWinTray] C:\Windows\tray\wintmr.exe (Salfeld Computer)
O4 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1005..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\.DEFAULT..\RunOnce: [KodakHomeCenter] C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe (Eastman Kodak Company)
O4 - HKU\S-1-5-18..\RunOnce: [KodakHomeCenter] C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe (Eastman Kodak Company)
O4 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1005..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Users\Jasmina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Users\Nico.NICOJAS-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Users\Nico.NICOJAS-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Users\Nico.NICOJAS-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O7 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0
O7 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableClock = 0
O7 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableLockWorkstation = 0
O7 - HKU\S-1-5-21-1835506289-3229931497-3952218681-1005\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8:64bit: - Extra context menu item: Free YouTube to iPod Converter - C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetoipodconverter.htm ()
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Free YouTube to iPod Converter - C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetoipodconverter.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O13 - gopher Prefix: missing
O16 - DPF: {1ABA5FAC-1417-422B-BA82-45C35E2C908B} http://kitchenplanner.ikea.com/DE/Core/Player/2020PlayerAX_IKEA_Win32.cab (20-20 3D Viewer for IKEA)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6FE6BAC3-E33E-46EB-8477-B5A8961B8F76}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.02.02 08:21:52 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Jasmina.NICOJAS-PC\Desktop\OTL.exe
[2013.02.01 09:18:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.02.01 09:18:06 | 000,024,176 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013.02.01 09:18:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013.02.01 09:16:26 | 010,156,344 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Program Files\mbam-setup-1.70.0.1100.exe
[2013.01.31 16:37:57 | 000,352,855 | ---- | C] (Farbar) -- C:\Users\Jasmina.NICOJAS-PC\Desktop\FSS.exe
[2013.01.31 15:38:10 | 000,000,000 | ---D | C] -- C:\$RECYCLE.BIN
[2013.01.31 15:35:27 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013.01.31 15:28:45 | 000,000,000 | ---D | C] -- C:\ComboFix
[2013.01.31 14:06:06 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013.01.31 14:06:06 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013.01.31 14:06:06 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013.01.31 14:06:00 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013.01.31 14:05:48 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2013.01.31 13:59:17 | 005,028,839 | R--- | C] (Swearware) -- C:\Users\Jasmina.NICOJAS-PC\Desktop\ComboFix.exe
[2013.01.31 06:09:24 | 000,000,000 | ---D | C] -- C:\Users\Jasmina.NICOJAS-PC\Desktop\Desktop 2013
[2013.01.30 17:37:33 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0
[2013.01.30 16:02:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LSoft Technologies
[2013.01.30 16:02:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Active@ ISO Burner
[2013.01.30 16:00:48 | 005,053,696 | ---- | C] (Macrovision Corporation) -- C:\Program Files\IsoBurner-Setup.exe
[2013.01.30 09:55:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Navilog1
[2013.01.29 15:25:41 | 000,246,216 | ---- | C] (Salfeld Computer) -- C:\Windows\SysWow64\wdrvhook.dll
[2013.01.29 12:06:05 | 000,000,000 | ---D | C] -- C:\Device
[2013.01.29 10:15:18 | 000,000,000 | -HSD | C] -- C:\ProgramData\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}
[2013.01.29 09:44:01 | 000,000,000 | ---D | C] -- C:\ProgramData\SpeedMaxPc
[2013.01.28 08:48:25 | 000,000,000 | ---D | C] -- C:\Users\Jasmina.NICOJAS-PC\AppData\Local\Diagnostics
[2013.01.27 16:50:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2013.01.24 11:04:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF-XChange PDF Viewer
[2013.01.24 11:04:22 | 000,000,000 | ---D | C] -- C:\Program Files\PDF Viewer
[2013.01.24 10:57:31 | 019,443,001 | ---- | C] (Tracker Software Products Ltd                              ) -- C:\Program Files\PDFXVwer.exe
[2013.01.23 21:06:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dienstprogramme
[2013.01.23 14:20:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Secunia
[2013.01.23 14:14:20 | 003,137,416 | ---- | C] (Secunia) -- C:\Program Files\PSISetup6001.exe
[2013.01.21 12:13:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Toolbar Cleaner
[2013.01.20 17:37:17 | 000,000,000 | ---D | C] -- C:\Users\Jasmina.NICOJAS-PC\Desktop\Antivirus Logs etc
[2013.01.19 16:22:17 | 004,178,040 | ---- | C] (Piriform Ltd) -- C:\Program Files\ccsetup326.exe
[2013.01.19 16:16:26 | 000,000,000 | ---D | C] -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\Avira
[2013.01.19 16:12:28 | 000,129,216 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys
[2013.01.19 16:12:28 | 000,099,912 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2013.01.19 16:12:28 | 000,027,800 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2013.01.19 16:12:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2013.01.19 16:12:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira
[2013.01.19 12:34:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2013.01.18 09:13:07 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2013.01.18 09:13:07 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2013.01.18 09:13:07 | 000,095,648 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013.01.16 16:42:46 | 000,000,000 | ---D | C] -- C:\Program Files\Definitions
[2013.01.16 16:42:12 | 000,014,456 | ---- | C] (GFI Software) -- C:\Windows\SysNative\drivers\gfibto.sys
[2013.01.14 08:43:58 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\20-20 Technologies
[2013.01.10 08:31:56 | 020,151,664 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 18.0.exe
[2013.01.09 15:07:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Thunderbird
[2013.01.09 06:39:45 | 000,750,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll
[2013.01.09 06:39:45 | 000,492,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\win32spl.dll
[2013.01.09 06:39:33 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll
[2013.01.09 06:39:31 | 000,800,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\usp10.dll
[2013.01.09 06:39:20 | 002,746,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\gameux.dll
[2013.01.09 06:39:20 | 002,576,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\gameux.dll
[2013.01.09 06:39:20 | 000,441,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Wpc.dll
[2013.01.09 06:39:20 | 000,046,592 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\fpb.rs
[2013.01.09 06:39:20 | 000,046,592 | ---- | C] (Microsoft) -- C:\Windows\SysNative\fpb.rs
[2013.01.09 06:39:20 | 000,045,568 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\oflc-nz.rs
[2013.01.09 06:39:20 | 000,045,568 | ---- | C] (Microsoft) -- C:\Windows\SysNative\oflc-nz.rs
[2013.01.09 06:39:20 | 000,044,544 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\pegibbfc.rs
[2013.01.09 06:39:20 | 000,044,544 | ---- | C] (Microsoft) -- C:\Windows\SysNative\pegibbfc.rs
[2013.01.09 06:39:20 | 000,043,520 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\csrr.rs
[2013.01.09 06:39:20 | 000,043,520 | ---- | C] (Microsoft) -- C:\Windows\SysNative\csrr.rs
[2013.01.09 06:39:20 | 000,040,960 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\cob-au.rs
[2013.01.09 06:39:20 | 000,040,960 | ---- | C] (Microsoft) -- C:\Windows\SysNative\cob-au.rs
[2013.01.09 06:39:20 | 000,030,720 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\usk.rs
[2013.01.09 06:39:20 | 000,030,720 | ---- | C] (Microsoft) -- C:\Windows\SysNative\usk.rs
[2013.01.09 06:39:20 | 000,021,504 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\grb.rs
[2013.01.09 06:39:20 | 000,021,504 | ---- | C] (Microsoft) -- C:\Windows\SysNative\grb.rs
[2013.01.09 06:39:20 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\pegi-pt.rs
[2013.01.09 06:39:20 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysNative\pegi-pt.rs
[2013.01.09 06:39:20 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\pegi.rs
[2013.01.09 06:39:20 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysNative\pegi.rs
[2013.01.09 06:39:20 | 000,015,360 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\djctq.rs
[2013.01.09 06:39:20 | 000,015,360 | ---- | C] (Microsoft) -- C:\Windows\SysNative\djctq.rs
[2013.01.09 06:39:19 | 000,308,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Wpc.dll
[2013.01.09 06:39:19 | 000,051,712 | ---- | C] (Microsoft) -- C:\Windows\SysNative\esrb.rs
[2013.01.09 06:39:18 | 000,055,296 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\cero.rs
[2013.01.09 06:39:18 | 000,055,296 | ---- | C] (Microsoft) -- C:\Windows\SysNative\cero.rs
[2013.01.09 06:39:18 | 000,051,712 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\esrb.rs
[2013.01.09 06:39:18 | 000,023,552 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\oflc.rs
[2013.01.09 06:39:18 | 000,023,552 | ---- | C] (Microsoft) -- C:\Windows\SysNative\oflc.rs
[2013.01.09 06:39:18 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\pegi-fi.rs
[2013.01.09 06:39:18 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysNative\pegi-fi.rs
[2013.01.09 06:38:46 | 001,161,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll
[2013.01.09 06:38:46 | 000,424,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll
[2013.01.09 06:38:45 | 000,362,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll
[2013.01.09 06:38:45 | 000,338,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\conhost.exe
[2013.01.09 06:38:45 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll
[2013.01.09 06:38:45 | 000,215,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll
[2013.01.09 06:38:45 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll
[2013.01.09 06:38:45 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll
[2013.01.09 06:38:45 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll
[2013.01.09 06:38:45 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2013.01.09 06:38:45 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2013.01.09 06:38:45 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2013.01.09 06:38:45 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll
[2013.01.09 06:38:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2013.01.09 06:38:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2013.01.09 06:38:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2013.01.09 06:38:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2013.01.09 06:38:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2013.01.09 06:38:45 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2013.01.09 06:38:44 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe
[2013.01.09 06:38:44 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe
[2013.01.09 06:38:44 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2013.01.09 06:38:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2013.01.09 06:38:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2013.01.09 06:38:44 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe
[2013.01.09 06:38:16 | 000,068,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\taskhost.exe
[2013.01.06 11:45:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kodak
[2013.01.06 11:43:42 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\kodak
[2013.01.06 11:42:15 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\spool
[2013.01.06 11:35:42 | 010,000,984 | ---- | C] (Eastman Kodak Company) -- C:\Program Files\aio_install.exe
[2013.01.04 08:37:05 | 000,000,000 | ---D | C] -- C:\Users\Jasmina.NICOJAS-PC\AppData\Local\Programs
[2012.12.22 10:27:43 | 000,016,384 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\wmdmhelper.dll
[2012.12.22 10:27:42 | 001,115,376 | ---- | C] (Gracenote) -- C:\Program Files\cddbmusicid.dll
[2012.12.22 10:27:42 | 000,943,344 | ---- | C] (Gracenote) -- C:\Program Files\cddblink.dll
[2012.12.22 10:27:42 | 000,641,536 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rjbres.dll
[2012.12.22 10:27:42 | 000,370,176 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rjdlg.dll
[2012.12.22 10:27:42 | 000,139,264 | ---- | C] (Inner Media, Inc.) -- C:\Program Files\dunzip32.dll
[2012.12.22 10:27:42 | 000,045,568 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\ierjplug.dll
[2012.12.22 10:27:42 | 000,031,232 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rjprog.dll
[2012.12.22 10:27:42 | 000,008,704 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\fixrjb.exe
[2012.12.22 10:27:41 | 002,041,072 | ---- | C] (Gracenote, Inc.) -- C:\Program Files\cddbcontrol.dll
[2012.12.22 10:27:41 | 000,073,216 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\tsasdk.dll
[2012.12.22 10:27:41 | 000,044,544 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\mmcdda32.dll
[2012.12.22 10:27:41 | 000,022,528 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\tnetdtct.dll
[2012.12.22 10:27:40 | 009,159,680 | ---- | C] (MediaArea.net) -- C:\Program Files\mediainfo.dll
[2012.12.22 10:27:40 | 000,389,272 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\realcleaner.exe
[2012.12.22 10:27:40 | 000,056,320 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rpwa3260.dll
[2012.12.22 10:27:40 | 000,048,640 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\tpasdk.dll
[2012.12.22 10:27:40 | 000,044,736 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rpshellsearch.dll
[2012.12.22 10:27:31 | 000,383,640 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\realconverter.exe
[2012.12.22 10:27:31 | 000,354,968 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\convert.exe
[2012.12.22 10:27:23 | 000,719,360 | ---- | C] (Microsoft Corporation) -- C:\Program Files\dbghelp.dll
[2012.12.22 10:27:23 | 000,390,384 | ---- | C] (MainConcept GmbH) -- C:\Program Files\mc_enc_mp4v.dll
[2012.12.22 10:27:23 | 000,389,272 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\realtrimmer.exe
[2012.12.22 10:27:23 | 000,136,336 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\realshare.exe
[2012.12.22 10:27:23 | 000,115,200 | ---- | C] (RealPlayer) -- C:\Program Files\rpshellextension.dll
[2012.12.22 10:27:23 | 000,069,632 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rjwmapln.dll
[2012.12.22 10:27:22 | 000,047,616 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rpau3260.dll
[2012.12.22 10:27:18 | 000,030,368 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rndevicedbbuilder.exe
[2012.12.22 10:27:17 | 000,112,824 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rdsf3260.dll
[2012.12.22 10:27:17 | 000,087,552 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\hxaudiodevicehook.dll
[2012.12.22 10:27:17 | 000,086,016 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rpplugprot.dll
[2012.12.22 10:27:17 | 000,070,840 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rpshell.dll
[2012.12.22 10:27:17 | 000,017,080 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\rphelperapp.exe
[2012.12.22 10:27:17 | 000,009,216 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\realjbox.exe
[2012.12.22 10:27:16 | 000,500,888 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\realplay.exe
[2012.12.22 08:43:14 | 000,766,272 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\RealPlayer16_de.exe
[2012.11.22 09:36:25 | 019,650,144 | ---- | C] (Mozilla) -- C:\Program Files\Thunderbird Setup 17.0.exe
[2012.11.22 09:35:36 | 019,231,504 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 17.0.exe
[2012.11.13 11:16:01 | 000,895,464 | ---- | C] (Oracle Corporation) -- C:\Program Files (x86)\jxpiinstall.exe
[2012.11.13 10:15:40 | 018,090,960 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 16.0.2.exe
[2012.11.13 10:11:21 | 018,580,512 | ---- | C] (Mozilla) -- C:\Program Files\Thunderbird Setup 16.0.2.exe
[2012.11.02 13:40:21 | 000,955,488 | ---- | C] (NCH Software) -- C:\Program Files\wpsetup-5.18.exe
[2012.11.01 14:39:24 | 009,814,632 | ---- | C] (Ashampoo GmbH & Co. KG                                      ) -- C:\Program Files\ashampoo_burning_studio_6_free_6.81_3639.exe
[2012.10.15 15:25:45 | 005,922,048 | ---- | C] (ManiacTools.com                                            ) -- C:\Program Files\m4a-to-mp3-70converter.exe
[2012.09.20 06:45:49 | 008,782,120 | ---- | C] (Tobit.Software) -- C:\Program Files\radiorecorder-setup.exe
[2012.09.11 12:51:11 | 014,894,636 | ---- | C] (Gougelet Pierre-e                                          ) -- C:\Program Files\XnView1991-win-full-de.exe
[2012.09.07 06:33:50 | 017,653,976 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 15.0.1.exe
[2012.08.30 06:12:27 | 018,365,488 | ---- | C] (Mozilla) -- C:\Program Files\Thunderbird Setup 15.0.exe
[2012.08.30 06:10:52 | 017,655,464 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 15.0.exe
[2012.08.25 14:15:13 | 076,021,168 | ---- | C] (The GIMP Team                                              ) -- C:\Program Files\gimp-2.8.2-setup.exe
[2012.08.12 12:22:26 | 018,503,824 | ---- | C] (Mozilla) -- C:\Program Files\Thunderbird Setup 14.0.exe
[2012.06.12 06:31:47 | 013,107,424 | ---- | C] (Adobe Systems Inc.) -- C:\Program Files\Shockwave_Installer_Full.exe
[2012.06.12 06:09:52 | 018,362,696 | ---- | C] (Mozilla) -- C:\Program Files\Thunderbird Setup 13.0.exe
[2012.06.11 18:11:49 | 017,301,984 | ---- | C] (Adobe Systems Inc.) -- C:\Program Files\AdobeAIRInstaller.exe
[2012.06.11 17:27:14 | 016,418,456 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 13.0.exe
[2012.05.19 22:53:40 | 001,292,648 | ---- | C] (Microsoft Corporation) -- C:\Program Files\wlsetup-web_15.4.3555.exe
[2012.05.15 12:30:33 | 040,437,664 | ---- | C] (Apple Inc.) -- C:\Program Files\QuickTimeInstaller.exe
[2012.05.02 06:57:45 | 016,179,464 | ---- | C] (Mozilla) -- C:\Program Files\Firefox Setup 12.0.exe
[2012.04.30 17:46:07 | 017,449,712 | ---- | C] (Mozilla) -- C:\Program Files\Thunderbird Setup 12.0.1.exe
[2012.04.05 09:20:03 | 026,534,080 | ---- | C] (DVDVideoSoft Ltd.                                          ) -- C:\Program Files (x86)\FreeAudioCDBurner.exe
[2012.04.02 12:04:59 | 027,672,000 | ---- | C] (DVDVideoSoft Ltd.                                          ) -- C:\Program Files (x86)\FreeYouTubeToiPodConverter_3.10.17.exe
[2012.02.25 09:42:27 | 006,674,008 | ---- | C] (Adobe Systems Inc.) -- C:\Program Files (x86)\Shockwave_Installer_Slim.exe
[2012.02.25 09:40:38 | 039,401,336 | ---- | C] (Apple Inc.) -- C:\Program Files (x86)\QuickTimeInstaller.exe
[2012.02.24 10:16:36 | 000,763,408 | ---- | C] (Google Inc.) -- C:\Program Files\GoogleEarthSetup.exe
[2008.04.11 09:09:24 | 000,093,200 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.1049.dll
[2008.04.11 07:03:48 | 000,562,688 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.exe
[2008.04.11 07:03:48 | 000,097,296 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.1036.dll
[2008.04.11 07:03:48 | 000,096,272 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.3082.dll
[2008.04.11 07:03:48 | 000,096,272 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.1031.dll
[2008.04.11 07:03:48 | 000,095,248 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.1040.dll
[2008.04.11 07:03:48 | 000,091,152 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.1033.dll
[2008.04.11 07:03:48 | 000,081,424 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.1041.dll
[2008.04.11 07:03:48 | 000,079,888 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.1042.dll
[2008.04.11 07:03:48 | 000,076,304 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.1028.dll
[2008.04.11 07:03:48 | 000,075,792 | ---- | C] (Microsoft Corporation) -- C:\Program Files\install.res.2052.dll
 
========== Files - Modified Within 30 Days ==========
 
[2013.02.02 09:07:42 | 000,014,208 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.02.02 09:07:42 | 000,014,208 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.02.02 09:07:34 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.02.02 09:07:34 | 000,654,400 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.02.02 09:07:34 | 000,616,242 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.02.02 09:07:34 | 000,130,240 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.02.02 09:07:34 | 000,106,622 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.02.02 09:02:23 | 000,001,226 | ---- | M] () -- C:\Windows\SysWow64\excltmp~.dat
[2013.02.02 09:00:53 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.02.02 09:00:05 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.02.02 09:00:02 | 3137,994,752 | -HS- | M] () -- C:\hiberfil.sys
[2013.02.02 08:58:01 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.02.02 08:27:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.02.02 08:22:48 | 000,012,632 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\otl anweisung.odt
[2013.02.02 08:21:53 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Jasmina.NICOJAS-PC\Desktop\OTL.exe
[2013.02.02 08:21:06 | 000,580,235 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\adwcleaner.exe
[2013.02.02 08:02:01 | 000,000,475 | ---- | M] () -- C:\NET.INI
[2013.02.01 18:40:27 | 000,000,172 | ---- | M] () -- C:\Windows\SysWow64\cchservice.err
[2013.02.01 09:18:07 | 000,001,092 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013.02.01 09:16:28 | 010,156,344 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Program Files\mbam-setup-1.70.0.1100.exe
[2013.01.31 17:07:08 | 000,365,568 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\gmer_2.0.18454.exe
[2013.01.31 16:37:58 | 000,352,855 | ---- | M] (Farbar) -- C:\Users\Jasmina.NICOJAS-PC\Desktop\FSS.exe
[2013.01.31 15:42:13 | 000,000,024 | ---- | M] () -- C:\Windows\SysWow64\SWCTL.DLL
[2013.01.31 15:35:28 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2013.01.31 14:00:01 | 005,028,839 | R--- | M] (Swearware) -- C:\Users\Jasmina.NICOJAS-PC\Desktop\ComboFix.exe
[2013.01.30 16:25:48 | 296,022,016 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\kav_rescue_10.iso
[2013.01.30 16:02:13 | 000,834,544 | ---- | M] () -- C:\Windows\SysNative\drivers\sptd.sys
[2013.01.30 16:00:50 | 005,053,696 | ---- | M] (Macrovision Corporation) -- C:\Program Files\IsoBurner-Setup.exe
[2013.01.28 08:32:54 | 000,007,604 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\AppData\Local\resmon.resmoncfg
[2013.01.27 20:28:27 | 000,013,806 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\Admin.odt
[2013.01.24 10:58:04 | 019,443,001 | ---- | M] (Tracker Software Products Ltd                              ) -- C:\Program Files\PDFXVwer.exe
[2013.01.24 09:53:56 | 000,002,767 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\AppData\Local\recently-used.xbel
[2013.01.23 14:20:55 | 000,001,089 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
[2013.01.23 14:14:26 | 003,137,416 | ---- | M] (Secunia) -- C:\Program Files\PSISetup6001.exe
[2013.01.21 12:14:10 | 000,014,456 | ---- | M] (GFI Software) -- C:\Windows\SysNative\drivers\gfibto.sys
[2013.01.19 16:22:18 | 004,178,040 | ---- | M] (Piriform Ltd) -- C:\Program Files\ccsetup326.exe
[2013.01.19 16:04:21 | 105,661,272 | ---- | M] () -- C:\Program Files\avira_free_antivirus_de.exe
[2013.01.19 12:24:55 | 000,012,793 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Documents\Imperativ Übung Sätze 2.odt
[2013.01.19 12:24:25 | 000,013,615 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Documents\Imperativ Übung Verben 2.odt
[2013.01.19 12:23:47 | 000,016,176 | ---- | M] () -- C:\Users\Jasmina.NICOJAS-PC\Documents\Imperativ Übung Sätze-Lösungen 2.odt
[2013.01.12 03:30:18 | 000,095,648 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013.01.12 03:26:16 | 000,174,496 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2013.01.12 03:24:49 | 000,174,496 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2013.01.10 08:33:13 | 000,001,130 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013.01.10 08:32:39 | 020,151,664 | ---- | M] (Mozilla) -- C:\Program Files\Firefox Setup 18.0.exe
[2013.01.10 08:29:37 | 017,301,984 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\AdobeAIRInstaller.exe
[2013.01.09 16:27:29 | 000,697,864 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2013.01.09 16:27:29 | 000,074,248 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013.01.09 12:09:59 | 000,424,008 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.01.06 11:35:52 | 010,000,984 | ---- | M] (Eastman Kodak Company) -- C:\Program Files\aio_install.exe
 
========== Files Created - No Company Name ==========
 
[2013.02.02 08:22:46 | 000,012,632 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\otl anweisung.odt
[2013.02.02 08:21:05 | 000,580,235 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\adwcleaner.exe
[2013.02.01 18:39:46 | 000,000,172 | ---- | C] () -- C:\Windows\SysWow64\cchservice.err
[2013.02.01 09:18:07 | 000,001,092 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013.01.31 17:04:25 | 000,365,568 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\gmer_2.0.18454.exe
[2013.01.31 15:42:13 | 000,000,024 | ---- | C] () -- C:\Windows\SysWow64\SWCTL.DLL
[2013.01.31 14:06:06 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013.01.31 14:06:06 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013.01.31 14:06:06 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013.01.31 14:06:06 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013.01.31 14:06:06 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013.01.30 16:10:48 | 296,022,016 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\kav_rescue_10.iso
[2013.01.30 16:02:13 | 000,834,544 | ---- | C] () -- C:\Windows\SysNative\drivers\sptd.sys
[2013.01.28 08:41:33 | 000,013,806 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Desktop\Admin.odt
[2013.01.28 08:32:13 | 000,007,604 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\AppData\Local\resmon.resmoncfg
[2013.01.25 07:30:50 | 000,001,226 | ---- | C] () -- C:\Windows\SysWow64\excltmp~.dat
[2013.01.24 09:53:56 | 000,002,767 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\AppData\Local\recently-used.xbel
[2013.01.23 21:06:22 | 000,001,137 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Express Zip.lnk
[2013.01.23 14:20:55 | 000,001,089 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
[2013.01.23 14:20:55 | 000,001,052 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk
[2013.01.19 12:24:53 | 000,012,793 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Documents\Imperativ Übung Sätze 2.odt
[2013.01.19 12:24:23 | 000,013,615 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Documents\Imperativ Übung Verben 2.odt
[2013.01.19 12:19:06 | 000,016,176 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\Documents\Imperativ Übung Sätze-Lösungen 2.odt
[2012.12.22 10:27:42 | 000,002,851 | ---- | C] () -- C:\Program Files\cdroms.cfg
[2012.12.22 10:27:40 | 000,119,808 | ---- | C] () -- C:\Program Files\waiting.avi
[2012.12.22 10:27:40 | 000,067,473 | ---- | C] () -- C:\Program Files\realplay.chm
[2012.12.22 10:27:40 | 000,027,278 | ---- | C] () -- C:\Program Files\frw.bmp
[2012.12.22 10:27:40 | 000,016,296 | ---- | C] () -- C:\Program Files\realtfon.fon
[2012.12.22 10:27:31 | 000,476,724 | ---- | C] () -- C:\Program Files\converter.vs
[2012.12.22 10:27:23 | 000,045,428 | ---- | C] () -- C:\Program Files\sharemedia.vs
[2012.12.22 10:27:23 | 000,001,209 | ---- | C] () -- C:\Program Files\flvplay.swf
[2012.12.22 10:27:22 | 000,033,157 | ---- | C] () -- C:\Program Files\RealNetworks License.html
[2012.12.22 10:27:22 | 000,033,157 | ---- | C] () -- C:\Program Files\playrlic.html
[2012.12.22 10:27:21 | 001,109,306 | ---- | C] () -- C:\Program Files\normal.vs
[2012.12.22 10:27:21 | 000,061,495 | ---- | C] () -- C:\Program Files\ssimages.vs
[2012.12.22 10:27:21 | 000,000,480 | ---- | C] () -- C:\Program Files\keys.dat
[2012.12.22 10:27:17 | 000,001,161 | ---- | C] () -- C:\Program Files\autoplaylist.dat
[2012.12.22 10:27:17 | 000,000,043 | ---- | C] () -- C:\Program Files\strs23.dat
[2012.12.22 10:27:17 | 000,000,013 | ---- | C] () -- C:\Program Files\strs26.dat
[2012.12.22 10:27:16 | 000,427,405 | ---- | C] () -- C:\Program Files\calibrate.rv
[2012.12.22 10:27:16 | 000,017,846 | ---- | C] () -- C:\Program Files\videotest.rm
[2012.12.22 10:27:16 | 000,000,221 | ---- | C] () -- C:\Program Files\subscription.rnx
[2012.12.22 10:27:16 | 000,000,177 | ---- | C] () -- C:\Program Files\freeoffers.rnx
[2012.12.15 13:46:18 | 022,916,830 | ---- | C] () -- C:\Program Files\vlc-2.0.5-win32.exe
[2012.12.15 13:06:25 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2012.09.27 10:19:36 | 000,013,824 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.09.20 06:46:53 | 000,554,496 | ---- | C] () -- C:\Windows\SysWow64\dvmsg.dll
[2012.08.29 08:03:59 | 000,160,350 | ---- | C] () -- C:\Program Files\JavaRa.zip
[2012.08.29 07:42:01 | 009,672,192 | ---- | C] () -- C:\Program Files\Adobe_Flash_Player_AX_11.4.402.265_SPS.exe
[2012.08.29 07:41:24 | 015,567,360 | ---- | C] () -- C:\Program Files\Adobe_AIR_3.4.0.2540_SPS.exe
[2012.08.27 10:09:16 | 152,249,762 | ---- | C] () -- C:\Program Files\Apache_OpenOffice_incubating_3.4.1_Win_x86_install_de.exe
[2012.08.15 11:05:18 | 009,697,792 | ---- | C] () -- C:\Program Files\ShockwavePlayer_11.6.6.636_SPS.exe
[2012.07.15 09:39:36 | 022,657,136 | ---- | C] () -- C:\Program Files\vlc-2.0.2-win32.exe
[2012.06.27 07:54:46 | 009,679,360 | ---- | C] () -- C:\Program Files\Shockwaveplayer_11.6.4.634.exe
[2012.06.17 18:54:57 | 000,000,271 | ---- | C] () -- C:\Users\Jasmina.NICOJAS-PC\AppData\Roaming\burnaware.ini
[2012.06.12 06:48:02 | 007,656,960 | ---- | C] () -- C:\Program Files\cortona3d.msi
[2012.06.12 06:05:13 | 000,441,829 | ---- | C] () -- C:\Program Files\ade-tb-13.0.c.xpi
[2012.06.11 08:53:53 | 000,000,085 | -HS- | C] () -- C:\ProgramData\.zreglib
[2012.05.29 09:37:28 | 151,893,470 | ---- | C] () -- C:\Program Files\Apache_OpenOffice_incubating_3.4.0_Win_x86_install_de.exe
[2012.05.23 17:49:32 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2012.05.23 17:49:32 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2012.05.23 17:49:32 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2012.05.23 17:49:32 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2012.05.22 06:51:22 | 000,338,432 | ---- | C] () -- C:\Windows\SysWow64\sqlite36_engine.dll
[2012.05.19 14:32:36 | 000,278,643 | ---- | C] () -- C:\Program Files\fast_video_download-4.1.6-fx.zip
[2012.05.19 14:22:36 | 196,941,888 | ---- | C] () -- C:\Program Files\ALDI Bestellsoftware Setup.exe
[2012.05.11 07:57:44 | 029,272,056 | ---- | C] () -- C:\Program Files\SaalDesignSoftware2.9.2.exe
[2012.05.05 16:00:03 | 004,998,707 | ---- | C] () -- C:\Program Files\flvplayer_setup20_25.exe
[2012.03.27 12:48:40 | 000,253,952 | ---- | C] () -- C:\Program Files\OOo_3.3.9567.500.exe
[2012.02.25 09:57:51 | 000,155,536 | ---- | C] () -- C:\Windows\SysWow64\dllcinx.exe
[2012.02.25 09:57:49 | 000,000,626 | ---- | C] () -- C:\Windows\SysWow64\nochook.ini
[2012.02.25 09:38:55 | 004,998,707 | ---- | C] () -- C:\Program Files (x86)\flvplayer_setup20_25.exe
[2012.02.24 16:58:29 | 000,000,140 | -H-- | C] () -- C:\Windows\SysWow64\ctlsw.ini
[2012.02.24 11:05:44 | 018,980,864 | ---- | C] () -- C:\Program Files\SkypeSetup_5.8.0.156.msi
[2012.02.24 10:48:18 | 031,870,976 | ---- | C] () -- C:\Program Files\PXCViewer_x6425201.msi
[2012.02.24 10:47:54 | 001,376,768 | ---- | C] () -- C:\Program Files\7z920-x64.msi
[2012.02.24 10:35:22 | 105,661,272 | ---- | C] () -- C:\Program Files\avira_free_antivirus_de.exe
[2012.02.24 10:15:24 | 168,166,968 | ---- | C] () -- C:\Program Files\OOo_3.3.0_Win_x86_install-wJRE_de.exe
[2012.02.22 08:07:19 | 000,066,856 | ---- | C] () -- C:\Windows\SysWow64\SynTPEnhPS.dll
[2011.11.30 01:26:12 | 000,960,940 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin
[2011.11.30 01:26:09 | 000,213,332 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin
[2011.11.30 01:26:04 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_89001461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_6B071461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_5B011461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_49001461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_3B011461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_33011461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2B071461_ca.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2B071461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2B071461_8a.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2A0F1461_ca.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2A071461_ca.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2A071461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2A071461_8a.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2A031461_ca.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2A031461_aa.bin
[2011.11.30 01:23:23 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_1C011461_61.bin
[2011.11.30 01:23:23 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_A3031461_ca.bin
[2011.11.30 01:23:23 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_A3031461_aa.bin
[2011.11.30 01:23:23 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_A3031461_8a.bin
[2011.11.30 01:23:23 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_83231461_ca.bin
[2011.11.30 01:23:23 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_83231461_aa.bin
[2011.11.30 01:23:23 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_83231461_8a.bin
[2011.11.30 01:23:23 | 000,000,436 | ---- | C] () -- C:\Windows\11317231_1C0F1461_41.bin
[2011.11.30 01:23:23 | 000,000,434 | ---- | C] () -- C:\Windows\11317231_890F1461_ca.bin
[2011.11.30 01:23:23 | 000,000,434 | ---- | C] () -- C:\Windows\11317231_3B0f1461_ca.bin
[2011.11.30 01:23:23 | 000,000,434 | ---- | C] () -- C:\Windows\11317231_2B0f1461_ca.bin
[2011.11.30 01:23:23 | 000,000,434 | ---- | C] () -- C:\Windows\11317231_29001461_ca.bin
[2011.11.30 01:23:23 | 000,000,412 | ---- | C] () -- C:\Windows\11317231_180F1461_ca.bin
[2011.11.30 01:23:23 | 000,000,412 | ---- | C] () -- C:\Windows\11317231_18071461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_14001461_61.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_13011461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_110F1461_ca.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_110F1461_8a.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_11071461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_11071461_8a.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0B071461_ca.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0B071461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0B071461_8a.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0B011461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A0F1461_ca.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A071461_ca.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A071461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A071461_8a.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A031461_ca.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A031461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A011461_ca.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A011461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_09001461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_08071461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_060F1461_ca.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_06071461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_06071461_8a.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_03011461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_03011461_8a.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_02011461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_02011461_8a.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_010F1461_ca.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_010F1461_8a.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_01071461_aa.bin
[2011.11.30 01:23:22 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_01071461_8a.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_07031461_aa.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_03231461_ca.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_03231461_aa.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_03231461_8a.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_03131461_8a.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_03031461_aa.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_02031461_ca.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_02031461_aa.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_02031461_8a.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_00000000_aa.bin
[2011.11.30 01:23:22 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_00000000_8a.bin
[2011.11.30 01:23:22 | 000,000,434 | ---- | C] () -- C:\Windows\11317231_0B0f1461_ca.bin
[2011.11.30 01:23:22 | 000,000,434 | ---- | C] () -- C:\Windows\11317231_090F1461_ca.bin
[2011.11.30 01:23:22 | 000,000,376 | ---- | C] () -- C:\Windows\11317231_0B001461_aa.bin
[2011.11.30 01:23:22 | 000,000,376 | ---- | C] () -- C:\Windows\11317231_03131461_aa.bin
[2008.04.11 09:11:40 | 000,233,472 | ---- | C] () -- C:\Program Files\VC_RED.MSI
[2008.04.11 09:09:38 | 003,797,292 | ---- | C] () -- C:\Program Files\VC_RED.cab
[2008.04.11 09:07:18 | 000,005,686 | ---- | C] () -- C:\Program Files\vcredist.bmp
[2008.04.11 09:07:18 | 000,001,110 | ---- | C] () -- C:\Program Files\globdata.ini
[2008.04.11 09:07:18 | 000,000,843 | ---- | C] () -- C:\Program Files\install.ini
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

< End of report >
Code:
OTL Extras logfile created on: 02.02.2013 09:03:21 - Run 7
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Jasmina.NICOJAS-PC\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,90 Gb Total Physical Memory | 2,28 Gb Available Physical Memory | 58,54% Memory free
7,79 Gb Paging File | 5,93 Gb Available in Paging File | 76,10% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 265,66 Gb Total Space | 85,14 Gb Free Space | 32,05% Space Free | Partition Type: NTFS
Drive D: | 200,00 Gb Total Space | 199,45 Gb Free Space | 99,72% Space Free | Partition Type: NTFS
 
Computer Name: NICOJAS-PC | User Name: Jasmina | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = ChromeHTML] -- Reg Error: Key error. File not found
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
[HKEY_USERS\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== System Restore Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
"DisableSR" = 0
"DisableConfig" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
"DisableSR" = 0
"DisableConfig" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
========== Firewall Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03B9EF93-80A8-4845-BBEA-E57E652BBCAF}" = rport=445 | protocol=6 | dir=out | app=system |
"{06E9E081-AF16-48F3-A65C-45D38EFFFDC6}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{13482F04-C479-4714-A5ED-39793B8AAE1D}" = rport=139 | protocol=6 | dir=out | app=system |
"{13E37376-E86C-4019-A725-370DBA1C472E}" = rport=138 | protocol=17 | dir=out | app=system |
"{19ABAAFE-5469-4D69-ADA2-4699E51AAFCF}" = lport=445 | protocol=6 | dir=in | app=system |
"{22BA7DA7-E3C4-47BD-BD6A-B114541112F4}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{2AA89C74-81DA-40D8-903C-81F5681F1A55}" = lport=9322 | protocol=6 | dir=in | name=ekdiscovery |
"{34E72618-0DA7-47D5-A7A0-F15510D9E758}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{482FEDE2-F7D7-4FCF-BC03-256AAC6974E5}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{49716C09-3F9C-404E-B180-E4081D0BBDC8}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{4A808828-8225-46D2-87EC-5E577FAB1B3A}" = lport=139 | protocol=6 | dir=in | app=system |
"{6EEE79D5-2A03-486E-9097-D0C7BAD265DF}" = lport=9322 | protocol=6 | dir=in | name=ekdiscovery |
"{99CBA5AC-9892-45B9-8760-B588F1E908B0}" = lport=5353 | protocol=17 | dir=in | name=bonjour port 5353 |
"{A2DF74D5-A568-4A13-A040-D2D95D6C75DE}" = rport=137 | protocol=17 | dir=out | app=system |
"{A3589360-384E-4156-A3A9-B670DC44F140}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{ADCF185E-AB3F-49C7-B4C6-6FEECB08A98F}" = lport=137 | protocol=17 | dir=in | app=system |
"{D9814FB7-C5B3-41F3-913D-6FC368B5C6E6}" = lport=138 | protocol=17 | dir=in | app=system |
"{F82628F2-3F45-4F25-BAAA-14803BF0F409}" = lport=5353 | protocol=17 | dir=in | name=bonjour port 5353 |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00DE7700-6E5A-4350-9F44-2A7432769CCB}" = protocol=6 | dir=in | app=c:\windows\syswow64\msiexec.exe |
"{02F141FE-498D-4574-A66D-58E2561D793C}" = protocol=17 | dir=in | app=c:\program files (x86)\2k sports\nba 2k13\nba2k13.exe |
"{126782C9-2354-44F3-8F23-A92D102A4E93}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\center\kodak.statistics.exe |
"{2F2EB0A3-4B90-4E33-8C0C-80A6A9C83A72}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\firmware\kodakaioupdater.exe |
"{2F5BDC80-D4CF-46DA-BFFF-FB1A05C2693B}" = protocol=17 | dir=in | app=c:\program files (x86)\cyanide\gamecenter\gamecenter.exe |
"{300ACAB8-ACF5-4FC8-A2ED-1BF12C2151CD}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\center\networkprinterdiscovery.exe |
"{36C3CA04-80CA-4D39-B6C5-AF220F844087}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\center\kodak.statistics.exe |
"{3AB28388-7EB4-46AA-8C6D-806B6571D56D}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\center\aiohomecenter.exe |
"{3B630698-B25B-41DF-8EF9-E2B396B0B083}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\firmware\kodakaioupdater.exe |
"{3CAEF7AF-5FBE-4237-9D6F-D6C0A7991314}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\center\aiohomecenter.exe |
"{3E609762-8618-4993-A50C-77D22F878630}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{43CBC248-7E0B-477C-8DB0-449AE476C7D5}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\firmware\kodakaioupdater.exe |
"{45B64134-8F9D-49F1-8940-F8D85BA68411}" = protocol=6 | dir=in | app=c:\program files (x86)\2k sports\nba 2k13\nba2k13.exe |
"{461D9763-7840-401C-8EA8-A9016EAFB6A0}" = protocol=17 | dir=in | app=c:\programdata\kodak\installer\setup.exe |
"{4B4AC4D5-F226-4ED8-91F7-5BF8E74E2912}" = protocol=6 | dir=in | app=c:\windows\syswow64\muzapp.exe |
"{4D4EFD79-8431-489B-ACBF-22842823D940}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{5CE13E4F-212C-42A3-98D7-C10DCBBAEAB8}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\center\networkprinterdiscovery.exe |
"{6286D4F7-67FF-4293-AA87-AC04E642A996}" = protocol=6 | dir=in | app=c:\programdata\kodak\installer\setup.exe |
"{673EE027-9D91-408D-8E7F-F9EAE8AA5195}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\firmware\kodakaioupdater.exe |
"{7FBC02D6-A43E-46B5-B55E-F878996E72CA}" = protocol=6 | dir=in | app=c:\programdata\kodak\installer\setup.exe |
"{80514CFD-8048-4C14-B844-9891D4854D21}" = protocol=6 | dir=in | app=c:\program files (x86)\sweetim\communicator\sweetpacksupdatemanager.exe |
"{83AF232F-8E60-4AE4-91F3-177AADA4C95D}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\center\aiohomecenter.exe |
"{86B3BA1A-EB42-41EB-8BE5-ED2F3CCD803F}" = protocol=17 | dir=in | app=d:\tobit radio.fx\client\rfx-client.exe |
"{8A47FCBE-4950-4015-8D01-2C2AC9895ED7}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\center\kodak.statistics.exe |
"{8A76F869-12AA-4BBE-8D9F-B97FFECBF30E}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\center\aiohomecenter.exe |
"{91EB51CE-59DF-48E1-BAF4-52E98B8F4352}" = protocol=17 | dir=in | app=d:\tobit radio.fx\server\rfx-server.exe |
"{97EB7143-70C5-495B-B9AF-62423A6EB4CC}" = protocol=17 | dir=in | app=c:\windows\syswow64\msiexec.exe |
"{9B906E24-8273-4393-AA06-F8A6FDA9FFC3}" = protocol=17 | dir=in | app=c:\program files (x86)\sweetim\communicator\sweetpacksupdatemanager.exe |
"{9E64C8F7-38F7-4211-9F24-27502D9F9377}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\center\networkprinterdiscovery.exe |
"{A2834B87-C86E-4D08-90B2-DA67BCA1716B}" = protocol=6 | dir=in | app=c:\program files (x86)\cyanide\gamecenter\gamecenter.exe |
"{A301FAD5-5412-4D17-BFE7-FECBF23E370B}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{A7F89437-5CF4-4291-AC2D-3A780F3ABEE7}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{BD7E8F19-BBB9-4C22-A1A9-13145F003618}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{BE688A9C-1735-4E3E-A89C-BC83633D49E9}" = protocol=17 | dir=in | app=c:\windows\syswow64\muzapp.exe |
"{BF64C12D-723D-4411-A3FB-77E0F02E6A4A}" = protocol=6 | dir=in | app=c:\program files (x86)\kodak\aio\center\kodak.statistics.exe |
"{C290BE6A-1286-4F6B-8429-B0EC7335FEE4}" = protocol=6 | dir=in | app=d:\tobit radio.fx\server\rfx-server.exe |
"{C8790961-8656-4860-9076-A2D6623D10E5}" = protocol=17 | dir=in | app=c:\program files (x86)\kodak\aio\center\networkprinterdiscovery.exe |
"{CC860D3A-C81A-4786-878A-4D6E17556474}" = protocol=17 | dir=in | app=c:\windows\syswow64\muzapp.exe |
"{CD406032-BF04-4303-912E-D7130F577CF8}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{CD7240F0-B94F-46EF-926F-AAE573567F82}" = protocol=6 | dir=in | app=d:\tobit radio.fx\client\rfx-client.exe |
"{DC484A61-D39E-484F-ABAC-79D0B001A970}" = protocol=6 | dir=in | app=c:\windows\syswow64\muzapp.exe |
"{E590CA35-BF4B-43AB-AD11-E1DFA3E5E85F}" = dir=in | app=c:\program files (x86)\dell stage\videostage\videostage.exe |
"{EB9E90E3-6809-4C85-8486-954384E4415E}" = protocol=17 | dir=in | app=c:\programdata\kodak\installer\setup.exe |
"TCP Query User{2C129A0F-15ED-4EB5-B1D1-52762861834F}C:\users\nico.nicojas-pc\appdata\local\facebook\video\skype\facebookvideocalling.exe" = protocol=6 | dir=in | app=c:\users\nico.nicojas-pc\appdata\local\facebook\video\skype\facebookvideocalling.exe |
"TCP Query User{415EE727-2686-4681-A0CC-B633456BC9A1}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe |
"TCP Query User{44F9B41D-F81E-4237-B65C-495E923A0A91}C:\users\nico.nicojas-pc\appdata\local\facebook\video\skype\facebookvideocalling.exe" = protocol=6 | dir=in | app=c:\users\nico.nicojas-pc\appdata\local\facebook\video\skype\facebookvideocalling.exe |
"TCP Query User{56412238-720A-46B5-A739-61A80F922067}C:\users\nico.nicojas-pc\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\nico.nicojas-pc\appdata\roaming\spotify\spotify.exe |
"TCP Query User{9B9701E4-29D1-4FF2-979C-8597475BDD6F}C:\program files (x86)\ea sports\fifa 11\game\fifa.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ea sports\fifa 11\game\fifa.exe |
"TCP Query User{D1677699-5DF9-4125-9F3C-4687B71E4538}C:\program files (x86)\ea sports\fifa 11\game\fifa.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ea sports\fifa 11\game\fifa.exe |
"TCP Query User{E0CFE6E6-8D1F-4EA9-8CB2-172678AAC4F5}C:\users\nico.nicojas-pc\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\nico.nicojas-pc\appdata\roaming\spotify\spotify.exe |
"UDP Query User{01DE79D1-8DE7-4447-ADB8-56C8B3C7497B}C:\users\nico.nicojas-pc\appdata\local\facebook\video\skype\facebookvideocalling.exe" = protocol=17 | dir=in | app=c:\users\nico.nicojas-pc\appdata\local\facebook\video\skype\facebookvideocalling.exe |
"UDP Query User{2F8A7DF9-1087-41D1-8A2C-9992D60A33F1}C:\program files (x86)\ea sports\fifa 11\game\fifa.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ea sports\fifa 11\game\fifa.exe |
"UDP Query User{40F012E4-AE29-44CC-BD71-803C69499479}C:\users\nico.nicojas-pc\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\nico.nicojas-pc\appdata\roaming\spotify\spotify.exe |
"UDP Query User{5DEF9C85-2CF8-4430-B799-143CCE815566}C:\users\nico.nicojas-pc\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\nico.nicojas-pc\appdata\roaming\spotify\spotify.exe |
"UDP Query User{7D3AE024-0E92-4F74-A165-5F405D7115A1}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe |
"UDP Query User{BA636B01-B9F1-4665-9285-7B080D1B5368}C:\users\nico.nicojas-pc\appdata\local\facebook\video\skype\facebookvideocalling.exe" = protocol=17 | dir=in | app=c:\users\nico.nicojas-pc\appdata\local\facebook\video\skype\facebookvideocalling.exe |
"UDP Query User{FC56FE20-5872-4926-A640-6CA999CC5F9B}C:\program files (x86)\ea sports\fifa 11\game\fifa.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ea sports\fifa 11\game\fifa.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{0645A454-AD44-4F0D-99CF-6B762735AD1F}" = aioprnt
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)
"{27EF8E7F-88D1-4ec5-ADE2-7E447FDF114E}" = Kodak AIO Printer
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{87CF757E-C1F1-4D22-865C-00C6950B5258}" = Quickset64
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1" = PDF-Viewer
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Optimus" = NVIDIA Optimus 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}" = PlayReady PC Runtime amd64
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"GIMP-2_is1" = GIMP 2.8.2
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"SynTPDeinstKey" = Synaptics Pointing Device Driver
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D98F04D-11A1-4B64-A406-43292B9EEE90}" = Dell PhotoStage
"{1798D459-6B8B-474B-868D-1229EADA3B95}" = Adobe AIR
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}" = OpenOffice.org 3.4.1
"{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java(TM) 6 Update 33
"{26A24AE4-039D-4CA4-87B4-2F83217009FF}" = Java 7 Update 11
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{376348C2-E372-48BC-A138-E896757BD86A}" = aioscnnr
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3E90B7F4-1817-4405-B4A5-E4EA5EC0E2B3}" = Dell MusicStage
"{3FEA6CD1-EA13-4CE7-A74E-A74A4A0A7B5C}" = FIFA 11
"{56BA241F-580C-43D2-8403-947241AAE633}" = center
"{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6F545E5E-4595-11E2-93B6-B8AC6F97B88E}" = Google Earth
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7694E0B1-2332-448B-9235-929F84B41E3F}" = Active@ ISO Burner
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D318C86-AF4C-409F-A6AC-7183FF4CF424}" = Internet-TV für Windows Media Center
"{9F06F464-479A-403E-AF92-70CBB8D674A1}" = PRE10STI64Installer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAECF7BA-E83B-4A10-87EA-DE0B333F8734}" = RealNetworks - Microsoft Visual C++ 2010 Runtime
"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
"{AF7EBCA4-9FAF-4DC8-8D09-67854BB84D34}" = RealDownloader
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B92C5909-1D37-4C51-8397-A28BB28E5DC3}" = Facebook Video Calling 1.2.0.287
"{BE94C681-68E2-4561-8ABC-8D2E799168B4}" = essentials
"{BFBCF96F-7361-486A-965C-54B17AC35421}" = ocr
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D96B6543-A0C0-4351-AF96-73DEF1DD6820}" = NBA 2K13
"{DA5BDB2A-12F0-4343-8351-21AAEB293990}" = PreReq
"{DCE0E79A-B9AC-41AC-98C1-7EF0538BCA7F}" = Dell VideoStage
"{DEACDFFA-D424-416F-B849-FA282F55B2CE}" = Cortona3D Viewer
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E0F274B7-592B-4669-8FB8-8D9825A09858}" = KODAK All-in-One Software
"{E2F57269-065E-4B19-8CDA-AB6C401FAF1A}" = Dell Stage
"{E4335E82-17B3-460F-9E70-39D9BC269DB3}" = Dell PhotoStage
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{EF53BFAB-4C10-40DB-A82D-9B07111715C6}" = aioscnnr
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics
"{F5266D28-E0B2-4130-BFC5-EE155AD514DC}" = Apple Application Support
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"ALDI Bestellsoftware" = ALDI Bestellsoftware 4.12.1
"Ashampoo Burning Studio 6 FREE_is1" = Ashampoo Burning Studio 6 FREE v.6.81
"Avira AntiVir Desktop" = Avira Free Antivirus
"Dell Webcam Central" = Dell Webcam Central
"ExpressBurn" = Express Burn
"ExpressRip" = Express Rip
"ExpressZip" = Express Zip
"FLV Player" = FLV Player 2.0 (build 25)
"Free M4a to MP3 Converter_is1" = Free M4a to MP3 Converter 7.0
"Free YouTube to iPod Converter_is1" = Free YouTube to iPod Converter version 3.10.32.918
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.32.918
"InstallShield_{DCE0E79A-B9AC-41AC-98C1-7EF0538BCA7F}" = Dell VideoStage
"Kindersicherung_is1" = Kindersicherung 2012
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"MixPad" = MixPad Audiodatei-Mixer
"Mozilla Firefox 18.0.1 (x86 de)" = Mozilla Firefox 18.0.1 (x86 de)
"Mozilla Thunderbird 17.0.2 (x86 de)" = Mozilla Thunderbird 17.0.2 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"PrintProjects" = PrintProjects
"RealPlayer 16.0" = RealPlayer
"Secunia PSI" = Secunia PSI (3.0.0.6001)
"Tobit Radio.fx Server 1" = WDR RadioRecorder
"Video Converter" = Video Converter
"VLC media player" = VLC media player 2.0.5
"WavePad" = WavePad Audiobearbeitungs-Software
"WinLiveSuite" = Windows Live Essentials
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-1835506289-3229931497-3952218681-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 24.10.2012 06:21:15 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 439
Description = Windows (2888) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk
 konnte nicht geschrieben werden. Fehler -1032.
 
Error - 24.10.2012 06:24:30 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 490
Description = Windows (2888) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 24.10.2012 06:24:30 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 439
Description = Windows (2888) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk
 konnte nicht geschrieben werden. Fehler -1032.
 
Error - 24.10.2012 06:26:43 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 490
Description = Windows (2888) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 24.10.2012 06:26:43 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 439
Description = Windows (2888) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk
 konnte nicht geschrieben werden. Fehler -1032.
 
Error - 24.10.2012 06:26:53 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 490
Description = Windows (2888) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 24.10.2012 06:26:53 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 439
Description = Windows (2888) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk
 konnte nicht geschrieben werden. Fehler -1032.
 
Error - 24.10.2012 06:27:03 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 490
Description = Windows (2888) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 24.10.2012 06:27:03 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 439
Description = Windows (2888) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk
 konnte nicht geschrieben werden. Fehler -1032.
 
Error - 24.10.2012 06:44:26 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 490
Description = Windows (2888) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 24.10.2012 06:44:26 | Computer Name = NicoJas-Pc | Source = ESENT | ID = 439
Description = Windows (2888) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk
 konnte nicht geschrieben werden. Fehler -1032.
 
[ Media Center Events ]
Error - 20.03.2012 15:11:39 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 20:11:34 - Fehler beim Herstellen der Internetverbindung.  20:11:34
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 20.03.2012 16:11:42 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 21:11:42 - Fehler beim Herstellen der Internetverbindung.  21:11:42
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 20.03.2012 16:11:51 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 21:11:47 - Fehler beim Herstellen der Internetverbindung.  21:11:47
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 05.05.2012 14:52:38 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 20:44:58 - EpgListing.enc konnte nicht abgerufen werden (Fehler: HTTP-Status
 404: Die angeforderte URL ist auf diesem Server nicht vorhanden.  ) 
 
Error - 22.05.2012 14:13:50 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 20:13:50 - Fehler beim Herstellen der Internetverbindung.  20:13:50
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 22.05.2012 14:14:07 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 20:13:55 - Fehler beim Herstellen der Internetverbindung.  20:13:55
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 13.07.2012 14:26:21 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 20:26:21 - Fehler beim Herstellen der Internetverbindung.  20:26:21
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 13.07.2012 14:26:39 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 20:26:27 - Fehler beim Herstellen der Internetverbindung.  20:26:27
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 24.08.2012 15:46:57 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 21:46:57 - Fehler beim Herstellen der Internetverbindung.  21:46:57
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 24.08.2012 15:47:42 | Computer Name = NicoJas-Pc | Source = MCUpdate | ID = 0
Description = 21:47:11 - Fehler beim Herstellen der Internetverbindung.  21:47:11
-    Serververbindung konnte nicht hergestellt werden.. 
 
[ System Events ]
Error - 01.02.2013 13:40:19 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:  %%1068
 
Error - 01.02.2013 13:40:19 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:  %%1068
 
Error - 01.02.2013 13:40:19 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:  %%1068
 
Error - 01.02.2013 13:40:19 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:  %%1068
 
Error - 01.02.2013 13:41:04 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7000
Description = Der Dienst "UAC-Dateivirtualisierung" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%2
 
Error - 01.02.2013 13:41:33 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  SBRE
 
Error - 02.02.2013 02:58:43 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7000
Description = Der Dienst "UAC-Dateivirtualisierung" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%2
 
Error - 02.02.2013 02:59:21 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  SBRE
 
Error - 02.02.2013 04:00:05 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7000
Description = Der Dienst "UAC-Dateivirtualisierung" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%2
 
Error - 02.02.2013 04:00:35 | Computer Name = NicoJas-Pc | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  SBRE
 
 
< End of report >

cosinus 02.02.2013 15:29
Mal ein Beispiel:

Zitat:
C:\Program Files\Adobe_Flash_Player_AX_11.4.402.265_SPS.exe
IMHO solltest du dir mal angewöhnen Setups NICHT nach C:\ProgramFiles oder C:\Programme zu speichern. Die Setups werden idR nur 1x benötigt und dann können und sollten sie auch gelöscht werden, weil es laufend neue Versionen gibt, die das ältere Setup mehr als überflüssig machen.


Sonst sieht soweit alles gut aus, Funde gabs ja keine mehr und das mit der SWH war Gott sei Dank kein Schädling sondern lag an dieser Crapware von Kindersicherung :pfui:

Sieht soweit ok aus

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Rheingold 02.02.2013 17:16
Hallo,
danke für den Tipp mit den Setups. Ich wusste nicht, ob ich die löschen kann oder nicht. Die Firefox Einstellung zu Cookies nach jeder Sitzung löschen habe ich schon. Die genannten Programme werde ich installieren.


Java (TM) 6 Update 33 kann ich nicht deinstallieren. Es kommt dann die Meldung "Es liegt ein dieses Windows Installer-Pakte betreffendes Problem vor. Eine für den Abschluss der Installation erforderliche DLL konnte nicht ausgeführt werden." Kann ich das einfach so belassen oder ist das eine Gefahrenquelle für meinen PC?

Ansonsten ist alles wieder okay! Thanks a lot!
Jasmina

cosinus 02.02.2013 17:19
Java6u33 ist uralt, deinstallieren!
Installiere falls du Java überhaupt brauchst das gerade jetzt aktuelle Java7u13 aber lass es am besten erstmal komplett weg. Java wird sogut wie garnicht mehr benötigt.

Weitere Überprüfung der Plugins kannst du hier machen => https://www.mozilla.org/de/plugincheck/

Rheingold 02.02.2013 19:40
Java (TM) 6 Update 33 kann ich nicht deinstallieren. Es kommt dann die Fehlermeldung "Es liegt ein dieses Windows Installer-Paket betreffendes Problem vor. Eine für den Abschluss der Installation erforderliche DLL konnte nicht ausgeführt werden".
:confused:

Java 7 habe ich entfernt.

VG, Jasmina

cosinus 03.02.2013 01:31
Probier dein Glück hiermit => Revo Uninstaller - Download - Filepony

Rheingold 03.02.2013 08:38
Hi Cosinus!
Ja, mit Revo hat's funktioniert.

Jetzt läuft alles wieder super!

Ganz herzlichen Dank an dich und noch ein schönes Restwochenende!

Viele Grüße,
Jasmina

:abklatsch:
:dankeschoen:


Alle Zeitangaben in WEZ +1. Es ist jetzt 13:12 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131