Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Ungewolltes Aktivieren der Proxyserververbindung in den Interneteinstellungen (https://www.trojaner-board.de/157489-ungewolltes-aktivieren-proxyserververbindung-interneteinstellungen.html)

weti 11.08.2014 19:05

Ungewolltes Aktivieren der Proxyserververbindung in den Interneteinstellungen
 
Liste der Anhänge anzeigen (Anzahl: 1)
Hallo Leute,

ich habe hier zwar jede Menge gelesen über das Thema, aber nichts trifft eigentlich so richtigh mein Problem.

Es ist folgendes: bei jedem Neustart ist die Einstellung 'Proxyserver für LAN verwenden' aktiviert (s.screenshot). Deshalb bekomme ich mit Chrome und mit dem IE keine Verbindung zum Internet (Firefox und Opera funktionieren tadellos). Da ich aber für bestimmte Addons den Chrome benutze ist es ziemlich nervig jedes Mal manuell den Proxyserver zu deaktivieren.

Es passieren keine ungewollten Internetverbindungen o.ä - zumindest merke ich nichts davon.

Betriebssystem ist Win7/64. Alle updates wurden gemacht. Auch die Softwareupdates.

Hat einer eine Idee, wie ich das beheben könnte.

Vielen Dank und schönen abend noch.
Werner

cosinus 11.08.2014 19:11

Hallo und :hallo:

Eine Möglichkeit wäre: Malware. Die macht das schonmal ganz gerne, den Proxy aus den localhost zu setzen, damit dir im Browser schön manipulierte Seiten angezeigt werden oder brisante Daten mitgeschnitten werden können...


Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden?

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten!
Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!




Zudem bitte auch ein Log mit Farbars Tool machen:

Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)



Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307

felix1 11.08.2014 19:29

Zitat:

Zitat von weti (Beitrag 1343134)
Es ist folgendes: bei jedem Neustart ist die Einstellung 'Proxyserver für LAN verwenden' aktiviert (s.screenshot). Deshalb bekomme ich mit Chrome und mit dem IE keine Verbindung zum Internet (Firefox und Opera funktionieren tadellos). Da ich aber für bestimmte Addons den Chrome benutze ist es ziemlich nervig jedes Mal manuell den Proxyserver zu deaktivieren.

Abgesehen von den Hinweisen von Cosinus, die Du unbedingt befolgen solltest, stellt sich mir hier die Frage: Wer hat in seinem Heimnetzwerk überhaupt einen Proxy am Laufen. Maximal den Router als DHCP- und DNS-Server.

cosinus 11.08.2014 19:34

Er hat bestimmt keinen Proxy, Felix, er will ja auch, dass es dauerhaft deaktiviert bleibt ;)

felix1 11.08.2014 19:42

Zitat:

Zitat von cosinus (Beitrag 1343159)
Er hat bestimmt keinen Proxy, Felix, er will ja auch, dass es dauerhaft deaktiviert bleibt ;)

Hallo Cosinus, das mit dem Proxy ist Deineseits vollkommen richtig:Boogie:
Aus den Postings geht aber nicht hervor, um welches BS es sich handelt und in welchen Netzwerken der PC schon registriert war/ist:alc:

cosinus 11.08.2014 19:43

Mööööp :p er hats doch beschrieben welches OS

Zitat:

Zitat von weti (Beitrag 1343134)
Betriebssystem ist Win7/64. Alle updates wurden gemacht. Auch die Softwareupdates.


weti 12.08.2014 09:46

Hallo Cosinus und die anderen,
erstmal vielen Dank für die Antworten. Ich habe einige scans gemacht, die ich anfüge. Vielleicht ist es untergegangen, aber ich habe dadurch keine Beinträchtigungen durch falsche Weiterleitungen beim surfen oder ähnliches. Chrome und IE verweigern nur die Internetverbindung mit dem Hinweis auf den Proxyserver.

Der FRST lässt sich nicht starten (keine Rückmeldung und das Programm muss manuell beendet werden). Vielleicht ist folgendes noch von Bedeutung: Ich konfiguriere meine Agfeo-Anlage über folgenden Link: hxxp://127.0.0.1:5080/. Das ist zumindest die gleiche IP aber mit einem anderen Port. Oder?

Hier die scans (die leider älter als 7 Tage sind, aber ich war in der Zwischenzeit häufig unterwegs, aber alle kurz nach dem Auftreten des Problems). :

Code:

# AdwCleaner v3.216 - Bericht erstellt am 24/07/2014 um 20:26:35
# Aktualisiert 17/07/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Admin - ADMIN-PC
# Gestartet von : D:\Download\Aktuell\adwcleaner_3.216.exe
# Option : Suchen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17207


-\\ Mozilla Firefox v31.0 (x86 de)

[ Datei : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default\prefs.js ]


-\\ Google Chrome v36.0.1985.125

[ Datei : C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [917 octets] - [24/07/2014 14:56:07]
AdwCleaner[R1].txt - [857 octets] - [24/07/2014 20:26:35]

########## EOF - C:\AdwCleaner\AdwCleaner[R1].txt - [916 octets] ##########

Code:

C:\Download\aktuell\GCSMSetup_3_5_20.exe        Variante von Win32/InstallShare.A evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert
C:\Download\aktuell\Unlocker1.9.1-x64.exe        Variante von Win32/Toolbar.Babylon evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert
C:\Download\aktuell\vlc-2.0.5-win64.exe        Win32/StartPage.OPH Trojaner        Gesäubert durch Löschen - in Quarantäne kopiert
D:\Download\Grafik\DesignPro\SoftonicDownloader_fuer_avery-designpro.exe        Win32/SoftonicDownloader.E evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert
D:\Download\Musik\vlc-1.1.7-win32.exe        Win32/StartPage.OIE Trojaner        Gesäubert durch Löschen - in Quarantäne kopiert
D:\Download\Software\Ashampoo\ashampoo_internet_accelerator_3_3.20_sm.exe        Win32/Toolbar.Conduit evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert
D:\Download\Software\Ashampoo\ashampoo_uninstaller_4_4.22_sm.exe        Win32/Toolbar.Conduit evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert
D:\Download\Software\Ashampoo\ashampoo_winoptimizer_8_e8.13_sm.exe        Variante von Win32/Toolbar.Conduit.AI evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert
D:\GKT-Service\Medien\Gassner\Engel für Opa.exe        Variante von Win32/Adware.ToolPlugin.A Anwendung        gelöscht - in Quarantäne kopiert
E:\Download\Aktuell\ashampoo_internet_accelerator_3_3.20_sm.exe        Win32/Toolbar.Conduit evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert
E:\Download\Aktuell\ashampoo_uninstaller_4_4.22_sm.exe        Win32/Toolbar.Conduit evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert
E:\Download\Aktuell\ashampoo_winoptimizer_8_e8.13_sm.exe        Variante von Win32/Toolbar.Conduit.AI evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert
E:\Download\Aktuell\DVD_Shrink_TSV31S5I.exe        Variante von Win32/Toolbar.Conduit.AE evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert
E:\Download\Aktuell\GCSMSetup_3_5_20.exe        Variante von Win32/InstallShare.A evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert
E:\Download\Aktuell\SoftonicDownloader_fuer_avery-designpro.exe        Win32/SoftonicDownloader.E evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert
E:\Download\Aktuell\Unlocker1.9.1-x64.exe        Variante von Win32/Toolbar.Babylon evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert
E:\Download\Aktuell\vlc-2.0.5-win64.exe        Win32/StartPage.OPH Trojaner        Gesäubert durch Löschen - in Quarantäne kopiert
E:\Download\Aktuell\vlc-2.1.0-win64.exe        NSIS/StartPage.CC Trojaner        Gesäubert durch Löschen - in Quarantäne kopiert
E:\Download\Aktuell\vlc-2.1.1-win64.exe        NSIS/StartPage.CC Trojaner        Gesäubert durch Löschen - in Quarantäne kopiert
E:\Download\Aktuell\vlc-2.1.3-win64.exe        NSIS/StartPage.CC Trojaner        Gesäubert durch Löschen - in Quarantäne kopiert
E:\Download\Grafik\DesignPro\SoftonicDownloader_fuer_avery-designpro.exe        Win32/SoftonicDownloader.E evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert
E:\Download\Musik\vlc-1.1.7-win32.exe        Win32/StartPage.OIE Trojaner        Gesäubert durch Löschen - in Quarantäne kopiert
E:\Download\Software\Ashampoo\ashampoo_internet_accelerator_3_3.20_sm.exe        Win32/Toolbar.Conduit evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert
E:\Download\Software\Ashampoo\ashampoo_uninstaller_4_4.22_sm.exe        Win32/Toolbar.Conduit evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert
E:\Download\Software\Ashampoo\ashampoo_winoptimizer_8_e8.13_sm.exe        Variante von Win32/Toolbar.Conduit.AI evtl. unerwünschte Anwendung        gelöscht - in Quarantäne kopiert
E:\GKT-Service\Medien\Gassner\Engel für Opa.exe        Variante von Win32/Adware.ToolPlugin.A Anwendung        gelöscht - in Quarantäne kopiert

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Professional x64
Ran by Admin on 24.07.2014 at 20:42:13,21
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Program Files (x86)\myfree codec"
Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"



~~~ FireFox

Successfully deleted the following from C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\tefcdjqq.default\prefs.js

user_pref("extensions.lastpass.searchforsiteswithinaddressbar", true);
Emptied folder: C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\tefcdjqq.default\minidumps [65 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 24.07.2014 at 20:48:55,68
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


cosinus 12.08.2014 10:06

Zitat:

Der FRST lässt sich nicht starten (keine Rückmeldung und das Programm muss manuell beendet werden). Vielleicht ist folgendes noch von Bedeutung: Ich konfiguriere meine Agfeo-Anlage über folgenden Link: hxxp://127.0.0.1:5080/. Das ist zumindest die gleiche IP aber mit einem anderen Port. Oder?
FRST via Rechtsklick als Admin gestartet?

Mit deiner Agfeo hat dein Problem so nichts zu tun denke ich, deine Anlage ist "zufällig" auch über den localhost erreichbar, mach aber keinen Proxy. localhost ( = 127.0.0.1 ) ist immer der lokale Rechner, vor man gerade hockt

weti 12.08.2014 10:08

Ja, habe ich auch als Admin probiert - gleiches Ergenis. Das Programm steht still (keine Rückmeldung in der Kopfzeile).
Agfeo: Das ist aber die gleiche IP, die als >Adresse im Proxy angegeben wird (s. screenshot vom ersten Posting). Ich bin jetzt erstmal weg. Komme in ca 1 Stunde wieder. Und - danke nochmal. Ich bin richtig froh, dass es euch gibt. :-)

cosinus 12.08.2014 10:51

Ja schon klar :D
Es gibt aber noch zig andere Anwendungsbereiche für den localhost (127.0.0.1) siehe localhost ? Wikipedia

Das FRST nicht geht, würde ich mal CF vorschlagen:


Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.


weti 12.08.2014 13:38

Hier der CombiFix-Log:

Code:

ComboFix 14-08-12.01 - Admin 12.08.2014  14:29:43.2.4 - x64
Microsoft Windows 7 Professional  6.1.7601.1.1252.49.1031.18.8169.6258 [GMT 2:00]
ausgeführt von:: c:\users\Admin\Desktop\ComboFix.exe
AV: BullGuard Antivirus *Disabled/Outdated* {C3CCAC61-52F7-A056-1860-6406566E2578}
FW: BullGuard Firewall *Disabled* {FBF72D44-1898-A10E-333F-CD33A8BD6203}
SP: BullGuard Antispyware *Disabled/Outdated* {78AD4D85-74CD-AFD8-22D0-5F742DE96FC5}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
ADS - Windows: deleted 192 bytes in 1 streams.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Admin\AppData\Local\assembly\tmp
c:\users\Admin\AppData\Local\assembly\tmp\00176MEY\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\00176MEY\DevExpress.Data.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\02P0M1FY\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\02P0M1FY\YourMailMetroSkin.DLL
c:\users\Admin\AppData\Local\assembly\tmp\0DJKRJBC\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\0DJKRJBC\AddinExpress.MSO.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\0DPEQADT\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\0DPEQADT\System.Data.SQLite.DLL
c:\users\Admin\AppData\Local\assembly\tmp\0EIBWHKF\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\0EIBWHKF\YourMailMetroSkin.DLL
c:\users\Admin\AppData\Local\assembly\tmp\0LOFJ1O8\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\0LOFJ1O8\DevExpress.XtraLayout.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\0LXRKBXS\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\0LXRKBXS\PdfSharp-WPF.DLL
c:\users\Admin\AppData\Local\assembly\tmp\0WH7QEF0\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\0WH7QEF0\yourMail.Client.LocalStore.DLL
c:\users\Admin\AppData\Local\assembly\tmp\15LTBU6S\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\15LTBU6S\yourMail.Client.TeamStore.DLL
c:\users\Admin\AppData\Local\assembly\tmp\1C1WIVCG\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\1C1WIVCG\HtmlAgilityPack.DLL
c:\users\Admin\AppData\Local\assembly\tmp\1JGQGLZU\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\1JGQGLZU\DevExpress.Utils.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\1N0WUGSC\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\1N0WUGSC\yourMail.Client.UI.resources.DLL
c:\users\Admin\AppData\Local\assembly\tmp\1ODANJKJ\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\1ODANJKJ\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\1PQ5GDN2\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\1PQ5GDN2\yourMail.Client.LocalStore.DLL
c:\users\Admin\AppData\Local\assembly\tmp\1SQLZKDO\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\1SQLZKDO\DevExpress.XtraEditors.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\22RXY89H\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\22RXY89H\DevExpress.Utils.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\24CF2QW8\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\24CF2QW8\AddinExpress.OL.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\24ZE7LTG\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\24ZE7LTG\DevExpress.XtraBars.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\25MEH41H\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\25MEH41H\Interop.Redemption.DLL
c:\users\Admin\AppData\Local\assembly\tmp\27FCWMQF\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\27FCWMQF\DevExpress.XtraEditors.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\27MVULCT\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\27MVULCT\AddinExpress.OL.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\29NZXJCV\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\29NZXJCV\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\2BUHA8QU\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\2BUHA8QU\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\2CWTVAYO\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\2CWTVAYO\yourMail.Client.UI.CustomControls.DLL
c:\users\Admin\AppData\Local\assembly\tmp\2D0GTWDI\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\2D0GTWDI\AddinExpress.OL.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\2FDSP8D0\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\2FDSP8D0\DevExpress.XtraGrid.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\2IGK9WM4\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\2IGK9WM4\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\2Q97RSBL\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\2Q97RSBL\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\2RBGVGR1\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\2RBGVGR1\DevExpress.XtraLayout.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\2RUXCAQE\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\2RUXCAQE\yourMail.Client.UI.resources.DLL
c:\users\Admin\AppData\Local\assembly\tmp\2ZFP77SH\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\2ZFP77SH\AddinExpress.OL.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\30387T1R\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\30387T1R\System.Data.SQLite.DLL
c:\users\Admin\AppData\Local\assembly\tmp\35PL3TAM\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\35PL3TAM\DevExpress.XtraBars.v12.2.resources.DLL
c:\users\Admin\AppData\Local\assembly\tmp\3732Z2Z1\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\3732Z2Z1\AddinExpress.MSO.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\3A64AH9J\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\3A64AH9J\yourMail.Client.UI.resources.DLL
c:\users\Admin\AppData\Local\assembly\tmp\3Y6M888V\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\3Y6M888V\DevExpress.XtraEditors.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\42YZ4C0R\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\42YZ4C0R\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\44RJOMKY\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\44RJOMKY\DevExpress.XtraBars.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\44T7J65D\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\44T7J65D\YourMailMetroSkin.DLL
c:\users\Admin\AppData\Local\assembly\tmp\450DHXK6\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\450DHXK6\System.Data.SQLite.DLL
c:\users\Admin\AppData\Local\assembly\tmp\461I5MWY\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\461I5MWY\DevExpress.XtraRichEdit.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\4888VCY6\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\4888VCY6\DevExpress.XtraBars.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\4EM2ZUHM\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\4EM2ZUHM\PdfSharp-WPF.DLL
c:\users\Admin\AppData\Local\assembly\tmp\4HFG5GL3\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\4HFG5GL3\yourMail.Client.TeamStore.DLL
c:\users\Admin\AppData\Local\assembly\tmp\4IQ9GQTD\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\4IQ9GQTD\log4net.DLL
c:\users\Admin\AppData\Local\assembly\tmp\4JDNS8WW\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\4JDNS8WW\DevExpress.Data.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\4YWQ5P34\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\4YWQ5P34\AddinExpress.MSO.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\569X1N6D\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\569X1N6D\DevExpress.Utils.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\57EESQU6\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\57EESQU6\DevExpress.XtraTreeList.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\5A4DHLZ3\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\5A4DHLZ3\Lucene.Net.DLL
c:\users\Admin\AppData\Local\assembly\tmp\5A7Q1MGK\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\5A7Q1MGK\DevExpress.Utils.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\5E9JWOOQ\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\5E9JWOOQ\DevExpress.Data.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\5GGYW3PS\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\5GGYW3PS\yourMail.Common.DLL
c:\users\Admin\AppData\Local\assembly\tmp\5J0Q9GWA\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\5J0Q9GWA\DevExpress.XtraGrid.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\5K8UIUHJ\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\5K8UIUHJ\DevExpress.XtraBars.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\5KXFFIWA\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\5KXFFIWA\Microsoft.SharePoint.Client.Runtime.DLL
c:\users\Admin\AppData\Local\assembly\tmp\5L38UN5F\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\5L38UN5F\yourMail.Client.UI.CustomControls.DLL
c:\users\Admin\AppData\Local\assembly\tmp\5LW26AFE\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\5LW26AFE\DevExpress.Data.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\5PNQG3LM\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\5PNQG3LM\DevExpress.XtraBars.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\5Q0AFU2Y\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\5Q0AFU2Y\DevExpress.XtraBars.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\5T6MXJ1J\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\5T6MXJ1J\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\5VB4D8VH\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\5VB4D8VH\DevExpress.Data.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\5X3H4DKW\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\5X3H4DKW\yourMail.Client.TeamStore.DLL
c:\users\Admin\AppData\Local\assembly\tmp\60COTC1J\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\60COTC1J\DevExpress.Data.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\60N6LHS4\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\60N6LHS4\DevExpress.Utils.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\68MTXXXP\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\68MTXXXP\yourMail.Client.UI.resources.DLL
c:\users\Admin\AppData\Local\assembly\tmp\69UVAD2H\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\69UVAD2H\DevExpress.XtraTreeList.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\6BHF1UER\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\6BHF1UER\DevExpress.RichEdit.v12.2.Core.DLL
c:\users\Admin\AppData\Local\assembly\tmp\6D01O46F\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\6D01O46F\AddinExpress.OL.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\6DBVQ1MZ\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\6DBVQ1MZ\yourMail.Common.DLL
c:\users\Admin\AppData\Local\assembly\tmp\6V0P5B4J\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\6V0P5B4J\DevExpress.Data.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\70XXPII2\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\70XXPII2\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\77MHLYTQ\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\77MHLYTQ\yourMail.Client.UI.CustomControls.DLL
c:\users\Admin\AppData\Local\assembly\tmp\78KCU6BN\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\78KCU6BN\Lucene.Net.DLL
c:\users\Admin\AppData\Local\assembly\tmp\78QDQ33V\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\78QDQ33V\AddinExpress.OL.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\79XUCTWV\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\79XUCTWV\Microsoft.SharePoint.Client.DLL
c:\users\Admin\AppData\Local\assembly\tmp\7CHZ2QG7\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\7CHZ2QG7\DevExpress.Data.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\7CPYE88B\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\7CPYE88B\yourMail.Client.UI.resources.DLL
c:\users\Admin\AppData\Local\assembly\tmp\7DVCCYGD\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\7DVCCYGD\AddinExpress.OL.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\7GBTF7SF\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\7GBTF7SF\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\7LIP180C\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\7LIP180C\DevExpress.Utils.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\7N2A06BU\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\7N2A06BU\DevExpress.Utils.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\7NN9QIY0\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\7NN9QIY0\yourMail.Client.TeamStore.DLL
c:\users\Admin\AppData\Local\assembly\tmp\7UT53HKN\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\7UT53HKN\Lucene.Net.DLL
c:\users\Admin\AppData\Local\assembly\tmp\7VHTXXSM\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\7VHTXXSM\yourMail.Client.LocalStore.DLL
c:\users\Admin\AppData\Local\assembly\tmp\7WR5960X\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\7WR5960X\Interop.Redemption.DLL
c:\users\Admin\AppData\Local\assembly\tmp\7YWIR8C5\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\7YWIR8C5\AddinExpress.MSO.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\817OUN0Z\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\817OUN0Z\Lucene.Net.DLL
c:\users\Admin\AppData\Local\assembly\tmp\81JLTVFH\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\81JLTVFH\DevExpress.Data.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\83T1EZCZ\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\83T1EZCZ\yourMail.Client.LocalStore.DLL
c:\users\Admin\AppData\Local\assembly\tmp\850YQX35\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\8B7M90DH\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\8B7M90DH\AddinExpress.MSO.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\8F2KG91Q\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\8F2KG91Q\DevExpress.XtraLayout.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\8NZ1EW9W\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\8NZ1EW9W\Interop.Redemption.DLL
c:\users\Admin\AppData\Local\assembly\tmp\8R930GNY\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\8R930GNY\yourMail.Client.UI.resources.DLL
c:\users\Admin\AppData\Local\assembly\tmp\8TFP21VE\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\8TFP21VE\DevExpress.XtraBars.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\8U16ZJAX\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\8U16ZJAX\AddinExpress.OL.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\8XLR9U28\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\8XLR9U28\DevExpress.Data.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\90QKRAEU\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\90QKRAEU\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\91HP1FC4\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\91HP1FC4\DevExpress.Utils.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\9CQFBUBU\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\9CQFBUBU\Interop.Redemption.DLL
c:\users\Admin\AppData\Local\assembly\tmp\9J2LVF2Y\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\9J2LVF2Y\DevExpress.XtraBars.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\9VDT7S5Y\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\9VDT7S5Y\YourMailMetroSkin.DLL
c:\users\Admin\AppData\Local\assembly\tmp\9VQPXOMD\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\9VQPXOMD\DevExpress.XtraEditors.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\9XGL7WLH\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\9XGL7WLH\yourMail.Client.BusinessLogic.DLL
c:\users\Admin\AppData\Local\assembly\tmp\9XHWUMK1\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\9XHWUMK1\Interop.Redemption.DLL
c:\users\Admin\AppData\Local\assembly\tmp\A07AYL66\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\A07AYL66\yourMail.Client.BusinessLogic.DLL
c:\users\Admin\AppData\Local\assembly\tmp\AF9SHG1Z\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\AF9SHG1Z\LogicNP.CryptoLicensing.DLL
c:\users\Admin\AppData\Local\assembly\tmp\AJVPY44W\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\AJVPY44W\yourMail.Client.TeamStore.DLL
c:\users\Admin\AppData\Local\assembly\tmp\AUGWQGV3\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\AUGWQGV3\DevExpress.XtraBars.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\B1VO73V5\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\B1VO73V5\Lucene.Net.DLL
c:\users\Admin\AppData\Local\assembly\tmp\B2KYY3NK\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\B2KYY3NK\yourMail.Client.LocalStore.DLL
c:\users\Admin\AppData\Local\assembly\tmp\B7PYGCF7\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\B7PYGCF7\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\B7TPGJ3K\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\B7TPGJ3K\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\BB6ZWGUA\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\BB6ZWGUA\yourMail.Common.DLL
c:\users\Admin\AppData\Local\assembly\tmp\BGSGD8J0\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\BGSGD8J0\Interop.Redemption.DLL
c:\users\Admin\AppData\Local\assembly\tmp\BMDJG8GY\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\BMDJG8GY\YourMailMetroSkin.DLL
c:\users\Admin\AppData\Local\assembly\tmp\BRMQOLQF\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\BRMQOLQF\yourMail.Client.BusinessLogic.DLL
c:\users\Admin\AppData\Local\assembly\tmp\BSOB3HLA\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\BSOB3HLA\PdfSharp-WPF.DLL
c:\users\Admin\AppData\Local\assembly\tmp\BXJ7A9T3\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\BXJ7A9T3\AddinExpress.MSO.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\BZ2DUKU2\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\BZ2DUKU2\AddinExpress.OL.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\BZJU4MF5\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\BZJU4MF5\yourMail.Client.BusinessLogic.DLL
c:\users\Admin\AppData\Local\assembly\tmp\C1RRDH7R\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\C1RRDH7R\PdfSharp-WPF.DLL
c:\users\Admin\AppData\Local\assembly\tmp\C5LC7M4H\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\C5LC7M4H\Chili.Opf3.DLL
c:\users\Admin\AppData\Local\assembly\tmp\C8827MYH\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\C8827MYH\DevExpress.XtraTreeList.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\C9YR03LC\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\C9YR03LC\Microsoft.SharePoint.Client.DLL
c:\users\Admin\AppData\Local\assembly\tmp\CF37C9M5\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\CF37C9M5\DevExpress.XtraBars.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\CIZTBNVC\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\CIZTBNVC\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\CJBN9PU7\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\CJBN9PU7\AddinExpress.OL.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\CNKNU3KF\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\CNKNU3KF\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\CTWKMR58\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\CTWKMR58\DevExpress.Data.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\D02AWTQL\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\D02AWTQL\yourMail.Common.DLL
c:\users\Admin\AppData\Local\assembly\tmp\D5BRBHQ8\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\D5BRBHQ8\yourMail.Client.BusinessLogic.DLL
c:\users\Admin\AppData\Local\assembly\tmp\D8RCOFFM\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\D8RCOFFM\DevExpress.XtraGrid.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\DM35IUDU\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\DM35IUDU\yourMail.Client.BusinessLogic.DLL
c:\users\Admin\AppData\Local\assembly\tmp\DO11LIV4\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\DO11LIV4\yourMail.Client.LocalStore.DLL
c:\users\Admin\AppData\Local\assembly\tmp\DRVN20YM\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\DRVN20YM\AddinExpress.OL.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\DU7LF8WA\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\DU7LF8WA\yourMail.Client.UI.resources.DLL
c:\users\Admin\AppData\Local\assembly\tmp\DU7ZVBYX\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\DU7ZVBYX\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\DVHXT2DU\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\DVHXT2DU\Microsoft.SharePoint.Client.Runtime.DLL
c:\users\Admin\AppData\Local\assembly\tmp\DY247WSZ\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\DY247WSZ\yourMail.Common.DLL
c:\users\Admin\AppData\Local\assembly\tmp\E1BR60VV\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\E1BR60VV\DevExpress.XtraBars.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\E1TUOJQF\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\E1TUOJQF\DevExpress.XtraBars.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\E3P0V7X3\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\E3P0V7X3\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\E4JZS6B5\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\E4JZS6B5\DevExpress.XtraBars.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\E6OGGWVW\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\E6OGGWVW\AddinExpress.OL.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\E8ZAUOT5\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\E8ZAUOT5\DevExpress.RichEdit.v12.2.Core.DLL
c:\users\Admin\AppData\Local\assembly\tmp\E9IMZCIN\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\E9IMZCIN\ICSharpCode.SharpZipLib.DLL
c:\users\Admin\AppData\Local\assembly\tmp\EBJAYLN8\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\EBJAYLN8\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\ECB4QF5B\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\ECB4QF5B\DevExpress.XtraEditors.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\EFWMK5WY\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\EFWMK5WY\yourMail.Client.TeamBusinessLogic.DLL
c:\users\Admin\AppData\Local\assembly\tmp\EKUYTGE9\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\EKUYTGE9\DevExpress.XtraEditors.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\EMUDB9E0\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\EMUDB9E0\AddinExpress.MSO.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\EN4WTXM1\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\EN4WTXM1\Interop.Redemption.DLL
c:\users\Admin\AppData\Local\assembly\tmp\EQL8MPXS\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\EQL8MPXS\AddinExpress.OL.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\EU6VVMBH\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\EU6VVMBH\Lucene.Net.DLL
c:\users\Admin\AppData\Local\assembly\tmp\EW734FBR\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\EW734FBR\DevExpress.RichEdit.v12.2.Core.DLL
c:\users\Admin\AppData\Local\assembly\tmp\EYMNE77X\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\EYMNE77X\DevExpress.XtraEditors.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\F0DMY1OF\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\F0DMY1OF\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\F3311M7W\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\F3311M7W\yourMail.Client.LocalStore.DLL
c:\users\Admin\AppData\Local\assembly\tmp\F3KCXNMS\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\F3KCXNMS\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\FBDGKUMJ\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\FBDGKUMJ\DevExpress.XtraBars.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\FBUGBZRI\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\FBUGBZRI\System.Data.SQLite.DLL
c:\users\Admin\AppData\Local\assembly\tmp\FCS9I47X\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\FCS9I47X\DevExpress.XtraBars.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\FENXY2EW\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\FENXY2EW\yourMail.Client.UI.resources.DLL
c:\users\Admin\AppData\Local\assembly\tmp\FFHTCDUS\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\FFHTCDUS\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\FKBBSQAI\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\FKBBSQAI\yourMail.Common.DLL
c:\users\Admin\AppData\Local\assembly\tmp\FKIR5FLU\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\FKIR5FLU\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\FO0FW5IF\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\FO0FW5IF\DevExpress.XtraGrid.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\FV1YH2OL\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\FV1YH2OL\yourMail.Client.TeamStore.DLL
c:\users\Admin\AppData\Local\assembly\tmp\FX4RWU13\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\FX4RWU13\AddinExpress.OL.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\FXPEBQ8R\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\FXPEBQ8R\Lucene.Net.DLL
c:\users\Admin\AppData\Local\assembly\tmp\FYTSDNFS\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\FYTSDNFS\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\G66L1KPZ\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\G66L1KPZ\YourMailMetroSkin.DLL
c:\users\Admin\AppData\Local\assembly\tmp\G77UAO3R\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\G77UAO3R\System.Data.SQLite.DLL
c:\users\Admin\AppData\Local\assembly\tmp\G9CC0GQT\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\G9CC0GQT\DevExpress.Utils.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\G9XQ6O2W\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\G9XQ6O2W\DevExpress.Utils.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\GLYH2P4D\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\GLYH2P4D\System.Data.SQLite.DLL
c:\users\Admin\AppData\Local\assembly\tmp\GMGB2WEK\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\GMGB2WEK\yourMail.Client.LocalStore.DLL
c:\users\Admin\AppData\Local\assembly\tmp\GOWAN7RE\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\GOWAN7RE\DevExpress.XtraEditors.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\GRUBPH5I\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\GRUBPH5I\DevExpress.XtraLayout.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\GU1VDGVT\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\GU1VDGVT\yourMail.Common.DLL
c:\users\Admin\AppData\Local\assembly\tmp\GUWVIMXN\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\GUWVIMXN\yourMail.Client.BusinessLogic.DLL
c:\users\Admin\AppData\Local\assembly\tmp\GV4HU1R6\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\GV4HU1R6\DevExpress.XtraBars.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\GYIJXWF8\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\GYIJXWF8\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\H1W0ZLXG\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\H1W0ZLXG\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\H44KERT8\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\H44KERT8\PdfSharp-WPF.DLL
c:\users\Admin\AppData\Local\assembly\tmp\H4LK4E0G\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\H4LK4E0G\DevExpress.Utils.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\H9UORZ0I\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\H9UORZ0I\AddinExpress.OL.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\HAXIXM0N\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\HAXIXM0N\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\HI5PAYT3\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\HI5PAYT3\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\HLKS089Y\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\HLKS089Y\DevExpress.Utils.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\HOXSTFIJ\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\HOXSTFIJ\DevExpress.XtraBars.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\HP0X8V2F\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\HP0X8V2F\System.Data.SQLite.DLL
c:\users\Admin\AppData\Local\assembly\tmp\HUFXCWG1\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\HUFXCWG1\yourMail.Client.LocalStore.DLL
c:\users\Admin\AppData\Local\assembly\tmp\HXGFPIVZ\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\HXGFPIVZ\yourMail.Client.LocalStore.DLL
c:\users\Admin\AppData\Local\assembly\tmp\HZNQ4TMP\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\HZNQ4TMP\PdfSharp-WPF.DLL
c:\users\Admin\AppData\Local\assembly\tmp\HZXNZXO4\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\HZXNZXO4\PdfSharp-WPF.DLL
c:\users\Admin\AppData\Local\assembly\tmp\I43799JK\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\I43799JK\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\I5GS9C1U\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\I5GS9C1U\AddinExpress.OL.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\I7DUJQNE\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\I7DUJQNE\AddinExpress.OL.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\I9RRAMZQ\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\I9RRAMZQ\DevExpress.Utils.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\IDW2IAL3\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\IDW2IAL3\Lucene.Net.DLL
c:\users\Admin\AppData\Local\assembly\tmp\IEJ927JP\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\IEJ927JP\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\IL57ONAN\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\IL57ONAN\LogicNP.CryptoLicensing.DLL
c:\users\Admin\AppData\Local\assembly\tmp\IM8LJHED\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\IM8LJHED\AddinExpress.OL.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\IVDIYEF4\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\IVDIYEF4\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\IW29T75T\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\IW29T75T\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\IWMPFSDX\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\IWMPFSDX\yourMail.Client.LocalStore.DLL
c:\users\Admin\AppData\Local\assembly\tmp\IXIXKMAJ\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\IXIXKMAJ\DevExpress.XtraEditors.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\J0YRHZ97\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\J0YRHZ97\DevExpress.Data.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\J8FRB0LO\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\J8FRB0LO\DevExpress.XtraBars.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\JDGNK879\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\JDGNK879\Microsoft.SharePoint.Client.DLL
c:\users\Admin\AppData\Local\assembly\tmp\JMB22V1S\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\JMB22V1S\yourMail.Client.TeamStore.DLL
c:\users\Admin\AppData\Local\assembly\tmp\JNIZO3JC\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\JNIZO3JC\DevExpress.XtraBars.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\JU28PCLN\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\JU28PCLN\AddinExpress.OL.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\JV3QS9GX\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\JV3QS9GX\yourMail.Client.LocalStore.DLL
c:\users\Admin\AppData\Local\assembly\tmp\JYQ48KKE\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\JYQ48KKE\DevExpress.RichEdit.v12.2.Core.DLL
c:\users\Admin\AppData\Local\assembly\tmp\K3KGENYO\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\K3KGENYO\AddinExpress.MSO.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\KGJYPEFP\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\KGJYPEFP\Lucene.Net.DLL
c:\users\Admin\AppData\Local\assembly\tmp\KJT7RGWO\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\KJT7RGWO\DevExpress.Utils.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\KKHQ6PG6\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\KKHQ6PG6\System.Data.SQLite.DLL
c:\users\Admin\AppData\Local\assembly\tmp\KMGFS46J\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\KMGFS46J\Microsoft.SharePoint.Client.DLL
c:\users\Admin\AppData\Local\assembly\tmp\KQ5R6GR9\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\KQ5R6GR9\System.Data.SQLite.DLL
c:\users\Admin\AppData\Local\assembly\tmp\KRRBT66X\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\KRRBT66X\Lucene.Net.DLL
c:\users\Admin\AppData\Local\assembly\tmp\KS1TWMM1\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\KS1TWMM1\Lucene.Net.DLL
c:\users\Admin\AppData\Local\assembly\tmp\KUXW273K\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\KUXW273K\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\KV8HTA0Y\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\KV8HTA0Y\DevExpress.Utils.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\KXG3HS3P\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\KXG3HS3P\yourMail.Client.BusinessLogic.DLL
c:\users\Admin\AppData\Local\assembly\tmp\KXS6HLHJ\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\KXS6HLHJ\LogicNP.CryptoLicensing.DLL
c:\users\Admin\AppData\Local\assembly\tmp\KYKOBQ8K\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\KYKOBQ8K\DevExpress.Printing.v12.2.Core.DLL
c:\users\Admin\AppData\Local\assembly\tmp\L1800O0E\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\L1800O0E\yourMail.Client.LocalStore.DLL
c:\users\Admin\AppData\Local\assembly\tmp\L2PMJRDU\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\L2PMJRDU\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\L4BZ4ERQ\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\L4BZ4ERQ\yourMail.Client.UI.resources.DLL
c:\users\Admin\AppData\Local\assembly\tmp\L61BE4AL\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\L61BE4AL\yourMail.Client.TeamBusinessLogic.DLL
c:\users\Admin\AppData\Local\assembly\tmp\L6AJRSQ7\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\L6AJRSQ7\PdfSharp-WPF.DLL
c:\users\Admin\AppData\Local\assembly\tmp\L6X7K5X9\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\L6X7K5X9\PdfSharp-WPF.DLL
c:\users\Admin\AppData\Local\assembly\tmp\LCGSGN68\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\LCGSGN68\Interop.Redemption.DLL
c:\users\Admin\AppData\Local\assembly\tmp\LCWRRVI5\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\LCWRRVI5\yourMail.Client.LocalStore.DLL
c:\users\Admin\AppData\Local\assembly\tmp\LJ9N4LPC\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\LJ9N4LPC\DevExpress.RichEdit.v12.2.Core.DLL
c:\users\Admin\AppData\Local\assembly\tmp\LKA4Y66K\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\LKA4Y66K\yourMail.Client.LocalStore.DLL
c:\users\Admin\AppData\Local\assembly\tmp\LOZXYQRC\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\LOZXYQRC\DevExpress.Utils.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\LXWXV336\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\LXWXV336\Interop.Redemption.DLL
c:\users\Admin\AppData\Local\assembly\tmp\LZNO1UBS\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\LZNO1UBS\AddinExpress.MSO.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\LZYCV9LC\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\LZYCV9LC\Interop.Redemption.DLL
c:\users\Admin\AppData\Local\assembly\tmp\M36UKHPO\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\M36UKHPO\YourMailMetroSkin.DLL
c:\users\Admin\AppData\Local\assembly\tmp\M5CI1KUM\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\M5CI1KUM\DevExpress.Data.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\M7HWGKYV\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\M7HWGKYV\yourMail.Client.LocalStore.DLL
c:\users\Admin\AppData\Local\assembly\tmp\M9Q2CG5Y\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\M9Q2CG5Y\AddinExpress.MSO.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\MB5ZFG90\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\MB5ZFG90\AddinExpress.MSO.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\MCEJI3X9\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\MCEJI3X9\DevExpress.Data.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\MEYS7LLL\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\MEYS7LLL\DevExpress.Utils.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\MHQAMRBS\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\MHQAMRBS\AddinExpress.OL.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\MKOTN4OK\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\MKOTN4OK\DevExpress.Utils.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\MMSZGEG8\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\MMSZGEG8\Lucene.Net.DLL
c:\users\Admin\AppData\Local\assembly\tmp\MN9C5L70\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\MN9C5L70\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\MXJYPMVL\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\MXJYPMVL\PdfSharp-WPF.DLL
c:\users\Admin\AppData\Local\assembly\tmp\MZ8QHHN8\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\MZ8QHHN8\DevExpress.XtraBars.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\N335013C\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\N335013C\DevExpress.XtraGrid.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\N3XIRRNP\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\N3XIRRNP\log4net.DLL
c:\users\Admin\AppData\Local\assembly\tmp\N46117BO\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\N46117BO\DevExpress.Data.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\N6POGPWZ\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\N6POGPWZ\Microsoft.SharePoint.Client.DLL
c:\users\Admin\AppData\Local\assembly\tmp\N799WWDC\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\N799WWDC\HtmlAgilityPack.DLL
c:\users\Admin\AppData\Local\assembly\tmp\N8DL9EHR\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\N8DL9EHR\yourMail.Common.DLL
c:\users\Admin\AppData\Local\assembly\tmp\NEHQOGLV\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\NEHQOGLV\DevExpress.XtraBars.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\NEJ89626\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\NEJ89626\DevExpress.XtraRichEdit.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\NITH4G4O\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\NITH4G4O\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\NLIPBKO3\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\NLIPBKO3\DevExpress.XtraEditors.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\NN4US37H\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\NN4US37H\DevExpress.Data.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\NNLSGP0M\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\NNLSGP0M\DevExpress.XtraTreeList.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\NRJZX8FY\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\NRJZX8FY\DevExpress.XtraLayout.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\NSM1DZZS\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\NSM1DZZS\DevExpress.Utils.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\O42FQKO6\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\O42FQKO6\DevExpress.XtraRichEdit.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\O650S1WB\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\O650S1WB\DevExpress.Data.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\OAYE6J1V\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\OAYE6J1V\DevExpress.Utils.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\ODGIIQJ2\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\ODGIIQJ2\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\OFUIKS7S\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\OHFF4AR0\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\OHFF4AR0\DevExpress.Data.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\OOVLMASJ\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\OOVLMASJ\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\OP0T6XNY\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\OP0T6XNY\yourMail.Client.UI.resources.DLL
c:\users\Admin\AppData\Local\assembly\tmp\OP44XWU4\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\OP44XWU4\AddinExpress.MSO.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\OX850J3R\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\OX850J3R\yourMail.Common.DLL
c:\users\Admin\AppData\Local\assembly\tmp\OZ6DCAV6\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\OZ6DCAV6\DevExpress.Data.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\P1LUS3X9\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\P1LUS3X9\AddinExpress.OL.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\P7K1T36U\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\P7K1T36U\yourMail.Common.DLL
c:\users\Admin\AppData\Local\assembly\tmp\PK1UJOJX\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\PK1UJOJX\AddinExpress.MSO.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\PL97WPXE\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\PL97WPXE\DevExpress.XtraBars.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\PNR9K3RF\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\PNR9K3RF\Lucene.Net.DLL
c:\users\Admin\AppData\Local\assembly\tmp\POCFFBM9\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\POCFFBM9\DevExpress.XtraBars.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\POWDKR17\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\POWDKR17\yourMail.Client.TeamBusinessLogic.DLL
c:\users\Admin\AppData\Local\assembly\tmp\PPK6CFMK\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\PPK6CFMK\YourMailMetroSkin.DLL
c:\users\Admin\AppData\Local\assembly\tmp\PPQKH495\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\PPQKH495\DevExpress.XtraBars.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\PTZG0D0C\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\PTZG0D0C\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\PVICPKCA\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\PVICPKCA\Microsoft.SharePoint.Client.DLL
c:\users\Admin\AppData\Local\assembly\tmp\PWGJOZ0A\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\PWGJOZ0A\yourMail.Client.BusinessLogic.DLL
c:\users\Admin\AppData\Local\assembly\tmp\Q3ZXPVO9\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\Q3ZXPVO9\DevExpress.XtraLayout.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\Q47NG3GB\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\Q47NG3GB\Interop.Redemption.DLL
c:\users\Admin\AppData\Local\assembly\tmp\Q7Z993WE\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\Q7Z993WE\DevExpress.XtraBars.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\QA1CM2Z7\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\QA1CM2Z7\AddinExpress.MSO.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\QB6GMQDA\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\QB6GMQDA\yourMail.Client.LocalStore.DLL
c:\users\Admin\AppData\Local\assembly\tmp\QBHWCLK1\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\QBHWCLK1\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\QBSSLIZU\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\QBSSLIZU\DevExpress.XtraEditors.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\QBTO24LU\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\QBTO24LU\YourMailMetroSkin.DLL
c:\users\Admin\AppData\Local\assembly\tmp\QD07SYWS\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\QD07SYWS\AddinExpress.MSO.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\QG1H3LOR\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\QG1H3LOR\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\QIDHPK3C\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\QIDHPK3C\DevExpress.RichEdit.v12.2.Core.DLL
c:\users\Admin\AppData\Local\assembly\tmp\QM3Y64Y4\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\QM3Y64Y4\yourMail.Client.UI.resources.DLL
c:\users\Admin\AppData\Local\assembly\tmp\QTXLMVL0\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\QTXLMVL0\DevExpress.Utils.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\QZSQGD9F\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\QZSQGD9F\DevExpress.XtraEditors.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\R1O7PNGC\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\R1O7PNGC\DevExpress.XtraEditors.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\RDYIOEKT\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\RDYIOEKT\DevExpress.XtraBars.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\RI81GHDU\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\RI81GHDU\DevExpress.XtraTreeList.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\RKIFF7VN\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\RKIFF7VN\ICSharpCode.SharpZipLib.DLL
c:\users\Admin\AppData\Local\assembly\tmp\RMRY77BH\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\RMRY77BH\AddinExpress.MSO.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\RMYTW89Q\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\RMYTW89Q\YourMailMetroSkin.DLL
c:\users\Admin\AppData\Local\assembly\tmp\RQ8SQRI3\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\RQ8SQRI3\DevExpress.Office.v12.2.Core.DLL
c:\users\Admin\AppData\Local\assembly\tmp\RQO39BMH\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\RQO39BMH\DevExpress.XtraBars.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\RQQ9N2S6\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\RQQ9N2S6\DevExpress.Utils.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\RS85W7MU\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\RS85W7MU\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\RX712BE8\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\RX712BE8\LogicNP.CryptoLicensing.DLL
c:\users\Admin\AppData\Local\assembly\tmp\S16STBFU\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\S16STBFU\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\S1GHY36T\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\S1GHY36T\DevExpress.Utils.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\S3G0QMEL\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\S3G0QMEL\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\S4TD3ID4\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\S4TD3ID4\AddinExpress.OL.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\S7UAI9TT\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\S7UAI9TT\AddinExpress.OL.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\SD2ADHZ4\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\SD2ADHZ4\DevExpress.XtraBars.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\SKI2NW6V\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\SKI2NW6V\DevExpress.XtraLayout.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\SNCQ2NC3\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\SNCQ2NC3\DevExpress.XtraGrid.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\SSIF93NA\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\SSIF93NA\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\SZ7AYZ0G\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\SZ7AYZ0G\AddinExpress.OL.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\T4A1QM0R\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\T4A1QM0R\yourMail.Client.UI.resources.DLL
c:\users\Admin\AppData\Local\assembly\tmp\T9AG0L4N\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\T9AG0L4N\AddinExpress.OL.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\TA3YBOTW\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\TA3YBOTW\yourMail.Common.DLL
c:\users\Admin\AppData\Local\assembly\tmp\TIXIPYLC\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\TIXIPYLC\DevExpress.XtraLayout.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\TK14HDBJ\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\TK14HDBJ\DevExpress.XtraLayout.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\TKSDHL0X\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\TKSDHL0X\Lucene.Net.DLL
c:\users\Admin\AppData\Local\assembly\tmp\TQVHE83C\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\TQVHE83C\DevExpress.Data.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\TQWXWVGR\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\TQWXWVGR\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\TRZN2E77\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\TRZN2E77\DevExpress.XtraEditors.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\TV2J4M72\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\TV2J4M72\yourMail.Client.UI.resources.DLL
c:\users\Admin\AppData\Local\assembly\tmp\TZJDEOZH\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\TZJDEOZH\System.Data.SQLite.DLL
c:\users\Admin\AppData\Local\assembly\tmp\U0S2J4AE\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\U0S2J4AE\DevExpress.XtraLayout.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\U8QU2JPJ\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\U8QU2JPJ\DevExpress.Printing.v12.2.Core.DLL
c:\users\Admin\AppData\Local\assembly\tmp\UDQ9J3GN\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\UDQ9J3GN\Interop.Redemption.DLL
c:\users\Admin\AppData\Local\assembly\tmp\UGTUC5UP\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\UGTUC5UP\Lucene.Net.DLL
c:\users\Admin\AppData\Local\assembly\tmp\UHDURG79\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\UHDURG79\yourMail.Client.UI.resources.DLL
c:\users\Admin\AppData\Local\assembly\tmp\UHGEZTIL\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\UHGEZTIL\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\UJNA38F9\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\UJNA38F9\AddinExpress.MSO.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\UODTD17L\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\UODTD17L\AddinExpress.OL.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\UP86O7VT\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\UP86O7VT\DevExpress.Data.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\UWCCQT7Q\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\UWCCQT7Q\AddinExpress.OL.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\UWTHQMGS\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\UWTHQMGS\Lucene.Net.DLL
c:\users\Admin\AppData\Local\assembly\tmp\UZK7WEI1\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\UZK7WEI1\DevExpress.Utils.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\V01IOHRT\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\V01IOHRT\DevExpress.Utils.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\V32FEWT0\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\V32FEWT0\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\V95FYU6V\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\V95FYU6V\yourMail.Client.TeamStore.DLL
c:\users\Admin\AppData\Local\assembly\tmp\VFG8L427\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\VFG8L427\Lucene.Net.DLL
c:\users\Admin\AppData\Local\assembly\tmp\VHEQYW1I\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\VHEQYW1I\PdfSharp-WPF.DLL
c:\users\Admin\AppData\Local\assembly\tmp\VJ3CSPAM\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\VJ3CSPAM\AddinExpress.OL.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\VN899DI5\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\VN899DI5\DevExpress.Data.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\VUI212B6\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\VUI212B6\AddinExpress.OL.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\W8BG7BDG\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\W8BG7BDG\DevExpress.XtraEditors.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\WA2BSSM0\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\WA2BSSM0\DevExpress.XtraTreeList.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\WJCT1O5K\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\WJCT1O5K\Interop.Redemption.DLL
c:\users\Admin\AppData\Local\assembly\tmp\WSBGNXER\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\WSBGNXER\yourMail.Common.DLL
c:\users\Admin\AppData\Local\assembly\tmp\WZC015ED\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\WZC015ED\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\X3GMCLIT\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\X3GMCLIT\PdfSharp-WPF.DLL
c:\users\Admin\AppData\Local\assembly\tmp\X69OIH8Q\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\X69OIH8Q\DevExpress.Utils.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\X99QDUM1\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\X99QDUM1\System.Data.SQLite.DLL
c:\users\Admin\AppData\Local\assembly\tmp\X9VQ356S\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\X9VQ356S\DevExpress.Utils.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\XAP8NSFS\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\XAP8NSFS\DevExpress.Utils.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\XCMM330L\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\XCMM330L\DevExpress.Utils.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\XCRS2UII\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\XCRS2UII\DevExpress.XtraEditors.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\XKD79N6W\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\XKD79N6W\PdfSharp-WPF.DLL
c:\users\Admin\AppData\Local\assembly\tmp\XKPIXYUO\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\XKPIXYUO\DevExpress.Data.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\XLO3FYVJ\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\XLO3FYVJ\yourMail.Client.LocalStore.DLL
c:\users\Admin\AppData\Local\assembly\tmp\XTSIGP9E\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\XTSIGP9E\log4net.DLL
c:\users\Admin\AppData\Local\assembly\tmp\XUDVMF7C\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\XUDVMF7C\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\XXZTK8Z6\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\XXZTK8Z6\Interop.Redemption.DLL
c:\users\Admin\AppData\Local\assembly\tmp\XYBG0BKM\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\XYBG0BKM\AddinExpress.OL.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\Y8D6Z7PE\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\Y8D6Z7PE\AddinExpress.OL.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\YA6WAOLG\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\YA6WAOLG\DevExpress.XtraEditors.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\YAI1STYP\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\YAI1STYP\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\YFEBZ84S\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\YFEBZ84S\AddinExpress.OL.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\YGT0VEFA\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\YGT0VEFA\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\YHBLGMFC\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\YHBLGMFC\DevExpress.XtraBars.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\YITUTSBC\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\YITUTSBC\AddinExpress.MSO.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\YNE3Q3DH\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\YNE3Q3DH\Microsoft.SharePoint.Client.DLL
c:\users\Admin\AppData\Local\assembly\tmp\Z0CQCRZ7\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\Z0CQCRZ7\DevExpress.RichEdit.v12.2.Core.DLL
c:\users\Admin\AppData\Local\assembly\tmp\Z14F7AIC\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\Z14F7AIC\yourMail.Client.UI.DLL
c:\users\Admin\AppData\Local\assembly\tmp\Z2NHX6GK\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\Z2NHX6GK\DevExpress.XtraRichEdit.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\Z7NLY5QN\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\Z7NLY5QN\DevExpress.XtraGrid.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\Z8QR5U97\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\Z8QR5U97\log4net.DLL
c:\users\Admin\AppData\Local\assembly\tmp\Z8QVFVWU\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\Z8QVFVWU\DevExpress.RichEdit.v12.2.Core.DLL
c:\users\Admin\AppData\Local\assembly\tmp\ZI8XAH68\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\ZI8XAH68\DevExpress.XtraLayout.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\ZJATRXQG\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\ZJATRXQG\DevExpress.XtraBars.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\ZJF76JA3\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\ZJF76JA3\AddinExpress.OL.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\ZL3XBGGL\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\ZL3XBGGL\DevExpress.XtraEditors.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\ZMWJKPU9\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\ZMWJKPU9\DevExpress.Utils.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\ZP023IW4\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\ZP023IW4\AddinExpress.OL.2005.DLL
c:\users\Admin\AppData\Local\assembly\tmp\ZQ1OKU5L\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\ZQ1OKU5L\YourMailMetroSkin.DLL
c:\users\Admin\AppData\Local\assembly\tmp\ZRCM5QDB\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\ZRCM5QDB\YourMailMetroSkin.DLL
c:\users\Admin\AppData\Local\assembly\tmp\ZT73CFE6\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\ZT73CFE6\DevExpress.Data.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\ZV6P0CVK\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\ZV6P0CVK\YourMailMetroSkin.DLL
c:\users\Admin\AppData\Local\assembly\tmp\ZXKPH2F7\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\ZXKPH2F7\DevExpress.Data.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\ZXR1LZNJ\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\ZXR1LZNJ\DevExpress.XtraEditors.v12.2.DLL
c:\users\Admin\AppData\Local\assembly\tmp\ZYCMUHBC\__AssemblyInfo__.ini
c:\users\Admin\AppData\Local\assembly\tmp\ZYCMUHBC\AddinExpress.MSO.2005.DLL
c:\users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\0545F7B45A7B4420A820F73747615E31@klemmePC
c:\users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\068D6D3A935D4E28989E038B86DF9F65@klemmePC
c:\users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\29AB98FE146F44F299E231AE5CF8F5B0@klemmePC
c:\users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\339B38CA77414F5199E2135697588B85@klemmePC
c:\users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\C3515C3602AB4A41A1A7353E5DE7F1E3@klemmePC
c:\users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\image001.jpg@01CF9C2F.7B7BA350
c:\users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\image001.jpg@01CF9D0E.9CB95B90
c:\users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\image001.jpg@01CF9D19.D98DB600
c:\users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\image001.jpg@01CFB23E.0226AFC0
c:\users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\image001.jpg@01CFB23E.439553D0
c:\users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\image001.png@01CFB320.D2D47CA0
c:\users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\image002.jpg@01CFAFE5.041D89D0
c:\users\Admin\AppData\Roaming\457
c:\windows\IsUn0407.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2014-07-12 bis 2014-08-12  ))))))))))))))))))))))))))))))
.
.
2014-08-12 12:33 . 2014-08-12 12:33        --------        d-----w-        c:\users\Public\AppData\Local\temp
2014-08-12 12:33 . 2014-08-12 12:33        --------        d-----w-        c:\users\Default\AppData\Local\temp
2014-08-12 08:12 . 2014-07-14 02:12        10924376        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{CF394883-27E3-4444-8D50-C5551DFC75CF}\mpengine.dll
2014-08-07 06:34 . 2014-08-07 06:34        153712        ----a-w-        c:\windows\system32\BgGamingMonitor.dll
2014-08-07 06:34 . 2014-08-07 06:34        140280        ----a-w-        c:\windows\SysWow64\BgGamingMonitor.dll
2014-07-31 10:55 . 2014-07-31 10:55        64336        ----a-w-        c:\windows\SysWow64\BGLsp.dll
2014-07-31 10:55 . 2014-07-31 10:55        76624        ----a-w-        c:\windows\system32\BGLsp.dll
2014-07-28 18:54 . 2014-07-28 18:54        98216        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-07-28 18:54 . 2014-07-28 18:54        --------        d-----w-        c:\program files (x86)\Java
2014-07-25 15:40 . 2014-07-25 15:40        --------        d-----w-        c:\users\Admin\AppData\Roaming\23753
2014-07-25 15:34 . 2014-07-25 15:34        --------        d-----w-        c:\users\Admin\AppData\Roaming\22590
2014-07-25 14:00 . 2014-07-25 14:00        --------        d-----w-        c:\users\Admin\AppData\Local\PackageAware
2014-07-24 18:42 . 2014-07-24 18:42        --------        d-----w-        c:\windows\ERUNT
2014-07-24 18:37 . 2014-07-24 18:37        --------        d-----w-        c:\program files (x86)\VS Revo Group
2014-07-24 16:48 . 2014-01-09 02:22        5694464        ----a-w-        c:\windows\SysWow64\mstscax.dll
2014-07-24 16:48 . 2014-01-03 22:44        6574592        ----a-w-        c:\windows\system32\mstscax.dll
2014-07-24 14:27 . 2014-05-08 09:32        3178496        ----a-w-        c:\windows\system32\rdpcorets.dll
2014-07-24 14:27 . 2014-05-08 09:32        16384        ----a-w-        c:\windows\system32\RdpGroupPolicyExtension.dll
2014-07-24 14:17 . 2012-08-23 14:10        19456        ----a-w-        c:\windows\system32\drivers\rdpvideominiport.sys
2014-07-24 14:17 . 2012-08-23 14:13        243200        ----a-w-        c:\windows\system32\rdpudd.dll
2014-07-24 14:17 . 2012-08-23 11:12        192000        ----a-w-        c:\windows\SysWow64\rdpendp_winip.dll
2014-07-24 14:17 . 2012-08-23 10:51        228864        ----a-w-        c:\windows\system32\rdpendp_winip.dll
2014-07-24 13:15 . 2013-09-25 02:23        1030144        ----a-w-        c:\windows\system32\TSWorkspace.dll
2014-07-24 13:15 . 2013-09-25 01:57        792576        ----a-w-        c:\windows\SysWow64\TSWorkspace.dll
2014-07-24 12:54 . 2013-07-14 15:32        4009167        ----a-w-        C:\ServicesRepair.exe
2014-07-24 12:54 . 2014-07-24 12:35        1354223        ----a-w-        C:\AdwCleaner(17).exe
2014-07-24 12:38 . 2014-07-24 12:38        --------        d-s---w-        c:\windows\SysWow64\Microsoft
2014-07-21 18:44 . 2014-07-21 18:44        --------        d-----w-        c:\users\Admin\AppData\Roaming\ASP
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-07-09 10:29 . 2012-08-08 07:58        71344        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-07-09 10:29 . 2012-08-08 07:58        699056        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2014-07-09 09:08 . 2012-08-07 15:59        96441528        ----a-w-        c:\windows\system32\MRT.exe
2014-06-30 02:09 . 2014-07-09 06:02        519168        ----a-w-        c:\windows\system32\aepdu.dll
2014-06-30 02:04 . 2014-07-09 06:02        424448        ----a-w-        c:\windows\system32\aeinv.dll
2014-06-20 20:14 . 2014-07-09 06:02        266424        ----a-w-        c:\windows\system32\iedkcs32.dll
2014-06-19 01:39 . 2014-07-09 06:02        23464448        ----a-w-        c:\windows\system32\mshtml.dll
2014-06-19 01:06 . 2014-07-09 06:02        2724864        ----a-w-        c:\windows\system32\mshtml.tlb
2014-06-19 01:06 . 2014-07-09 06:02        4096        ----a-w-        c:\windows\system32\ieetwcollectorres.dll
2014-06-19 00:48 . 2014-07-09 06:02        2768384        ----a-w-        c:\windows\system32\iertutil.dll
2014-06-19 00:42 . 2014-07-09 06:02        548352        ----a-w-        c:\windows\system32\vbscript.dll
2014-06-19 00:42 . 2014-07-09 06:02        66048        ----a-w-        c:\windows\system32\iesetup.dll
2014-06-19 00:41 . 2014-07-09 06:02        48640        ----a-w-        c:\windows\system32\ieetwproxystub.dll
2014-06-19 00:41 . 2014-07-09 06:02        83968        ----a-w-        c:\windows\system32\MshtmlDac.dll
2014-06-19 00:32 . 2014-07-09 06:02        51200        ----a-w-        c:\windows\system32\jsproxy.dll
2014-06-19 00:31 . 2014-07-09 06:02        33792        ----a-w-        c:\windows\system32\iernonce.dll
2014-06-19 00:26 . 2014-07-09 06:02        598016        ----a-w-        c:\windows\system32\ieui.dll
2014-06-19 00:24 . 2014-07-09 06:02        139264        ----a-w-        c:\windows\system32\ieUnatt.exe
2014-06-19 00:24 . 2014-07-09 06:02        111616        ----a-w-        c:\windows\system32\ieetwcollector.exe
2014-06-19 00:23 . 2014-07-09 06:02        752640        ----a-w-        c:\windows\system32\jscript9diag.dll
2014-06-19 00:14 . 2014-07-09 06:02        940032        ----a-w-        c:\windows\system32\MsSpellCheckingFacility.exe
2014-06-19 00:09 . 2014-07-09 06:02        452608        ----a-w-        c:\windows\system32\dxtmsft.dll
2014-06-18 23:59 . 2014-07-09 06:02        38400        ----a-w-        c:\windows\system32\JavaScriptCollectionAgent.dll
2014-06-18 23:56 . 2014-07-09 06:02        2724864        ----a-w-        c:\windows\SysWow64\mshtml.tlb
2014-06-18 23:53 . 2014-07-09 06:02        195584        ----a-w-        c:\windows\system32\msrating.dll
2014-06-18 23:51 . 2014-07-09 06:02        5721088        ----a-w-        c:\windows\system32\jscript9.dll
2014-06-18 23:50 . 2014-07-09 06:02        85504        ----a-w-        c:\windows\system32\mshtmled.dll
2014-06-18 23:48 . 2014-07-09 06:02        292864        ----a-w-        c:\windows\system32\dxtrans.dll
2014-06-18 23:39 . 2014-07-09 06:02        608768        ----a-w-        c:\windows\system32\ie4uinit.exe
2014-06-18 23:38 . 2014-07-09 06:02        455168        ----a-w-        c:\windows\SysWow64\vbscript.dll
2014-06-18 23:37 . 2014-07-09 06:02        61952        ----a-w-        c:\windows\SysWow64\iesetup.dll
2014-06-18 23:36 . 2014-07-09 06:02        51200        ----a-w-        c:\windows\SysWow64\ieetwproxystub.dll
2014-06-18 23:35 . 2014-07-09 06:02        62464        ----a-w-        c:\windows\SysWow64\MshtmlDac.dll
2014-06-18 23:33 . 2014-07-09 06:02        631808        ----a-w-        c:\windows\system32\msfeeds.dll
2014-06-18 23:27 . 2014-07-09 06:02        1249280        ----a-w-        c:\windows\system32\mshtmlmedia.dll
2014-06-18 23:27 . 2014-07-09 06:02        2040832        ----a-w-        c:\windows\system32\inetcpl.cpl
2014-06-18 23:23 . 2014-07-09 06:02        112128        ----a-w-        c:\windows\SysWow64\ieUnatt.exe
2014-06-18 23:22 . 2014-07-09 06:02        592896        ----a-w-        c:\windows\SysWow64\jscript9diag.dll
2014-06-18 23:06 . 2014-07-09 06:02        32256        ----a-w-        c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2014-06-18 22:58 . 2014-07-09 06:02        2266112        ----a-w-        c:\windows\system32\wininet.dll
2014-06-18 22:52 . 2014-07-09 06:02        4254720        ----a-w-        c:\windows\SysWow64\jscript9.dll
2014-06-18 22:51 . 2014-07-09 06:02        13527040        ----a-w-        c:\windows\system32\ieframe.dll
2014-06-18 22:46 . 2014-07-09 06:02        1068032        ----a-w-        c:\windows\SysWow64\mshtmlmedia.dll
2014-06-18 22:45 . 2014-07-09 06:02        1964544        ----a-w-        c:\windows\SysWow64\inetcpl.cpl
2014-06-18 22:34 . 2014-07-09 06:02        1393664        ----a-w-        c:\windows\system32\urlmon.dll
2014-06-18 22:15 . 2014-07-09 06:02        846336        ----a-w-        c:\windows\system32\ieapfltr.dll
2014-06-18 22:13 . 2014-07-09 06:02        1791488        ----a-w-        c:\windows\SysWow64\wininet.dll
2014-06-18 02:18 . 2014-07-09 06:02        692736        ----a-w-        c:\windows\system32\osk.exe
2014-06-18 01:51 . 2014-07-09 06:02        646144        ----a-w-        c:\windows\SysWow64\osk.exe
2014-06-18 01:10 . 2014-07-09 06:02        3157504        ----a-w-        c:\windows\system32\win32k.sys
2014-06-06 10:10 . 2014-07-09 06:02        624128        ----a-w-        c:\windows\system32\qedit.dll
2014-06-06 09:44 . 2014-07-09 06:02        509440        ----a-w-        c:\windows\SysWow64\qedit.dll
2014-06-05 14:45 . 2014-07-09 06:01        1460736        ----a-w-        c:\windows\system32\lsasrv.dll
2014-06-05 14:26 . 2014-07-09 06:01        22016        ----a-w-        c:\windows\SysWow64\secur32.dll
2014-06-05 14:25 . 2014-07-09 06:01        96768        ----a-w-        c:\windows\SysWow64\sspicli.dll
2014-05-30 08:08 . 2014-07-09 06:02        210944        ----a-w-        c:\windows\system32\wdigest.dll
2014-05-30 08:08 . 2014-07-09 06:02        86528        ----a-w-        c:\windows\system32\TSpkg.dll
2014-05-30 08:08 . 2014-07-09 06:02        340992        ----a-w-        c:\windows\system32\schannel.dll
2014-05-30 08:08 . 2014-07-09 06:02        314880        ----a-w-        c:\windows\system32\msv1_0.dll
2014-05-30 08:08 . 2014-07-09 06:02        307200        ----a-w-        c:\windows\system32\ncrypt.dll
2014-05-30 08:08 . 2014-07-09 06:02        728064        ----a-w-        c:\windows\system32\kerberos.dll
2014-05-30 08:08 . 2014-07-09 06:02        22016        ----a-w-        c:\windows\system32\credssp.dll
2014-05-30 07:52 . 2014-07-09 06:02        172032        ----a-w-        c:\windows\SysWow64\wdigest.dll
2014-05-30 07:52 . 2014-07-09 06:02        65536        ----a-w-        c:\windows\SysWow64\TSpkg.dll
2014-05-30 07:52 . 2014-07-09 06:02        247808        ----a-w-        c:\windows\SysWow64\schannel.dll
2014-05-30 07:52 . 2014-07-09 06:02        220160        ----a-w-        c:\windows\SysWow64\ncrypt.dll
2014-05-30 07:52 . 2014-07-09 06:02        259584        ----a-w-        c:\windows\SysWow64\msv1_0.dll
2014-05-30 07:52 . 2014-07-09 06:02        550912        ----a-w-        c:\windows\SysWow64\kerberos.dll
2014-05-30 07:52 . 2014-07-09 06:02        17408        ----a-w-        c:\windows\SysWow64\credssp.dll
2014-05-30 06:45 . 2014-07-09 06:02        497152        ----a-w-        c:\windows\system32\drivers\afd.sys
2014-05-28 14:07 . 2014-05-19 12:16        117184        ----a-w-        c:\windows\system32\drivers\BdAgent.sys
2014-05-19 12:16 . 2013-03-18 13:25        67680        ----a-w-        c:\windows\system32\drivers\BdSpy.sys
2014-05-19 12:16 . 2012-11-20 13:11        42760        ----a-r-        c:\windows\system32\drivers\afw.sys
2014-05-19 12:16 . 2012-10-04 07:38        34896        ----a-w-        c:\windows\system32\drivers\BdNet.sys
2014-05-19 12:16 . 2012-06-26 09:48        27544        ----a-w-        c:\windows\system32\drivers\NSNetmon.sys
2014-05-19 12:16 . 2012-06-26 09:48        296368        ----a-w-        c:\windows\system32\drivers\NSKernel.sys
2014-05-19 12:16 . 2012-11-20 13:11        469256        ----a-r-        c:\windows\system32\drivers\afwcore.sys
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-05-08 21444224]
"CAHeadless"="c:\program files (x86)\Adobe\Elements 12 Organizer\CAHeadless\ElementsAutoAnalyzer.exe" [2014-05-09 1401040]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"sysTPL"="c:\program files (x86)\sysTPL\sysTPL.exe" [2014-02-07 1244440]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-08-25 98304]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2010-01-19 43632]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2014-02-21 152392]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-02-12 43848]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-12-21 959904]
.
c:\users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Evoluent Mouse Manager.lnk - c:\windows\Installer\{1DF99F8F-31BC-4058-B750-DC0C86FC0038}\_97D7716B285C2208949646.exe [2012-8-8 4286]
PhraseExpress.lnk - c:\program files (x86)\PhraseExpress\phraseexpress.exe [2012-8-9 22427944]
ProCall One.lnk - c:\program files (x86)\ESTOS\ProCall One\ECtiClientOne.exe [2013-12-16 19845120]
TK-Suite Client.lnk - c:\program files (x86)\AGFEO\Tk-Suite\tools\ctimon.exe [2013-8-20 7351928]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Das Telefonbuch Browserlösung.lnk - c:\program files (x86)\TVG\DasTelefonbuch Deutschland\http_tfd.exe [2014-4-8 20992]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\System32\BgGamingMonitor.dll c:\progra~1\BULLGU~1\BULLGU~1\Files32\BgAgent.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BsMain]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BsScanner]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 sysTPLMonitor.exe;sysTPLMonitor;c:\program files (x86)\sysTPL\sysTPLMonitor.exe;c:\program files (x86)\sysTPL\sysTPLMonitor.exe [x]
R2 sysTPLService.exe;sysTPLService;c:\program files (x86)\sysTPL\sysTPLService.exe;c:\program files (x86)\sysTPL\sysTPLService.exe [x]
R3 ATHDFU;Atheros Valkyrie USB BootROM;c:\windows\system32\Drivers\AthDfu.sys;c:\windows\SYSNATIVE\Drivers\AthDfu.sys [x]
R3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys;c:\windows\SYSNATIVE\drivers\avmeject.sys [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 fwlanusb4;FRITZ!WLAN N/G;c:\windows\system32\DRIVERS\fwlanusb4.sys;c:\windows\SYSNATIVE\DRIVERS\fwlanusb4.sys [x]
R3 hidkmdf;KMDF Driver;c:\windows\system32\DRIVERS\hidkmdf.sys;c:\windows\SYSNATIVE\DRIVERS\hidkmdf.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WacHidRouter;Wacom Hid Router;c:\windows\system32\DRIVERS\wachidrouter.sys;c:\windows\SYSNATIVE\DRIVERS\wachidrouter.sys [x]
R3 wacomrouterfilter;Wacom Router Filter Driver;c:\windows\system32\DRIVERS\wacomrouterfilter.sys;c:\windows\SYSNATIVE\DRIVERS\wacomrouterfilter.sys [x]
S0 fltsrv;Acronis Storage Filter Management;c:\windows\system32\DRIVERS\fltsrv.sys;c:\windows\SYSNATIVE\DRIVERS\fltsrv.sys [x]
S0 mv91xx;mv91xx;c:\windows\system32\DRIVERS\mv91xx.sys;c:\windows\SYSNATIVE\DRIVERS\mv91xx.sys [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S0 vidsflt67;Acronis Disk Storage Filter (67);c:\windows\system32\DRIVERS\vsflt67.sys;c:\windows\SYSNATIVE\DRIVERS\vsflt67.sys [x]
S1 AFW;Agnitum Firewall Driver;c:\windows\system32\DRIVERS\afw.sys;c:\windows\SYSNATIVE\DRIVERS\afw.sys [x]
S1 BdAgent;BullGuard Security Agent;c:\windows\system32\DRIVERS\BdAgent.sys;c:\windows\SYSNATIVE\DRIVERS\BdAgent.sys [x]
S1 BdSpy;BdSpy;c:\windows\system32\drivers\BdSpy.sys;c:\windows\SYSNATIVE\drivers\BdSpy.sys [x]
S1 NovaShieldFilterDriver;NovaShieldFilterDriver;c:\windows\system32\DRIVERS\NSKernel.sys;c:\windows\SYSNATIVE\DRIVERS\NSKernel.sys [x]
S1 NovaShieldTDIDriver;NovaShieldTDIDriver;c:\windows\system32\DRIVERS\NSNetmon.sys;c:\windows\SYSNATIVE\DRIVERS\NSNetmon.sys [x]
S2 AdobeActiveFileMonitor12.0;Adobe Active File Monitor V12;c:\program files (x86)\Adobe\Elements 12 Organizer\PhotoshopElementsFileAgent.exe;c:\program files (x86)\Adobe\Elements 12 Organizer\PhotoshopElementsFileAgent.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe;c:\program files (x86)\Bluetooth Suite\adminservice.exe [x]
S2 BsBackup;BullGuard backup service;c:\windows\System32\SvcHost.exe;c:\windows\SYSNATIVE\SvcHost.exe [x]
S2 BsBhvScan;BullGuard Behavioural Detection;c:\program files\bullguard ltd\bullguard\BullGuardBhvScanner.exe;c:\program files\bullguard ltd\bullguard\BullGuardBhvScanner.exe [x]
S2 BsCache;BullGuard CODS service;c:\windows\System32\SvcHost.exe;c:\windows\SYSNATIVE\SvcHost.exe [x]
S2 BsFileScan;BullGuard on-access service;c:\windows\System32\SvcHost.exe;c:\windows\SYSNATIVE\SvcHost.exe [x]
S2 BsFire;BullGuard firewall service;c:\windows\System32\SvcHost.exe;c:\windows\SYSNATIVE\SvcHost.exe [x]
S2 BsMailProxy;BullGuard e-mail monitoring service;c:\windows\System32\SvcHost.exe;c:\windows\SYSNATIVE\SvcHost.exe [x]
S2 BsMain;BullGuard main service;c:\windows\System32\SvcHost.exe;c:\windows\SYSNATIVE\SvcHost.exe [x]
S2 BsScanner;BullGuard scanning service;c:\program files\bullguard ltd\bullguard\BullGuardScanner.exe;c:\program files\bullguard ltd\bullguard\BullGuardScanner.exe [x]
S2 BsUpdate;BullGuard update service;c:\program files\bullguard ltd\bullguard\BullGuardUpdate.exe;c:\program files\bullguard ltd\bullguard\BullGuardUpdate.exe [x]
S2 cjpcsc;cyberJack PC/SC COM Service ;c:\windows\SysWOW64\cjpcsc.exe;c:\windows\SysWOW64\cjpcsc.exe [x]
S2 Intel® PROSet Monitoring Service;Intel® PROSet Monitoring Service;c:\windows\system32\IProsetMonitor.exe;c:\windows\SYSNATIVE\IProsetMonitor.exe [x]
S2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\SysWOW64\nlssrv32.exe;c:\windows\SysWOW64\nlssrv32.exe [x]
S2 StarMoney 9.0 OnlineUpdate;StarMoney 9.0 OnlineUpdate;c:\program files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe;c:\program files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe [x]
S2 tksock;TK-Suite Server;c:\program files (x86)\AGFEO\Tk-Suite\tkserver\tksock.exe;c:\program files (x86)\AGFEO\Tk-Suite\tkserver\tksock.exe [x]
S2 TVGOnlineUpdateSvc;TVG OnlineUpdate-Service;c:\program files (x86)\TVG\OnlineUpdate\OnlineUpdateSvc.exe;c:\program files (x86)\TVG\OnlineUpdate\OnlineUpdateSvc.exe [x]
S3 afwcore;afwcore;c:\windows\system32\DRIVERS\afwcore.sys;c:\windows\SYSNATIVE\DRIVERS\afwcore.sys [x]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys;c:\windows\SYSNATIVE\DRIVERS\asmthub3.sys [x]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys;c:\windows\SYSNATIVE\DRIVERS\asmtxhci.sys [x]
S3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_flt.sys [x]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 AVMCOWAN;AVM ISDN CoNDIS WAN CAPI Driver;c:\windows\system32\DRIVERS\AVMCOWAN.sys;c:\windows\SYSNATIVE\DRIVERS\AVMCOWAN.sys [x]
S3 BdNet;BdNet;c:\windows\system32\drivers\BdNet.sys;c:\windows\SYSNATIVE\drivers\BdNet.sys [x]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys;c:\windows\SYSNATIVE\drivers\btath_a2dp.sys [x]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys;c:\windows\SYSNATIVE\DRIVERS\btath_bus.sys [x]
S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys;c:\windows\SYSNATIVE\DRIVERS\btath_hcrp.sys [x]
S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_lwflt.sys [x]
S3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys;c:\windows\SYSNATIVE\DRIVERS\btath_rcp.sys [x]
S3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys;c:\windows\SYSNATIVE\DRIVERS\btfilter.sys [x]
S3 cjusb;REINER SCT cyberJack USB Driver;c:\windows\system32\DRIVERS\cjusb.sys;c:\windows\SYSNATIVE\DRIVERS\cjusb.sys [x]
S3 EvoMouseDriverFilterHidUsb;Evoluent Mouse Driver Filter;c:\windows\system32\DRIVERS\EvoMouseDriverFilterHidUsb.sys;c:\windows\SYSNATIVE\DRIVERS\EvoMouseDriverFilterHidUsb.sys [x]
S3 EvoMouseDriverMini;EvoMouseDriverMini;c:\windows\system32\drivers\EvoMouseDriverMini.sys;c:\windows\SYSNATIVE\drivers\EvoMouseDriverMini.sys [x]
S3 FPCIBASE;AVM FRITZ!Card PCI;c:\windows\system32\DRIVERS\fpcibase.sys;c:\windows\SYSNATIVE\DRIVERS\fpcibase.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt        REG_MULTI_SZ          hpqcxs08 hpqddsvc
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{2D46B6DC-2207-486B-B523-A557E6D54B47}]
start [BU]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-07-18 07:47        1104200        ----a-w-        c:\program files (x86)\Google\Chrome\Application\36.0.1985.125\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-08-12 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-08 10:29]
.
2014-08-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-23 09:08]
.
2014-08-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-23 09:08]
.
2014-08-12 c:\windows\Tasks\HP Photo Creations Communicator.job
- c:\programdata\HP Photo Creations\Communicator.exe [2014-05-05 08:19]
.
2014-08-08 c:\windows\Tasks\yourMail free edition Updates for Admin-PC_Admin.job
- c:\users\Admin\AppData\Local\yourTime\yourMail\components\schedule\yourMail Free Edition Updates.lnk [2013-05-20 18:51]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\BackupOverlayErr]
@="{8749448C-D907-45BF-A842-4D3898894AC8}"
[HKEY_CLASSES_ROOT\CLSID\{8749448C-D907-45BF-A842-4D3898894AC8}]
2014-07-31 10:55        315728        ----a-w-        c:\program files\BullGuard Ltd\BullGuard\BackupShellHook.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\BackupOverlayInProgress]
@="{3FFBF330-7839-476B-BE14-2C8597CE11B6}"
[HKEY_CLASSES_ROOT\CLSID\{3FFBF330-7839-476B-BE14-2C8597CE11B6}]
2014-07-31 10:55        315728        ----a-w-        c:\program files\BullGuard Ltd\BullGuard\BackupShellHook.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\BackupOverlaySynced]
@="{C62CF4DB-48CB-4B03-BFD0-30A29125FA49}"
[HKEY_CLASSES_ROOT\CLSID\{C62CF4DB-48CB-4B03-BFD0-30A29125FA49}]
2014-07-31 10:55        315728        ----a-w-        c:\program files\BullGuard Ltd\BullGuard\BackupShellHook.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BullGuardUpdate2"="c:\program files\bullguard ltd\bullguard\BullGuardUpdate2.exe" [2014-08-06 2933584]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-19 11613288]
"IntelliType Pro"="c:\program files\Microsoft Mouse and Keyboard Center\itype.exe" [2012-11-02 1464944]
"IntelliPoint"="c:\program files\Microsoft Mouse and Keyboard Center\ipoint.exe" [2012-11-02 2076272]
"BullGuard"="c:\program files\BullGuard Ltd\BullGuard\bullguard.exe" [2014-08-07 1319248]
"AtherosBtStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2010-10-27 613536]
"AthBtTray"="c:\program files (x86)\Bluetooth Suite\AthBtTray.exe" [2010-10-27 379040]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2013-06-03 472984]
"BgDelayStartup"="c:\program files\bullguard ltd\bullguard\BgDelayStartup.exe" [2014-07-31 86352]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\BgGamingMonitor.dll c:\progra~1\BULLGU~1\BULLGU~1\BgAgent.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
mDefault_Page_URL = hxxp://www.google.com
uInternet Settings,ProxyServer = http=127.0.0.1:8877
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: An SchnapperPlus senden - c:\program files (x86)\SchnapperPlus\SchnapperPlusMenu.js
IE: LastPass - file://c:\users\Admin\AppData\LocalLow\LastPass\context.html?cmd=lastpass
IE: LastPass Fill Forms - file://c:\users\Admin\AppData\LocalLow\LastPass\context.html?cmd=fillforms
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
AddRemove-TWAIN - c:\windows\IsUn0407.exe
AddRemove-MyFreeCodec - c:\program files (x86)\MyFree Codec\1.0b beta\uninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.14"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-08-12  14:34:38
ComboFix-quarantined-files.txt  2014-08-12 12:34
ComboFix2.txt  2013-07-27 18:05
.
Vor Suchlauf: 16 Verzeichnis(se), 51.002.245.120 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 50.607.427.584 Bytes frei
.
- - End Of File - - 1BE2C461AD3E6F6C6BC7685784E2F5B1
4D3FFB2728D7BB129968845914D24193


cosinus 12.08.2014 15:14

Combofix-Skript
WARNUNG für die MITLESER:
Folgendes ComboFix Skript ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

  • Lösche die vorhandene Combofix.exe von deinem Desktop und lade das Programm von folgenden Download-Spiegel neu herunter: Link
  • Speichere es erneut auf dem Desktop (nicht woanders hin, das ist wichtig)!
  • Drücke die Windows + R Taste --> notepad (hinein schreiben) --> OK
  • Kopiere nun den Text aus der folgenden Codebox komplett in das leere Textdokument.
    Code:

    Folder::
    c:\users\Admin\AppData\Roaming\23753
    c:\users\Admin\AppData\Roaming\22590

  • Speichere dies als CFScript.txt auf deinem Desktop.
  • Wichtig: Stelle deine Anti Viren Software temporär ab. Dies kann ComboFix nämlich bei der Arbeit behindern.
    Danach wieder anstellen nicht vergessen!
  • Schließe alle laufenden Programme damit ComboFix ungehindert arbeiten kann.
  • Ziehe CFScript.txt in die ComboFix.exe wie in diesem Bild:
  • Mache nichts am Computer, bewege nicht die Maus über das ComboFix-Fenster oder klicke in dieses hinein. Dies kann dazu führen, dass ComboFix sich aufhängt.
  • Wenn ComboFix fertig ist wird es ein Log erstellen: C:\ComboFix.txt
    Bitte füge es hier als Antwort (in CODE-Tags mit dem #-Button des Editors) ein.

Hinweis:
Suspect:: und Collect::
Falls im Skript diese Anweisungen enthalten sind, sollen Dateien zur Analyse eingeschickt werden. Es erscheint eine Message-Box, nachdem Combofix fertig ist. Klicke OK und folge den Aufforderungen/Anweisungen, um die Dateien hochzuladen. Teile mir unbedingt mit, ob der Upload geklappt hat!


weti 12.08.2014 15:27

Sorry Cosinus - aber FRST funzt ja nicht. Soll ich das dann mit Combofix machen?

cosinus 12.08.2014 15:27

Ups sry, bin auf den falschen Button gekommen :stirn:

Ist korrigiert

weti 12.08.2014 17:01

Kein Ssupect oder Collect enhalten, keine Datei hochgeladen. Hier der Logtext:
Code:

ComboFix 14-08-12.01 - Admin 12.08.2014  16:35:42.3.4 - x64
Microsoft Windows 7 Professional  6.1.7601.1.1252.49.1031.18.8169.5400 [GMT 2:00]
ausgeführt von:: c:\users\Admin\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\Admin\Desktop\CFScript.txt
AV: BullGuard Antivirus *Disabled/Outdated* {C3CCAC61-52F7-A056-1860-6406566E2578}
FW: BullGuard Firewall *Disabled* {FBF72D44-1898-A10E-333F-CD33A8BD6203}
SP: BullGuard Antispyware *Disabled/Outdated* {78AD4D85-74CD-AFD8-22D0-5F742DE96FC5}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Admin\AppData\Local\assembly\tmp
c:\users\Admin\AppData\Roaming\22590
c:\users\Admin\AppData\Roaming\23753
.
.
(((((((((((((((((((((((  Dateien erstellt von 2014-07-12 bis 2014-08-12  ))))))))))))))))))))))))))))))
.
.
2014-08-12 14:38 . 2014-08-12 14:38        --------        d-----w-        c:\users\Public\AppData\Local\temp
2014-08-12 14:38 . 2014-08-12 14:38        --------        d-----w-        c:\users\Default\AppData\Local\temp
2014-08-12 08:12 . 2014-07-14 02:12        10924376        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{CF394883-27E3-4444-8D50-C5551DFC75CF}\mpengine.dll
2014-08-07 06:34 . 2014-08-07 06:34        153712        ----a-w-        c:\windows\system32\BgGamingMonitor.dll
2014-08-07 06:34 . 2014-08-07 06:34        140280        ----a-w-        c:\windows\SysWow64\BgGamingMonitor.dll
2014-07-31 10:55 . 2014-07-31 10:55        64336        ----a-w-        c:\windows\SysWow64\BGLsp.dll
2014-07-31 10:55 . 2014-07-31 10:55        76624        ----a-w-        c:\windows\system32\BGLsp.dll
2014-07-28 18:54 . 2014-07-28 18:54        98216        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-07-28 18:54 . 2014-07-28 18:54        --------        d-----w-        c:\program files (x86)\Java
2014-07-25 14:00 . 2014-07-25 14:00        --------        d-----w-        c:\users\Admin\AppData\Local\PackageAware
2014-07-24 18:42 . 2014-07-24 18:42        --------        d-----w-        c:\windows\ERUNT
2014-07-24 18:37 . 2014-07-24 18:37        --------        d-----w-        c:\program files (x86)\VS Revo Group
2014-07-24 16:48 . 2014-01-09 02:22        5694464        ----a-w-        c:\windows\SysWow64\mstscax.dll
2014-07-24 16:48 . 2014-01-03 22:44        6574592        ----a-w-        c:\windows\system32\mstscax.dll
2014-07-24 14:27 . 2014-05-08 09:32        3178496        ----a-w-        c:\windows\system32\rdpcorets.dll
2014-07-24 14:27 . 2014-05-08 09:32        16384        ----a-w-        c:\windows\system32\RdpGroupPolicyExtension.dll
2014-07-24 14:17 . 2012-08-23 14:10        19456        ----a-w-        c:\windows\system32\drivers\rdpvideominiport.sys
2014-07-24 14:17 . 2012-08-23 14:13        243200        ----a-w-        c:\windows\system32\rdpudd.dll
2014-07-24 14:17 . 2012-08-23 11:12        192000        ----a-w-        c:\windows\SysWow64\rdpendp_winip.dll
2014-07-24 14:17 . 2012-08-23 10:51        228864        ----a-w-        c:\windows\system32\rdpendp_winip.dll
2014-07-24 13:15 . 2013-09-25 02:23        1030144        ----a-w-        c:\windows\system32\TSWorkspace.dll
2014-07-24 13:15 . 2013-09-25 01:57        792576        ----a-w-        c:\windows\SysWow64\TSWorkspace.dll
2014-07-24 12:54 . 2013-07-14 15:32        4009167        ----a-w-        C:\ServicesRepair.exe
2014-07-24 12:54 . 2014-07-24 12:35        1354223        ----a-w-        C:\AdwCleaner(17).exe
2014-07-24 12:38 . 2014-07-24 12:38        --------        d-s---w-        c:\windows\SysWow64\Microsoft
2014-07-21 18:44 . 2014-07-21 18:44        --------        d-----w-        c:\users\Admin\AppData\Roaming\ASP
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-07-09 10:29 . 2012-08-08 07:58        71344        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-07-09 10:29 . 2012-08-08 07:58        699056        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2014-07-09 09:08 . 2012-08-07 15:59        96441528        ----a-w-        c:\windows\system32\MRT.exe
2014-06-30 02:09 . 2014-07-09 06:02        519168        ----a-w-        c:\windows\system32\aepdu.dll
2014-06-30 02:04 . 2014-07-09 06:02        424448        ----a-w-        c:\windows\system32\aeinv.dll
2014-06-20 20:14 . 2014-07-09 06:02        266424        ----a-w-        c:\windows\system32\iedkcs32.dll
2014-06-19 01:39 . 2014-07-09 06:02        23464448        ----a-w-        c:\windows\system32\mshtml.dll
2014-06-19 01:06 . 2014-07-09 06:02        2724864        ----a-w-        c:\windows\system32\mshtml.tlb
2014-06-19 01:06 . 2014-07-09 06:02        4096        ----a-w-        c:\windows\system32\ieetwcollectorres.dll
2014-06-19 00:48 . 2014-07-09 06:02        2768384        ----a-w-        c:\windows\system32\iertutil.dll
2014-06-19 00:42 . 2014-07-09 06:02        548352        ----a-w-        c:\windows\system32\vbscript.dll
2014-06-19 00:42 . 2014-07-09 06:02        66048        ----a-w-        c:\windows\system32\iesetup.dll
2014-06-19 00:41 . 2014-07-09 06:02        48640        ----a-w-        c:\windows\system32\ieetwproxystub.dll
2014-06-19 00:41 . 2014-07-09 06:02        83968        ----a-w-        c:\windows\system32\MshtmlDac.dll
2014-06-19 00:32 . 2014-07-09 06:02        51200        ----a-w-        c:\windows\system32\jsproxy.dll
2014-06-19 00:31 . 2014-07-09 06:02        33792        ----a-w-        c:\windows\system32\iernonce.dll
2014-06-19 00:26 . 2014-07-09 06:02        598016        ----a-w-        c:\windows\system32\ieui.dll
2014-06-19 00:24 . 2014-07-09 06:02        139264        ----a-w-        c:\windows\system32\ieUnatt.exe
2014-06-19 00:24 . 2014-07-09 06:02        111616        ----a-w-        c:\windows\system32\ieetwcollector.exe
2014-06-19 00:23 . 2014-07-09 06:02        752640        ----a-w-        c:\windows\system32\jscript9diag.dll
2014-06-19 00:14 . 2014-07-09 06:02        940032        ----a-w-        c:\windows\system32\MsSpellCheckingFacility.exe
2014-06-19 00:09 . 2014-07-09 06:02        452608        ----a-w-        c:\windows\system32\dxtmsft.dll
2014-06-18 23:59 . 2014-07-09 06:02        38400        ----a-w-        c:\windows\system32\JavaScriptCollectionAgent.dll
2014-06-18 23:56 . 2014-07-09 06:02        2724864        ----a-w-        c:\windows\SysWow64\mshtml.tlb
2014-06-18 23:53 . 2014-07-09 06:02        195584        ----a-w-        c:\windows\system32\msrating.dll
2014-06-18 23:51 . 2014-07-09 06:02        5721088        ----a-w-        c:\windows\system32\jscript9.dll
2014-06-18 23:50 . 2014-07-09 06:02        85504        ----a-w-        c:\windows\system32\mshtmled.dll
2014-06-18 23:48 . 2014-07-09 06:02        292864        ----a-w-        c:\windows\system32\dxtrans.dll
2014-06-18 23:39 . 2014-07-09 06:02        608768        ----a-w-        c:\windows\system32\ie4uinit.exe
2014-06-18 23:38 . 2014-07-09 06:02        455168        ----a-w-        c:\windows\SysWow64\vbscript.dll
2014-06-18 23:37 . 2014-07-09 06:02        61952        ----a-w-        c:\windows\SysWow64\iesetup.dll
2014-06-18 23:36 . 2014-07-09 06:02        51200        ----a-w-        c:\windows\SysWow64\ieetwproxystub.dll
2014-06-18 23:35 . 2014-07-09 06:02        62464        ----a-w-        c:\windows\SysWow64\MshtmlDac.dll
2014-06-18 23:33 . 2014-07-09 06:02        631808        ----a-w-        c:\windows\system32\msfeeds.dll
2014-06-18 23:27 . 2014-07-09 06:02        1249280        ----a-w-        c:\windows\system32\mshtmlmedia.dll
2014-06-18 23:27 . 2014-07-09 06:02        2040832        ----a-w-        c:\windows\system32\inetcpl.cpl
2014-06-18 23:23 . 2014-07-09 06:02        112128        ----a-w-        c:\windows\SysWow64\ieUnatt.exe
2014-06-18 23:22 . 2014-07-09 06:02        592896        ----a-w-        c:\windows\SysWow64\jscript9diag.dll
2014-06-18 23:06 . 2014-07-09 06:02        32256        ----a-w-        c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2014-06-18 22:58 . 2014-07-09 06:02        2266112        ----a-w-        c:\windows\system32\wininet.dll
2014-06-18 22:52 . 2014-07-09 06:02        4254720        ----a-w-        c:\windows\SysWow64\jscript9.dll
2014-06-18 22:51 . 2014-07-09 06:02        13527040        ----a-w-        c:\windows\system32\ieframe.dll
2014-06-18 22:46 . 2014-07-09 06:02        1068032        ----a-w-        c:\windows\SysWow64\mshtmlmedia.dll
2014-06-18 22:45 . 2014-07-09 06:02        1964544        ----a-w-        c:\windows\SysWow64\inetcpl.cpl
2014-06-18 22:34 . 2014-07-09 06:02        1393664        ----a-w-        c:\windows\system32\urlmon.dll
2014-06-18 22:15 . 2014-07-09 06:02        846336        ----a-w-        c:\windows\system32\ieapfltr.dll
2014-06-18 22:13 . 2014-07-09 06:02        1791488        ----a-w-        c:\windows\SysWow64\wininet.dll
2014-06-18 02:18 . 2014-07-09 06:02        692736        ----a-w-        c:\windows\system32\osk.exe
2014-06-18 01:51 . 2014-07-09 06:02        646144        ----a-w-        c:\windows\SysWow64\osk.exe
2014-06-18 01:10 . 2014-07-09 06:02        3157504        ----a-w-        c:\windows\system32\win32k.sys
2014-06-06 10:10 . 2014-07-09 06:02        624128        ----a-w-        c:\windows\system32\qedit.dll
2014-06-06 09:44 . 2014-07-09 06:02        509440        ----a-w-        c:\windows\SysWow64\qedit.dll
2014-06-05 14:45 . 2014-07-09 06:01        1460736        ----a-w-        c:\windows\system32\lsasrv.dll
2014-06-05 14:26 . 2014-07-09 06:01        22016        ----a-w-        c:\windows\SysWow64\secur32.dll
2014-06-05 14:25 . 2014-07-09 06:01        96768        ----a-w-        c:\windows\SysWow64\sspicli.dll
2014-05-30 08:08 . 2014-07-09 06:02        210944        ----a-w-        c:\windows\system32\wdigest.dll
2014-05-30 08:08 . 2014-07-09 06:02        86528        ----a-w-        c:\windows\system32\TSpkg.dll
2014-05-30 08:08 . 2014-07-09 06:02        340992        ----a-w-        c:\windows\system32\schannel.dll
2014-05-30 08:08 . 2014-07-09 06:02        314880        ----a-w-        c:\windows\system32\msv1_0.dll
2014-05-30 08:08 . 2014-07-09 06:02        307200        ----a-w-        c:\windows\system32\ncrypt.dll
2014-05-30 08:08 . 2014-07-09 06:02        728064        ----a-w-        c:\windows\system32\kerberos.dll
2014-05-30 08:08 . 2014-07-09 06:02        22016        ----a-w-        c:\windows\system32\credssp.dll
2014-05-30 07:52 . 2014-07-09 06:02        172032        ----a-w-        c:\windows\SysWow64\wdigest.dll
2014-05-30 07:52 . 2014-07-09 06:02        65536        ----a-w-        c:\windows\SysWow64\TSpkg.dll
2014-05-30 07:52 . 2014-07-09 06:02        247808        ----a-w-        c:\windows\SysWow64\schannel.dll
2014-05-30 07:52 . 2014-07-09 06:02        220160        ----a-w-        c:\windows\SysWow64\ncrypt.dll
2014-05-30 07:52 . 2014-07-09 06:02        259584        ----a-w-        c:\windows\SysWow64\msv1_0.dll
2014-05-30 07:52 . 2014-07-09 06:02        550912        ----a-w-        c:\windows\SysWow64\kerberos.dll
2014-05-30 07:52 . 2014-07-09 06:02        17408        ----a-w-        c:\windows\SysWow64\credssp.dll
2014-05-30 06:45 . 2014-07-09 06:02        497152        ----a-w-        c:\windows\system32\drivers\afd.sys
2014-05-28 14:07 . 2014-05-19 12:16        117184        ----a-w-        c:\windows\system32\drivers\BdAgent.sys
2014-05-19 12:16 . 2013-03-18 13:25        67680        ----a-w-        c:\windows\system32\drivers\BdSpy.sys
2014-05-19 12:16 . 2012-11-20 13:11        42760        ----a-r-        c:\windows\system32\drivers\afw.sys
2014-05-19 12:16 . 2012-10-04 07:38        34896        ----a-w-        c:\windows\system32\drivers\BdNet.sys
2014-05-19 12:16 . 2012-06-26 09:48        27544        ----a-w-        c:\windows\system32\drivers\NSNetmon.sys
2014-05-19 12:16 . 2012-06-26 09:48        296368        ----a-w-        c:\windows\system32\drivers\NSKernel.sys
2014-05-19 12:16 . 2012-11-20 13:11        469256        ----a-r-        c:\windows\system32\drivers\afwcore.sys
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-05-08 21444224]
"CAHeadless"="c:\program files (x86)\Adobe\Elements 12 Organizer\CAHeadless\ElementsAutoAnalyzer.exe" [2014-05-09 1401040]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"sysTPL"="c:\program files (x86)\sysTPL\sysTPL.exe" [2014-02-07 1244440]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-08-25 98304]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2010-01-19 43632]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2014-02-21 152392]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-02-12 43848]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-12-21 959904]
.
c:\users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Evoluent Mouse Manager.lnk - c:\windows\Installer\{1DF99F8F-31BC-4058-B750-DC0C86FC0038}\_97D7716B285C2208949646.exe [2012-8-8 4286]
PhraseExpress.lnk - c:\program files (x86)\PhraseExpress\phraseexpress.exe [2012-8-9 22427944]
ProCall One.lnk - c:\program files (x86)\ESTOS\ProCall One\ECtiClientOne.exe [2013-12-16 19845120]
TK-Suite Client.lnk - c:\program files (x86)\AGFEO\Tk-Suite\tools\ctimon.exe [2013-8-20 7351928]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Das Telefonbuch Browserlösung.lnk - c:\program files (x86)\TVG\DasTelefonbuch Deutschland\http_tfd.exe [2014-4-8 20992]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\System32\BgGamingMonitor.dll c:\progra~1\BULLGU~1\BULLGU~1\Files32\BgAgent.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BsMain]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BsScanner]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 sysTPLMonitor.exe;sysTPLMonitor;c:\program files (x86)\sysTPL\sysTPLMonitor.exe;c:\program files (x86)\sysTPL\sysTPLMonitor.exe [x]
R2 sysTPLService.exe;sysTPLService;c:\program files (x86)\sysTPL\sysTPLService.exe;c:\program files (x86)\sysTPL\sysTPLService.exe [x]
R3 ATHDFU;Atheros Valkyrie USB BootROM;c:\windows\system32\Drivers\AthDfu.sys;c:\windows\SYSNATIVE\Drivers\AthDfu.sys [x]
R3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys;c:\windows\SYSNATIVE\drivers\avmeject.sys [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 fwlanusb4;FRITZ!WLAN N/G;c:\windows\system32\DRIVERS\fwlanusb4.sys;c:\windows\SYSNATIVE\DRIVERS\fwlanusb4.sys [x]
R3 hidkmdf;KMDF Driver;c:\windows\system32\DRIVERS\hidkmdf.sys;c:\windows\SYSNATIVE\DRIVERS\hidkmdf.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WacHidRouter;Wacom Hid Router;c:\windows\system32\DRIVERS\wachidrouter.sys;c:\windows\SYSNATIVE\DRIVERS\wachidrouter.sys [x]
R3 wacomrouterfilter;Wacom Router Filter Driver;c:\windows\system32\DRIVERS\wacomrouterfilter.sys;c:\windows\SYSNATIVE\DRIVERS\wacomrouterfilter.sys [x]
S0 fltsrv;Acronis Storage Filter Management;c:\windows\system32\DRIVERS\fltsrv.sys;c:\windows\SYSNATIVE\DRIVERS\fltsrv.sys [x]
S0 mv91xx;mv91xx;c:\windows\system32\DRIVERS\mv91xx.sys;c:\windows\SYSNATIVE\DRIVERS\mv91xx.sys [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S0 vidsflt67;Acronis Disk Storage Filter (67);c:\windows\system32\DRIVERS\vsflt67.sys;c:\windows\SYSNATIVE\DRIVERS\vsflt67.sys [x]
S1 AFW;Agnitum Firewall Driver;c:\windows\system32\DRIVERS\afw.sys;c:\windows\SYSNATIVE\DRIVERS\afw.sys [x]
S1 BdAgent;BullGuard Security Agent;c:\windows\system32\DRIVERS\BdAgent.sys;c:\windows\SYSNATIVE\DRIVERS\BdAgent.sys [x]
S1 BdSpy;BdSpy;c:\windows\system32\drivers\BdSpy.sys;c:\windows\SYSNATIVE\drivers\BdSpy.sys [x]
S1 NovaShieldFilterDriver;NovaShieldFilterDriver;c:\windows\system32\DRIVERS\NSKernel.sys;c:\windows\SYSNATIVE\DRIVERS\NSKernel.sys [x]
S1 NovaShieldTDIDriver;NovaShieldTDIDriver;c:\windows\system32\DRIVERS\NSNetmon.sys;c:\windows\SYSNATIVE\DRIVERS\NSNetmon.sys [x]
S2 AdobeActiveFileMonitor12.0;Adobe Active File Monitor V12;c:\program files (x86)\Adobe\Elements 12 Organizer\PhotoshopElementsFileAgent.exe;c:\program files (x86)\Adobe\Elements 12 Organizer\PhotoshopElementsFileAgent.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe;c:\program files (x86)\Bluetooth Suite\adminservice.exe [x]
S2 BsBackup;BullGuard backup service;c:\windows\System32\SvcHost.exe;c:\windows\SYSNATIVE\SvcHost.exe [x]
S2 BsBhvScan;BullGuard Behavioural Detection;c:\program files\bullguard ltd\bullguard\BullGuardBhvScanner.exe;c:\program files\bullguard ltd\bullguard\BullGuardBhvScanner.exe [x]
S2 BsCache;BullGuard CODS service;c:\windows\System32\SvcHost.exe;c:\windows\SYSNATIVE\SvcHost.exe [x]
S2 BsFileScan;BullGuard on-access service;c:\windows\System32\SvcHost.exe;c:\windows\SYSNATIVE\SvcHost.exe [x]
S2 BsFire;BullGuard firewall service;c:\windows\System32\SvcHost.exe;c:\windows\SYSNATIVE\SvcHost.exe [x]
S2 BsMailProxy;BullGuard e-mail monitoring service;c:\windows\System32\SvcHost.exe;c:\windows\SYSNATIVE\SvcHost.exe [x]
S2 BsMain;BullGuard main service;c:\windows\System32\SvcHost.exe;c:\windows\SYSNATIVE\SvcHost.exe [x]
S2 BsScanner;BullGuard scanning service;c:\program files\bullguard ltd\bullguard\BullGuardScanner.exe;c:\program files\bullguard ltd\bullguard\BullGuardScanner.exe [x]
S2 BsUpdate;BullGuard update service;c:\program files\bullguard ltd\bullguard\BullGuardUpdate.exe;c:\program files\bullguard ltd\bullguard\BullGuardUpdate.exe [x]
S2 cjpcsc;cyberJack PC/SC COM Service ;c:\windows\SysWOW64\cjpcsc.exe;c:\windows\SysWOW64\cjpcsc.exe [x]
S2 Intel® PROSet Monitoring Service;Intel® PROSet Monitoring Service;c:\windows\system32\IProsetMonitor.exe;c:\windows\SYSNATIVE\IProsetMonitor.exe [x]
S2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\SysWOW64\nlssrv32.exe;c:\windows\SysWOW64\nlssrv32.exe [x]
S2 StarMoney 9.0 OnlineUpdate;StarMoney 9.0 OnlineUpdate;c:\program files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe;c:\program files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe [x]
S2 tksock;TK-Suite Server;c:\program files (x86)\AGFEO\Tk-Suite\tkserver\tksock.exe;c:\program files (x86)\AGFEO\Tk-Suite\tkserver\tksock.exe [x]
S2 TVGOnlineUpdateSvc;TVG OnlineUpdate-Service;c:\program files (x86)\TVG\OnlineUpdate\OnlineUpdateSvc.exe;c:\program files (x86)\TVG\OnlineUpdate\OnlineUpdateSvc.exe [x]
S3 afwcore;afwcore;c:\windows\system32\DRIVERS\afwcore.sys;c:\windows\SYSNATIVE\DRIVERS\afwcore.sys [x]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys;c:\windows\SYSNATIVE\DRIVERS\asmthub3.sys [x]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys;c:\windows\SYSNATIVE\DRIVERS\asmtxhci.sys [x]
S3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_flt.sys [x]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 AVMCOWAN;AVM ISDN CoNDIS WAN CAPI Driver;c:\windows\system32\DRIVERS\AVMCOWAN.sys;c:\windows\SYSNATIVE\DRIVERS\AVMCOWAN.sys [x]
S3 BdNet;BdNet;c:\windows\system32\drivers\BdNet.sys;c:\windows\SYSNATIVE\drivers\BdNet.sys [x]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys;c:\windows\SYSNATIVE\drivers\btath_a2dp.sys [x]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys;c:\windows\SYSNATIVE\DRIVERS\btath_bus.sys [x]
S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys;c:\windows\SYSNATIVE\DRIVERS\btath_hcrp.sys [x]
S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_lwflt.sys [x]
S3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys;c:\windows\SYSNATIVE\DRIVERS\btath_rcp.sys [x]
S3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys;c:\windows\SYSNATIVE\DRIVERS\btfilter.sys [x]
S3 cjusb;REINER SCT cyberJack USB Driver;c:\windows\system32\DRIVERS\cjusb.sys;c:\windows\SYSNATIVE\DRIVERS\cjusb.sys [x]
S3 EvoMouseDriverFilterHidUsb;Evoluent Mouse Driver Filter;c:\windows\system32\DRIVERS\EvoMouseDriverFilterHidUsb.sys;c:\windows\SYSNATIVE\DRIVERS\EvoMouseDriverFilterHidUsb.sys [x]
S3 EvoMouseDriverMini;EvoMouseDriverMini;c:\windows\system32\drivers\EvoMouseDriverMini.sys;c:\windows\SYSNATIVE\drivers\EvoMouseDriverMini.sys [x]
S3 FPCIBASE;AVM FRITZ!Card PCI;c:\windows\system32\DRIVERS\fpcibase.sys;c:\windows\SYSNATIVE\DRIVERS\fpcibase.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt        REG_MULTI_SZ          hpqcxs08 hpqddsvc
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{2D46B6DC-2207-486B-B523-A557E6D54B47}]
start [BU]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-07-18 07:47        1104200        ----a-w-        c:\program files (x86)\Google\Chrome\Application\36.0.1985.125\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-08-12 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-08 10:29]
.
2014-08-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-23 09:08]
.
2014-08-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-23 09:08]
.
2014-08-12 c:\windows\Tasks\HP Photo Creations Communicator.job
- c:\programdata\HP Photo Creations\Communicator.exe [2014-05-05 08:19]
.
2014-08-08 c:\windows\Tasks\yourMail free edition Updates for Admin-PC_Admin.job
- c:\users\Admin\AppData\Local\yourTime\yourMail\components\schedule\yourMail Free Edition Updates.lnk [2013-05-20 18:51]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\BackupOverlayErr]
@="{8749448C-D907-45BF-A842-4D3898894AC8}"
[HKEY_CLASSES_ROOT\CLSID\{8749448C-D907-45BF-A842-4D3898894AC8}]
2014-07-31 10:55        315728        ----a-w-        c:\program files\BullGuard Ltd\BullGuard\BackupShellHook.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\BackupOverlayInProgress]
@="{3FFBF330-7839-476B-BE14-2C8597CE11B6}"
[HKEY_CLASSES_ROOT\CLSID\{3FFBF330-7839-476B-BE14-2C8597CE11B6}]
2014-07-31 10:55        315728        ----a-w-        c:\program files\BullGuard Ltd\BullGuard\BackupShellHook.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\BackupOverlaySynced]
@="{C62CF4DB-48CB-4B03-BFD0-30A29125FA49}"
[HKEY_CLASSES_ROOT\CLSID\{C62CF4DB-48CB-4B03-BFD0-30A29125FA49}]
2014-07-31 10:55        315728        ----a-w-        c:\program files\BullGuard Ltd\BullGuard\BackupShellHook.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BullGuardUpdate2"="c:\program files\bullguard ltd\bullguard\BullGuardUpdate2.exe" [2014-08-06 2933584]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-19 11613288]
"IntelliType Pro"="c:\program files\Microsoft Mouse and Keyboard Center\itype.exe" [2012-11-02 1464944]
"IntelliPoint"="c:\program files\Microsoft Mouse and Keyboard Center\ipoint.exe" [2012-11-02 2076272]
"BullGuard"="c:\program files\BullGuard Ltd\BullGuard\bullguard.exe" [2014-08-07 1319248]
"AtherosBtStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2010-10-27 613536]
"AthBtTray"="c:\program files (x86)\Bluetooth Suite\AthBtTray.exe" [2010-10-27 379040]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2013-06-03 472984]
"BgDelayStartup"="c:\program files\bullguard ltd\bullguard\BgDelayStartup.exe" [2014-07-31 86352]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\BgGamingMonitor.dll c:\progra~1\BULLGU~1\BULLGU~1\BgAgent.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
mDefault_Page_URL = hxxp://www.google.com
uInternet Settings,ProxyServer = http=127.0.0.1:8877
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: An SchnapperPlus senden - c:\program files (x86)\SchnapperPlus\SchnapperPlusMenu.js
IE: LastPass - file://c:\users\Admin\AppData\LocalLow\LastPass\context.html?cmd=lastpass
IE: LastPass Fill Forms - file://c:\users\Admin\AppData\LocalLow\LastPass\context.html?cmd=fillforms
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
AddRemove-TWAIN - c:\windows\IsUn0407.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.14"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-08-12  16:39:50
ComboFix-quarantined-files.txt  2014-08-12 14:39
ComboFix2.txt  2014-08-12 12:34
ComboFix3.txt  2013-07-27 18:05
.
Vor Suchlauf: 17 Verzeichnis(se), 50.630.295.552 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 50.571.354.112 Bytes frei
.
- - End Of File - - 53DCB6EA6A2FE7AD67C09B188CCE7601
4D3FFB2728D7BB129968845914D24193

Hallo Cosinus,

ich habe FRST nochmal runtergeladen und jetzt funzte es. Soll ich dir diese Logdateien auch noch schicken?

cosinus 12.08.2014 18:22

Jo, die Logs wären gut

felix1 12.08.2014 18:25

Zitat:

Zitat von weti (Beitrag 1343575)
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.8169.5400 [GMT 2:00]

W7 Pro ist im Homebereich eher selten anzutreffen. Hast Du den Rechner mal in einer Dömäne angemeldet?

OT
Hallo Cosinus
Du siehst, meine Gedanken gehen in eine ganz andere Richtung :)
Nicht überall müssen Schädlinge schuld sein.
LG
/OT

cosinus 12.08.2014 19:03

Zitat:

Zitat von felix1 (Beitrag 1343679)
W7 Pro ist im Homebereich eher selten anzutreffen. Hast Du den Rechner mal in einer Dömäne angemeldet?

OT
Hallo Cosinus
Du siehst, meine Gedanken gehen in eine ganz andere Richtung :)
Nicht überall müssen Schädlinge schuld sein.
LG
/OT

Das Thema kenn ich doch ;)
Hier hab ich aber (noch) nicht drauf geschaut welche Edition von Windows genau werkelt
Natürlich hast du recht, dass nicht immer Schädlinge am Werkeln sein müssen, aber hier hatte den Verdacht wegen des nicht sich startenden FRST und dem Proxy in nur bestimmten Browsern.

weti 12.08.2014 19:48

zuerst die FRST.txt:

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-08-2014 01
Ran by Admin (administrator) on ADMIN-PC on 12-08-2014 17:56:09
Running from C:\Users\Admin\Desktop
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(AVM Berlin) C:\Program Files (x86)\avmwlanstick\WLanNetService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(BullGuard Ltd.) C:\Program Files\BullGuard Ltd\BullGuard\BullGuardBhvScanner.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(BullGuard Ltd.) C:\Program Files\BullGuard Ltd\BullGuard\BullGuardScanner.exe
(BullGuard Ltd.) C:\Program Files\BullGuard Ltd\BullGuard\BullGuardUpdate.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(REINER SCT) C:\Windows\SysWOW64\cjpcsc.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Nalpeiron Ltd.) C:\Windows\SysWOW64\nlssrv32.exe
(Star Finanz-Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe
(Evoluent) C:\Program Files\Evoluent\VMouse\EvoMouseExec.exe
(Tlapia) C:\Program Files (x86)\sysTPL\sysTPL.exe
(AGFEO      ) C:\Program Files (x86)\AGFEO\Tk-Suite\tools\ctimon.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
() C:\Program Files (x86)\WizMouse\WizMouse.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(AGFEO      ) C:\Program Files (x86)\AGFEO\Tk-Suite\tkserver\tksock.exe
() C:\Program Files (x86)\TVG\OnlineUpdate\OnlineUpdateSvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(AGFEO      ) C:\Program Files (x86)\AGFEO\Tk-Suite\tkserver\tkmedia.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 12 Organizer\PhotoshopElementsFileAgent.exe
(Opera Software) C:\Program Files (x86)\Opera\opera.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Firetrust) C:\Program Files (x86)\Firetrust\MailWasher\MailWasherPro.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
(ESTOS GmbH) C:\Program Files (x86)\ESTOS\ProCall One\ECtiClientOne.exe
(Marek Jasinski) C:\Program Files (x86)\FreeCommander XE\FreeCommander.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [BullGuardUpdate2] => c:\program files\bullguard ltd\bullguard\BullGuardUpdate2.exe [2933584 2014-08-06] (BullGuard Ltd.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11613288 2010-11-19] (Realtek Semiconductor)
HKLM\...\Run: [IntelliType Pro] => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [1464944 2012-11-02] (Microsoft Corporation)
HKLM\...\Run: [IntelliPoint] => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2076272 2012-11-02] (Microsoft Corporation)
HKLM\...\Run: [BullGuard] => C:\Program Files\BullGuard Ltd\BullGuard\bullguard.exe [1319248 2014-08-07] (BullGuard Ltd.)
HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [613536 2010-10-27] (Atheros Communications)
HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [379040 2010-10-27] (Atheros Commnucations)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472984 2013-06-03] (Adobe Systems Incorporated)
HKLM\...\Run: [BgDelayStartup] => c:\program files\bullguard ltd\bullguard\BgDelayStartup.exe [86352 2014-07-31] (BullGuard Ltd.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [sysTPL] => C:\Program Files (x86)\sysTPL\sysTPL.exe [1244440 2014-02-07] (Tlapia)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-08-25] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [JMB36X IDE Setup] => C:\Windows\RaidTool\xInsIDE.exe [43632 2010-01-19] ()
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKU\S-1-5-21-79635218-2301998975-3311727660-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.)
HKU\S-1-5-21-79635218-2301998975-3311727660-1000\...\Run: [CAHeadless] => C:\Program Files (x86)\Adobe\Elements 12 Organizer\CAHeadless\ElementsAutoAnalyzer.exe [1401040 2014-05-09] (Adobe Systems Incorporated)
AppInit_DLLs: C:\Windows\System32\BgGamingMonitor.dll => C:\Windows\System32\BgGamingMonitor.dll [153712 2014-08-07] (BullGuard Ltd.)
AppInit_DLLs:  c:\PROGRA~1\BULLGU~1\BULLGU~1\BgAgent.dll => c:\Program Files\BullGuard Ltd\BullGuard\BgAgent.dll [100656 2014-07-31] (BullGuard Ltd.)
AppInit_DLLs-x32: C:\Windows\System32\BgGamingMonitor.dll => C:\Windows\SysWOW64\BgGamingMonitor.dll [140280 2014-08-07] (BullGuard Ltd.)
AppInit_DLLs-x32:  c:\PROGRA~1\BULLGU~1\BULLGU~1\Files32\BgAgent.dll => c:\Program Files\BullGuard Ltd\BullGuard\Files32\BgAgent.dll [86200 2014-07-31] (BullGuard Ltd.)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Evoluent Mouse Manager.lnk
ShortcutTarget: Evoluent Mouse Manager.lnk -> C:\Windows\Installer\{1DF99F8F-31BC-4058-B750-DC0C86FC0038}\_97D7716B285C2208949646.exe ()
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PhraseExpress.lnk
ShortcutTarget: PhraseExpress.lnk -> C:\Program Files (x86)\PhraseExpress\phraseexpress.exe (Bartels Media GmbH)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ProCall One.lnk
ShortcutTarget: ProCall One.lnk -> C:\Program Files (x86)\ESTOS\ProCall One\ECtiClientOne.exe (ESTOS GmbH)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TK-Suite Client.lnk
ShortcutTarget: TK-Suite Client.lnk -> C:\Program Files (x86)\AGFEO\Tk-Suite\tools\ctimon.exe (AGFEO      )
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Evoluent Mouse Manager.lnk
ShortcutTarget: Evoluent Mouse Manager.lnk -> C:\Windows\Installer\{1DF99F8F-31BC-4058-B750-DC0C86FC0038}\_97D7716B285C2208949646.exe ()
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PhraseExpress.lnk
ShortcutTarget: PhraseExpress.lnk -> C:\Program Files (x86)\PhraseExpress\phraseexpress.exe (Bartels Media GmbH)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ProCall One.lnk
ShortcutTarget: ProCall One.lnk -> C:\Program Files (x86)\ESTOS\ProCall One\ECtiClientOne.exe (ESTOS GmbH)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TK-Suite Client.lnk
ShortcutTarget: TK-Suite Client.lnk -> C:\Program Files (x86)\AGFEO\Tk-Suite\tools\ctimon.exe (AGFEO      )
ShellIconOverlayIdentifiers: BackupOverlayErr -> {8749448C-D907-45BF-A842-4D3898894AC8} => C:\Program Files\BullGuard Ltd\BullGuard\BackupShellHook.dll (BullGuard Ltd.)
ShellIconOverlayIdentifiers: BackupOverlayInProgress -> {3FFBF330-7839-476B-BE14-2C8597CE11B6} => C:\Program Files\BullGuard Ltd\BullGuard\BackupShellHook.dll (BullGuard Ltd.)
ShellIconOverlayIdentifiers: BackupOverlaySynced -> {C62CF4DB-48CB-4B03-BFD0-30A29125FA49} => C:\Program Files\BullGuard Ltd\BullGuard\BackupShellHook.dll (BullGuard Ltd.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyServer: http=127.0.0.1:8877
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x954321BBB774CD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {ADF3D08D-C10A-4C0C-9AAA-3693A1221042} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKLM - {ADF3D08D-C10A-4C0C-9AAA-3693A1221042} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {ADF3D08D-C10A-4C0C-9AAA-3693A1221042} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKCU - {ADF3D08D-C10A-4C0C-9AAA-3693A1221042} URL = hxxp://www.sm.de/?q={searchTerms}
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: LastPass Vault -> {95D9ECF5-2A4D-4550-BE49-70D42F71296E} -> C:\Program Files (x86)\LastPass\LPToolbar_x64.dll ()
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: PDFXChange 4.0 IE Plugin -> {42DFA04F-0F16-418e-B80C-AB97A5AFAD39} -> C:\Program Files\Tracker Software\PDF-XChange 4\PXCIEAddin4.dll (Tracker Softaware)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: LastPass Vault -> {95D9ECF5-2A4D-4550-BE49-70D42F71296E} -> C:\Program Files (x86)\LastPass\LPToolbar.dll ()
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll ()
Toolbar: HKLM-x32 - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar.dll ()
Toolbar: HKLM-x32 - PDFXChange 4.0 IE Plugin - {42DFA04F-0F16-418e-B80C-AB97A5AFAD39} - C:\Program Files\Tracker Software\PDF-XChange 4\PXCIEAddin4.dll (Tracker Softaware)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll No File
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 -> C:\ProgramData\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin HKCU: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll No File
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default\searchplugins\acoon.xml
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default\searchplugins\search_engine.xml
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default\searchplugins\startpage-https---deutsch.xml
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default\searchplugins\wolframalpha.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: LastPass - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default\Extensions\support@lastpass.com [2014-08-12]
FF Extension: Autocopy - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default\Extensions\{0FED7D55-65D4-47b6-A6DE-9A4ADB55355F} [2013-01-07]
FF Extension: FireGestures - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default\Extensions\firegestures@xuldev.org.xpi [2012-08-09]
FF Extension: Secure Login - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default\Extensions\secureLogin@blueimp.net.xpi [2012-08-16]
FF Extension: Tile Tabs - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default\Extensions\tiletabs@DW-dev.xpi [2014-05-06]
FF Extension: BetterPrivacy - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2012-09-17]
FF HKLM-x32\...\Firefox\Extensions: [antiphishing@bullguard] - c:\program files\bullguard ltd\bullguard\Files32\Antiphishing\FF\antiphishing@bullguard
FF Extension: BullGuard Safe Browsing - c:\program files\bullguard ltd\bullguard\Files32\Antiphishing\FF\antiphishing@bullguard [2013-07-29]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-05-04]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

Chrome:
=======
CHR HomePage: hxxp://www.netvibes.com/privatepage/4#Home
CHR StartupUrls: "hxxp://blog.24stundenbetreut.com/", "chrome-extension://jkkenjlnjfemconejajakbijbheoffli/chrome/sidebar.html?v=__YOONO_BUILD__"
CHR Extension: (Google Docs) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-07-28]
CHR Extension: (Google Drive) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-07-23]
CHR Extension: (https://translate.google.de/#pl/de/Kochany%20) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkmlelhnmpnjbijdijnmagddkjnjkihn [2014-07-28]
CHR Extension: (YouTube) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-07-23]
CHR Extension: (Google-Suche) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-07-23]
CHR Extension: (Google Kalender) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjicmeblgpmajnghnpcppodonldlgfn [2014-07-28]
CHR Extension: (LastPass: Free Password Manager) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd [2014-07-28]
CHR Extension: (Yoono - Twitter, Facebook, LinkedIn, YouTube™) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jkkenjlnjfemconejajakbijbheoffli [2014-07-28]
CHR Extension: (Smooth Gestures) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfkgmnnajiljnolcgolmmgnecgldgeld [2014-07-28]
CHR Extension: (Google Maps) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lneaknkopdijkpnocmklfnjbeapigfbh [2014-07-28]
CHR Extension: (Google Wallet) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-07-23]
CHR Extension: (ImTranslator: Google Translate) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\noaijdpnepcgjemiklgfkcfbkokogabh [2014-07-28]
CHR Extension: (Picasa) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\onlgmecjpnejhfeofkgbfgnmdlipdejb [2014-07-28]
CHR Extension: (Google Mail) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-07-23]
CHR HKLM-x32\...\Chrome\Extension: [hdokiejnpimakedhajhdlcegeplioahd] - C:\Program Files (x86)\LastPass\lpchrome.crx [2012-08-28]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdobeActiveFileMonitor12.0; C:\Program Files (x86)\Adobe\Elements 12 Organizer\PhotoshopElementsFileAgent.exe [181152 2013-09-03] (Adobe Systems Incorporated)
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [52896 2010-10-27] (Atheros Commnucations) [File not signed]
R2 AVM WLAN Connection Service; C:\Program Files (x86)\avmwlanstick\WlanNetService.exe [376832 2010-10-22] (AVM Berlin) [File not signed]
R2 BsBackup; c:\program files\bullguard ltd\bullguard\BsBackup.dll [728400 2014-08-07] (BullGuard Ltd.)
R2 BsBhvScan; c:\program files\bullguard ltd\bullguard\BullGuardBhvScanner.exe [529744 2014-08-07] (BullGuard Ltd.)
R2 BsCache; c:\program files\bullguard ltd\bullguard\BsCache.dll [145744 2014-08-07] (BullGuard Ltd.)
R2 BsFileScan; c:\program files\bullguard ltd\bullguard\BsFileScan.dll [419152 2014-08-07] (BullGuard Ltd.)
R2 BsFire; c:\program files\bullguard ltd\bullguard\BsFire.dll [766800 2014-08-07] (BullGuard Ltd.)
R2 BsMailProxy; c:\program files\bullguard ltd\bullguard\BsMailProxy\BsMailProxy.dll [745296 2014-08-07] (BullGuard Ltd.)
R2 BsMain; c:\program files\bullguard ltd\bullguard\bsmain.dll [499536 2014-08-07] (BullGuard Ltd.)
R2 BsScanner; c:\program files\bullguard ltd\bullguard\BullGuardScanner.exe [273232 2014-08-07] (BullGuard Ltd.)
R2 BsUpdate; c:\program files\bullguard ltd\bullguard\BullGuardUpdate.exe [366928 2014-08-06] (BullGuard Ltd.)
R2 cjpcsc; C:\Windows\SysWOW64\cjpcsc.exe [514128 2012-03-19] (REINER SCT)
R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1039360 2010-10-22] (Hewlett-Packard Co.) [File not signed]
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
R2 StarMoney 9.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe [697488 2014-07-04] (Star Finanz-Software Entwicklung und Vertriebs GmbH)
S2 sysTPLMonitor.exe; C:\Program Files (x86)\sysTPL\sysTPLMonitor.exe [399640 2014-02-07] (Tlapia)
S2 sysTPLService.exe; C:\Program Files (x86)\sysTPL\sysTPLService.exe [397080 2013-09-29] (Tlapia)
R2 tksock; C:\Program Files (x86)\AGFEO\Tk-Suite\tkserver\tksock.exe [2220664 2013-08-20] (AGFEO      )
R2 TVGOnlineUpdateSvc; C:\Program Files (x86)\TVG\OnlineUpdate\OnlineUpdateSvc.exe [398128 2010-12-14] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 AFW; C:\Windows\System32\DRIVERS\afw.sys [42760 2014-05-19] (Agnitum Ltd.)
R3 afwcore; C:\Windows\System32\DRIVERS\afwcore.sys [469256 2014-05-19] (Agnitum Ltd.)
R3 AVMCOWAN; C:\Windows\System32\DRIVERS\AVMCOWAN.sys [79872 2009-06-10] (AVM GmbH)
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2010-10-22] (AVM Berlin)
R1 BdAgent; C:\Windows\System32\DRIVERS\BdAgent.sys [117184 2014-05-28] (BullGuard Ltd.)
R3 BdNet; C:\Windows\System32\drivers\BdNet.sys [34896 2014-05-19] (BullGuard Ltd.)
R1 BdSpy; C:\Windows\System32\drivers\BdSpy.sys [67680 2014-05-19] (BullGuard Ltd.)
R3 cjusb; C:\Windows\System32\DRIVERS\cjusb.sys [34672 2011-03-29] (REINER SCT)
R3 EvoMouseDriverFilterHidUsb; C:\Windows\System32\DRIVERS\EvoMouseDriverFilterHidUsb.sys [25656 2010-06-23] (Evoluent)
R3 EvoMouseDriverMini; C:\Windows\System32\drivers\EvoMouseDriverMini.sys [22584 2010-06-23] ()
R3 FPCIBASE; C:\Windows\System32\DRIVERS\fpcibase.sys [899328 2009-06-10] (AVM Berlin)
S3 fwlanusb4; C:\Windows\System32\DRIVERS\fwlanusb4.sys [1293824 2010-10-22] (AVM GmbH)
R1 NovaShieldFilterDriver; C:\Windows\System32\DRIVERS\NSKernel.sys [296368 2014-05-19] (BullGuard Ltd.)
R1 NovaShieldTDIDriver; C:\Windows\System32\DRIVERS\NSNetmon.sys [27544 2014-05-19] (BullGuard Ltd.)
R0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2012-08-10] (Corel Corporation)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [27520 2007-05-14] (Research In Motion Limited)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [350160 2013-01-25] (BitDefender S.R.L.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-12 17:56 - 2014-08-12 17:56 - 00028353 _____ () C:\Users\Admin\Desktop\FRST.txt
2014-08-12 17:56 - 2014-08-12 17:56 - 00000000 ____D () C:\FRST
2014-08-12 17:54 - 2014-08-12 17:54 - 02099712 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe
2014-08-12 16:48 - 2014-08-12 16:48 - 00000081 _____ () C:\Users\Admin\Desktop\bsi.txt
2014-08-12 16:39 - 2014-08-12 16:39 - 00031682 _____ () C:\ComboFix.txt
2014-08-12 16:31 - 2014-08-12 16:31 - 05569662 ____R (Swearware) C:\Users\Admin\Desktop\ComboFix.exe
2014-08-12 10:04 - 2014-08-12 10:04 - 00000512 _____ () C:\Windows\system32\F39D4DE6-98B8-4E05-91BD-549E8A8248BD
2014-08-12 10:02 - 2014-08-12 10:02 - 00000000 ___RD () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2014-08-10 18:29 - 2014-08-10 18:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-08-10 18:08 - 2014-08-10 18:08 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-08-08 08:09 - 2014-08-12 10:02 - 00000784 _____ () C:\Windows\setupact.log
2014-08-08 08:09 - 2014-08-08 08:09 - 00000468 _____ () C:\Windows\PFRO.log
2014-08-08 08:09 - 2014-08-08 08:09 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-07 08:34 - 2014-08-07 08:34 - 00153712 _____ (BullGuard Ltd.) C:\Windows\system32\BgGamingMonitor.dll
2014-08-07 08:34 - 2014-08-07 08:34 - 00140280 _____ (BullGuard Ltd.) C:\Windows\SysWOW64\BgGamingMonitor.dll
2014-07-31 12:55 - 2014-07-31 12:55 - 00076624 _____ (BullGuard Ltd.) C:\Windows\system32\BGLsp.dll
2014-07-31 12:55 - 2014-07-31 12:55 - 00064336 _____ (BullGuard Ltd.) C:\Windows\SysWOW64\BGLsp.dll
2014-07-30 20:25 - 2014-07-30 20:28 - 00000000 ____D () C:\Users\Admin\Desktop\CSV-JS
2014-07-29 10:13 - 2014-07-29 10:13 - 00000000 ___SD () C:\Users\Admin\Documents\Meine Datenquellen
2014-07-28 20:54 - 2014-07-28 20:54 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-07-28 20:54 - 2014-07-28 20:54 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-07-28 20:54 - 2014-07-28 20:54 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-07-28 20:54 - 2014-07-28 20:54 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-07-28 20:54 - 2014-07-28 20:54 - 00000000 ____D () C:\Program Files (x86)\Java
2014-07-28 09:12 - 2014-07-28 09:12 - 00000146 _____ () C:\Users\Admin\Desktop\Internetoptionen - Verknüpfung.lnk
2014-07-25 16:54 - 2014-07-25 17:38 - 00004858 _____ () C:\dvdfab_burn_vso.log
2014-07-25 16:00 - 2014-07-25 16:00 - 00000000 ____D () C:\Users\Admin\AppData\Local\PackageAware
2014-07-24 20:42 - 2014-07-24 20:42 - 00000000 ____D () C:\Windows\ERUNT
2014-07-24 20:38 - 2014-07-24 20:38 - 00003262 _____ () C:\Windows\System32\Tasks\{9ADD4159-A8BD-499E-9697-AE7AEE8E3035}
2014-07-24 20:37 - 2014-07-24 20:37 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-07-24 20:30 - 2014-08-12 17:55 - 00000000 ____D () C:\Users\Admin\Desktop\Malware
2014-07-24 18:48 - 2014-01-09 04:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-07-24 18:48 - 2014-01-04 00:44 - 06574592 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-07-24 16:27 - 2014-05-08 11:32 - 03178496 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-07-24 16:27 - 2014-05-08 11:32 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2014-07-24 16:17 - 2012-08-23 16:13 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2014-07-24 16:17 - 2012-08-23 16:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2014-07-24 16:17 - 2012-08-23 13:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll
2014-07-24 16:17 - 2012-08-23 12:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll
2014-07-24 15:52 - 2013-10-02 04:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2014-07-24 15:52 - 2013-10-02 04:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2014-07-24 15:52 - 2013-10-02 04:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2014-07-24 15:52 - 2013-10-02 03:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2014-07-24 15:52 - 2013-10-02 03:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2014-07-24 15:52 - 2013-10-02 03:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-07-24 15:52 - 2013-10-02 03:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2014-07-24 15:52 - 2013-10-02 02:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2014-07-24 15:52 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll
2014-07-24 15:52 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll
2014-07-24 15:52 - 2013-10-02 02:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2014-07-24 15:52 - 2013-10-02 02:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2014-07-24 15:52 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2014-07-24 15:52 - 2013-10-02 01:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-07-24 15:52 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2014-07-24 15:52 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-07-24 15:15 - 2013-09-25 04:23 - 01030144 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-07-24 15:15 - 2013-09-25 03:57 - 00792576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-07-24 14:54 - 2014-07-24 14:35 - 01354223 _____ () C:\AdwCleaner(17).exe
2014-07-24 14:54 - 2013-07-14 17:32 - 04009167 _____ () C:\ServicesRepair.exe
2014-07-21 20:44 - 2014-07-21 20:44 - 00003320 _____ () C:\Windows\System32\Tasks\ASP
2014-07-21 20:44 - 2014-07-21 20:44 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\ASP

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-12 17:56 - 2014-08-12 17:56 - 00028353 _____ () C:\Users\Admin\Desktop\FRST.txt
2014-08-12 17:56 - 2014-08-12 17:56 - 00000000 ____D () C:\FRST
2014-08-12 17:55 - 2014-07-24 20:30 - 00000000 ____D () C:\Users\Admin\Desktop\Malware
2014-08-12 17:55 - 2013-07-29 10:57 - 00000000 ____D () C:\ProgramData\BullGuard
2014-08-12 17:55 - 2012-08-08 17:05 - 00000224 _____ () C:\Windows\system32\config\afw_hm.conf
2014-08-12 17:55 - 2012-08-08 17:05 - 00000004 _____ () C:\Windows\system32\config\afw_db.conf
2014-08-12 17:54 - 2014-08-12 17:54 - 02099712 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe
2014-08-12 17:47 - 2012-08-23 11:08 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-12 17:29 - 2013-11-05 16:29 - 00000338 _____ () C:\Windows\Tasks\HP Photo Creations Communicator.job
2014-08-12 17:29 - 2012-08-08 09:58 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-12 17:14 - 2012-08-07 17:37 - 01905718 _____ () C:\Windows\WindowsUpdate.log
2014-08-12 16:56 - 2012-08-08 17:43 - 00000000 ____D () C:\Users\Admin\Documents\Outlook-Dateien
2014-08-12 16:48 - 2014-08-12 16:48 - 00000081 _____ () C:\Users\Admin\Desktop\bsi.txt
2014-08-12 16:39 - 2014-08-12 16:39 - 00031682 _____ () C:\ComboFix.txt
2014-08-12 16:39 - 2013-07-27 20:01 - 00000000 ____D () C:\Qoobox
2014-08-12 16:38 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-08-12 16:31 - 2014-08-12 16:31 - 05569662 ____R (Swearware) C:\Users\Admin\Desktop\ComboFix.exe
2014-08-12 14:33 - 2013-03-31 18:29 - 00000000 ____D () C:\Program Files (x86)\StarMoney 9.0
2014-08-12 14:27 - 2012-08-08 17:46 - 00000000 ____D () C:\Users\Admin\Documents\PhraseExpress
2014-08-12 14:26 - 2012-08-09 13:28 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Skype
2014-08-12 10:37 - 2009-07-14 06:45 - 00022368 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-12 10:37 - 2009-07-14 06:45 - 00022368 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-12 10:12 - 2014-06-20 07:55 - 00000000 ____D () C:\Users\Admin\AppData\Local\Adobe
2014-08-12 10:12 - 2010-11-21 08:50 - 00702942 _____ () C:\Windows\system32\perfh007.dat
2014-08-12 10:12 - 2010-11-21 08:50 - 00150582 _____ () C:\Windows\system32\perfc007.dat
2014-08-12 10:12 - 2009-07-14 07:13 - 01637932 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-12 10:04 - 2014-08-12 10:04 - 00000512 _____ () C:\Windows\system32\F39D4DE6-98B8-4E05-91BD-549E8A8248BD
2014-08-12 10:02 - 2014-08-12 10:02 - 00000000 ___RD () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2014-08-12 10:02 - 2014-08-08 08:09 - 00000784 _____ () C:\Windows\setupact.log
2014-08-12 10:02 - 2014-06-24 10:32 - 00003608 _____ () C:\Windows\System32\Tasks\WizMouse
2014-08-12 10:02 - 2012-08-23 11:08 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-12 10:02 - 2012-08-07 17:47 - 00000035 _____ () C:\Users\Public\Documents\AtherosServiceConfig.ini
2014-08-12 10:02 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-11 19:47 - 2013-04-10 10:26 - 00000000 ____D () C:\Users\Admin\~tmp
2014-08-11 18:10 - 2013-10-15 20:16 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{D781DCA7-39F3-4ADE-9B92-F10BCBB64E55}
2014-08-11 09:38 - 2012-08-09 11:12 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-08-10 19:55 - 2012-08-12 19:38 - 00000000 ____D () C:\Users\Admin\Desktop\Medien
2014-08-10 18:38 - 2014-02-07 11:59 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\vlc
2014-08-10 18:30 - 2012-12-17 18:31 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\dvdcss
2014-08-10 18:29 - 2014-08-10 18:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-08-10 18:08 - 2014-08-10 18:08 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-08-08 16:59 - 2014-07-02 21:02 - 00000000 ____D () C:\Users\Admin\Desktop\Bullguard
2014-08-08 16:23 - 2012-09-03 17:50 - 00000000 ____D () C:\Program Files (x86)\Music Wizard
2014-08-08 16:00 - 2013-05-20 17:49 - 00000000 __HDC () C:\Users\Admin\AppData\Local\{C6B707E6-325A-4AB7-BC10-1D3EB2DDFF13}
2014-08-08 16:00 - 2012-08-09 10:35 - 00000372 _____ () C:\Windows\Tasks\yourMail free edition Updates for Admin-PC_Admin.job
2014-08-08 09:14 - 2012-08-08 16:52 - 00000000 ____D () C:\Users\Admin\Desktop\Tools
2014-08-08 08:09 - 2014-08-08 08:09 - 00000468 _____ () C:\Windows\PFRO.log
2014-08-08 08:09 - 2014-08-08 08:09 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-07 20:41 - 2012-08-08 11:23 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-08-07 08:34 - 2014-08-07 08:34 - 00153712 _____ (BullGuard Ltd.) C:\Windows\system32\BgGamingMonitor.dll
2014-08-07 08:34 - 2014-08-07 08:34 - 00140280 _____ (BullGuard Ltd.) C:\Windows\SysWOW64\BgGamingMonitor.dll
2014-08-06 15:43 - 2012-12-13 20:58 - 00000000 ____D () C:\Windows\System32\Tasks\NCH Software
2014-07-31 12:55 - 2014-07-31 12:55 - 00076624 _____ (BullGuard Ltd.) C:\Windows\system32\BGLsp.dll
2014-07-31 12:55 - 2014-07-31 12:55 - 00064336 _____ (BullGuard Ltd.) C:\Windows\SysWOW64\BGLsp.dll
2014-07-30 20:28 - 2014-07-30 20:25 - 00000000 ____D () C:\Users\Admin\Desktop\CSV-JS
2014-07-29 10:13 - 2014-07-29 10:13 - 00000000 ___SD () C:\Users\Admin\Documents\Meine Datenquellen
2014-07-28 20:54 - 2014-07-28 20:54 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-07-28 20:54 - 2014-07-28 20:54 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-07-28 20:54 - 2014-07-28 20:54 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-07-28 20:54 - 2014-07-28 20:54 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-07-28 20:54 - 2014-07-28 20:54 - 00000000 ____D () C:\Program Files (x86)\Java
2014-07-28 09:12 - 2014-07-28 09:12 - 00000146 _____ () C:\Users\Admin\Desktop\Internetoptionen - Verknüpfung.lnk
2014-07-25 17:40 - 2012-08-14 16:05 - 00000000 ____D () C:\Users\Admin\Desktop\Brennen
2014-07-25 17:39 - 2014-04-01 15:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDFab 9
2014-07-25 17:39 - 2014-04-01 15:31 - 00000000 ____D () C:\Program Files (x86)\DVDFab 9
2014-07-25 17:39 - 2013-12-11 20:35 - 00000000 ____D () C:\Users\Admin\Documents\DVDFab9
2014-07-25 17:38 - 2014-07-25 16:54 - 00004858 _____ () C:\dvdfab_burn_vso.log
2014-07-25 16:00 - 2014-07-25 16:00 - 00000000 ____D () C:\Users\Admin\AppData\Local\PackageAware
2014-07-25 14:15 - 2013-10-17 18:25 - 00000076 _____ () C:\Windows\SETSCAN.INI
2014-07-25 14:00 - 2012-08-09 17:17 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\PhraseExpress
2014-07-25 10:37 - 2013-01-16 12:16 - 00000000 ____D () C:\Program Files\CCleaner
2014-07-25 09:07 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-07-25 08:13 - 2013-07-29 10:57 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\BullGuard
2014-07-24 20:42 - 2014-07-24 20:42 - 00000000 ____D () C:\Windows\ERUNT
2014-07-24 20:38 - 2014-07-24 20:38 - 00003262 _____ () C:\Windows\System32\Tasks\{9ADD4159-A8BD-499E-9697-AE7AEE8E3035}
2014-07-24 20:37 - 2014-07-24 20:37 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-07-24 16:17 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-07-24 16:15 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-07-24 15:37 - 2013-03-11 15:06 - 00000000 ____D () C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet
2014-07-24 14:40 - 2012-12-04 14:12 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-07-24 14:40 - 2012-12-04 14:12 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-07-24 14:35 - 2014-07-24 14:54 - 01354223 _____ () C:\AdwCleaner(17).exe
2014-07-24 09:52 - 2012-12-04 14:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-07-22 07:57 - 2009-07-14 06:45 - 06305968 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-21 20:51 - 2012-08-07 17:53 - 00088800 _____ () C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-21 20:44 - 2014-07-21 20:44 - 00003320 _____ () C:\Windows\System32\Tasks\ASP
2014-07-21 20:44 - 2014-07-21 20:44 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\ASP
2014-07-21 20:30 - 2012-08-13 19:48 - 00000000 ____D () C:\Users\Admin\AppData\Local\CrashDumps
2014-07-21 20:29 - 2013-04-04 20:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

Files to move or delete:
====================
C:\Users\Admin\phraseexpresssqlclientmanagersetup.exe


Some content of TEMP:
====================
C:\Users\Admin\AppData\Local\Temp\IntResource.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-07 09:00

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---


jetzt die Addition.txt:
Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-08-2014 01
Ran by Admin at 2014-08-12 17:56:26
Running from C:\Users\Admin\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: BullGuard Antivirus (Disabled - Out of date) {C3CCAC61-52F7-A056-1860-6406566E2578}
AS: BullGuard Antispyware (Disabled - Out of date) {78AD4D85-74CD-AFD8-22D0-5F742DE96FC5}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: BullGuard Firewall (Disabled) {FBF72D44-1898-A10E-333F-CD33A8BD6203}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
8000A809 (x32 Version: 140.0.000.000 - Hewlett-Packard) Hidden
8000A809_eDocs (x32 Version: 140.0.000.000 - Hewlett-Packard) Hidden
8000A809_Help (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Help Manager (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 4.0.244 - Adobe Systems Incorporated)
Adobe Help Manager (x32 Version: 4.0.244 - Adobe Systems Incorporated) Hidden
Adobe Photoshop Elements 12 (HKLM-x32\...\Adobe Photoshop Elements 12) (Version: 12.1.0.0 - Adobe Systems Incorporated)
Adobe Photoshop Elements 12 (x32 Version: 12.1.0.0 - Adobe Systems Incorporated) Hidden
Adobe Photoshop Lightroom 5.4 64-bit (HKLM\...\{558B5965-CC1B-4AF1-BA07-5D6832404050}) (Version: 5.4.0 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.07) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
AGFEO TK-Suite Server (HKLM-x32\...\tksuite_tksuite_server) (Version: 4.4.13 - AGFEO GmbH & Co. KG)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - ATI Technologies Inc.) Hidden
Apple Application Support (HKLM-x32\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Ashampoo Burning Studio 12 v.12.0.5 (HKLM-x32\...\{91B33C97-93EB-244C-F687-71D85E45A206}_is1) (Version: 12.0.5 - Ashampoo GmbH & Co. KG)
Ashampoo Slideshow Studio HD 3 v.3.0.3 (HKLM-x32\...\{91B33C97-0CE8-6ABD-1CF4-0DAF2CCF492A}_is1) (Version: 3.0.3 - Ashampoo GmbH & Co. KG)
Asmedia ASM104x USB 3.0 Host Controller Driver (HKLM-x32\...\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.4.5.0 - Asmedia Technology)
ATI AVIVO64 Codecs (Version: 11.6.0.50825 - ATI Technologies Inc.) Hidden
ATI Catalyst Install Manager (HKLM\...\{70DFF8B2-44A3-2C2C-FB21-783E8291265F}) (Version: 3.0.790.0 - ATI Technologies, Inc.)
AttachmentsManager 1.8.6 (HKLM-x32\...\AttachmentsManager_is1) (Version: 1.8.6 - EDV-Service Marchert)
AVM FRITZ!WLAN (HKLM-x32\...\AVMWLANCLI) (Version:  - AVM Berlin)
BayWotch Update v4.2.24 (HKLM-x32\...\baywotch4_is1) (Version:  - Elmar Denkmann)
bl (x32 Version: 1.0.0 - Your Company Name) Hidden
Bluetooth Win7 Suite (64) (HKLM\...\{230D1595-57DA-4933-8C4E-375797EBB7E1}) (Version: 7.2.0.40 - Atheros Communications)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
BPDSoftware (x32 Version: 140.0.000.000 - Hewlett-Packard) Hidden
BPDSoftware_Ini (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
BufferChm (x32 Version: 140.0.213.000 - Hewlett-Packard) Hidden
BullGuard (HKLM\...\BullGuard) (Version: 13.0 - BullGuard Ltd.)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2010.0825.2146.37182 - ATI) Hidden
Catalyst Control Center Graphics Previews Vista (x32 Version: 2010.0825.2146.37182 - ATI) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2010.0825.2146.37182 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2010.0825.2146.37182 - ATI) Hidden
CCC Help Chinese Standard (x32 Version: 2010.0825.2145.37182 - ATI) Hidden
CCC Help Chinese Traditional (x32 Version: 2010.0825.2145.37182 - ATI) Hidden
CCC Help Czech (x32 Version: 2010.0825.2145.37182 - ATI) Hidden
CCC Help Danish (x32 Version: 2010.0825.2145.37182 - ATI) Hidden
CCC Help Dutch (x32 Version: 2010.0825.2145.37182 - ATI) Hidden
CCC Help English (x32 Version: 2010.0825.2145.37182 - ATI) Hidden
CCC Help Finnish (x32 Version: 2010.0825.2145.37182 - ATI) Hidden
CCC Help French (x32 Version: 2010.0825.2145.37182 - ATI) Hidden
CCC Help German (x32 Version: 2010.0825.2145.37182 - ATI) Hidden
CCC Help Greek (x32 Version: 2010.0825.2145.37182 - ATI) Hidden
CCC Help Hungarian (x32 Version: 2010.0825.2145.37182 - ATI) Hidden
CCC Help Italian (x32 Version: 2010.0825.2145.37182 - ATI) Hidden
CCC Help Japanese (x32 Version: 2010.0825.2145.37182 - ATI) Hidden
CCC Help Korean (x32 Version: 2010.0825.2145.37182 - ATI) Hidden
CCC Help Norwegian (x32 Version: 2010.0825.2145.37182 - ATI) Hidden
CCC Help Polish (x32 Version: 2010.0825.2145.37182 - ATI) Hidden
CCC Help Portuguese (x32 Version: 2010.0825.2145.37182 - ATI) Hidden
CCC Help Russian (x32 Version: 2010.0825.2145.37182 - ATI) Hidden
CCC Help Spanish (x32 Version: 2010.0825.2145.37182 - ATI) Hidden
CCC Help Swedish (x32 Version: 2010.0825.2145.37182 - ATI) Hidden
CCC Help Thai (x32 Version: 2010.0825.2145.37182 - ATI) Hidden
CCC Help Turkish (x32 Version: 2010.0825.2145.37182 - ATI) Hidden
ccc-core-static (x32 Version: 2010.0825.2146.37182 - Ihr Firmenname) Hidden
ccc-utility64 (Version: 2010.0825.2146.37182 - ATI) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.16 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.2.4214 - CDBurnerXP)
CUEcards 2000 (HKLM-x32\...\CUEcards 2000) (Version:  - Marcus Humann Software-Technik)
cyberJack Base Components (HKLM-x32\...\{FC338210-F594-11D3-BA24-00001C3AB4DF}) (Version: 6.10.0 - REINER SCT)
Das Telefonbuch Deutschland (HKLM-x32\...\DasTelefonbuch Deutschland) (Version:  - TVG Telefonbuch- und Verzeichnisverlag GmbH & Co. KG)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{5C78021E-3C8E-4EDF-97EA-E9B8D808FD6D}) (Version:  - Microsoft)
DesignPro 5 (HKLM-x32\...\InstallShield_{F82C6574-AD88-4B40-A432-970BC77F1BD2}) (Version: 5.5.708 - Avery Dennison)
DesignPro 5 (x32 Version: 5.5.708 - Avery Dennison) Hidden
DeviceDiscovery (x32 Version: 140.0.213.000 - Hewlett-Packard) Hidden
DHTML Editing Component (HKLM-x32\...\{2EA870FA-585F-4187-903D-CB9FFD21E2E0}) (Version: 6.02.0001 - Microsoft Corporation)
DVD Profiler Version 3.8.2 (HKLM-x32\...\InvelosDVDProfiler_is1) (Version:  - )
DVDFab 9.1.5.9 (25/07/2014) (HKLM-x32\...\DVDFab 9_is1) (Version:  - Fengtao Software Inc.)
EASY Office (HKLM-x32\...\{079F01C3-751A-43BA-BBB6-6239D4F0F19A}) (Version: 2.10.0 - FAX.de)
Elements 12 Organizer (x32 Version: 12.0 - Ihr Firmenname) Hidden
ESTOS ProCall One (HKLM-x32\...\{1F30C083-169A-48AA-A24A-427194AEAB84}) (Version: 3.0.3.1045 - ESTOS)
Evoluent Mouse Manager (HKLM\...\{1DF99F8F-31BC-4058-B750-DC0C86FC0038}) (Version: 3.9.1 - Evoluent)
Firmen-SMS (HKLM-x32\...\{4A1946BC-2D29-40EE-9783-51150DD6F21C}) (Version: 2.4.91 - Krämer IT Solutions GmbH)
FreeCommander 2009.02b (HKLM-x32\...\FreeCommander_is1) (Version: 2009.02 - Marek Jasinski)
FreeCommander XE (HKLM-x32\...\FreeCommander XE_is1) (Version: Preview - Marek Jasinski)
FreeFileSync 6.0 (HKLM-x32\...\FreeFileSync) (Version: 6.0 - Zenju)
GO Contact Sync Mod (HKLM-x32\...\{CD178FDD-086A-4C2E-935E-8CDB747B0F29}) (Version: 3.6.1 - WebGear, Create Software, Stru.be, saller.NET)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 36.0.1985.125 - Google Inc.)
Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
GPBaseService2 (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden
HP Customer Participation Program 14.0 (HKLM\...\HPExtendedCapabilities) (Version: 14.0 - HP)
HP IDF Software (HKLM-x32\...\{974025B1-769B-49E9-817C-C638ABE8F372}) (Version: 11.15.1000 - Hewlett-Packard Company)
HP Imaging Device Functions 14.0 (HKLM\...\HP Imaging Device Functions) (Version: 14.0 - HP)
HP Officejet Pro 8000 A809 Series (HKLM\...\{A9E695CB-A6AA-4B4C-9754-BA3CFF1C3B00}) (Version: 14.0 - HP)
HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.12992 - HP)
HP Scanjet 7650 Document ISIS/TWAIN (HKLM-x32\...\HP Scanjet 7650 Document ISIS/TWAIN) (Version:  - )
HP Smart Web Printing 4.60 (HKLM\...\HP Smart Web Printing) (Version: 4.60 - HP)
HP Solution Center 14.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 14.0 - HP)
HP Update (HKLM-x32\...\{74DC0593-6BC6-4001-AD5F-D810AFB68D86}) (Version: 5.002.002.002 - Hewlett-Packard)
HPProductAssistant (x32 Version: 140.0.213.000 - Hewlett-Packard) Hidden
HPScanjet7650Corporate (HKLM-x32\...\{8A6CC564-4900-4282-8BD1-B3C419432148}) (Version: 2.20.0000 - Ihr Firmenname)
HPScanjet7650Corporate (HKLM-x32\...\{8CCA32E6-9A53-41D5-91F8-5ACF71FBEBD4}) (Version: 2.20.0000 - Ihr Firmenname)
HPSSupply (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden
HydraVision (x32 Version: 4.2.180.0 - ATI Technologies Inc.) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Network Connections 15.6.25.0 (HKLM\...\PROSetDX) (Version: 15.6.25.0 - Intel)
Intel(R) Network Connections 15.6.25.0 (Version: 15.6.25.0 - Intel) Hidden
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.37 - Irfan Skiljan)
iTunes (HKLM\...\{B8BA155B-1E75-405F-9CB4-8A99615D09DC}) (Version: 11.1.5.5 - Apple Inc.)
Java 7 Update 55 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417055FF}) (Version: 7.0.550 - Oracle)
Java 7 Update 65 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217065FF}) (Version: 7.0.650 - Oracle)
JMicron JMB36X Driver (HKLM-x32\...\{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}) (Version: 1.17.58.2 - JMicron Technology Corp.)
LastPass (uninstall only) (HKLM-x32\...\LastPass) (Version:  - LastPass)
MailWasherPro (HKLM-x32\...\{4622F96A-780B-48B8-8304-1CD8A40043E8}) (Version: 7.3.0 - Firetrust)
MailWasherPro (HKLM-x32\...\{6657DA03-A39B-472C-8458-6292E128A3D9}) (Version: 7.2.0 - Firetrust)
MarketResearch (x32 Version: 140.0.214.000 - Hewlett-Packard) Hidden
marvell 91xx driver (HKLM-x32\...\MagniDriver) (Version: 1.0.0.1045 - Marvell)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Business 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.0.162.0 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (Version: 2.0.162.0 - Microsoft Corporation) Hidden
MOBackup - Datensicherung für Outlook (Vollversion) (HKLM-x32\...\MOBackup-DatensicherungfürOutlook) (Version: 7.95 - Heiko Schröder)
Mozilla Firefox 32.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0 (x86 de)) (Version: 32.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
Music Wizard Professional 8.0.9 (HKLM-x32\...\MUSICWIZARD_is1) (Version:  - Stefan Hollesch)
myPrintMileage (Officejet Pro 8000 A809) (HKLM-x32\...\{366584A4-1D35-49B2-97B3-C803DDFCC543}) (Version: 1.00.0000 - Hewlett-Packard)
Network64 (Version: 140.0.215.000 - Hewlett-Packard) Hidden
Network64 (Version: 140.0.221.000 - Hewlett-Packard) Hidden
Opera 12.17 (HKLM-x32\...\Opera 12.17.1863) (Version: 12.17.1863 - Opera Software ASA)
PantsOff 2.0 (HKLM-x32\...\{EC1F15E1-F3CC-46EE-B7A5-849A08ED60DC}}_is1) (Version: 2.0 - Christoph Bünger Software)
Password Depot 5 (HKLM-x32\...\{66815B84-05B8-4FA3-AACA-3E7C434F78B8}_is1) (Version: 5.3.1 - AceBIT GmbH)
PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.208.0 - Tracker Software Products Ltd)
PDF-XChange Pro 4.0 (HKLM\...\{421E2E8D-F119-431D-A1F4-5F78989BEC75}) (Version: 4.197.197.0 - Tracker Software Products Ltd.)
Perfect Effects 8 (HKLM-x32\...\{C982ACFF-5997-4B7D-B3E1-CF7273A06FB2}) (Version: 8.1.0 - onOne Software)
ph (x32 Version: 1.0.0 - Your Company Name) Hidden
PhraseExpress v10.1.59 (HKLM-x32\...\PhraseExpress_is1) (Version: 10.1.59 - Bartels Media GmbH)
ProductContext (x32 Version: 140.0.000.000 - Hewlett-Packard) Hidden
PSE12 STI Installer (x32 Version: 12.0 - Adobe Systems Incorporated) Hidden
QuickScan 4.6.1 (HKLM-x32\...\{09F26C15-F1FE-4560-9AF2-41A7052B1B76}) (Version: 4.6.8372 - EMC Captiva)
QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6251 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.15.0 - SAMSUNG Electronics Co., Ltd.)
SchnapperPlus 1.9.11 (HKLM-x32\...\SchnapperPlus) (Version: 1.9.11 - Schnapper-Software Robert Beer)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version:  - Microsoft) Hidden
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 14.0 - HP)
Skype™ 6.16 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.)
SmartWebPrinting (x32 Version: 140.0.213.000 - Hewlett-Packard) Hidden
SolutionCenter (x32 Version: 140.0.214.000 - Hewlett-Packard) Hidden
StarMoney (x32 Version: 3.0.4.48 - StarFinanz) Hidden
StarMoney (x32 Version: 4.0.0.203 - StarFinanz) Hidden
StarMoney 9.0  (HKLM-x32\...\{5B4B2623-E55E-451C-B448-5761B92ADE04}) (Version: 9.0 - Star Finanz GmbH)
Startup Manager 1.5 (HKLM-x32\...\Startup Manager 1.5_is1) (Version:  - )
Status (x32 Version: 140.0.256.000 - Hewlett-Packard) Hidden
SumatraPDF (HKLM-x32\...\SumatraPDF) (Version: 2.5.2 - Krzysztof Kowalczyk)
sysTPL (HKLM-x32\...\{4B74BC31-B353-4B8F-8CBE-DAB4FF326FF1}) (Version: 1.0.0 - Tlapia) <==== ATTENTION
Textbausteinverwaltung Outlook Add-In v10.0.0 (HKLM-x32\...\Textbausteinverwaltung Outlook Add-In_is1) (Version: 10.0.0 - Bartels Media GmbH)
Toolbox (x32 Version: 140.0.428.000 - Hewlett-Packard) Hidden
TrayApp (x32 Version: 140.0.213.000 - Hewlett-Packard) Hidden
TSP7 (HKLM\...\{4E3C43BF-52C0-4FAC-8E36-E2B4872A7F4F}) (Version: 7.0.06 - AGFEO)
TSP7 (HKLM\...\{AEEC99DE-C6EA-443C-BFF5-7AB75F720BE7}) (Version: 7.0.04 - AGFEO)
Turbo Lister 2 (HKLM-x32\...\{8927E07C-97F7-4A54-88FB-D976F50DD46E}) (Version: 2.00.0000 - eBay Inc.)
Unlocker 1.9.1-x64 (HKLM\...\Unlocker) (Version: 1.9.1 - Cedrick Collomb)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version:  - Microsoft)
Update for Microsoft Excel 2010 (KB2837600) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{4ACD847E-547D-493F-9A86-F73EAE1B5174}) (Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version:  - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2825635) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{F1A20C69-9FE5-40FD-9CD5-84EABC2EF64A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2837581) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{334FB202-28D7-4BA4-8BC9-4FE4AB233EA0}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2837606) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{B0D672F7-883E-4279-8E75-D97A5445AB46}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2878252) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{B0DB9F71-E0F7-4FE6-8925-35B860CAC0C4}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2881028) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{EAD7BEF9-B28C-425F-B2C5-538CB27EF013}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2881028) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{C0BDC1DE-C35E-422B-8CBD-C1D555468720}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2881028) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{089DBFD7-8211-43B2-AAAE-5BDD8C23E3A8}) (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{40EC8FB1-5202-469D-9232-C28FB1C6FC64}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{2BA40F82-F3A4-441C-BF1A-ED4C42FF4872}) (Version:  - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version:  - Microsoft)
Update for Microsoft Visio 2010 (KB2880526) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{7B29D8B8-6A87-496C-A65E-B935E740448A}) (Version:  - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2837587) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{38CF30E4-3348-4BD1-A859-B630C355A56F}) (Version:  - Microsoft)
Update for Microsoft Word 2010 (KB2880529) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{B9B89E01-5B6B-4F73-BC34-B2C0D8ACB4CD}) (Version:  - Microsoft)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
VoiceOver Kit (HKLM-x32\...\{6B4AD1A9-E73A-4184-9D6B-072F8A3C5EBA}) (Version: 1.42.128.0 - Apple Inc.)
WebReg (x32 Version: 140.0.213.017 - Hewlett-Packard) Hidden
Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
WizMouse v1.7.0.3 (HKLM-x32\...\WizMouse_is1) (Version:  - Antibody Software)
yourMail free edition (HKCU\...\yourMail free edition) (Version: 13.1.37 - yourTime Solutions GmbH)
yourMail free edition (x32 Version: 13.1.37 - yourTime Solutions GmbH) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{0120BEF9-D180-3FFA-B803-EF7D1B3E4A4E}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{0292BF0D-D3B5-3EC1-AE7F-299E91D63287}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{056B2B25-2625-37D8-B54B-1C281EFD4BDE}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{0ABB0535-FA7C-3B83-AD58-C157D46592FA}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{0DBB2152-8146-321E-AFBF-96B3E0710D03}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{1279D0F4-C5D4-309A-ADB1-6E706CF4665E}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{144AED71-7513-36C9-9A2C-C48947FDD237}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{1549D32B-48CF-3EC9-B7DC-DD5613B62CB9}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{19FE1B34-64E9-37D8-B00B-5A3DF01F3442}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{1C88D2B1-377B-3579-AE03-469D05EA854D}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{2120FB0E-F9F5-3AFF-9F5A-E15F673F8725}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{250191BA-C4C5-33B5-843C-C03E34321763}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{261ED200-50C1-3915-996E-F5686B5452C0}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{2C9E8E7F-56BA-3D7C-9600-9BE8EF3B2617}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{36ACA068-EF97-3CBF-95C0-DA96067FB0B4}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{374D5443-D596-3E2B-A5A1-79006BE585CA}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{3789CED9-3F14-304B-970D-F38BE8ADB00F}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{388407B2-A219-3AEF-86E0-4CC8E35B6DB5}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{3A7C40AB-6839-3CE3-A763-A89D55FCC7D7}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{3C1F4A65-C8AC-3BCD-B9CD-F8F4A82CF27D}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{3C9238D3-56EF-3387-97EA-9EFDDC07DE54}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{3CA4EC05-94BE-39C1-A8B8-9670EE42DDD2}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{3E5A7E05-5230-318E-8C4D-FBCE4A4BE5C4}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{406BF0CD-E30C-34BB-92EE-BE2043B9D335}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{4311841D-D8F6-36CC-A6F7-1D8495C049DC}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{43897AE7-032A-39EF-AD07-3280A2A4E239}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{45CBF5F2-7B7C-303C-A5A1-4209E5650E02}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{4894777D-AE8C-346D-BE00-BD2A870B9F6D}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{4DD88CAA-50FA-3A12-88A0-73A7CB13C741}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{50CF5CEE-2F89-3058-B8ED-03B73287460D}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{5377B11F-255F-34F5-93E4-360A84166F71}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{5C387E9E-C7E6-3548-B0EE-72E0403DEA28}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{5F6D2F1B-AC0F-3D23-ADC9-D3805EB7B3DB}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{618D2AF3-4818-3377-ADD2-52AF733DDD28}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{6794B28C-7E32-3026-A886-354712D7B1E3}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{6F558239-7A7C-35BD-82D7-54728DA4B111}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{70439584-B32E-32FA-AAFE-683FF2E4BAA2}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{71413B42-2BC7-3BF9-970B-725151B58D51}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{78FD893E-8C4E-3601-A0AE-D95D591DCDB8}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{7D21CFD5-1B1E-3B77-90EB-5CD884DE6A5C}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{7D59FBC7-B480-385C-8B79-A14DB9627169}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{8E9B4076-E988-4ED5-9EC5-3202814D535B}\InprocServer32 -> C:\Users\Admin\AppData\Local\yourTime\yourMail\components\adxloader64.dll ()
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{8EB13808-8010-3E2C-B712-650C20D3FB22}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{8ED1BC64-F066-3AFC-80A5-6B725C9521D6}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{A6A8EFD9-8026-3E50-B8CD-B0B20CBE9766}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{A8E7D70B-7778-30EE-8750-280F88B7F206}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{B05BA62E-E406-3153-94A0-C02655698D9B}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{B2F3B90D-E351-3B8C-A2B6-E0D8F6EFA8F4}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{B529C9BF-3D8C-36CE-BC9F-7C948EF7FE70}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{B94EDB05-554D-36BC-8308-3331B2F8E3A9}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{BF7BCEFA-4E90-3597-B2DF-821EB9034307}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{BFE4DF3C-9CF1-3B16-9755-BE2A11BF4BFC}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{CEBFB8B4-7D6F-39DD-A128-7BBF2A1FD1DA}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{D127EC81-AF67-3BED-B391-A268599A0B52}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{D7F03C6C-B820-30CE-8F7F-4491A3C1F042}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{DAB9F861-6438-3544-A9BA-C34C902AE078}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{DBAF149A-3897-33BE-B82E-FFDA15FF4B8C}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{DCEDAFBB-4865-3DA0-8E79-263A6B349B7E}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{E02F2817-DA99-3750-A784-D15702DC05A4}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{E592DABA-C195-3B0B-B77E-79E807F6C2D5}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{E8C3692E-DB82-3F0D-9593-800112B4B61B}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{EFC4CBC9-9BF6-326E-851F-2CBB0E4A1465}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{F0105D64-4CD6-3FD6-A1B1-B6E57BB8A9A9}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{F40FB7C7-62E9-357A-95B5-55C1762595E6}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{F56DBDF8-437A-3458-B1E1-A52B7FC7A6BF}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{F5E65528-44E8-34E3-B131-A7FE7B20B22F}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{F8C07970-7C72-3BB2-8F2F-FF2A405E37EA}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{FB3E0669-DFF1-3AEE-AC92-E94AE298C9E7}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\CLSID\{FD07B9F9-910F-31F7-93C2-8ACDE3AA71A3}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)

==================== Restore Points  =========================

28-07-2014 18:53:56 Installed Java 7 Update 65
30-07-2014 16:41:12 Windows Update
06-08-2014 13:53:02 Windows Update
12-08-2014 08:12:25 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2014-08-12 14:33 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1      localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {263D7530-1331-48A3-ABC5-01157B3F1C1B} - System32\Tasks\SidebarExecute => C:\Program Files (x86)\Windows Sidebar\sidebar.exe [2010-11-21] (Microsoft Corporation)
Task: {368CC4E9-DFAC-48AD-BED9-DA7C2EC48040} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-07-23] (Piriform Ltd)
Task: {39B02345-F0DC-4E57-889F-F0ED949A62C2} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-09] (Adobe Systems Incorporated)
Task: {6A532441-BDE4-4107-87D0-91AFAEEFAD94} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2012-11-02] (Microsoft Corporation)
Task: {6E24544F-0CC9-4ACA-9E7A-0F329F450561} - System32\Tasks\HP Photo Creations Communicator => C:\ProgramData\HP Photo Creations\Communicator.exe [2014-05-05] ()
Task: {787E4459-3082-4ADD-9099-49FCD9B5DA6C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-08-23] (Google Inc.)
Task: {8489915A-F53B-4CF9-9905-D44A1039E31F} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {932BDFAD-3EB2-41C1-AB67-DB8F9E252FF8} - System32\Tasks\ASP => C:\Program Files (x86)\RegClean Pro\SystweakASP.exe <==== ATTENTION
Task: {B8BE736A-9E61-44BD-8302-1BBE0149EFBD} - System32\Tasks\WizMouse => C:\Program Files (x86)\WizMouse\WizMouseLaunch.exe [2013-09-22] ()
Task: {CD56A220-2DC7-4FA5-A7F7-FA99D8F8E783} - System32\Tasks\AdobeAAMUpdater-1.0-Admin-PC-Admin => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2013-06-03] (Adobe Systems Incorporated)
Task: {D6BB99C2-A0AF-46C1-9AAD-1D771052FB99} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2012-11-02] (Microsoft)
Task: {DDFE6514-1EB1-4098-9626-493488A2DE79} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-08-23] (Google Inc.)
Task: {E539B7D2-8102-47A5-92B4-BC8F0D23722D} - System32\Tasks\yourMail free edition Updates for Admin-PC_Admin => C:\Users\Admin\AppData\Local\yourTime\yourMail\components\schedule\yourMail Free Edition Updates.lnk [2014-07-21] ()
Task: {F3BA925C-50A3-40C9-B6B3-F51CAC31ECC7} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2012-11-02] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HP Photo Creations Communicator.job => C:\ProgramData\HP Photo Creations\Communicator.exe
Task: C:\Windows\Tasks\yourMail free edition Updates for Admin-PC_Admin.job => ?

==================== Loaded Modules (whitelisted) =============

2014-07-31 12:55 - 2014-07-31 12:55 - 00613200 _____ () c:\program files\bullguard ltd\bullguard\SQLite.dll
2014-07-31 12:55 - 2014-07-31 12:55 - 00084304 _____ () c:\program files\bullguard ltd\bullguard\zlib1.dll
2014-07-31 12:55 - 2014-07-31 12:55 - 00653136 _____ () c:\program files\bullguard ltd\bullguard\LibXml2.dll
2014-05-19 14:16 - 2014-05-19 14:16 - 00023376 _____ () c:\program files\bullguard ltd\bullguard\res\de\BullGuardBhvScannerRes.dll
2014-07-31 12:55 - 2014-07-31 12:55 - 00064848 _____ () c:\program files\bullguard ltd\bullguard\LIBBZ2.dll
2014-03-13 11:47 - 2013-09-22 11:27 - 00119000 _____ () C:\Program Files (x86)\WizMouse\wizmouse.exe
2010-08-04 15:58 - 2010-08-04 15:58 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2010-08-25 21:44 - 2010-08-25 21:44 - 00270336 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2014-04-08 09:12 - 2010-12-14 10:47 - 00398128 _____ () C:\Program Files (x86)\TVG\OnlineUpdate\OnlineUpdateSvc.exe
2010-07-15 06:44 - 2010-07-15 06:44 - 00020032 _____ () C:\Program Files\Unlocker\UnlockerCOM.dll
2014-02-12 21:58 - 2014-02-12 21:58 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-02-12 21:58 - 2014-02-12 21:58 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2012-08-08 12:17 - 2007-05-31 07:38 - 00167936 ____N () C:\Windows\SysWOW64\SerialXP.dll
2014-07-21 09:01 - 2011-01-13 10:44 - 00232800 _____ () C:\Program Files (x86)\StarMoney 9.0\ouservice\PATCHW32.dll
2013-08-20 18:48 - 2013-08-20 18:48 - 00024576 _____ () C:\Program Files (x86)\AGFEO\Tk-Suite\tkserver\tkmedia_lib.dll
2013-08-20 18:48 - 2013-08-20 18:48 - 00028672 _____ () C:\Program Files (x86)\AGFEO\Tk-Suite\tkserver\tkmedia_capi.dll
2013-08-20 18:48 - 2013-08-20 18:48 - 00011776 _____ () C:\Program Files (x86)\AGFEO\Tk-Suite\tkserver\tkmedia_serial.dll
2013-08-20 18:48 - 2013-08-20 18:48 - 00012288 _____ () C:\Program Files (x86)\AGFEO\Tk-Suite\tkserver\tkmedia_xport.dll
2012-08-08 17:08 - 2014-04-26 16:53 - 00835584 _____ () C:\Program Files (x86)\Opera\gstreamer\gstreamer.dll
2012-08-08 17:08 - 2014-04-26 16:53 - 00093696 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstaudioconvert.dll
2012-08-08 17:08 - 2014-04-26 16:53 - 00094208 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstaudioresample.dll
2012-08-08 17:08 - 2014-04-26 16:53 - 00057344 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstautodetect.dll
2012-08-08 17:08 - 2014-04-26 16:53 - 00096256 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstcoreplugins.dll
2012-08-08 17:08 - 2014-04-26 16:53 - 00062976 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstdecodebin2.dll
2012-08-08 17:08 - 2014-04-26 16:53 - 00067072 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstdirectsound.dll
2012-08-08 17:08 - 2014-04-26 16:53 - 00158208 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstffmpegcolorspace.dll
2012-08-08 17:08 - 2014-04-26 16:53 - 00312832 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstoggdec.dll
2012-08-08 17:08 - 2014-04-26 16:53 - 00038912 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstwaveform.dll
2012-08-08 17:08 - 2014-04-26 16:53 - 00073728 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstwavparse.dll
2012-08-08 17:08 - 2014-04-26 16:53 - 00101888 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstwebmdec.dll
2014-07-18 09:48 - 2014-07-15 11:24 - 00718664 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\libglesv2.dll
2014-07-18 09:48 - 2014-07-15 11:24 - 00126280 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\libegl.dll
2014-07-18 09:48 - 2014-07-15 11:24 - 08537928 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\pdf.dll
2014-07-18 09:48 - 2014-07-15 11:24 - 00353096 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\ppGoogleNaClPluginChrome.dll
2014-07-18 09:48 - 2014-07-15 11:24 - 01732936 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\ffmpegsumo.dll
2013-06-07 18:49 - 2013-06-07 18:49 - 00061952 _____ () C:\Program Files (x86)\Firetrust\MailWasher\MWPBridgeDLL.dll
2013-06-07 18:49 - 2013-06-07 18:49 - 04642816 _____ () C:\Program Files (x86)\Firetrust\MailWasher\MWPappDLL.dll
2011-04-26 17:37 - 2011-04-26 17:37 - 00061952 _____ () C:\Program Files (x86)\Firetrust\MailWasher\FTBridge.dll
2011-04-26 17:37 - 2011-04-26 17:37 - 00272384 _____ () C:\Program Files (x86)\Firetrust\MailWasher\FTClientNode.dll
2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\office14\Cultures\office.odf
2012-08-09 10:50 - 2013-05-07 10:33 - 00360448 _____ () C:\Program Files (x86)\Common Files\ESM-Tools Shared\License.dll
2012-08-09 10:50 - 2013-08-29 06:31 - 01966080 _____ () C:\Program Files (x86)\ESM-Tools\AttachmentsManager\AttachmentsManager.dll
2012-08-09 10:50 - 2012-08-01 10:45 - 00212992 _____ () C:\Program Files (x86)\Common Files\ESM-Tools Shared\LiveUpdate.dll
2013-04-27 18:26 - 2013-04-04 11:57 - 04053504 _____ () C:\Program Files (x86)\PhraseExpress\pexmsol.dll
2013-04-24 17:00 - 2013-04-24 17:00 - 00499712 _____ () C:\Users\Admin\AppData\Local\yourTime\yourMail\components\adxloader.dll
2013-02-14 16:46 - 2013-02-14 16:46 - 01044048 _____ () C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll
2013-05-20 18:12 - 2013-05-20 18:12 - 00872448 _____ () C:\Users\Admin\AppData\Local\assembly\dl3\JTK0W0YG.Y7R\8ADW7DWQ.96L\6606d554\f1ce1d75_fc40ce01\YourMailMetroSkin.DLL
2010-05-11 03:00 - 2010-05-11 03:00 - 01785856 _____ () C:\Program Files (x86)\ESTOS\ProCall One\TfD.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Admin\Lokale Einstellungen:Dmg2XLDiMEhwNeg9DnUiYRW2D
AlternateDataStreams: C:\Users\Admin\Lokale Einstellungen:jcS6QwtlG8eyLFEGR4trRBW8rB9I
AlternateDataStreams: C:\Users\Admin\AppData\Local:Dmg2XLDiMEhwNeg9DnUiYRW2D
AlternateDataStreams: C:\Users\Admin\AppData\Local:jcS6QwtlG8eyLFEGR4trRBW8rB9I
AlternateDataStreams: C:\Users\Admin\AppData\Local\Anwendungsdaten:Dmg2XLDiMEhwNeg9DnUiYRW2D
AlternateDataStreams: C:\Users\Admin\AppData\Local\Anwendungsdaten:jcS6QwtlG8eyLFEGR4trRBW8rB9I

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BsMain => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BsScanner => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\BsMain => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\BsScanner => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\BsUpdate => ""="Service"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: MemeoBackgroundService => 2
MSCONFIG\Services: StarMoney 8.0 OnlineUpdate => 2

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (08/12/2014 04:28:09 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm FRST64.exe, Version 10.8.2014.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1518

Startzeit: 01cfb639426ca0be

Endzeit: 60000

Anwendungspfad: D:\Download\Aktuell\FRST64.exe

Berichts-ID: b5a57190-222c-11e4-a29e-0026831840ab

Error: (08/12/2014 11:46:12 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (08/12/2014 11:46:11 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (08/12/2014 11:46:10 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (08/12/2014 11:46:09 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (08/12/2014 11:46:09 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (08/12/2014 11:46:07 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (08/12/2014 11:46:03 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (08/12/2014 11:46:01 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (08/12/2014 11:46:00 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.


System errors:
=============
Error: (08/12/2014 04:38:50 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (08/12/2014 04:37:02 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (08/12/2014 02:33:37 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (08/12/2014 02:32:28 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\ComboFix\catchme.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.

Error: (08/12/2014 02:32:28 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\ComboFix\catchme.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.

Error: (08/12/2014 02:30:57 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (08/12/2014 02:27:41 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "HP CUE DeviceDiscovery Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (08/12/2014 02:27:41 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "hpqcxs08" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (08/12/2014 10:08:31 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "BullGuard firewall service" wurde nicht richtig gestartet.

Error: (08/12/2014 10:06:40 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (120000 ms) wurde beim Verbindungsversuch mit dem Dienst sysTPLService erreicht.


Microsoft Office Sessions:
=========================
Error: (08/12/2014 04:28:09 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: FRST64.exe10.8.2014.0151801cfb639426ca0be60000D:\Download\Aktuell\FRST64.exeb5a57190-222c-11e4-a29e-0026831840ab

Error: (08/12/2014 11:46:12 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestd:\Download\Aktuell\esetsmartinstaller_deu.exe

Error: (08/12/2014 11:46:11 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestd:\Download\Aktuell\esetsmartinstaller_deu.exe

Error: (08/12/2014 11:46:10 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestd:\Download\Aktuell\esetsmartinstaller_deu.exe

Error: (08/12/2014 11:46:09 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestd:\Download\Aktuell\esetsmartinstaller_deu.exe

Error: (08/12/2014 11:46:09 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestd:\Download\Aktuell\esetsmartinstaller_deu.exe

Error: (08/12/2014 11:46:07 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestd:\Download\Aktuell\esetsmartinstaller_deu.exe

Error: (08/12/2014 11:46:03 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestd:\Download\Aktuell\esetsmartinstaller_deu.exe

Error: (08/12/2014 11:46:01 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestd:\Download\Aktuell\esetsmartinstaller_deu.exe

Error: (08/12/2014 11:46:00 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestd:\Download\Aktuell\esetsmartinstaller_deu.exe


CodeIntegrity Errors:
===================================
  Date: 2014-08-12 14:32:28.891
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-08-12 14:32:28.860
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-08-12 14:32:28.829
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-08-12 14:32:28.813
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-07-27 20:04:34.475
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-07-27 20:04:34.444
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info ===========================

Percentage of memory in use: 45%
Total physical RAM: 8168.61 MB
Available physical RAM: 4421.43 MB
Total Pagefile: 16335.39 MB
Available Pagefile: 12428.39 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (SYSTEM) (Fixed) (Total:111.69 GB) (Free:46.78 GB) NTFS
Drive d: (DATEN) (Fixed) (Total:465.76 GB) (Free:361.35 GB) NTFS
Drive e: (DATEN 2) (Fixed) (Total:465.76 GB) (Free:311.66 GB) NTFS
Drive h: (Toshiba HDD) (Fixed) (Total:596.17 GB) (Free:464.15 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: ECA4EBCF)
Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or Vista) (Size: 466 GB) (Disk ID: A570E81D)
Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 112 GB) (Disk ID: 2A82E0E6)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=112 GB) - (Type=07 NTFS)

========================================================
Disk: 3 (Size: 596 GB) (Disk ID: F5346CD7)
Partition 1: (Active) - (Size=596 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Was bedeuztet das "in einer Domain" angemeldet?
Ich nutze ein kleines Heimnetzwerk mit 2 LAN-Rechnern, manchmal über WLAN mit eierpads o.ä.

Zitat:

Zitat von felix1 (Beitrag 1343679)
W7 Pro ist im Homebereich eher selten anzutreffen. Hast Du den Rechner mal in einer Dömäne angemeldet?

Was bedeutet das?

felix1 12.08.2014 20:30

Poste bitte mal den Inhalt der Datei hosts aus dem Verzeichnis
C:\Windows\System32\drivers\etc

weti 12.08.2014 20:49

Hi Felix,
dort finde ich keine Datei mit dem Namen 'hosts'!
Es gibt auch keinen Ordner mit dem Namen 'etc'

Es gibt hier eine Hosts-Datei:
C:\Windows\winsxs\amd64_microsoft-windows-w..nfrastructure-other_31bf3856ad364e35_6.1.7600.16385_none_6079f415110c0210

Code:

# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97    rhino.acme.com          # source server
#      38.25.63.10    x.acme.com              # x client host

# localhost name resolution is handled within DNS itself.
#        127.0.0.1      localhost
#        ::1            localhost


cosinus 12.08.2014 21:40

In der Hosts Datei ist alles ok. Felix wollte wohl nur wissen, ob du dieses System vllt mal gewerblich nutzt oder genutzt hast, ob dieser Rechner gar in einem Büro stand. Da sind nämlich Windows-Server-Domains recht üblich.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ProxyServer: http=127.0.0.1:8877
SearchScopes: HKLM - DefaultScope {ADF3D08D-C10A-4C0C-9AAA-3693A1221042} URL = http://www.sm.de/?q={searchTerms}
SearchScopes: HKLM - {ADF3D08D-C10A-4C0C-9AAA-3693A1221042} URL = http://www.sm.de/?q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {ADF3D08D-C10A-4C0C-9AAA-3693A1221042} URL = http://www.sm.de/?q={searchTerms}
SearchScopes: HKCU - {ADF3D08D-C10A-4C0C-9AAA-3693A1221042} URL = http://www.sm.de/?q={searchTerms}
C:\Windows\System32\Tasks\{9ADD4159-A8BD-499E-9697-AE7AEE8E3035}
C:\Users\Admin\phraseexpresssqlclientmanagersetup.exe
Task: {932BDFAD-3EB2-41C1-AB67-DB8F9E252FF8} - System32\Tasks\ASP => C:\Program Files (x86)\RegClean Pro\SystweakASP.exe <==== ATTENTION
C:\Program Files (x86)\RegClean Pro
AlternateDataStreams: C:\Users\Admin\Lokale Einstellungen:Dmg2XLDiMEhwNeg9DnUiYRW2D
AlternateDataStreams: C:\Users\Admin\Lokale Einstellungen:jcS6QwtlG8eyLFEGR4trRBW8rB9I
AlternateDataStreams: C:\Users\Admin\AppData\Local:Dmg2XLDiMEhwNeg9DnUiYRW2D
AlternateDataStreams: C:\Users\Admin\AppData\Local:jcS6QwtlG8eyLFEGR4trRBW8rB9I
AlternateDataStreams: C:\Users\Admin\AppData\Local\Anwendungsdaten:Dmg2XLDiMEhwNeg9DnUiYRW2D
AlternateDataStreams: C:\Users\Admin\AppData\Local\Anwendungsdaten:jcS6QwtlG8eyLFEGR4trRBW8rB9I


Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.


weti 13.08.2014 09:26

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-08-2014
Ran by Admin at 2014-08-13 10:24:55 Run:1
Running from C:\Users\Admin\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
ProxyServer: http=127.0.0.1:8877
SearchScopes: HKLM - DefaultScope {ADF3D08D-C10A-4C0C-9AAA-3693A1221042} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKLM - {ADF3D08D-C10A-4C0C-9AAA-3693A1221042} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {ADF3D08D-C10A-4C0C-9AAA-3693A1221042} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKCU - {ADF3D08D-C10A-4C0C-9AAA-3693A1221042} URL = hxxp://www.sm.de/?q={searchTerms}
C:\Windows\System32\Tasks\{9ADD4159-A8BD-499E-9697-AE7AEE8E3035}
C:\Users\Admin\phraseexpresssqlclientmanagersetup.exe
Task: {932BDFAD-3EB2-41C1-AB67-DB8F9E252FF8} - System32\Tasks\ASP => C:\Program Files (x86)\RegClean Pro\SystweakASP.exe <==== ATTENTION
C:\Program Files (x86)\RegClean Pro
AlternateDataStreams: C:\Users\Admin\Lokale Einstellungen:Dmg2XLDiMEhwNeg9DnUiYRW2D
AlternateDataStreams: C:\Users\Admin\Lokale Einstellungen:jcS6QwtlG8eyLFEGR4trRBW8rB9I
AlternateDataStreams: C:\Users\Admin\AppData\Local:Dmg2XLDiMEhwNeg9DnUiYRW2D
AlternateDataStreams: C:\Users\Admin\AppData\Local:jcS6QwtlG8eyLFEGR4trRBW8rB9I
AlternateDataStreams: C:\Users\Admin\AppData\Local\Anwendungsdaten:Dmg2XLDiMEhwNeg9DnUiYRW2D
AlternateDataStreams: C:\Users\Admin\AppData\Local\Anwendungsdaten:jcS6QwtlG8eyLFEGR4trRBW8rB9I
       
*****************

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{ADF3D08D-C10A-4C0C-9AAA-3693A1221042}" => Key deleted successfully.
"HKCR\CLSID\{ADF3D08D-C10A-4C0C-9AAA-3693A1221042}" => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
"HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{ADF3D08D-C10A-4C0C-9AAA-3693A1221042}" => Key deleted successfully.
"HKCR\CLSID\{ADF3D08D-C10A-4C0C-9AAA-3693A1221042}" => Key not found.
C:\Windows\System32\Tasks\{9ADD4159-A8BD-499E-9697-AE7AEE8E3035} => Moved successfully.
C:\Users\Admin\phraseexpresssqlclientmanagersetup.exe => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{932BDFAD-3EB2-41C1-AB67-DB8F9E252FF8}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{932BDFAD-3EB2-41C1-AB67-DB8F9E252FF8}" => Key deleted successfully.
C:\Windows\System32\Tasks\ASP => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ASP" => Key deleted successfully.
"C:\Program Files (x86)\RegClean Pro" => File/Directory not found.
"C:\Users\Admin\Lokale Einstellungen" => ":Dmg2XLDiMEhwNeg9DnUiYRW2D" ADS not found.
"C:\Users\Admin\Lokale Einstellungen" => ":jcS6QwtlG8eyLFEGR4trRBW8rB9I" ADS not found.
C:\Users\Admin\AppData\Local => ":Dmg2XLDiMEhwNeg9DnUiYRW2D" ADS removed successfully.
C:\Users\Admin\AppData\Local => ":jcS6QwtlG8eyLFEGR4trRBW8rB9I" ADS removed successfully.
"C:\Users\Admin\AppData\Local\Anwendungsdaten" => ":Dmg2XLDiMEhwNeg9DnUiYRW2D" ADS not found.
"C:\Users\Admin\AppData\Local\Anwendungsdaten" => ":jcS6QwtlG8eyLFEGR4trRBW8rB9I" ADS not found.

==== End of Fixlog ====


cosinus 13.08.2014 09:49

Neu starten und frische FRST Logs bitte

weti 13.08.2014 09:59


FRST Logfile:
Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-08-2014
Ran by Admin (administrator) on ADMIN-PC on 13-08-2014 10:58:19
Running from C:\Users\Admin\Desktop
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(AVM Berlin) C:\Program Files (x86)\avmwlanstick\WLanNetService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(BullGuard Ltd.) C:\Program Files\BullGuard Ltd\BullGuard\BullGuardBhvScanner.exe
(BullGuard Ltd.) C:\Program Files\BullGuard Ltd\BullGuard\BullGuardScanner.exe
(BullGuard Ltd.) C:\Program Files\BullGuard Ltd\BullGuard\BullGuardUpdate.exe
(REINER SCT) C:\Windows\SysWOW64\cjpcsc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(BullGuard Ltd.) C:\Program Files\BullGuard Ltd\BullGuard\BullGuard.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Nalpeiron Ltd.) C:\Windows\SysWOW64\nlssrv32.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
(Star Finanz-Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe
(BullGuard Ltd.) C:\Program Files\BullGuard Ltd\BullGuard\BgDelayStartup.exe
(Tlapia) C:\Program Files (x86)\sysTPL\sysTPLMonitor.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 12 Organizer\CAHeadless\ElementsAutoAnalyzer.exe
(Evoluent) C:\Program Files\Evoluent\VMouse\EvoMouseExec.exe
(AGFEO      ) C:\Program Files (x86)\AGFEO\Tk-Suite\tkserver\tksock.exe
() C:\Program Files (x86)\TVG\OnlineUpdate\OnlineUpdateSvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(AGFEO      ) C:\Program Files (x86)\AGFEO\Tk-Suite\tkserver\tkmedia.exe
(ESTOS GmbH) C:\Program Files (x86)\ESTOS\ProCall One\ECtiClientOne.exe
(AGFEO      ) C:\Program Files (x86)\AGFEO\Tk-Suite\tools\ctimon.exe
(Tlapia) C:\Program Files (x86)\sysTPL\sysTPL.exe
(Bartels Media GmbH) C:\Program Files (x86)\PhraseExpress\phraseexpress.exe
(AGFEO      ) C:\Program Files (x86)\AGFEO\Tk-Suite\tools\ctimon.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(BullGuard Ltd.) C:\Program Files\BullGuard Ltd\BullGuard\Files32\Spamfilter\LittleHook.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
() C:\Program Files\BullGuard Ltd\BullGuard\BgWsc.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
() C:\Program Files (x86)\WizMouse\WizMouse.exe
(Opera Software) C:\Program Files (x86)\Opera\opera.exe
(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Tlapia) C:\Program Files (x86)\sysTPL\sysTPLService.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [BullGuardUpdate2] => c:\program files\bullguard ltd\bullguard\BullGuardUpdate2.exe [2933584 2014-08-06] (BullGuard Ltd.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11613288 2010-11-19] (Realtek Semiconductor)
HKLM\...\Run: [IntelliType Pro] => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [1464944 2012-11-02] (Microsoft Corporation)
HKLM\...\Run: [IntelliPoint] => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2076272 2012-11-02] (Microsoft Corporation)
HKLM\...\Run: [BullGuard] => C:\Program Files\BullGuard Ltd\BullGuard\bullguard.exe [1319248 2014-08-07] (BullGuard Ltd.)
HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [613536 2010-10-27] (Atheros Communications)
HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [379040 2010-10-27] (Atheros Commnucations)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472984 2013-06-03] (Adobe Systems Incorporated)
HKLM\...\Run: [BgDelayStartup] => c:\program files\bullguard ltd\bullguard\BgDelayStartup.exe [86352 2014-07-31] (BullGuard Ltd.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [sysTPL] => C:\Program Files (x86)\sysTPL\sysTPL.exe [1244440 2014-02-07] (Tlapia)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-08-25] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [JMB36X IDE Setup] => C:\Windows\RaidTool\xInsIDE.exe [43632 2010-01-19] ()
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKU\S-1-5-21-79635218-2301998975-3311727660-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.)
HKU\S-1-5-21-79635218-2301998975-3311727660-1000\...\Run: [CAHeadless] => C:\Program Files (x86)\Adobe\Elements 12 Organizer\CAHeadless\ElementsAutoAnalyzer.exe [1401040 2014-05-09] (Adobe Systems Incorporated)
AppInit_DLLs: C:\Windows\System32\BgGamingMonitor.dll => C:\Windows\System32\BgGamingMonitor.dll [153712 2014-08-07] (BullGuard Ltd.)
AppInit_DLLs:  c:\PROGRA~1\BULLGU~1\BULLGU~1\BgAgent.dll => c:\Program Files\BullGuard Ltd\BullGuard\BgAgent.dll [100656 2014-07-31] (BullGuard Ltd.)
AppInit_DLLs-x32: C:\Windows\System32\BgGamingMonitor.dll => C:\Windows\SysWOW64\BgGamingMonitor.dll [140280 2014-08-07] (BullGuard Ltd.)
AppInit_DLLs-x32:  c:\PROGRA~1\BULLGU~1\BULLGU~1\Files32\BgAgent.dll => c:\Program Files\BullGuard Ltd\BullGuard\Files32\BgAgent.dll [86200 2014-07-31] (BullGuard Ltd.)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Evoluent Mouse Manager.lnk
ShortcutTarget: Evoluent Mouse Manager.lnk -> C:\Windows\Installer\{1DF99F8F-31BC-4058-B750-DC0C86FC0038}\_97D7716B285C2208949646.exe ()
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PhraseExpress.lnk
ShortcutTarget: PhraseExpress.lnk -> C:\Program Files (x86)\PhraseExpress\phraseexpress.exe (Bartels Media GmbH)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ProCall One.lnk
ShortcutTarget: ProCall One.lnk -> C:\Program Files (x86)\ESTOS\ProCall One\ECtiClientOne.exe (ESTOS GmbH)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TK-Suite Client.lnk
ShortcutTarget: TK-Suite Client.lnk -> C:\Program Files (x86)\AGFEO\Tk-Suite\tools\ctimon.exe (AGFEO      )
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Evoluent Mouse Manager.lnk
ShortcutTarget: Evoluent Mouse Manager.lnk -> C:\Windows\Installer\{1DF99F8F-31BC-4058-B750-DC0C86FC0038}\_97D7716B285C2208949646.exe ()
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PhraseExpress.lnk
ShortcutTarget: PhraseExpress.lnk -> C:\Program Files (x86)\PhraseExpress\phraseexpress.exe (Bartels Media GmbH)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ProCall One.lnk
ShortcutTarget: ProCall One.lnk -> C:\Program Files (x86)\ESTOS\ProCall One\ECtiClientOne.exe (ESTOS GmbH)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TK-Suite Client.lnk
ShortcutTarget: TK-Suite Client.lnk -> C:\Program Files (x86)\AGFEO\Tk-Suite\tools\ctimon.exe (AGFEO      )
ShellIconOverlayIdentifiers: BackupOverlayErr -> {8749448C-D907-45BF-A842-4D3898894AC8} => C:\Program Files\BullGuard Ltd\BullGuard\BackupShellHook.dll (BullGuard Ltd.)
ShellIconOverlayIdentifiers: BackupOverlayInProgress -> {3FFBF330-7839-476B-BE14-2C8597CE11B6} => C:\Program Files\BullGuard Ltd\BullGuard\BackupShellHook.dll (BullGuard Ltd.)
ShellIconOverlayIdentifiers: BackupOverlaySynced -> {C62CF4DB-48CB-4B03-BFD0-30A29125FA49} => C:\Program Files\BullGuard Ltd\BullGuard\BackupShellHook.dll (BullGuard Ltd.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x954321BBB774CD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: LastPass Vault -> {95D9ECF5-2A4D-4550-BE49-70D42F71296E} -> C:\Program Files (x86)\LastPass\LPToolbar_x64.dll ()
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: PDFXChange 4.0 IE Plugin -> {42DFA04F-0F16-418e-B80C-AB97A5AFAD39} -> C:\Program Files\Tracker Software\PDF-XChange 4\PXCIEAddin4.dll (Tracker Softaware)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: LastPass Vault -> {95D9ECF5-2A4D-4550-BE49-70D42F71296E} -> C:\Program Files (x86)\LastPass\LPToolbar.dll ()
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll ()
Toolbar: HKLM-x32 - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar.dll ()
Toolbar: HKLM-x32 - PDFXChange 4.0 IE Plugin - {42DFA04F-0F16-418e-B80C-AB97A5AFAD39} - C:\Program Files\Tracker Software\PDF-XChange 4\PXCIEAddin4.dll (Tracker Softaware)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll No File
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 -> C:\ProgramData\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin HKCU: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll No File
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default\searchplugins\acoon.xml
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default\searchplugins\search_engine.xml
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default\searchplugins\startpage-https---deutsch.xml
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default\searchplugins\wolframalpha.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: LastPass - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default\Extensions\support@lastpass.com [2014-08-12]
FF Extension: Autocopy - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default\Extensions\{0FED7D55-65D4-47b6-A6DE-9A4ADB55355F} [2013-01-07]
FF Extension: FireGestures - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default\Extensions\firegestures@xuldev.org.xpi [2012-08-09]
FF Extension: Secure Login - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default\Extensions\secureLogin@blueimp.net.xpi [2012-08-16]
FF Extension: Tile Tabs - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default\Extensions\tiletabs@DW-dev.xpi [2014-05-06]
FF Extension: BetterPrivacy - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2012-09-17]
FF HKLM-x32\...\Firefox\Extensions: [antiphishing@bullguard] - c:\program files\bullguard ltd\bullguard\Files32\Antiphishing\FF\antiphishing@bullguard
FF Extension: BullGuard Safe Browsing - c:\program files\bullguard ltd\bullguard\Files32\Antiphishing\FF\antiphishing@bullguard [2013-07-29]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-05-04]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

Chrome:
=======
CHR HomePage: hxxp://www.netvibes.com/privatepage/4#Home
CHR StartupUrls: "hxxp://blog.24stundenbetreut.com/", "chrome-extension://jkkenjlnjfemconejajakbijbheoffli/chrome/sidebar.html?v=__YOONO_BUILD__"
CHR Extension: (Google Docs) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-07-28]
CHR Extension: (Google Drive) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-07-23]
CHR Extension: (https://translate.google.de/#pl/de/Kochany%20) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkmlelhnmpnjbijdijnmagddkjnjkihn [2014-07-28]
CHR Extension: (YouTube) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-07-23]
CHR Extension: (Google-Suche) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-07-23]
CHR Extension: (Google Kalender) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjicmeblgpmajnghnpcppodonldlgfn [2014-07-28]
CHR Extension: (LastPass: Free Password Manager) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd [2014-07-28]
CHR Extension: (Yoono - Twitter, Facebook, LinkedIn, YouTube™) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jkkenjlnjfemconejajakbijbheoffli [2014-07-28]
CHR Extension: (Smooth Gestures) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfkgmnnajiljnolcgolmmgnecgldgeld [2014-07-28]
CHR Extension: (Google Maps) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lneaknkopdijkpnocmklfnjbeapigfbh [2014-07-28]
CHR Extension: (Google Wallet) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-07-23]
CHR Extension: (ImTranslator: Google Translate) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\noaijdpnepcgjemiklgfkcfbkokogabh [2014-07-28]
CHR Extension: (Picasa) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\onlgmecjpnejhfeofkgbfgnmdlipdejb [2014-07-28]
CHR Extension: (Google Mail) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-07-23]
CHR HKLM-x32\...\Chrome\Extension: [hdokiejnpimakedhajhdlcegeplioahd] - C:\Program Files (x86)\LastPass\lpchrome.crx [2012-08-28]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 AdobeActiveFileMonitor12.0; C:\Program Files (x86)\Adobe\Elements 12 Organizer\PhotoshopElementsFileAgent.exe [181152 2013-09-03] (Adobe Systems Incorporated)
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [52896 2010-10-27] (Atheros Commnucations) [File not signed]
R2 AVM WLAN Connection Service; C:\Program Files (x86)\avmwlanstick\WlanNetService.exe [376832 2010-10-22] (AVM Berlin) [File not signed]
R2 BsBackup; c:\program files\bullguard ltd\bullguard\BsBackup.dll [728400 2014-08-07] (BullGuard Ltd.)
R2 BsBhvScan; c:\program files\bullguard ltd\bullguard\BullGuardBhvScanner.exe [529744 2014-08-07] (BullGuard Ltd.)
R2 BsCache; c:\program files\bullguard ltd\bullguard\BsCache.dll [145744 2014-08-07] (BullGuard Ltd.)
R2 BsFileScan; c:\program files\bullguard ltd\bullguard\BsFileScan.dll [419152 2014-08-07] (BullGuard Ltd.)
R2 BsFire; c:\program files\bullguard ltd\bullguard\BsFire.dll [766800 2014-08-07] (BullGuard Ltd.)
R2 BsMailProxy; c:\program files\bullguard ltd\bullguard\BsMailProxy\BsMailProxy.dll [745296 2014-08-07] (BullGuard Ltd.)
R2 BsMain; c:\program files\bullguard ltd\bullguard\bsmain.dll [499536 2014-08-07] (BullGuard Ltd.)
R2 BsScanner; c:\program files\bullguard ltd\bullguard\BullGuardScanner.exe [273232 2014-08-07] (BullGuard Ltd.)
R2 BsUpdate; c:\program files\bullguard ltd\bullguard\BullGuardUpdate.exe [366928 2014-08-06] (BullGuard Ltd.)
R2 cjpcsc; C:\Windows\SysWOW64\cjpcsc.exe [514128 2012-03-19] (REINER SCT)
R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1039360 2010-10-22] (Hewlett-Packard Co.) [File not signed]
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
R2 StarMoney 9.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe [697488 2014-07-04] (Star Finanz-Software Entwicklung und Vertriebs GmbH)
R2 sysTPLMonitor.exe; C:\Program Files (x86)\sysTPL\sysTPLMonitor.exe [399640 2014-02-07] (Tlapia)
R2 sysTPLService.exe; C:\Program Files (x86)\sysTPL\sysTPLService.exe [397080 2013-09-29] (Tlapia)
R2 tksock; C:\Program Files (x86)\AGFEO\Tk-Suite\tkserver\tksock.exe [2220664 2013-08-20] (AGFEO      )
R2 TVGOnlineUpdateSvc; C:\Program Files (x86)\TVG\OnlineUpdate\OnlineUpdateSvc.exe [398128 2010-12-14] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 AFW; C:\Windows\System32\DRIVERS\afw.sys [42760 2014-05-19] (Agnitum Ltd.)
R3 afwcore; C:\Windows\System32\DRIVERS\afwcore.sys [469256 2014-05-19] (Agnitum Ltd.)
R3 AVMCOWAN; C:\Windows\System32\DRIVERS\AVMCOWAN.sys [79872 2009-06-10] (AVM GmbH)
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2010-10-22] (AVM Berlin)
R1 BdAgent; C:\Windows\System32\DRIVERS\BdAgent.sys [117184 2014-05-28] (BullGuard Ltd.)
R3 BdNet; C:\Windows\System32\drivers\BdNet.sys [34896 2014-05-19] (BullGuard Ltd.)
R1 BdSpy; C:\Windows\System32\drivers\BdSpy.sys [67680 2014-05-19] (BullGuard Ltd.)
R3 cjusb; C:\Windows\System32\DRIVERS\cjusb.sys [34672 2011-03-29] (REINER SCT)
R3 EvoMouseDriverFilterHidUsb; C:\Windows\System32\DRIVERS\EvoMouseDriverFilterHidUsb.sys [25656 2010-06-23] (Evoluent)
R3 EvoMouseDriverMini; C:\Windows\System32\drivers\EvoMouseDriverMini.sys [22584 2010-06-23] ()
R3 FPCIBASE; C:\Windows\System32\DRIVERS\fpcibase.sys [899328 2009-06-10] (AVM Berlin)
S3 fwlanusb4; C:\Windows\System32\DRIVERS\fwlanusb4.sys [1293824 2010-10-22] (AVM GmbH)
R1 NovaShieldFilterDriver; C:\Windows\System32\DRIVERS\NSKernel.sys [296368 2014-05-19] (BullGuard Ltd.)
R1 NovaShieldTDIDriver; C:\Windows\System32\DRIVERS\NSNetmon.sys [27544 2014-05-19] (BullGuard Ltd.)
R0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2012-08-10] (Corel Corporation)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [27520 2007-05-14] (Research In Motion Limited)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [350160 2013-01-25] (BitDefender S.R.L.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-13 10:58 - 2014-08-13 10:58 - 00027946 _____ () C:\Users\Admin\Desktop\FRST.txt
2014-08-13 10:58 - 2014-08-13 10:58 - 00000512 _____ () C:\Windows\system32\F39D4DE6-98B8-4E05-91BD-549E8A8248BD
2014-08-13 10:56 - 2014-08-13 10:56 - 00000000 ___RD () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2014-08-12 17:56 - 2014-08-13 10:58 - 00000000 ____D () C:\FRST
2014-08-12 17:54 - 2014-08-13 10:23 - 02100224 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe
2014-08-12 16:48 - 2014-08-12 16:48 - 00000081 _____ () C:\Users\Admin\Desktop\bsi.txt
2014-08-12 16:39 - 2014-08-12 16:39 - 00031682 _____ () C:\ComboFix.txt
2014-08-12 16:31 - 2014-08-12 16:31 - 05569662 ____R (Swearware) C:\Users\Admin\Desktop\ComboFix.exe
2014-08-10 18:29 - 2014-08-10 18:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-08-10 18:08 - 2014-08-10 18:08 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-08-08 08:09 - 2014-08-13 10:56 - 00001008 _____ () C:\Windows\setupact.log
2014-08-08 08:09 - 2014-08-13 09:41 - 00001456 _____ () C:\Windows\PFRO.log
2014-08-08 08:09 - 2014-08-08 08:09 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-07 08:34 - 2014-08-07 08:34 - 00153712 _____ (BullGuard Ltd.) C:\Windows\system32\BgGamingMonitor.dll
2014-08-07 08:34 - 2014-08-07 08:34 - 00140280 _____ (BullGuard Ltd.) C:\Windows\SysWOW64\BgGamingMonitor.dll
2014-07-31 12:55 - 2014-07-31 12:55 - 00076624 _____ (BullGuard Ltd.) C:\Windows\system32\BGLsp.dll
2014-07-31 12:55 - 2014-07-31 12:55 - 00064336 _____ (BullGuard Ltd.) C:\Windows\SysWOW64\BGLsp.dll
2014-07-30 20:25 - 2014-07-30 20:28 - 00000000 ____D () C:\Users\Admin\Desktop\CSV-JS
2014-07-29 10:13 - 2014-07-29 10:13 - 00000000 ___SD () C:\Users\Admin\Documents\Meine Datenquellen
2014-07-28 20:54 - 2014-07-28 20:54 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-07-28 20:54 - 2014-07-28 20:54 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-07-28 20:54 - 2014-07-28 20:54 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-07-28 20:54 - 2014-07-28 20:54 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-07-28 20:54 - 2014-07-28 20:54 - 00000000 ____D () C:\Program Files (x86)\Java
2014-07-28 09:12 - 2014-07-28 09:12 - 00000146 _____ () C:\Users\Admin\Desktop\Internetoptionen - Verknüpfung.lnk
2014-07-25 16:54 - 2014-07-25 17:38 - 00004858 _____ () C:\dvdfab_burn_vso.log
2014-07-25 16:00 - 2014-07-25 16:00 - 00000000 ____D () C:\Users\Admin\AppData\Local\PackageAware
2014-07-24 20:42 - 2014-07-24 20:42 - 00000000 ____D () C:\Windows\ERUNT
2014-07-24 20:37 - 2014-07-24 20:37 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-07-24 20:30 - 2014-08-13 10:24 - 00000000 ____D () C:\Users\Admin\Desktop\Malware
2014-07-24 18:48 - 2014-01-09 04:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-07-24 18:48 - 2014-01-04 00:44 - 06574592 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-07-24 16:27 - 2014-05-08 11:32 - 03178496 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-07-24 16:27 - 2014-05-08 11:32 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2014-07-24 16:17 - 2012-08-23 16:13 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2014-07-24 16:17 - 2012-08-23 16:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2014-07-24 16:17 - 2012-08-23 13:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll
2014-07-24 16:17 - 2012-08-23 12:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll
2014-07-24 15:52 - 2013-10-02 04:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2014-07-24 15:52 - 2013-10-02 04:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2014-07-24 15:52 - 2013-10-02 04:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2014-07-24 15:52 - 2013-10-02 03:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2014-07-24 15:52 - 2013-10-02 03:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2014-07-24 15:52 - 2013-10-02 03:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-07-24 15:52 - 2013-10-02 03:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2014-07-24 15:52 - 2013-10-02 02:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2014-07-24 15:52 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll
2014-07-24 15:52 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll
2014-07-24 15:52 - 2013-10-02 02:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2014-07-24 15:52 - 2013-10-02 02:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2014-07-24 15:52 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2014-07-24 15:52 - 2013-10-02 01:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-07-24 15:52 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2014-07-24 15:52 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-07-24 15:15 - 2013-09-25 04:23 - 01030144 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-07-24 15:15 - 2013-09-25 03:57 - 00792576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-07-24 14:54 - 2014-07-24 14:35 - 01354223 _____ () C:\AdwCleaner(17).exe
2014-07-24 14:54 - 2013-07-14 17:32 - 04009167 _____ () C:\ServicesRepair.exe
2014-07-21 20:44 - 2014-07-21 20:44 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\ASP

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-13 10:58 - 2014-08-13 10:58 - 00027946 _____ () C:\Users\Admin\Desktop\FRST.txt
2014-08-13 10:58 - 2014-08-13 10:58 - 00000512 _____ () C:\Windows\system32\F39D4DE6-98B8-4E05-91BD-549E8A8248BD
2014-08-13 10:58 - 2014-08-12 17:56 - 00000000 ____D () C:\FRST
2014-08-13 10:58 - 2013-07-29 10:57 - 00000000 ____D () C:\ProgramData\BullGuard
2014-08-13 10:57 - 2012-08-09 13:28 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Skype
2014-08-13 10:57 - 2012-08-08 17:43 - 00000000 ____D () C:\Users\Admin\Documents\Outlook-Dateien
2014-08-13 10:56 - 2014-08-13 10:56 - 00000000 ___RD () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2014-08-13 10:56 - 2014-08-08 08:09 - 00001008 _____ () C:\Windows\setupact.log
2014-08-13 10:56 - 2014-06-24 10:32 - 00003608 _____ () C:\Windows\System32\Tasks\WizMouse
2014-08-13 10:56 - 2012-08-23 11:08 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-13 10:56 - 2012-08-07 17:47 - 00000035 _____ () C:\Users\Public\Documents\AtherosServiceConfig.ini
2014-08-13 10:56 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-13 10:55 - 2012-08-08 17:46 - 00000000 ____D () C:\Users\Admin\Documents\PhraseExpress
2014-08-13 10:55 - 2012-08-08 17:05 - 00233752 _____ () C:\Windows\system32\config\afw_db.conf
2014-08-13 10:55 - 2012-08-08 17:05 - 00000224 _____ () C:\Windows\system32\config\afw_hm.conf
2014-08-13 10:55 - 2012-08-07 17:37 - 02057582 _____ () C:\Windows\WindowsUpdate.log
2014-08-13 10:47 - 2012-08-23 11:08 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-13 10:44 - 2013-04-10 10:26 - 00000000 ____D () C:\Users\Admin\~tmp
2014-08-13 10:29 - 2013-11-05 16:29 - 00000338 _____ () C:\Windows\Tasks\HP Photo Creations Communicator.job
2014-08-13 10:29 - 2012-08-08 09:58 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-13 10:24 - 2014-07-24 20:30 - 00000000 ____D () C:\Users\Admin\Desktop\Malware
2014-08-13 10:24 - 2012-08-07 17:37 - 00000000 ____D () C:\Users\Admin
2014-08-13 10:23 - 2014-08-12 17:54 - 02100224 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe
2014-08-13 09:51 - 2014-06-20 07:55 - 00000000 ____D () C:\Users\Admin\AppData\Local\Adobe
2014-08-13 09:50 - 2009-07-14 06:45 - 00022368 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-13 09:50 - 2009-07-14 06:45 - 00022368 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-13 09:47 - 2010-11-21 08:50 - 00702942 _____ () C:\Windows\system32\perfh007.dat
2014-08-13 09:47 - 2010-11-21 08:50 - 00150582 _____ () C:\Windows\system32\perfc007.dat
2014-08-13 09:47 - 2009-07-14 07:13 - 01637932 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-13 09:41 - 2014-08-08 08:09 - 00001456 _____ () C:\Windows\PFRO.log
2014-08-12 18:51 - 2013-10-15 20:16 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{D781DCA7-39F3-4ADE-9B92-F10BCBB64E55}
2014-08-12 16:48 - 2014-08-12 16:48 - 00000081 _____ () C:\Users\Admin\Desktop\bsi.txt
2014-08-12 16:39 - 2014-08-12 16:39 - 00031682 _____ () C:\ComboFix.txt
2014-08-12 16:39 - 2013-07-27 20:01 - 00000000 ____D () C:\Qoobox
2014-08-12 16:38 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-08-12 16:31 - 2014-08-12 16:31 - 05569662 ____R (Swearware) C:\Users\Admin\Desktop\ComboFix.exe
2014-08-12 14:33 - 2013-03-31 18:29 - 00000000 ____D () C:\Program Files (x86)\StarMoney 9.0
2014-08-11 09:38 - 2012-08-09 11:12 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-08-10 19:55 - 2012-08-12 19:38 - 00000000 ____D () C:\Users\Admin\Desktop\Medien
2014-08-10 18:38 - 2014-02-07 11:59 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\vlc
2014-08-10 18:30 - 2012-12-17 18:31 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\dvdcss
2014-08-10 18:29 - 2014-08-10 18:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-08-10 18:08 - 2014-08-10 18:08 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-08-08 16:59 - 2014-07-02 21:02 - 00000000 ____D () C:\Users\Admin\Desktop\Bullguard
2014-08-08 16:23 - 2012-09-03 17:50 - 00000000 ____D () C:\Program Files (x86)\Music Wizard
2014-08-08 16:00 - 2013-05-20 17:49 - 00000000 __HDC () C:\Users\Admin\AppData\Local\{C6B707E6-325A-4AB7-BC10-1D3EB2DDFF13}
2014-08-08 16:00 - 2012-08-09 10:35 - 00000372 _____ () C:\Windows\Tasks\yourMail free edition Updates for Admin-PC_Admin.job
2014-08-08 09:14 - 2012-08-08 16:52 - 00000000 ____D () C:\Users\Admin\Desktop\Tools
2014-08-08 08:09 - 2014-08-08 08:09 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-07 20:41 - 2012-08-08 11:23 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-08-07 08:34 - 2014-08-07 08:34 - 00153712 _____ (BullGuard Ltd.) C:\Windows\system32\BgGamingMonitor.dll
2014-08-07 08:34 - 2014-08-07 08:34 - 00140280 _____ (BullGuard Ltd.) C:\Windows\SysWOW64\BgGamingMonitor.dll
2014-08-06 15:43 - 2012-12-13 20:58 - 00000000 ____D () C:\Windows\System32\Tasks\NCH Software
2014-07-31 12:55 - 2014-07-31 12:55 - 00076624 _____ (BullGuard Ltd.) C:\Windows\system32\BGLsp.dll
2014-07-31 12:55 - 2014-07-31 12:55 - 00064336 _____ (BullGuard Ltd.) C:\Windows\SysWOW64\BGLsp.dll
2014-07-30 20:28 - 2014-07-30 20:25 - 00000000 ____D () C:\Users\Admin\Desktop\CSV-JS
2014-07-29 10:13 - 2014-07-29 10:13 - 00000000 ___SD () C:\Users\Admin\Documents\Meine Datenquellen
2014-07-28 20:54 - 2014-07-28 20:54 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-07-28 20:54 - 2014-07-28 20:54 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-07-28 20:54 - 2014-07-28 20:54 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-07-28 20:54 - 2014-07-28 20:54 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-07-28 20:54 - 2014-07-28 20:54 - 00000000 ____D () C:\Program Files (x86)\Java
2014-07-28 09:12 - 2014-07-28 09:12 - 00000146 _____ () C:\Users\Admin\Desktop\Internetoptionen - Verknüpfung.lnk
2014-07-25 17:40 - 2012-08-14 16:05 - 00000000 ____D () C:\Users\Admin\Desktop\Brennen
2014-07-25 17:39 - 2014-04-01 15:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDFab 9
2014-07-25 17:39 - 2014-04-01 15:31 - 00000000 ____D () C:\Program Files (x86)\DVDFab 9
2014-07-25 17:39 - 2013-12-11 20:35 - 00000000 ____D () C:\Users\Admin\Documents\DVDFab9
2014-07-25 17:38 - 2014-07-25 16:54 - 00004858 _____ () C:\dvdfab_burn_vso.log
2014-07-25 16:00 - 2014-07-25 16:00 - 00000000 ____D () C:\Users\Admin\AppData\Local\PackageAware
2014-07-25 14:15 - 2013-10-17 18:25 - 00000076 _____ () C:\Windows\SETSCAN.INI
2014-07-25 14:00 - 2012-08-09 17:17 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\PhraseExpress
2014-07-25 10:37 - 2013-01-16 12:16 - 00000000 ____D () C:\Program Files\CCleaner
2014-07-25 09:07 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-07-25 08:13 - 2013-07-29 10:57 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\BullGuard
2014-07-24 20:42 - 2014-07-24 20:42 - 00000000 ____D () C:\Windows\ERUNT
2014-07-24 20:37 - 2014-07-24 20:37 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-07-24 16:17 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-07-24 16:15 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-07-24 15:37 - 2013-03-11 15:06 - 00000000 ____D () C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet
2014-07-24 14:40 - 2012-12-04 14:12 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-07-24 14:40 - 2012-12-04 14:12 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-07-24 14:35 - 2014-07-24 14:54 - 01354223 _____ () C:\AdwCleaner(17).exe
2014-07-24 09:52 - 2012-12-04 14:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-07-22 07:57 - 2009-07-14 06:45 - 06305968 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-21 20:51 - 2012-08-07 17:53 - 00088800 _____ () C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-21 20:44 - 2014-07-21 20:44 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\ASP
2014-07-21 20:30 - 2012-08-13 19:48 - 00000000 ____D () C:\Users\Admin\AppData\Local\CrashDumps
2014-07-21 20:29 - 2013-04-04 20:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-07 09:00

==================== End Of Log ============================

--- --- ---

cosinus 13.08.2014 10:18

Ok, prüf mal ob die Proxyeinstellung so bleibt wie gewollt

weti 13.08.2014 10:20

Nein, der Proxy war wieder aktiviert

cosinus 13.08.2014 10:35

Welche(r) Browser?

weti 13.08.2014 10:47

Lieber Cosinus,
ich bin nun etwas verwirrt, denn nachdem du gefragt hast, habe ich den Chrome gestartet - und siehe da er hat eine Internetverbindung aufgebaut obwohl der Proxy aktiviert war.

Ich habe dann mal einen Neustart gemacht - der Proxy ist immer noch aktiviert und Chrome und IE funzen trotzdem!

Ist das Problem jetzt gelöst - oder muss ich mir weiter Gedanken machen wegen des aktivierten Proxys UND böser Tierchen? Und soll ich das aktiviert lassen?

cosinus 13.08.2014 11:05

Der Proxy ist sowohl im IE also auch im Chrome noch aktiv? :wtf:
Sicher? Machst mal nen aktuellen Screenshot davon direkt anch Neustart?

weti 13.08.2014 11:17

Liste der Anhänge anzeigen (Anzahl: 2)
Die Verwirrung nimmt kein Ende:
In den Interneteinstellungen aus der Systemsteuerung ist er nicht aktiviert
In Chrome und IE aber ist er aktiviert - aber die Verbindung funzt trotzdem

siehe beil. screenshots, wobei ich mir den IE spare, den nutze ich sowieso fast nie

cosinus 13.08.2014 11:40

Es sollte so wie folgt aussehen...




Falsche Proxy Einstellungen entfernen
  • Klicke im Start-Menü unter "Einstellungen" auf "Systemsteuerung" -> "Internetoptionen".
  • Wähle die Karteikarte "Verbindungen->Lan-Einstellungen“ und überprüfe ob bei Proxyserver ein Häkchen steht,
    wenn ja -> Entfernen, dann -> OK (sofern nicht richtige Eintragung)



weti 13.08.2014 12:20

Ich habe es genauso gemacht, wie du gesagt hast. Habe nun auch nochmal einen Neustart gemacht mit Ergebnis, dass der Proxy wieder aktiviert ist, aber Chrome und IE trotzdem funzen.

Sorry - noch was vergessen, was vlcht wichtig ist: der PC startet deutlich schneller und vor allem zwei Anwendungen aus dem Autostart starten wesentlich schneller als vorher (Procall und TK-Suit).

cosinus 13.08.2014 12:48

Also. Im FRST Log hab ich nichts mehr zu nem Proxy gesehen.
Deine Einstellung sollte jetzt zwar so passen ist aber strange. Du hast da zB einen Haken gesetzt, das Feld dadrunter wo man den Proxy definiert ist aber immer noch ausgegraut und damit deaktiviert. Was steht denn bei Erweitert?

Chrome ist so eingestellt, dass er kein Proxy oder Systemeinstellungen verwendet, ist das wurscht weil er beim Reboot eh wieder seinen eigenen Kopf hat? :wtf:

Und nochmal die Frage, hing dieser Rechner mal in einer Windows-Server-Domain?

weti 13.08.2014 12:53

Die Einstellungen waren genauso wie beim ersten screenshot, die Boxen zwar ausgegraut aber unter erweitert die IP 127.0.0.1 Port 8877.
Da hat sich also nichts geändert. Geändert hat sich nur, dass das jetzt dem Chrome völlig egal zu sein scheint und trotzdem eine Verbindung herstellt.

Ich weiß zwar immer noch nicht genau, was mit einer Windows-Server-Domain gemeint ist, würde aber mal behaupten 'nein'. Der Rechner wurde von mir gekauft, hat nirgends woanders gestanden und wurde nur im Heimnetzwerk betrieben.

Und vor allem - es hat ja ca 2 Jahre funktioniert!

cosinus 13.08.2014 14:43

Mehr wollte ich nicht wissen ;)

Die wirkliche Ursache konnte ich noch nicht ausfindig machen. Ich schlage Kontrollscans mit MBAM und ESET vor während ich nach weiteren mögliche Ursachen forsche

Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.




ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


weti 13.08.2014 19:05

MBAM hat nichts gefunden.
Eset läuft noch. Schon seit 40 Minuten und ist erst bei ca 25% im Schritt 3 von 4, Bisher eine Bedrohung erkannt: NSIS/StartPge.CC Trojaner.
Soll ich die ganze Zeit ohne aktiven Virenscanner und Firewall laufen lassen? Ist mir ja ein bisschen mulmig!

MBAM = keinen Fund

hier eset:
Code:

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=abe5677a3251ae48aabc6b84682142d4
# engine=19638
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-08-13 05:49:48
# local_time=2014-08-13 07:49:48 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='BullGuard Antivirus'
# compatibility_mode=4611 16777215 100 96 25199 67248098 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 35877 159582038 0 0
# scanned=335911
# found=14
# cleaned=0
# scan_time=10315
sh=E79CE0DA43C79F2A4E48A4F4A02905DE783FBD16 ft=1 fh=a9eb553813c219ce vn="NSIS/StartPage.CC Trojaner" ac=I fn="D:\Download\Aktuell\vlc-2.1.4-win64.exe"
sh=122C420D5BEA4A475E2BFE7451A9141984D5563B ft=1 fh=6369d34d5890de0d vn="Win32/Systweak.D evtl. unerwünschte Anwendung" ac=I fn="E:\Download\Aktuell\rcpsetup_2005.exe"
sh=E79CE0DA43C79F2A4E48A4F4A02905DE783FBD16 ft=1 fh=a9eb553813c219ce vn="NSIS/StartPage.CC Trojaner" ac=I fn="E:\Download\Aktuell\vlc-2.1.4-win64.exe"
sh=3B232FFEE48A9235B2ABDB7F780898B99C881B9A ft=1 fh=a69526e0f5d72c42 vn="Variante von Win32/Adware.ToolPlugin.A Anwendung" ac=I fn="E:\GKT-Service\Medien\Gassner\Engel für Opa.exe"
sh=5990317D528D5F527A448371137A97681C8EC499 ft=0 fh=0000000000000000 vn="Variante von Win32/InstallShare.A evtl. unerwünschte Anwendung" ac=I fn="H:\ADMIN-PC\Backup Set 2014-01-26 190001\Backup Files 2014-01-26 190001\Backup files 18.zip"
sh=9F67660F00C5C012C0B68B3664760D8E8651FA97 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="H:\ADMIN-PC\Backup Set 2014-01-26 190001\Backup Files 2014-01-26 190001\Backup files 19.zip"
sh=7C0C2D9CE493E44DC7B522436758A6898290768D ft=0 fh=0000000000000000 vn="Variante von Win32/InstallShare.A evtl. unerwünschte Anwendung" ac=I fn="H:\ADMIN-PC\Backup Set 2014-03-09 190001\Backup Files 2014-03-09 190001\Backup files 22.zip"
sh=FA5CC75182142315D037E8CB23F19DBB14701EF2 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="H:\ADMIN-PC\Backup Set 2014-03-09 190001\Backup Files 2014-03-09 190001\Backup files 23.zip"
sh=0395D9738E3FCAA14FB20009DF05F42D121475F7 ft=0 fh=0000000000000000 vn="Variante von Win32/InstallShare.A evtl. unerwünschte Anwendung" ac=I fn="H:\ADMIN-PC\Backup Set 2014-04-06 190001\Backup Files 2014-04-06 190001\Backup files 21.zip"
sh=BB03DA633AAF38C401B99871F953187F6F2401B9 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="H:\ADMIN-PC\Backup Set 2014-04-06 190001\Backup Files 2014-04-06 190001\Backup files 22.zip"
sh=DF654F89B96FF2F96DF7425AAA3A2CB856913C13 ft=0 fh=0000000000000000 vn="Variante von Win32/InstallShare.A evtl. unerwünschte Anwendung" ac=I fn="H:\ADMIN-PC\Backup Set 2014-05-18 190001\Backup Files 2014-05-18 190001\Backup files 23.zip"
sh=37C6D7A6FA786D07AAA8D8D2CDC2A874F769354D ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="H:\ADMIN-PC\Backup Set 2014-05-18 190001\Backup Files 2014-05-18 190001\Backup files 24.zip"
sh=258767581163DEBCEEF9BDE86609ADBD52076891 ft=0 fh=0000000000000000 vn="Variante von Win32/InstallShare.A evtl. unerwünschte Anwendung" ac=I fn="H:\ADMIN-PC\Backup Set 2014-06-22 190001\Backup Files 2014-06-22 190001\Backup files 22.zip"
sh=103995CFB3AF3648146C8618EF7619A577EA3937 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="H:\ADMIN-PC\Backup Set 2014-06-22 190001\Backup Files 2014-06-22 190001\Backup files 23.zip"


cosinus 13.08.2014 22:45

Zitat:

E:\GKT-Service\Medien\Gassner\Engel für Opa.exe
WAsndas? :wtf:

weti 14.08.2014 08:08

Das ist ein Film über eine 24-Stundenbetreuung von der Redaktion 37 Grad. Brauch ich aber nicht mehr, da ich den Film auf DVD habe

cosinus 14.08.2014 08:22

Ein Film? Nach einem Film sieht mir das nicht aus. Das ist ne Datei mit der Endung exe, also ein Programm.

Weitere Hinweise zu deinem Proxy hab ich so noch nicht. Du anderen Funde sind alte Backup-Sets, die zu VLC liegen offensichtlich darin begründet, dass du VLC nicht von der Originalseite videolang, sondern vlc.de geladen hast. Letztere ist bekannt dafür, veränderte VLC-Setups auszuliefern um die Browserstartseite abzuändern.

weti 14.08.2014 08:35

Ok. Die exe-Datei kann ich ja löschen - oder soll ich sie shreddern?
Und was ist mit den anderen Tierchen, die Eset gefunden hat? Auch einfach die Dateien löschen oder schreddern?

cosinus 14.08.2014 09:08

Einfaches löschen sollte reichen, "shreddern" macht nur aus Datenschutzgründen Sinn, damit niemand mehr etwas über forensische Tools wiederherstellen kann.

weti 14.08.2014 09:14

ok. Mach ich. Dann die letzten Fragen:
1. soll ich dann den Proxy aktiviert lassen (solange wie alles funzt) oder soll ich es weiter manuell deaktivieren?
2. in einigen screenshots von dir war in den Interneteinstellungen die Box "Einstellungen automatisch erkennen" aktiviert. Soll ich das auch mal versuchen?

Wie du siehst, tu ich nicht ohne ausdrückliche Erlaubnis :applaus:

cosinus 14.08.2014 10:08

Zitat:

2. in einigen screenshots von dir war in den Interneteinstellungen die Box "Einstellungen automatisch erkennen" aktiviert. Soll ich das auch mal versuchen?
Das kannst du gern mal ausprobieren und schauen ob beim Reboot wieder alles über den Haufen geschmissen wird

weti 14.08.2014 12:50

Lieber cosinus, :dankeschoen:

auch wenn letztlich das Problem nicht ganz gelöst wurde: ich danke dir erstmal sehr herzlich für deine kompetente und prompte Hilfe. Ich habe mich immer sehr sicher bei dir gefühlt. Überhaupt finde ich das TB einfach nur klasse.
Spende ist unterwegs.

cosinus 14.08.2014 15:45

Naja, wenn du willst, kannst du nochmal nen aktuellen adwCleaner neu runterladen und daurchlaufen lassen. Wenn der nicht fündig wird wäre ein Durchsuchen der Reg mit systemlook vllt noch ne Idee.

weti 18.08.2014 15:06

Hallo Cosinus,
zu deiner Info: Die "Einstellungen automatisch erkennen' hat auch nichts gebracht.
Bei systemlook brauche ich wohl deine Hilfe, denn ich werde beim Start nach einem Script gefragt.

cosinus 19.08.2014 09:53

Ok, schaun wir mal


Lade dir die passende Version von SystemLook vom folgenden Spiegel herunter und speichere das Tool auf dem Desktop:
SystemLook (32 bit) | SystemLook (64 bit)
  • Doppelklicke auf die SystemLook.exe, um das Tool zu starten.
  • Kopiere den Inhalt der folgenden Codebox in das Textfeld des Tools:
    Code:

    :regfind
    proxyserver

    :reg
    HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings /sub
    HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings /sub

  • Klicke nun auf den Button Look, um den Scan zu starten.
  • Der Suchlauf kann einige Zeit dauern.
  • Wenn der Suchlauf beendet ist, wird sich dein Editor mit den Ergebnissen öffnen, poste diese in deinen Thread.
  • Die Ergebnisse werden auch auf dem Desktop als SystemLook.txt gespeichert.


weti 19.08.2014 10:09

Der Logtext ist zu lang, deshalb ausnahmsweise als Anlage:
Die Anlage ist auch zu groß. Was tun?

cosinus 19.08.2014 10:14

Wie groß ist das Log denn (in Kilobyte)?

weti 19.08.2014 10:18

341 KB, der Text hat 175.000 Zeichen.
Soll ich den Text in zwei teile posten?

cosinus 19.08.2014 10:20

Na, das ist noch nicht so groß, das solltest du in drei Beiträgen verteilt hier gepostet bekommen

weti 19.08.2014 10:29

SystemLook 30.07.11 by jpshortstuff
Log created at 11:02 on 19/08/2014 by Admin
Administrator - Elevation successful

========== regfind ==========

Searching for "proxyserver"
[HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\Internet]
"UseRWHlinkNavigation"="http://www.trojaner-board.de/157489-...new-post.html"
[HKEY_CURRENT_USER\Software\Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"=""
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"="http=127.0.0.1:8877;https=127.0.0.1:8877"
[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"="http=127.0.0.1:8877;https=127.0.0.1:8877"
[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"="http=127.0.0.1:8877;https=127.0.0.1:8877"
[HKEY_USERS\S-1-5-21-79635218-2301998975-3311727660-1000\Software\Microsoft\Office\14.0\Common\Internet]
"UseRWHlinkNavigation"="http://www.trojaner-board.de/157489-...new-post.html"
[HKEY_USERS\S-1-5-21-79635218-2301998975-3311727660-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"="http=127.0.0.1:8877;https=127.0.0.1:8877"
[HKEY_USERS\S-1-5-21-79635218-2301998975-3311727660-1000\Software\Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"="http=127.0.0.1:8877;https=127.0.0.1:8877"
[HKEY_USERS\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"="http=127.0.0.1:8877;https=127.0.0.1:8877"
[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"="http=127.0.0.1:8877;https=127.0.0.1:8877"

========== reg ==========

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"IE5_UA_Backup_Flag"="5.0"
"User Agent"="Mozilla/4.0 (compatible; MSIE 8.0; Win32)"
"EmailName"="User@"
"PrivDiscUiShown"= 0x0000000001 (1)
"EnableHttp1_1"= 0x0000000001 (1)
"WarnOnIntranet"= 0x0000000001 (1)
"MimeExclusionListForCache"="multipart/mixed multipart/x-mixed-replace multipart/x-byteranges "
"AutoConfigProxy"="wininet.dll"
"UseSchannelDirectly"=01 00 00 00 (REG_BINARY)
"WarnOnPost"=01 00 00 00 (REG_BINARY)
"UrlEncoding"= 0x0000000000 (0)
"SecureProtocols"= 0x0000000aa0 (2720)
"PrivacyAdvanced"= 0x0000000000 (0)
"ZonesSecurityUpgrade"=75 3a 48 3b d0 e5 ce 01 (REG_BINARY)
"DisableCachingOfSSLPages"= 0x0000000000 (0)
"WarnonZoneCrossing"= 0x0000000001 (1)
"CertificateRevocation"= 0x0000000001 (1)
"EnableNegotiate"= 0x0000000001 (1)
"MigrateProxy"= 0x0000000001 (1)
"ProxyEnable"= 0x0000000001 (1)
"GlobalUserOffline"= 0x0000000000 (0)
"WarnonBadCertRecving"= 0x0000000001 (1)
"WarnOnPostRedirect"= 0x0000000000 (0)
"WarnOnHTTPSToHTTPRedirect"= 0x0000000001 (1)
"ProxyOverride"="www;http;https"
"ProxyServer"="http=127.0.0.1:8877;https=127.0.0.1:8877"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache]
"Signature"="Client UrlCache MMF Ver 5.2"
"ContentLimit"= 0x00000000fa (250)
"TotalContentLimit"= 0x0000000000 (0)
"AppContainerTotalContentLimit"= 0x00000003e8 (1000)
"AppContainerContentLimit"= 0x0000000032 (50)
"Version"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix"=""
"CacheLimit"= 0x000003e800 (256000)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix"="Cookie:"
"CacheLimit"= 0x0000002000 (8192)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\DNTException]
"CachePrefix"="DNTException:"
"CachePath"="%APPDATA%\Microsoft\Windows\DNTException"
"CacheOptions"= 0x0000000300 (768)
"CacheRepair"= 0x0000000000 (0)
"CacheLimit"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\DOMStore]
"CachePath"="%USERPROFILE%\AppData\Local\Microsoft\Internet Explorer\DOMStore"
"CachePrefix"="DOMStore"
"CacheLimit"= 0x00000003e8 (1000)
"CacheOptions"= 0x0000000008 (8)
"CacheRepair"= 0x0000000000 (0)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\EmieSiteList]
"CachePrefix"="EmieSiteList:"
"CachePath"="%USERPROFILE%\AppData\Local\EmieSiteList"
"CacheOptions"= 0x0000000300 (768)
"CacheRepair"= 0x0000000000 (0)
"CacheLimit"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\EmieUserList]
"CachePrefix"="EmieUserList:"
"CachePath"="%USERPROFILE%\AppData\Local\EmieUserList"
"CacheOptions"= 0x0000000300 (768)
"CacheRepair"= 0x0000000000 (0)
"CacheLimit"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\feedplat]
"CachePath"="%USERPROFILE%\AppData\Local\Microsoft\Feeds Cache"
"CachePrefix"="feedplat:"
"CacheLimit"= 0x0000002000 (8192)
"CacheOptions"= 0x0000000000 (0)
"CacheRepair"= 0x0000000000 (0)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\iecompat]
"CachePrefix"="iecompat:"
"CachePath"="%APPDATA%\Microsoft\Windows\IECompatCache"
"CacheOptions"= 0x0000000309 (777)
"CacheRepair"= 0x0000000000 (0)
"CacheLimit"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\iecompatua]
"CachePrefix"="iecompatua:"
"CachePath"="%APPDATA%\Microsoft\Windows\iecompatuaCache"
"CacheOptions"= 0x0000000309 (777)
"CacheRepair"= 0x0000000000 (0)
"CacheLimit"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\iedownload]
"CachePath"="%APPDATA%\Microsoft\Windows\IEDownloadHistory"
"CachePrefix"="iedownload:"
"CacheLimit"= 0x0000002000 (8192)
"CacheOptions"= 0x0000000009 (9)
"CacheRepair"= 0x0000000000 (0)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\ietld]
"CachePath"="%APPDATA%\Microsoft\Windows\IETldCache"
"CachePrefix"="ietld:"
"CacheLimit"= 0x0000002000 (8192)
"CacheOptions"= 0x0000000009 (9)
"CacheRepair"= 0x0000000000 (0)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014072820140804]
"CachePrefix"=":2014072820140804: "
"CachePath"="%USERPROFILE%\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012014072820140804"
"CacheOptions"= 0x000000000b (11)
"CacheRepair"= 0x0000000000 (0)
"CacheLimit"= 0x0000002000 (8192)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014080420140811]
"CachePrefix"=":2014080420140811: "
"CachePath"="%USERPROFILE%\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012014080420140811"
"CacheOptions"= 0x000000000b (11)
"CacheRepair"= 0x0000000000 (0)
"CacheLimit"= 0x0000002000 (8192)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014081120140818]
"CachePrefix"=":2014081120140818: "
"CachePath"="%USERPROFILE%\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012014081120140818"
"CacheOptions"= 0x000000000b (11)
"CacheRepair"= 0x0000000000 (0)
"CacheLimit"= 0x0000002000 (8192)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014081820140819]
"CachePrefix"=":2014081820140819: "
"CachePath"="%USERPROFILE%\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012014081820140819"
"CacheOptions"= 0x000000000b (11)
"CacheRepair"= 0x0000000000 (0)
"CacheLimit"= 0x0000002000 (8192)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\PrivacIE:]
"CachePath"="%APPDATA%\Microsoft\Windows\PrivacIE"
"CachePrefix"="PrivacIE:"
"CacheLimit"= 0x0000000400 (1024)
"CacheOptions"= 0x0000000009 (9)
"CacheRepair"= 0x0000000000 (0)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\UserData]
"CachePath"="%APPDATA%\Microsoft\Internet Explorer\UserData"
"CachePrefix"="UserData"
"CacheLimit"= 0x00000003e8 (1000)
"CacheOptions"= 0x0000000008 (8)
"CacheRepair"= 0x0000000000 (0)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix"="Visited:"
"CacheLimit"= 0x0000002000 (8192)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache]
"Signature"="Client UrlCache MMF Ver 5.2"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Content]
"CachePrefix"=""
"CacheLimit"= 0x000003e800 (256000)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Cookies]
"CachePrefix"="Cookie:"
"CacheLimit"= 0x0000002000 (8192)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Extensible Cache]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Extensible Cache\DNTException]
"CachePrefix"="DNTException:"
"CachePath"="%APPDATA%\Microsoft\Windows\DNTException\Low"
"CacheOptions"= 0x0000000300 (768)
"CacheRepair"= 0x0000000000 (0)
"CacheLimit"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Extensible Cache\DOMStore]
"CachePath"="%USERPROFILE%\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore"
"CachePrefix"="DOMStore"
"CacheLimit"= 0x00000003e8 (1000)
"CacheOptions"= 0x0000000008 (8)
"CacheRepair"= 0x0000000000 (0)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Extensible Cache\EmieSiteList]
"CachePrefix"="EmieSiteList:"
"CachePath"="%USERPROFILE%\AppData\LocalLow\EmieSiteList"
"CacheOptions"= 0x0000000300 (768)
"CacheRepair"= 0x0000000000 (0)
"CacheLimit"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Extensible Cache\EmieUserList]
"CachePrefix"="EmieUserList:"
"CachePath"="%USERPROFILE%\AppData\LocalLow\EmieUserList"
"CacheOptions"= 0x0000000300 (768)
"CacheRepair"= 0x0000000000 (0)
"CacheLimit"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Extensible Cache\iecompat]
"CachePrefix"="iecompat:"
"CachePath"="%APPDATA%\Microsoft\Windows\IECompatCache\Low"
"CacheOptions"= 0x0000000309 (777)
"CacheRepair"= 0x0000000000 (0)
"CacheLimit"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Extensible Cache\iecompatua]
"CachePrefix"="iecompatua:"
"CachePath"="%APPDATA%\Microsoft\Windows\iecompatuaCache\Low"
"CacheOptions"= 0x0000000309 (777)
"CacheRepair"= 0x0000000000 (0)
"CacheLimit"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Extensible Cache\ietld]
"CachePath"="%APPDATA%\Microsoft\Windows\IETldCache\Low"
"CachePrefix"="ietld:"
"CacheLimit"= 0x0000002000 (8192)
"CacheOptions"= 0x0000000009 (9)
"CacheRepair"= 0x0000000000 (0)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Extensible Cache\PrivacIE:]
"CachePath"="%APPDATA%\Microsoft\Windows\PrivacIE\Low"
"CachePrefix"="PrivacIE:"
"CacheLimit"= 0x0000000400 (1024)
"CacheOptions"= 0x0000000009 (9)
"CacheRepair"= 0x0000000000 (0)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\History]
"CachePrefix"="Visited:"
"CacheLimit"= 0x0000002000 (8192)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\post platform]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\CACHE]
"Persistent"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings"=46 00 00 00 11 17 00 00 09 00 00 00 00 00 00 00 0e 00 00 00 77 77 77 3b 68 74 74 70 3b 68 74 74 70 73 00 00 00 00 05 00 00 00 00 00 00 00 a1 4c 73 21 ba 56 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 02 00 00 00 c0 a8 02 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 17 00 00 00 00 00 00 00 20 01 00 00 5e f5 79 fd 1c 1b 1d 06 3f 57 fd e1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 (REG_BINARY)
"SavedLegacySettings"=46 00 00 00 aa 36 00 00 09 00 00 00 00 00 00 00 0e 00 00 00 77 77 77 3b 68 74 74 70 3b 68 74 74 70 73 00 00 00 00 05 00 00 00 00 00 00 00 a1 4c 73 21 ba 56 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 02 00 00 00 c0 a8 02 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 17 00 00 00 00 00 00 00 20 01 00 00 5e f5 79 fd 1c 1b 1d 06 3f 57 fd e1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 (REG_BINARY)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0]
@=""
"DisplayName"="Computer"
"PMDisplayName"="Computer [Protected Mode]"
"Description"="Your computer"
"Icon"="shell32.dll#0016"
"LowIcon"="inetcpl.cpl#005422"
"CurrentLevel"= 0x0000000000 (0)
"Flags"= 0x0000000021 (33)
"1200"= 0x0000000003 (3)
"1400"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1]
@=""
"DisplayName"="Local intranet"
"PMDisplayName"="Local intranet [Protected Mode]"
"Description"="This zone contains all Web sites that are on your organization's intranet."
"Icon"="shell32.dll#0018"
"LowIcon"="inetcpl.cpl#005423"
"CurrentLevel"= 0x0000000000 (0)
"Flags"= 0x00000000db (219)
"1200"= 0x0000000003 (3)
"1400"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2]
@=""
"DisplayName"="Trusted sites"
"PMDisplayName"="Trusted sites [Protected Mode]"
"Description"="This zone contains Web sites that you trust not to damage your computer or data."
"Icon"="inetcpl.cpl#00004480"
"LowIcon"="inetcpl.cpl#005424"
"CurrentLevel"= 0x0000000000 (0)
"Flags"= 0x0000000021 (33)
"1200"= 0x0000000003 (3)
"1400"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3]
@=""
"DisplayName"="Internet"
"PMDisplayName"="Internet [Protected Mode]"
"Description"="This zone contains all Web sites you haven't placed in other zones"
"Icon"="inetcpl.cpl#001313"
"LowIcon"="inetcpl.cpl#005425"
"CurrentLevel"= 0x0000000000 (0)
"Flags"= 0x0000000021 (33)
"1200"= 0x0000000003 (3)
"1400"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4]
@=""
"DisplayName"="Restricted sites"
"PMDisplayName"="Restricted sites [Protected Mode]"
"Description"="This zone contains Web sites that could potentially damage your computer or data."
"Icon"="inetcpl.cpl#00004481"
"LowIcon"="inetcpl.cpl#005426"
"CurrentLevel"= 0x0000000000 (0)
"Flags"= 0x0000000021 (33)
"1200"= 0x0000000003 (3)
"1400"= 0x0000000003 (3)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Passport]
"NumRegistrationRuns"= 0x0000000006 (6)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Passport\LowDAMap]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Protocols]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Protocols\Mailto]
"UTF8Encoding"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\TemplatePolicies]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\TemplatePolicies\High]
"1400"= 0x0000000003 (3)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad]
"WpadLastNetwork"="{62F3D355-17BC-4659-AD54-81F97F8B860F}"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-1f-3f-35-cc-dc]
"WpadDecisionReason"= 0x0000000001 (1)
"WpadDecisionTime"=9a c4 e2 84 f6 c4 ce 01 (REG_BINARY)
"WpadDecision"= 0x0000000000 (0)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-1f-3f-35-cc-dc_9c-c7-a6-0d-aa-9b]
"WpadDecisionReason"= 0x0000000001 (1)
"WpadDecisionTime"=54 03 c0 56 76 71 ce 01 (REG_BINARY)
"WpadDecision"= 0x0000000000 (0)
"WpadDetectedUrl"=""

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9c-c7-a6-0d-aa-9b]
"WpadDecisionReason"= 0x0000000001 (1)
"WpadDecisionTime"=41 a4 36 2e 8c bb cf 01 (REG_BINARY)
"WpadDecision"= 0x0000000000 (0)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c0-25-06-2b-61-5d]
"WpadDecisionReason"= 0x0000000001 (1)
"WpadDecisionTime"=10 3d c5 c6 b5 74 cd 01 (REG_BINARY)
"WpadDecision"= 0x0000000000 (0)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1F3EECBD-495D-4D6D-990C-6631219E58E6}_{73EB4C80-49FD-452D-B285-3DCD3FC2BDB5}]
"WpadDecisionReason"= 0x0000000001 (1)
"WpadDecisionTime"=cc f3 bf 70 24 ed ce 01 (REG_BINARY)
"WpadDecision"= 0x0000000000 (0)
"WpadNetworkName"="Netzwerk 3"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{214D255B-9B82-4507-83F0-B99D43C0520D}]
"WpadDecisionReason"= 0x0000000001 (1)
"WpadDecisionTime"=10 3d c5 c6 b5 74 cd 01 (REG_BINARY)
"WpadDecision"= 0x0000000000 (0)
"WpadNetworkName"="Netzwerk"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{214D255B-9B82-4507-83F0-B99D43C0520D}\c0-25-06-2b-61-5d]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{62F3D355-17BC-4659-AD54-81F97F8B860F}]
"WpadDecisionReason"= 0x0000000001 (1)
"WpadDecisionTime"=9a c4 e2 84 f6 c4 ce 01 (REG_BINARY)
"WpadDecision"= 0x0000000000 (0)
"WpadNetworkName"="Netzwerk 2"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{62F3D355-17BC-4659-AD54-81F97F8B860F}\00-1f-3f-35-cc-dc]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{62F3D355-17BC-4659-AD54-81F97F8B860F}_{73EB4C80-49FD-452D-B285-3DCD3FC2BDB5}]
"WpadDecisionReason"= 0x0000000001 (1)
"WpadDecisionTime"=54 03 c0 56 76 71 ce 01 (REG_BINARY)
"WpadDecision"= 0x0000000000 (0)
"WpadNetworkName"="Netzwerk 2"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{62F3D355-17BC-4659-AD54-81F97F8B860F}_{73EB4C80-49FD-452D-B285-3DCD3FC2BDB5}\00-1f-3f-35-cc-dc_9c-c7-a6-0d-aa-9b]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{73EB4C80-49FD-452D-B285-3DCD3FC2BDB5}]
"WpadDecisionReason"= 0x0000000001 (1)
"WpadDecisionTime"=41 a4 36 2e 8c bb cf 01 (REG_BINARY)
"WpadDecision"= 0x0000000000 (0)
"WpadNetworkName"="Netzwerk 3"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{73EB4C80-49FD-452D-B285-3DCD3FC2BDB5}\9c-c7-a6-0d-aa-9b]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet"= 0x0000000001 (1)
"AutoDetect"= 0x0000000001 (1)
@=""
"ProxyBypass"= 0x0000000001 (1)
"IntranetName"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]
@=""

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\fritz.box]
"*"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\microsoft.com]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\microsoft.com\*.update]
"http"= 0x0000000002 (2)
"https"= 0x0000000002 (2)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults]
@=""
"http"= 0x0000000003 (3)
"https"= 0x0000000003 (3)
"ftp"= 0x0000000003 (3)
"file"= 0x0000000003 (3)
"@ivt"= 0x0000000001 (1)
"shell"= 0x0000000000 (0)
"knownfolder"= 0x0000000000 (0)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges]
@=""

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range1]
"*"= 0x0000000001 (1)
":Range"="192.168.178.1"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones]
@=""
"SecuritySafe"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]
"2004"= 0x0000000003 (3)
"2001"= 0x0000000003 (3)
@=""
"DisplayName"="Computer"
"PMDisplayName"="Computer [Protected Mode]"
"Description"="Your computer"
"Icon"="shell32.dll#0016"
"LowIcon"="inetcpl.cpl#005422"
"CurrentLevel"= 0x0000000000 (0)
"Flags"= 0x0000000021 (33)
"1200"= 0x0000000000 (0)
"1400"= 0x0000000000 (0)
"2007"= 0x0000000003 (3)
"1001"= 0x0000000000 (0)
"1004"= 0x0000000000 (0)
"1201"= 0x0000000001 (1)
"1206"= 0x0000000000 (0)
"1402"= 0x0000000000 (0)
"1405"= 0x0000000000 (0)
"1406"= 0x0000000000 (0)
"1407"= 0x0000000000 (0)
"1601"= 0x0000000000 (0)
"1604"= 0x0000000000 (0)
"1605"= 0x0000000000 (0)
"1606"= 0x0000000000 (0)
"1607"= 0x0000000000 (0)
"1608"= 0x0000000000 (0)
"1609"= 0x0000000001 (1)
"1800"= 0x0000000000 (0)
"1802"= 0x0000000000 (0)
"1803"= 0x0000000000 (0)
"1804"= 0x0000000000 (0)
"1805"= 0x0000000000 (0)
"1806"= 0x0000000000 (0)
"1807"= 0x0000000000 (0)
"1808"= 0x0000000000 (0)
"1809"= 0x0000000003 (3)
"1A00"= 0x0000000000 (0)
"1A02"= 0x0000000000 (0)
"1A03"= 0x0000000000 (0)
"1A04"= 0x0000000000 (0)
"1A05"= 0x0000000000 (0)
"1A06"= 0x0000000000 (0)
"1A10"= 0x0000000000 (0)
"1C00"= 0x0000020000 (131072)
"1E05"= 0x0000030000 (196608)
"2100"= 0x0000000000 (0)
"2101"= 0x0000000003 (3)
"2102"= 0x0000000000 (0)
"2200"= 0x0000000000 (0)
"2201"= 0x0000000000 (0)
"2300"= 0x0000000001 (1)
"2000"= 0x0000000000 (0)
"1207"= 0x0000000000 (0)
"1208"= 0x0000000000 (0)
"1209"= 0x0000000000 (0)
"120A"= 0x0000000000 (0)
"1408"= 0x0000000000 (0)
"160A"= 0x0000000000 (0)
"180A"= 0x0000000000 (0)
"180C"= 0x0000000000 (0)
"180D"= 0x0000000000 (0)
"2301"= 0x0000000003 (3)
"2103"= 0x0000000000 (0)
"2104"= 0x0000000000 (0)
"2105"= 0x0000000000 (0)
"2400"= 0x0000000000 (0)
"2401"= 0x0000000000 (0)
"2402"= 0x0000000000 (0)
"2600"= 0x0000000000 (0)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1]
"2004"= 0x0000000000 (0)
"2001"= 0x0000000000 (0)
@=""
"DisplayName"="Local intranet"
"PMDisplayName"="Local intranet [Protected Mode]"
"Description"="This zone contains all Web sites that are on your organization's intranet."
"Icon"="shell32.dll#0018"
"LowIcon"="inetcpl.cpl#005423"
"CurrentLevel"= 0x0000010500 (66816)
"Flags"= 0x00000001db (475)
"1200"= 0x0000000000 (0)
"1400"= 0x0000000000 (0)
"2500"= 0x0000000003 (3)
"2007"= 0x0000010000 (65536)
"1001"= 0x0000000001 (1)
"1004"= 0x0000000003 (3)
"1201"= 0x0000000003 (3)
"1206"= 0x0000000000 (0)
"1402"= 0x0000000000 (0)
"1405"= 0x0000000000 (0)
"1406"= 0x0000000001 (1)
"1407"= 0x0000000000 (0)
"1601"= 0x0000000000 (0)
"1604"= 0x0000000000 (0)
"1605"= 0x0000000000 (0)
"1606"= 0x0000000000 (0)
"1607"= 0x0000000000 (0)
"1608"= 0x0000000000 (0)
"1609"= 0x0000000001 (1)
"1800"= 0x0000000001 (1)
"1802"= 0x0000000000 (0)
"1803"= 0x0000000000 (0)
"1804"= 0x0000000001 (1)
"1805"= 0x0000000000 (0)
"1806"= 0x0000000000 (0)
"1807"= 0x0000000000 (0)
"1808"= 0x0000000000 (0)
"1809"= 0x0000000003 (3)
"1A00"= 0x0000020000 (131072)
"1A02"= 0x0000000000 (0)
"1A03"= 0x0000000000 (0)
"1A04"= 0x0000000000 (0)
"1A05"= 0x0000000000 (0)
"1A06"= 0x0000000000 (0)
"1A10"= 0x0000000000 (0)
"1C00"= 0x0000020000 (131072)
"1E05"= 0x0000020000 (131072)
"2100"= 0x0000000000 (0)
"2101"= 0x0000000000 (0)
"2102"= 0x0000000000 (0)
"2200"= 0x0000000000 (0)
"2201"= 0x0000000000 (0)
"2300"= 0x0000000001 (1)
"2000"= 0x0000000000 (0)
"1207"= 0x0000000000 (0)
"1208"= 0x0000000000 (0)
"1209"= 0x0000000000 (0)
"120A"= 0x0000000003 (3)
"1408"= 0x0000000000 (0)
"160A"= 0x0000000000 (0)
"180A"= 0x0000000000 (0)
"180C"= 0x0000000000 (0)
"180D"= 0x0000000000 (0)
"2301"= 0x0000000003 (3)
"2103"= 0x0000000000 (0)
"2104"= 0x0000000000 (0)
"2105"= 0x0000000000 (0)
"2400"= 0x0000000000 (0)
"2401"= 0x0000000000 (0)
"2402"= 0x0000000000 (0)
"2600"= 0x0000000000 (0)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]
"2001"= 0x0000000000 (0)
"2004"= 0x0000000000 (0)
@=""
"DisplayName"="Trusted sites"
"PMDisplayName"="Trusted sites [Protected Mode]"
"Description"="This zone contains Web sites that you trust not to damage your computer or data."
"Icon"="inetcpl.cpl#00004480"
"LowIcon"="inetcpl.cpl#005424"
"CurrentLevel"= 0x0000011000 (69632)
"Flags"= 0x0000000047 (71)
"1200"= 0x0000000000 (0)
"1400"= 0x0000000000 (0)
"1001"= 0x0000000001 (1)
"1004"= 0x0000000003 (3)
"1201"= 0x0000000003 (3)
"1206"= 0x0000000003 (3)
"1207"= 0x0000000000 (0)
"1208"= 0x0000000000 (0)
"1209"= 0x0000000003 (3)
"120A"= 0x0000000003 (3)
"1402"= 0x0000000000 (0)
"1405"= 0x0000000000 (0)
"1406"= 0x0000000003 (3)
"1407"= 0x0000000001 (1)
"1408"= 0x0000000000 (0)
"1409"= 0x0000000000 (0)
"1601"= 0x0000000000 (0)
"1604"= 0x0000000000 (0)
"1605"= 0x0000000000 (0)
"1606"= 0x0000000000 (0)
"1607"= 0x0000000003 (3)
"1608"= 0x0000000000 (0)
"1609"= 0x0000000001 (1)
"160A"= 0x0000000000 (0)
"1800"= 0x0000000001 (1)
"1802"= 0x0000000000 (0)
"1803"= 0x0000000000 (0)
"1804"= 0x0000000001 (1)
"1809"= 0x0000000000 (0)
"1A00"= 0x0000020000 (131072)
"1A02"= 0x0000000000 (0)
"1A03"= 0x0000000000 (0)
"1A04"= 0x0000000003 (3)
"1A05"= 0x0000000001 (1)
"1A06"= 0x0000000000 (0)
"1C00"= 0x0000010000 (65536)
"2000"= 0x0000000000 (0)
"2005"= 0x0000000000 (0)
"2100"= 0x0000000000 (0)
"2101"= 0x0000000000 (0)
"2102"= 0x0000000003 (3)
"2103"= 0x0000000000 (0)
"2104"= 0x0000000000 (0)
"2105"= 0x0000000000 (0)
"2106"= 0x0000000000 (0)
"2200"= 0x0000000003 (3)
"2201"= 0x0000000003 (3)
"2300"= 0x0000000001 (1)
"2301"= 0x0000000000 (0)
"2400"= 0x0000000000 (0)
"2401"= 0x0000000000 (0)
"2402"= 0x0000000000 (0)
"2600"= 0x0000000000 (0)
"2700"= 0x0000000003 (3)
"2007"= 0x0000010000 (65536)
"2107"= 0x0000000000 (0)
"2701"= 0x0000000000 (0)
"2702"= 0x0000000000 (0)
"2703"= 0x0000000000 (0)
"2708"= 0x0000000003 (3)
"2709"= 0x0000000003 (3)
"1812"= 0x0000000000 (0)
"140A"= 0x0000000000 (0)
"2302"= 0x0000000003 (3)
"270B"= 0x0000000000 (0)
"160B"= 0x0000000000 (0)
"2704"= 0x0000000000 (0)
"2108"= 0x0000000003 (3)
"1805"= 0x0000000001 (1)
"1806"= 0x0000000001 (1)
"1807"= 0x0000000001 (1)
"1808"= 0x0000000000 (0)
"1A10"= 0x0000000001 (1)
"1E05"= 0x0000020000 (131072)
"180A"= 0x0000000003 (3)
"180C"= 0x0000000000 (0)
"180D"= 0x0000000000 (0)
"120B"= 0x0000000000 (0)
"270C"= 0x0000000003 (3)
"270D"= 0x0000000000 (0)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
"2004"= 0x0000000000 (0)
"2001"= 0x0000000000 (0)
"{AEBA21FA-782A-4A90-978D-B72164C80120}"=1a 37 61 59 23 52 35 0c 7a 5f 20 17 2f 1e 1a 19 0e 2b 01 73 1e 28 1a 04 1b 0c 3b c2 21 27 53 0d 36 05 2c 05 04 3d 4f 3a 4a 44 33 3a 0a 06 12 68 53 7c 20 13 35 5d 4c 10 27 01 56 7a 2d 3f 38 4f 79 0f 16 26 75 53 1c 31 00 56 7a 3e 32 24 4f 79 1b 00 33 71 4d 23 32 29 7c 6a 35 31 34 40 72 3b 01 2e 5d 4c 2a 07 15 48 72 38 12 00 56 7a 3e 16 3c 71 4d 24 33 35 7c 72 35 0e 3c 1a 41 44 19 0f 31 3a 56 7a 2e 3e 31 0c 7c 6a 10 27 0c 05 5d 4c 39 19 12 15 61 54 2e 00 33 32 40 52 03 25 1f 05 5d 4c 2c 0c 0a 15 61 54 1a 26 1f 05 5d 4c 10 21 1d 1b 71 4d 3b 24 3a 21 6d 72 24 16 3c 32 40 72 21 0f 3a 1a 41 44 1b 1e 01 01 71 4d 32 23 30 27 6d 4d 1f 28 10 3c 56 7a 2f 2e 32 16 7c 6a 3a 12 3b 28 75 53 0b 3f 12 01 71 4d 23 32 29 27 75 53 12 30 32 1e 4f 79 12 38 17 01 71 4d 30 3e 37 27 6d 72 38 12 3f 04 41 44 0a 0e 32 28 49 5f 1c 24 0b 1b 36 21 41 7b 5b 24 39 31 7c 6a 2b 0e 25 75 53 1a 2e 26 41 72 34 16 26 71 4d 30 30 3a 7c 6a 07 33 1a 56 7a 3a 00 33 71 4d 23 32 29 7c 6a 1a 26 1a 40 52 24 3f 1a 6d 4d 1c 22 28 75 53 13 25 20 41 44 0a 0e (REG_BINARY)
"1A10"= 0x0000000001 (1)
"{A8A88C49-5EB2-4990-A1A2-0876022C854F}"=1a 37 61 59 23 52 35 0c 7a 5f 20 17 2f 1e 1a 19 0e 2b 01 73 1e 28 1a 04 1b 0c 3b c2 21 2d 53 49 07 25 0f 29 01 7c 50 68 3a 3b 34 4f 79 08 39 0d 49 72 33 1f 39 5d 4c 17 37 05 56 7a 2f 2e 32 4f 79 1f 12 3b 75 53 0b 3f 12 56 7a 3a 20 23 4f 79 12 05 33 71 4d 3a 31 29 7c 6a 2b 08 21 40 72 38 12 3f 5d 4c 39 1d 17 48 72 21 0f 03 56 7a 2f 06 22 32 40 52 2c 29 05 3a 56 7a 2e 3e 31 0c 7c 6a 2b 06 25 32 40 52 33 24 01 32 75 53 0b 3f 32 04 4f 79 1b 3b 1f 0c 40 72 3b 01 2d 1a 75 53 12 30 3f 04 4f 79 08 3f 09 0c 75 53 13 25 20 04 75 53 07 37 17 05 5d 4c 36 0a 1b 3a 56 72 35 0e 3c 3c 56 7a 2d 3f 38 16 7c 6a 17 37 01 1b 5d 4c 2a 0d 18 1f 61 54 12 12 3b 28 40 52 3f 3a 19 34 48 72 20 0c 17 01 71 4d 1a 26 1a 1b 5d 4c 2c 0c 17 01 71 4d 30 3e 37 27 6d 4d 1b 3b 0c 1b 5d 4c 39 1d 17 3c 56 7a 3b 2f 3f 16 15 39 5f 7b 42 29 1d 3c 71 4d 30 06 22 71 4d 32 23 30 7c 6a 2a 1e 19 75 53 1c 31 20 41 72 24 12 3b 71 4d 23 32 24 7c 6a 03 25 17 56 7a 25 05 33 71 4d 3a 31 29 7c 6a 10 21 09 40 52 27 2c 0b 6d 4d 0f 28 2a 75 53 08 3e 23 41 44 1b 1e (REG_BINARY)
@=""
"DisplayName"="Internet"
"PMDisplayName"="Internet [Protected Mode]"
"Description"="This zone contains all Web sites you haven't placed in other zones"
"Icon"="inetcpl.cpl#001313"
"LowIcon"="inetcpl.cpl#005425"
"CurrentLevel"= 0x0000011500 (70912)
"Flags"= 0x0000000001 (1)
"1200"= 0x0000000000 (0)
"1400"= 0x0000000000 (0)
"1001"= 0x0000000001 (1)
"1004"= 0x0000000003 (3)
"1201"= 0x0000000003 (3)
"1206"= 0x0000000003 (3)
"1207"= 0x0000000003 (3)
"1208"= 0x0000000003 (3)
"1209"= 0x0000000003 (3)
"120A"= 0x0000000003 (3)
"1402"= 0x0000000000 (0)
"1405"= 0x0000000000 (0)
"1406"= 0x0000000003 (3)
"1407"= 0x0000000001 (1)
"1408"= 0x0000000003 (3)
"1409"= 0x0000000000 (0)
"1601"= 0x0000000000 (0)
"1604"= 0x0000000000 (0)
"1605"= 0x0000000000 (0)
"1606"= 0x0000000000 (0)
"1607"= 0x0000000003 (3)
"1608"= 0x0000000000 (0)
"1609"= 0x0000000001 (1)
"160A"= 0x0000000003 (3)
"1800"= 0x0000000001 (1)
"1802"= 0x0000000000 (0)
"1803"= 0x0000000000 (0)
"1804"= 0x0000000001 (1)
"1809"= 0x0000000000 (0)
"1A00"= 0x0000020000 (131072)
"1A02"= 0x0000000000 (0)
"1A03"= 0x0000000000 (0)
"1A04"= 0x0000000003 (3)
"1A05"= 0x0000000001 (1)
"1A06"= 0x0000000000 (0)
"1C00"= 0x0000010000 (65536)
"2000"= 0x0000000000 (0)
"2005"= 0x0000000003 (3)
"2100"= 0x0000000000 (0)
"2101"= 0x0000000000 (0)
"2102"= 0x0000000003 (3)
"2103"= 0x0000000003 (3)
"2104"= 0x0000000003 (3)
"2105"= 0x0000000003 (3)
"2106"= 0x0000000000 (0)
"2200"= 0x0000000003 (3)
"2201"= 0x0000000003 (3)
"2300"= 0x0000000001 (1)
"2301"= 0x0000000000 (0)
"2400"= 0x0000000003 (3)
"2401"= 0x0000000000 (0)
"2402"= 0x0000000003 (3)
"2600"= 0x0000000000 (0)
"2700"= 0x0000000000 (0)
"2007"= 0x0000010000 (65536)
"2107"= 0x0000000003 (3)
"2701"= 0x0000000000 (0)
"2702"= 0x0000000000 (0)
"2703"= 0x0000000003 (3)
"2708"= 0x0000000003 (3)
"2709"= 0x0000000003 (3)
"1812"= 0x0000000001 (1)
"140A"= 0x0000000000 (0)
"2302"= 0x0000000003 (3)
"270B"= 0x0000000003 (3)
"160B"= 0x0000000000 (0)
"2704"= 0x0000000000 (0)
"1805"= 0x0000000001 (1)
"1806"= 0x0000000001 (1)
"1807"= 0x0000000001 (1)
"1808"= 0x0000000000 (0)
"1E05"= 0x0000020000 (131072)
"180A"= 0x0000000003 (3)
"180C"= 0x0000000003 (3)
"180D"= 0x0000000001 (1)
"120B"= 0x0000000003 (3)
"270C"= 0x0000000000 (0)
"270D"= 0x0000000003 (3)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4]
"2004"= 0x0000000003 (3)
"2001"= 0x0000000003 (3)
"1400"= 0x0000000003 (3)
"1C00"= 0x0000000000 (0)
"{AEBA21FA-782A-4A90-978D-B72164C80120}"=1a 37 61 59 23 52 35 0c 7a 5f 20 17 2f 1e 1a 19 0e 2b 01 73 13 37 13 12 14 1a 15 39 (REG_BINARY)
"1A10"= 0x0000000003 (3)
"{A8A88C49-5EB2-4990-A1A2-0876022C854F}"=1a 37 61 59 23 52 35 0c 7a 5f 20 17 2f 1e 1a 19 0e 2b 01 73 13 37 13 12 14 1a 15 39 (REG_BINARY)
@=""
"DisplayName"="Restricted sites"
"PMDisplayName"="Restricted sites [Protected Mode]"
"Description"="This zone contains Web sites that could potentially damage your computer or data."
"Icon"="inetcpl.cpl#00004481"
"LowIcon"="inetcpl.cpl#005426"
"CurrentLevel"= 0x0000012000 (73728)
"Flags"= 0x0000000003 (3)
"1200"= 0x0000000003 (3)
"2007"= 0x0000000003 (3)
"1001"= 0x0000000003 (3)
"1004"= 0x0000000003 (3)
"1201"= 0x0000000003 (3)
"1206"= 0x0000000003 (3)
"1402"= 0x0000000003 (3)
"1405"= 0x0000000003 (3)
"1406"= 0x0000000003 (3)
"1407"= 0x0000000003 (3)
"1601"= 0x0000000001 (1)
"1604"= 0x0000000003 (3)
"1605"= 0x0000000000 (0)
"1606"= 0x0000000003 (3)
"1607"= 0x0000000003 (3)
"1608"= 0x0000000003 (3)
"1609"= 0x0000000001 (1)
"1800"= 0x0000000003 (3)
"1802"= 0x0000000001 (1)
"1803"= 0x0000000003 (3)
"1804"= 0x0000000003 (3)
"1805"= 0x0000000001 (1)
"1806"= 0x0000000003 (3)
"1807"= 0x0000000001 (1)
"1808"= 0x0000000000 (0)
"1809"= 0x0000000000 (0)
"1A00"= 0x0000010000 (65536)
"1A02"= 0x0000000003 (3)
"1A03"= 0x0000000003 (3)
"1A04"= 0x0000000003 (3)
"1A05"= 0x0000000003 (3)
"1A06"= 0x0000000003 (3)
"1E05"= 0x0000010000 (65536)
"2100"= 0x0000000003 (3)
"2101"= 0x0000000003 (3)
"2102"= 0x0000000003 (3)
"2200"= 0x0000000003 (3)
"2201"= 0x0000000003 (3)
"2300"= 0x0000000003 (3)
"2000"= 0x0000000003 (3)
"1207"= 0x0000000003 (3)
"1208"= 0x0000000003 (3)
"1209"= 0x0000000003 (3)
"120A"= 0x0000000003 (3)
"1408"= 0x0000000003 (3)
"160A"= 0x0000000003 (3)
"180A"= 0x0000000003 (3)
"180B"= 0x0000000001 (1)
"180C"= 0x0000000003 (3)
"180D"= 0x0000000001 (1)
"2301"= 0x0000000000 (0)
"2103"= 0x0000000003 (3)
"2104"= 0x0000000003 (3)
"2105"= 0x0000000003 (3)
"2400"= 0x0000000003 (3)
"2401"= 0x0000000003 (3)
"2402"= 0x0000000003 (3)
"2600"= 0x0000000003 (3)


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"EnablePunycode"= 0x0000000001 (1)
"CodeBaseSearchPath"="CODEBASE"
"WarnOnIntranet"= 0x0000000001 (1)
"MinorVersion"="0"
"ActiveXCache"="C:\Windows\Downloaded Program Files"
"WarnOnPost"=01 00 00 00 (REG_BINARY)
"WarnonBadCertRecving"= 0x0000000001 (1)
"WarnOnPostRedirect"= 0x0000000000 (0)
"WarnOnZoneCrossing"= 0x0000000001 (1)
"WarnOnHTTPSToHTTPRedirect"= 0x0000000001 (1)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0]
"SpecialDomains"="lp. rg."

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache]
(No values found)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"PerUserItem"= 0x0000000001 (1)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"PerUserItem"= 0x0000000001 (1)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"PerUserItem"= 0x0000000001 (1)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent]
(No values found)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\post platform]
"Tablet PC 2.0"=""
".NET4.0C"=""
".NET4.0E"=""

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Accepted Documents]
"application"="application/x-ms-application"
"1"="image/jpeg"
"xaml"="application/xaml+xml"
"0"="image/gif"
"2"="image/pjpeg"
"xbap"="application/x-ms-xbap"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ActiveX Cache]
"0"="C:\Windows\Downloaded Program Files"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedBehaviors]
"#default#VML"= 0x0000000000 (0)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedDragImageExts]
".aif"= 0x0000000001 (1)
".aifc"= 0x0000000001 (1)
".aiff"= 0x0000000001 (1)
".art"= 0x0000000001 (1)
".asf"= 0x0000000001 (1)
".asx"= 0x0000000001 (1)
".au"= 0x0000000001 (1)
".avi"= 0x0000000001 (1)
".bm"= 0x0000000001 (1)
".bmp"= 0x0000000001 (1)
".dib"= 0x0000000001 (1)
".dvr-ms"= 0x0000000001 (1)
".emf"= 0x0000000001 (1)
".gif"= 0x0000000001 (1)
".ico"= 0x0000000001 (1)
".jfif"= 0x0000000001 (1)
".jpe"= 0x0000000001 (1)
".jpeg"= 0x0000000001 (1)
".jpg"= 0x0000000001 (1)
".m1v"= 0x0000000001 (1)
".m3u"= 0x0000000001 (1)
".mid"= 0x0000000001 (1)
".midi"= 0x0000000001 (1)
".mp2"= 0x0000000001 (1)
".mp2v"= 0x0000000001 (1)
".mp3"= 0x0000000001 (1)
".mpa"= 0x0000000001 (1)
".mpe"= 0x0000000001 (1)
".mpeg"= 0x0000000001 (1)
".mpg"= 0x0000000001 (1)
".mpv"= 0x0000000001 (1)
".mpv2"= 0x0000000001 (1)
".png"= 0x0000000001 (1)
".rmi"= 0x0000000001 (1)
".snd"= 0x0000000001 (1)
".tif"= 0x0000000001 (1)
".tiff"= 0x0000000001 (1)
".wav"= 0x0000000001 (1)
".wax"= 0x0000000001 (1)
".wm"= 0x0000000001 (1)
".wma"= 0x0000000001 (1)
".wmf"= 0x0000000001 (1)
".wmp"= 0x0000000001 (1)
".wmv"= 0x0000000001 (1)
".wmx"= 0x0000000001 (1)
".wvx"= 0x0000000001 (1)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedDragProtocols]
(No values found)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedDragProtocols\0]
"*"= 0x0000000000 (0)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedDragProtocols\1]
"http"= 0x0000000000 (0)
"https"= 0x0000000000 (0)
"javascript"= 0x0000000000 (0)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedDragProtocols\2]
"*"= 0x0000000000 (0)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedDragProtocols\3]
"http"= 0x0000000000 (0)
"https"= 0x0000000000 (0)
"javascript"= 0x0000000000 (0)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedDragProtocols\4]
"http"= 0x0000000000 (0)
"https"= 0x0000000000 (0)
"javascript"= 0x0000000000 (0)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ApprovedActiveXInstallSites]
(No values found)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache]
"CleanupTime"=00 00 00 00 (REG_BINARY)
"CleanupFactor"=19 00 00 00 (REG_BINARY)
"FreshnessInterval"=80 f4 03 00 (REG_BINARY)
"CleanupInterval"=80 51 01 00 (REG_BINARY)
"DebugFlag"=ff ff 00 00 (REG_BINARY)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths"=04 00 00 00 (REG_BINARY)
"Directory"="C:\Windows\Temporary Internet Files"
"Size"=24 01 00 00 (REG_BINARY)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Special Paths]
(No values found)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Special Paths\Cookies]
"Directory"="%USERPROFILE%\Cookies"
"CachePrefix"="Cookie:"
"CacheLimit"=00 04 00 00 (REG_BINARY)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Special Paths\History]
@="Software\Microsoft\Windows\CurrentVersion\Internet Settings\Url History"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"WinHttpSettings"=18 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 (REG_BINARY)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters]
(No values found)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA]
(No values found)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Last Update]
(No values found)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Last Update\IEXPLOREV4]
"CurrentVerTimestamp"="Sun, 21 April 1996 01:00:00 GMT"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones]
(No values found)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0]
"1001"= 0x0000000001 (1)
"1004"= 0x0000000003 (3)
"1200"= 0x0000000003 (3)
"1201"= 0x0000000003 (3)
"1206"= 0x0000000000 (0)
"1207"= 0x0000000003 (3)
"1208"= 0x0000000003 (3)
"1209"= 0x0000000003 (3)
"120A"= 0x0000000003 (3)
"120B"= 0x0000000000 (0)
"1400"= 0x0000000001 (1)
"1402"= 0x0000000000 (0)
"1405"= 0x0000000000 (0)
"1406"= 0x0000000000 (0)
"1407"= 0x0000000001 (1)
"1408"= 0x0000000003 (3)
"1409"= 0x0000000003 (3)
"1601"= 0x0000000000 (0)
"1604"= 0x0000000000 (0)
"1605"= 0x0000000000 (0)
"1606"= 0x0000000000 (0)
"1607"= 0x0000000000 (0)
"1608"= 0x0000000000 (0)
"1609"= 0x0000000001 (1)
"160A"= 0x0000000000 (0)
"1802"= 0x0000000000 (0)
"1803"= 0x0000000000 (0)
"1804"= 0x0000000000 (0)
"1805"= 0x0000000000 (0)
"1806"= 0x0000000000 (0)
"1807"= 0x0000000000 (0)
"1808"= 0x0000000000 (0)
"1809"= 0x0000000003 (3)
"180A"= 0x0000000000 (0)
"180C"= 0x0000000000 (0)
"180D"= 0x0000000000 (0)
"180E"= 0x0000000000 (0)
"180F"= 0x0000000000 (0)
"1A00"= 0x0000000000 (0)
"1A02"= 0x0000000000 (0)
"1A03"= 0x0000000000 (0)
"1A04"= 0x0000000003 (3)
"1A05"= 0x0000000000 (0)
"1A06"= 0x0000000000 (0)
"1A10"= 0x0000000000 (0)
"1C00"= 0x0000000000 (0)
"2000"= 0x0000010000 (65536)
"2005"= 0x0000000003 (3)
"2100"= 0x0000000003 (3)
"2101"= 0x0000000003 (3)
"2102"= 0x0000000003 (3)
"2103"= 0x0000000003 (3)
"2104"= 0x0000000003 (3)
"2105"= 0x0000000003 (3)
"2106"= 0x0000000003 (3)
"2200"= 0x0000000003 (3)
"2201"= 0x0000000003 (3)
"2301"= 0x0000000003 (3)
"2400"= 0x0000000000 (0)
"2401"= 0x0000000000 (0)
"2402"= 0x0000000000 (0)
"2500"= 0x0000000003 (3)
"2600"= 0x0000000000 (0)
"2700"= 0x0000000003 (3)
"CurrentLevel"= 0x0000000000 (0)
"Description"="Your computer"
"DisplayName"="Computer"
"Flags"= 0x0000000021 (33)
"Icon"="shell32.dll#0016"
"LowIcon"="inetcpl.cpl#005422"
"PMDisplayName"="Computer [Protected Mode]"
"2107"= 0x0000000003 (3)
"2701"= 0x0000000003 (3)
"2702"= 0x0000000003 (3)
"2703"= 0x0000000003 (3)
"2708"= 0x0000000003 (3)
"2709"= 0x0000000003 (3)
"1812"= 0x0000000000 (0)
"140A"= 0x0000000000 (0)
"2302"= 0x0000000003 (3)
"270B"= 0x0000000003 (3)
"160B"= 0x0000000000 (0)
"2704"= 0x0000000003 (3)
"1810"= 0x0000000003 (3)
"1800"= 0x0000000000 (0)
"1E05"= 0x0000030000 (196608)
"270C"= 0x0000000003 (3)
"270D"= 0x0000000003 (3)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1]
"1001"= 0x0000000001 (1)
"1004"= 0x0000000003 (3)
"1200"= 0x0000000003 (3)
"1201"= 0x0000000003 (3)
"1206"= 0x0000000000 (0)
"1207"= 0x0000000003 (3)
"1208"= 0x0000000003 (3)
"1209"= 0x0000000003 (3)
"120A"= 0x0000000003 (3)
"120B"= 0x0000000000 (0)
"1400"= 0x0000000001 (1)
"1402"= 0x0000000000 (0)
"1405"= 0x0000000000 (0)
"1406"= 0x0000000001 (1)
"1407"= 0x0000000001 (1)
"1408"= 0x0000000003 (3)
"1409"= 0x0000000003 (3)
"1601"= 0x0000000000 (0)
"1604"= 0x0000000000 (0)
"1605"= 0x0000000000 (0)
"1606"= 0x0000000000 (0)
"1607"= 0x0000000000 (0)
"1608"= 0x0000000000 (0)
"1609"= 0x0000000001 (1)
"160A"= 0x0000000003 (3)
"1802"= 0x0000000000 (0)
"1803"= 0x0000000000 (0)
"1804"= 0x0000000001 (1)
"1805"= 0x0000000000 (0)
"1806"= 0x0000000000 (0)
"1807"= 0x0000000000 (0)
"1808"= 0x0000000000 (0)
"1809"= 0x0000000003 (3)
"180A"= 0x0000000000 (0)
"180C"= 0x0000000003 (3)
"180D"= 0x0000000000 (0)
"180E"= 0x0000000000 (0)
"180F"= 0x0000000000 (0)
"1A00"= 0x0000020000 (131072)
"1A02"= 0x0000000000 (0)
"1A03"= 0x0000000000 (0)
"1A04"= 0x0000000003 (3)
"1A05"= 0x0000000000 (0)
"1A06"= 0x0000000000 (0)
"1A10"= 0x0000000000 (0)
"1C00"= 0x0000000000 (0)
"2000"= 0x0000010000 (65536)
"2005"= 0x0000000003 (3)
"2100"= 0x0000000003 (3)
"2101"= 0x0000000003 (3)
"2102"= 0x0000000003 (3)
"2103"= 0x0000000003 (3)
"2104"= 0x0000000003 (3)
"2105"= 0x0000000003 (3)
"2106"= 0x0000000003 (3)
"2200"= 0x0000000003 (3)
"2201"= 0x0000000003 (3)
"2301"= 0x0000000003 (3)
"2400"= 0x0000000000 (0)
"2401"= 0x0000000000 (0)
"2402"= 0x0000000000 (0)
"2500"= 0x0000000003 (3)
"2600"= 0x0000000000 (0)
"2700"= 0x0000000000 (0)
"CurrentLevel"= 0x0000000000 (0)
"Description"="This zone contains all Web sites that are on your organization's intranet."
"DisplayName"="Local intranet"
"Flags"= 0x00000000db (219)
"Icon"="shell32.dll#0018"
"LowIcon"="inetcpl.cpl#005423"
"PMDisplayName"="Local intranet [Protected Mode]"
"2107"= 0x0000000003 (3)
"2701"= 0x0000000003 (3)
"2702"= 0x0000000003 (3)
"2703"= 0x0000000000 (0)
"2708"= 0x0000000003 (3)
"2709"= 0x0000000003 (3)
"1812"= 0x0000000000 (0)
"140A"= 0x0000000000 (0)
"2302"= 0x0000000003 (3)
"270B"= 0x0000000000 (0)
"160B"= 0x0000000000 (0)
"2704"= 0x0000000003 (3)
"1810"= 0x0000000003 (3)
"1800"= 0x0000000001 (1)
"1E05"= 0x0000030000 (196608)
"270C"= 0x0000000000 (0)
"270D"= 0x0000000003 (3)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2]
"1001"= 0x0000000001 (1)
"1004"= 0x0000000003 (3)
"1200"= 0x0000000003 (3)
"1201"= 0x0000000003 (3)
"1206"= 0x0000000003 (3)
"1207"= 0x0000000003 (3)
"1208"= 0x0000000003 (3)
"1209"= 0x0000000003 (3)
"120A"= 0x0000000003 (3)
"120B"= 0x0000000000 (0)
"1400"= 0x0000000001 (1)
"1402"= 0x0000000000 (0)
"1405"= 0x0000000000 (0)
"1406"= 0x0000000003 (3)
"1407"= 0x0000000001 (1)
"1408"= 0x0000000003 (3)
"1409"= 0x0000000000 (0)
"1601"= 0x0000000000 (0)
"1604"= 0x0000000000 (0)
"1605"= 0x0000000000 (0)
"1606"= 0x0000000000 (0)
"1607"= 0x0000000003 (3)
"1608"= 0x0000000000 (0)
"1609"= 0x0000000001 (1)
"160A"= 0x0000000003 (3)
"1802"= 0x0000000000 (0)
"1803"= 0x0000000000 (0)
"1804"= 0x0000000001 (1)
"1805"= 0x0000000001 (1)
"1806"= 0x0000000001 (1)
"1807"= 0x0000000001 (1)
"1808"= 0x0000000000 (0)
"1809"= 0x0000000003 (3)
"180A"= 0x0000000003 (3)
"180C"= 0x0000000003 (3)
"180D"= 0x0000000000 (0)
"180E"= 0x0000000000 (0)
"180F"= 0x0000000000 (0)
"1A00"= 0x0000020000 (131072)
"1A02"= 0x0000000000 (0)
"1A03"= 0x0000000000 (0)
"1A04"= 0x0000000003 (3)
"1A05"= 0x0000000001 (1)
"1A06"= 0x0000000000 (0)
"1A10"= 0x0000000001 (1)
"1C00"= 0x0000000000 (0)
"2000"= 0x0000010000 (65536)
"2005"= 0x0000000003 (3)
"2100"= 0x0000000003 (3)
"2101"= 0x0000000003 (3)
"2102"= 0x0000000003 (3)
"2103"= 0x0000000003 (3)
"2104"= 0x0000000003 (3)
"2105"= 0x0000000003 (3)
"2106"= 0x0000000003 (3)
"2200"= 0x0000000003 (3)
"2201"= 0x0000000003 (3)
"2301"= 0x0000000000 (0)
"2400"= 0x0000000000 (0)
"2401"= 0x0000000000 (0)
"2402"= 0x0000000000 (0)
"2500"= 0x0000000003 (3)
"2600"= 0x0000000000 (0)
"2700"= 0x0000000000 (0)
"CurrentLevel"= 0x0000000000 (0)
"Description"="This zone contains Web sites that you trust not to damage your computer or data."
"DisplayName"="Trusted sites"
"Flags"= 0x0000000021 (33)
"Icon"="inetcpl.cpl#00004480"
"LowIcon"="inetcpl.cpl#005424"
"PMDisplayName"="Trusted sites [Protected Mode]"
"2107"= 0x0000000003 (3)
"2701"= 0x0000000000 (0)
"2702"= 0x0000000000 (0)
"2703"= 0x0000000000 (0)
"2708"= 0x0000000003 (3)
"2709"= 0x0000000003 (3)
"1812"= 0x0000000000 (0)
"140A"= 0x0000000000 (0)
"2302"= 0x0000000003 (3)
"270B"= 0x0000000000 (0)
"160B"= 0x0000000000 (0)
"2704"= 0x0000000000 (0)
"1810"= 0x0000000003 (3)
"1800"= 0x0000000001 (1)
"1E05"= 0x0000020000 (131072)
"270C"= 0x0000000000 (0)
"270D"= 0x0000000003 (3)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3]
"1001"= 0x0000000001 (1)
"1004"= 0x0000000003 (3)
"1200"= 0x0000000003 (3)
"1201"= 0x0000000003 (3)
"1206"= 0x0000000003 (3)
"1207"= 0x0000000003 (3)
"1208"= 0x0000000003 (3)
"1209"= 0x0000000003 (3)
"120A"= 0x0000000003 (3)
"120B"= 0x0000000003 (3)
"1400"= 0x0000000001 (1)
"1402"= 0x0000000000 (0)
"1405"= 0x0000000000 (0)
"1406"= 0x0000000003 (3)
"1407"= 0x0000000001 (1)
"1408"= 0x0000000003 (3)
"1409"= 0x0000000000 (0)
"1601"= 0x0000000000 (0)
"1604"= 0x0000000000 (0)
"1605"= 0x0000000000 (0)
"1606"= 0x0000000000 (0)
"1607"= 0x0000000003 (3)
"1608"= 0x0000000000 (0)
"1609"= 0x0000000001 (1)
"160A"= 0x0000000003 (3)
"1802"= 0x0000000000 (0)
"1803"= 0x0000000000 (0)
"1804"= 0x0000000001 (1)
"1805"= 0x0000000001 (1)
"1806"= 0x0000000001 (1)
"1807"= 0x0000000001 (1)
"1808"= 0x0000000000 (0)
"1809"= 0x0000000000 (0)
"180A"= 0x0000000003 (3)
"180C"= 0x0000000003 (3)
"180D"= 0x0000000001 (1)
"180E"= 0x0000000000 (0)
"180F"= 0x0000000000 (0)
"1A00"= 0x0000020000 (131072)
"1A02"= 0x0000000000 (0)
"1A03"= 0x0000000000 (0)
"1A04"= 0x0000000003 (3)
"1A05"= 0x0000000001 (1)
"1A06"= 0x0000000000 (0)
"1A10"= 0x0000000001 (1)
"1C00"= 0x0000000000 (0)
"2000"= 0x0000010000 (65536)
"2005"= 0x0000000003 (3)
"2100"= 0x0000000003 (3)
"2101"= 0x0000000003 (3)
"2102"= 0x0000000003 (3)
"2103"= 0x0000000003 (3)
"2104"= 0x0000000003 (3)
"2105"= 0x0000000003 (3)
"2200"= 0x0000000003 (3)
"2106"= 0x0000000003 (3)
"2201"= 0x0000000003 (3)
"2301"= 0x0000000000 (0)
"2400"= 0x0000000000 (0)
"2401"= 0x0000000000 (0)
"2402"= 0x0000000000 (0)
"2500"= 0x0000000000 (0)
"2600"= 0x0000000000 (0)
"2700"= 0x0000000000 (0)
"CurrentLevel"= 0x0000000000 (0)
"Description"="This zone contains all Web sites you haven't placed in other zones"
"DisplayName"="Internet"
"Flags"= 0x0000000021 (33)
"Icon"="inetcpl.cpl#001313"
"LowIcon"="inetcpl.cpl#005425"
"PMDisplayName"="Internet [Protected Mode]"
"2107"= 0x0000000003 (3)
"2701"= 0x0000000003 (3)
"2702"= 0x0000000000 (0)
"2703"= 0x0000000003 (3)
"2708"= 0x0000000003 (3)
"2709"= 0x0000000003 (3)
"1812"= 0x0000000001 (1)
"140A"= 0x0000000000 (0)
"2302"= 0x0000000003 (3)
"270B"= 0x0000000003 (3)
"160B"= 0x0000000000 (0)
"2704"= 0x0000000003 (3)
"1810"= 0x0000000003 (3)
"1800"= 0x0000000001 (1)
"1E05"= 0x0000030000 (196608)
"270C"= 0x0000000000 (0)
"270D"= 0x0000000003 (3)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4]
"1001"= 0x0000000003 (3)
"1004"= 0x0000000003 (3)
"1200"= 0x0000000003 (3)
"1201"= 0x0000000003 (3)
"1206"= 0x0000000003 (3)
"1207"= 0x0000000003 (3)
"1208"= 0x0000000003 (3)
"1209"= 0x0000000003 (3)
"120A"= 0x0000000003 (3)
"120B"= 0x0000000003 (3)
"1400"= 0x0000000003 (3)
"1402"= 0x0000000003 (3)
"1405"= 0x0000000003 (3)
"1406"= 0x0000000003 (3)
"1407"= 0x0000000003 (3)
"1408"= 0x0000000003 (3)
"1409"= 0x0000000000 (0)
"1601"= 0x0000000001 (1)
"1604"= 0x0000000003 (3)
"1605"= 0x0000000000 (0)
"1606"= 0x0000000003 (3)
"1607"= 0x0000000003 (3)
"1608"= 0x0000000003 (3)
"1609"= 0x0000000001 (1)
"160A"= 0x0000000003 (3)
"1802"= 0x0000000001 (1)
"1803"= 0x0000000003 (3)
"1804"= 0x0000000003 (3)
"1805"= 0x0000000001 (1)
"1806"= 0x0000000003 (3)
"1807"= 0x0000000001 (1)
"1808"= 0x0000000000 (0)
"1809"= 0x0000000000 (0)
"180A"= 0x0000000003 (3)
"180B"= 0x0000000003 (3)
"180C"= 0x0000000003 (3)
"180D"= 0x0000000001 (1)
"180E"= 0x0000000003 (3)
"180F"= 0x0000000003 (3)
"1A00"= 0x0000010000 (65536)
"1A02"= 0x0000000003 (3)
"1A03"= 0x0000000003 (3)
"1A04"= 0x0000000003 (3)
"1A05"= 0x0000000003 (3)
"1A06"= 0x0000000003 (3)
"1A10"= 0x0000000003 (3)
"1C00"= 0x0000000000 (0)
"2000"= 0x0000000003 (3)
"2005"= 0x0000000003 (3)
"2100"= 0x0000000003 (3)
"2101"= 0x0000000003 (3)
"2102"= 0x0000000003 (3)
"2103"= 0x0000000003 (3)
"2104"= 0x0000000003 (3)
"2105"= 0x0000000003 (3)
"2106"= 0x0000000003 (3)
"2200"= 0x0000000003 (3)
"2201"= 0x0000000003 (3)
"2301"= 0x0000000000 (0)
"2400"= 0x0000000003 (3)
"2401"= 0x0000000003 (3)
"2402"= 0x0000000003 (3)
"2500"= 0x0000000000 (0)
"2600"= 0x0000000003 (3)
"2700"= 0x0000000000 (0)
"CurrentLevel"= 0x0000000000 (0)
"Description"="This zone contains Web sites that could potentially damage your computer or data."
"DisplayName"="Restricted sites"
"Flags"= 0x0000000021 (33)
"Icon"="inetcpl.cpl#00004481"
"2107"= 0x0000000003 (3)
"2701"= 0x0000000003 (3)
"2702"= 0x0000000000 (0)
"2703"= 0x0000000003 (3)
"2708"= 0x0000000003 (3)
"2709"= 0x0000000003 (3)
"1812"= 0x0000000001 (1)
"140A"= 0x0000000000 (0)
"2302"= 0x0000000003 (3)
"270B"= 0x0000000003 (3)
"160B"= 0x0000000000 (0)
"2704"= 0x0000000003 (3)
"1810"= 0x0000000003 (3)
"1800"= 0x0000000003 (3)
"1E05"= 0x0000030000 (196608)
"270C"= 0x0000000000 (0)
"270D"= 0x0000000003 (3)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\NoFileLifetimeExtension]
".pub"=""
".vsi"=""

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P]
(No values found)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History]
(No values found)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Passport]
(No values found)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Secure Mime Handlers]
"CorTransientLoader.CorLoad.1"=""

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO]
(No values found)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4774"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,1321"
"Text"="ActiveX Controls and plugins"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ACTIVEX]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4775"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,1321"
"HelpID"="iexplore.hlp#50499"
"Text"="Run ActiveX controls and plugins"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ACTIVEX\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1200"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ACTIVEX\APPROVE]
"CheckedValue"= 0x0000010000 (65536)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4806"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1200"
"Text"="Administrator approved"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ACTIVEX\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1200"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ACTIVEX\QUERY]
"CheckedValue"= 0x0000000001 (1)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4804"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1200"
"Text"="Prompt"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ACTIVEX_OPTIN]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4897"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,1321"
"Text"="Allow previously unused ActiveX controls to run without prompt"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ACTIVEX_OPTIN\DISABLE]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1208"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ACTIVEX_OPTIN\ENABLE]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1208"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ACTIVEX_OVERRIDE_DOMAINLIST]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4900"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,1321"
"Text"="Only allow approved domains to use ActiveX without prompt"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ACTIVEX_OVERRIDE_DOMAINLIST\DISABLE]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="120B"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ACTIVEX_OVERRIDE_DOMAINLIST\ENABLE]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="120B"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ALLOW_DYNSRC_VIDEO]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4899"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,1321"
"Text"="Display video and animation on a webpage that does not use external media player"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ALLOW_DYNSRC_VIDEO\DISABLE]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="120A"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ALLOW_DYNSRC_VIDEO\ENABLE]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="120A"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\AUTOMATIC_ACTIVEX_UI]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4889"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,1321"
"Text"="Automatic prompting for ActiveX controls"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\AUTOMATIC_ACTIVEX_UI\DISABLE]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2201"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\AUTOMATIC_ACTIVEX_UI\ENABLE]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2201"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\BBHVR]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4884"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,1321"
"Text"="Binary behaviors"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\BBHVR\APPROVE]
"CheckedValue"= 0x0000010000 (65536)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4806"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2000"
"Text"="Administrator approved"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\BBHVR\DISABLE]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2000"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\BBHVR\ENABLE]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2000"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\BBHVR\PROMPT]
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\BBHVR\QUERY]
"CheckedValue"= 0x0000000001 (1)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4804"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2000"
"Text"="Prompt"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ENABLE]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4776"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,1321"
"Text"="Download signed ActiveX controls"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ENABLE\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1001"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ENABLE\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1001"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ENABLE\QUERY]
"CheckedValue"= 0x0000000001 (1)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4804"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1001"
"Text"="Prompt"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\FILTER]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4923"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,1321"
"Text"="Allow ActiveX Filtering"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\FILTER\DISABLE]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2702"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\FILTER\ENABLE]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2702"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\SAFETY]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4783"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,1321"
"Text"="Initialize and script ActiveX controls not marked as safe for scripting"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\SAFETY\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1201"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\SAFETY\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1201"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\SAFETY\QUERY]
"CheckedValue"= 0x0000000001 (1)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4804"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1201"
"Text"="Prompt"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\SCRIPTLETRUN]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4780"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,1321"
"Text"="Allow Scriptlets"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\SCRIPTLETRUN\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1209"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\SCRIPTLETRUN\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1209"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\SCRIPTLETRUN\QUERY]
"CheckedValue"= 0x0000000001 (1)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4804"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1209"
"Text"="Prompt"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\SCRIPTSAFE]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4784"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,1321"
"RequiresReboot"= 0x0000000001 (1)
"Text"="Script ActiveX controls marked safe for scripting"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\SCRIPTSAFE\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1405"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\SCRIPTSAFE\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1405"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\SCRIPTSAFE\QUERY]
"CheckedValue"= 0x0000000001 (1)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4804"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1405"
"Text"="Prompt"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\UNSIGNEDACTIVEX]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4777"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,1321"
"Text"="Download unsigned ActiveX controls"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\UNSIGNEDACTIVEX\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1004"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\UNSIGNEDACTIVEX\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1004"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\UNSIGNEDACTIVEX\QUERY]
"CheckedValue"= 0x0000000001 (1)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4804"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1004"
"Text"="Prompt"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\VALIDATION]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4924"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,1321"
"Text"="Run antimalware software on ActiveX controls"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\VALIDATION\DISABLE]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000000 (0)
"ValueName"="270C"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\VALIDATION\ENABLE]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000000 (0)
"ValueName"="270C"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\AUTH]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4788"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,1323"
"Text"="User Authentication"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\AUTH\LOGON]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4790"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,1323"
"HelpID"="iexplore.hlp#50283"
"Text"="Logon"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\AUTH\LOGON\ANONYMOUS]
"CheckedValue"= 0x0000030000 (196608)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4807"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"HelpID"="iexplore.hlp#50283"
"DefaultValue"= 0x0000030000 (196608)
"ValueName"="1A00"
"Text"="Anonymous logon"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\AUTH\LOGON\ASK]
"CheckedValue"= 0x0000010000 (65536)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4808"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"HelpID"="iexplore.hlp#50283"
"DefaultValue"= 0x0000030000 (196608)
"ValueName"="1A00"
"Text"="Prompt for user name and password"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\AUTH\LOGON\COND]
"CheckedValue"= 0x0000020000 (131072)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4810"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"HelpID"="iexplore.hlp#50283"
"DefaultValue"= 0x0000030000 (196608)
"ValueName"="1A00"
"Text"="Automatic logon only in Intranet zone"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\AUTH\LOGON\SILENT]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4809"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"HelpID"="iexplore.hlp#50283"
"DefaultValue"= 0x0000030000 (196608)
"ValueName"="1A00"
"Text"="Automatic logon with current user name and password"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOTNET]
"Type"="group"
"Text"=".Net Framework"
"PlugUIText"="@mscorier.dll,-1001"
"Bitmap"="C:\Windows\system32\mscorier.dll,2000"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOTNET\DOWNLOAD]
"Text"="Download managed code"
"PlugUIText"="@mscorier.dll,-1006"
"Bitmap"="C:\Windows\system32\mscorier.dll,2000"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOTNET\DOWNLOAD\ALLOW]
"Type"="radio"
"CheckedValue"= 0x0000000000 (0)
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"DefaultValue"= 0x0000000003 (3)
"PlugUIText"="@mscorier.dll,-1004"
"Text"="Enable"
"ValueName"="2001"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOTNET\DOWNLOAD\DENY]
"Type"="radio"
"Text"="Disable"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"ValueName"="2001"
"PlugUIText"="@mscorier.dll,-1003"
"CheckedValue"= 0x0000000003 (3)
"DefaultValue"= 0x0000000003 (3)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOTNET\DOWNLOAD\QUERY]
"ValueName"="2001"
"PlugUIText"="@mscorier.dll,-1005"
"DefaultValue"= 0x0000000003 (3)
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"Text"="Prompt"
"Type"="radio"
"CheckedValue"= 0x0000000001 (1)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOTNET\DOWNLOADUNSIGNED]
"Text"="Download unsigned managed code"
"Bitmap"="C:\Windows\system32\mscorier.dll,2000"
"PlugUIText"="@mscorier.dll,-1002"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOTNET\DOWNLOADUNSIGNED\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"Text"="Enable"
"PlugUIText"="@mscorier.dll,-1004"
"DefaultValue"= 0x0000000003 (3)
"Type"="radio"
"ValueName"="2004"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOTNET\DOWNLOADUNSIGNED\DENY]
"Text"="Disable"
"ValueName"="2004"
"CheckedValue"= 0x0000000003 (3)
"Type"="radio"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"DefaultValue"= 0x0000000003 (3)
"PlugUIText"="@mscorier.dll,-1003"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOTNET\DOWNLOADUNSIGNED\QUERY]
"Text"="Prompt"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"ValueName"="2004"
"PlugUIText"="@mscorier.dll,-1005"
"CheckedValue"= 0x0000000001 (1)
"DefaultValue"= 0x0000000003 (3)
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOTNET\MANIFESTPERMISSIONS]
"Bitmap"="C:\Windows\system32\mscorier.dll,2000"
"PlugUIText"="@mscorier.dll,-1007"
"Text"="Permissions for components with manifests"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOTNET\MANIFESTPERMISSIONS\DISABLE]
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"PlugUIText"="@mscorier.dll,-1003"
"DefaultValue"= 0x0000010000 (65536)
"Type"="radio"
"CheckedValue"= 0x0000000003 (3)
"ValueName"="2007"
"Text"="Disable"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOTNET\MANIFESTPERMISSIONS\HIGHSAFETY]
"DefaultValue"= 0x0000010000 (65536)
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"Text"="High Safety"
"PlugUIText"="@mscorier.dll,-1008"
"Type"="radio"
"ValueName"="2007"
"CheckedValue"= 0x0000010000 (65536)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOWNLOAD]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4791"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4486"
"Text"="Downloads"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOWNLOAD\FILEDOWNLOAD]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4792"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4486"
"Text"="File download"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOWNLOAD\FILEDOWNLOAD\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1803"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOWNLOAD\FILEDOWNLOAD\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1803"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOWNLOAD\FONTDOWNLOAD]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4793"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4486"
"Text"="Font download"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOWNLOAD\FONTDOWNLOAD\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1604"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOWNLOAD\FONTDOWNLOAD\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1604"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOWNLOAD\FONTDOWNLOAD\QUERY]
"CheckedValue"= 0x0000000001 (1)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4804"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1604"
"Text"="Prompt"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\JAVAPER]
"Text"="Java VM"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\JAVAPER\JAVA]
(No values found)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\JAVAPER\JAVA\CUSTOM]
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\JAVAPER\JAVA\DISABLE]
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\JAVAPER\JAVA\HIGH]
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\JAVAPER\JAVA\LOW]
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\JAVAPER\JAVA\MEDIUM]
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4794"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4443"
"Text"="Miscellaneous"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\ClientCertPrompt]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4862"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4443"
"Text"="Don't prompt for client certificate selection when no certificates or only one certificate exists"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\ClientCertPrompt\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1A04"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\ClientCertPrompt\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1A04"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\CrossDomainData]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4785"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4443"
"Text"="Access data sources across domains"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\CrossDomainData\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1406"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\CrossDomainData\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1406"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\CrossDomainData\QUERY]
"CheckedValue"= 0x0000000001 (1)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4804"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1406"
"Text"="Prompt"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\DRAGDROP]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4796"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4443"
"Text"="Drag and drop or copy and paste files"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\DRAGDROP\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1802"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\DRAGDROP\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1802"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\DRAGDROP\QUERY]
"CheckedValue"= 0x0000000001 (1)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4804"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1802"
"Text"="Prompt"
"Type"="radio"

Teil 2:
Code:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\DRAGDROP_XDOM_ACROSSWINDOWS]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4800"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4443"
"Text"="Allow dragging of content between domains into separate windows"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\DRAGDROP_XDOM_ACROSSWINDOWS\DISABLE]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2709"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\DRAGDROP_XDOM_ACROSSWINDOWS\ENABLE]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2709"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\DRAGDROP_XDOM_WITHINWINDOW]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4799"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4443"
"Text"="Allow dragging of content between domains into the same window"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\DRAGDROP_XDOM_WITHINWINDOW\DISABLE]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2708"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\DRAGDROP_XDOM_WITHINWINDOW\ENABLE]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2708"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\FORCE_ADDRESS_BAR]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4898"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4443"
"Text"="Allow web sites to open windows without address or status bars"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\FORCE_ADDRESS_BAR\DISABLE]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2104"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\FORCE_ADDRESS_BAR\ENABLE]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2104"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\FORMDATA]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4797"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4443"
"Text"="Submit non-encrypted form data"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\FORMDATA\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"Mask"= 0x0000000003 (3)
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1601"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\FORMDATA\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"Mask"= 0x0000000003 (3)
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1601"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\FORMDATA\QUERY]
"CheckedValue"= 0x0000000001 (1)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4804"
"Mask"= 0x0000000003 (3)
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1601"
"Text"="Prompt"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\INC_UPLOAD_FILEPATH]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4911"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4443"
"Text"="Include local directory path when uploading files to a server"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\INC_UPLOAD_FILEPATH\DISABLE]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="160A"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\INC_UPLOAD_FILEPATH\ENABLE]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="160A"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\LAUNCHING]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4798"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4443"
"Text"="Launching programs and files in an IFRAME"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\LAUNCHING\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1804"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\LAUNCHING\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1804"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\LAUNCHING\QUERY]
"CheckedValue"= 0x0000000001 (1)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4804"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1804"
"Text"="Prompt"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\META_REFRESH]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4870"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4443"
"Text"="Allow META REFRESH"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\META_REFRESH\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1608"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\META_REFRESH\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1608"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\MIME_SNIFFING]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4885"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4443"
"Text"="Enable MIME Sniffing"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\MIME_SNIFFING\DISABLE]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2100"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\MIME_SNIFFING\ENABLE]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2100"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\MIXED_CONTENT]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4872"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4443"
"Text"="Display mixed content"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\MIXED_CONTENT\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1609"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\MIXED_CONTENT\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1609"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\MIXED_CONTENT\QUERY]
"CheckedValue"= 0x0000000001 (1)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4804"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1609"
"Text"="Prompt"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\NEWWINDOW]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4883"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4443"
"Text"="Use Pop-up Blocker"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\NEWWINDOW\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1809"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\NEWWINDOW\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1809"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\PHISHINGFILTER]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-5368"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4443"
"Text"="Use Phishing Filter"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\PHISHINGFILTER\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2301"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\PHISHINGFILTER\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2301"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\RENDER_LEGACY_DXTFILTERS]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-6618"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4443"
"Text"="Enable use of legacy filters during rendering"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\RENDER_LEGACY_DXTFILTERS\DISABLE]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="270B"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\RENDER_LEGACY_DXTFILTERS\ENABLE]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="270B"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\RESTRICTED_PROTOCOLS]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4890"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4443"
"Text"="Allow active content over restricted protocols to access my computer"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\RESTRICTED_PROTOCOLS\DISABLE]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2300"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\RESTRICTED_PROTOCOLS\ENABLE]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2300"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\RESTRICTED_PROTOCOLS\QUERY]
"CheckedValue"= 0x0000000001 (1)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4804"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2300"
"Text"="Prompt"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\SHELLEXEC]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4864"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4443"
"Text"="Launching programs and unsafe files"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\SHELLEXEC\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1806"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\SHELLEXEC\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1806"
"Text"="Disable"
"Type"="radio"


weti 19.08.2014 10:30

Teil 3:
Code:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\SHELLEXEC\QUERY]
"CheckedValue"= 0x0000000001 (1)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4804"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1806"
"Text"="Prompt"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\SubFrameNavigate]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4855"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4443"
"Text"="Navigate sub-frames across different domains"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\SubFrameNavigate\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1607"
"Text"="Enable"
"Type"="radio"


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\SubFrameNavigate\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1607"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\SubFrameNavigate\QUERY]
"CheckedValue"= 0x0000000001 (1)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4804"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1607"
"Text"="Prompt"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\UserData]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4853"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4443"
"Text"="Userdata persistence"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\UserData\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1606"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\UserData\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1606"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\WebOC]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4879"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4443"
"Text"="Allow scripting of Microsoft web browser control"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\WebOC\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1206"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\WebOC\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1206"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\WINDOW_RESTRICTIONS]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4887"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4443"
"Text"="Allow script-initiated windows without size or position constraints"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\WINDOW_RESTRICTIONS\DISABLE]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2102"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\WINDOW_RESTRICTIONS\ENABLE]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2102"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\ZONE_ELEVATION]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4886"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4443"
"Text"="Web sites can open new windows in a less restrictive Web content zone"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\ZONE_ELEVATION\DISABLE]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2101"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\ZONE_ELEVATION\ENABLE]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2101"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\ZONE_ELEVATION\QUERY]
"CheckedValue"= 0x0000000001 (1)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4804"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2101"
"Text"="Prompt"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\SCRIPTING]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4782"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4485"
"Text"="Scripting"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\SCRIPTING\SCRIPT]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4786"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4485"
"Text"="Active scripting"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\SCRIPTING\SCRIPT\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1400"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\SCRIPTING\SCRIPT\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1400"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\SCRIPTING\SCRIPT\QUERY]
"CheckedValue"= 0x0000000001 (1)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4804"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1400"
"Text"="Prompt"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\SCRIPTING\SCRIPTJAVA]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4787"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4485"
"Text"="Scripting of Java applets"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\SCRIPTING\SCRIPTJAVA\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1402"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\SCRIPTING\SCRIPTJAVA\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000000 (0)
"ValueName"="1402"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\SCRIPTING\SCRIPTJAVA\QUERY]
"CheckedValue"= 0x0000000001 (1)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4804"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1402"
"Text"="Prompt"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\SCRIPTING\SCRIPTPASTE]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4854"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4485"
"Text"="Allow paste operations via script"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\SCRIPTING\SCRIPTPASTE\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1407"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\SCRIPTING\SCRIPTPASTE\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1407"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\SCRIPTING\SCRIPTPASTE\QUERY]
"CheckedValue"= 0x0000000001 (1)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4804"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1407"
"Text"="Prompt"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\SCRIPTING\SCRIPTPROMPT]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4912"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4485"
"Text"="Allow websites to prompt for information using scripted windows"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\SCRIPTING\SCRIPTPROMPT\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2105"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\SCRIPTING\SCRIPTPROMPT\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2105"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\SCRIPTING\SCRIPTSTATUS]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4867"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4485"
"Text"="Allow status bar updates via script"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\SCRIPTING\SCRIPTSTATUS\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2103"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\SCRIPTING\SCRIPTSTATUS\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2103"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\SCRIPTING\XSSFilter]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4901"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4485"
"Text"="XSSFilter"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\SCRIPTING\XSSFilter\DISABLE]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000000 (0)
"ValueName"="1409"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\SCRIPTING\XSSFilter\ENABLE]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000000 (0)
"ValueName"="1409"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\WINFX]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-6400"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4486"
"Text"=".NET Framework"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\WINFX\LOOSE_XAML]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-6401"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4486"
"Text"="Loose XAML"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\WINFX\LOOSE_XAML\DISABLE]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2402"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\WINFX\LOOSE_XAML\ENABLE]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2402"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\WINFX\LOOSE_XAML\QUERY]
"CheckedValue"= 0x0000000001 (1)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4804"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2402"
"Text"="Prompt"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\WINFX\WINDOWS_BROWSER_APPLICATIONS]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-6403"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4486"
"Text"="Windows Browser Applications"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\WINFX\WINDOWS_BROWSER_APPLICATIONS\DISABLE]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2400"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\WINFX\WINDOWS_BROWSER_APPLICATIONS\ENABLE]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2400"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\WINFX\WINDOWS_BROWSER_APPLICATIONS\QUERY]
"CheckedValue"= 0x0000000001 (1)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4804"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2400"
"Text"="Prompt"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\WINFX\XPS_DOCUMENTS]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-6402"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4486"
"Text"="XPS documents"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\WINFX\XPS_DOCUMENTS\DISABLE]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2401"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\WINFX\XPS_DOCUMENTS\ENABLE]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2401"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\WINFX\XPS_DOCUMENTS\QUERY]
"CheckedValue"= 0x0000000001 (1)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4804"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2401"
"Text"="Prompt"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\WinFXSetup]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-5440"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4486"
"Text"="Enable .NET Framework setup"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\WinFXSetup\DISABLE]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2600"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\WinFXSetup\ENABLE]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2600"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SOIEAK]
(No values found)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SOIEAK\DOTNET]
"PlugUIText"="@mscorier.dll,-1001"
"Type"="group"
"Text"=".Net Framework"
"Bitmap"="C:\Windows\system32\mscorier.dll,2000"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SOIEAK\DOTNET\DOWNLOAD]
"Bitmap"="C:\Windows\system32\mscorier.dll,2000"
"Type"="group"
"PlugUIText"="@mscorier.dll,-1006"
"Text"="Download managed code"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SOIEAK\DOTNET\DOWNLOAD\ALLOW]
"Type"="radio"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"PlugUIText"="@mscorier.dll,-1004"
"CheckedValue"= 0x0000000000 (0)
"Text"="Enable"
"ValueName"="2001"
"DefaultValue"= 0x0000000003 (3)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SOIEAK\DOTNET\DOWNLOAD\DENY]
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"CheckedValue"= 0x0000000003 (3)
"DefaultValue"= 0x0000000003 (3)
"Type"="radio"
"Text"="Disable"
"ValueName"="2001"
"PlugUIText"="@mscorier.dll,-1003"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SOIEAK\DOTNET\DOWNLOAD\QUERY]
"ValueName"="2001"
"CheckedValue"= 0x0000000001 (1)
"DefaultValue"= 0x0000000003 (3)
"Type"="radio"
"Text"="Prompt"
"PlugUIText"="@mscorier.dll,-1005"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SOIEAK\DOTNET\DOWNLOADUNSIGNED]
"Text"="Download unsigned managed code"
"Type"="group"
"PlugUIText"="@mscorier.dll,-1002"
"Bitmap"="C:\Windows\system32\mscorier.dll,2000"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SOIEAK\DOTNET\DOWNLOADUNSIGNED\ALLOW]
"ValueName"="2004"
"CheckedValue"= 0x0000000000 (0)
"DefaultValue"= 0x0000000003 (3)
"Text"="Enable"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"Type"="radio"
"PlugUIText"="@mscorier.dll,-1004"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SOIEAK\DOTNET\DOWNLOADUNSIGNED\DENY]
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"PlugUIText"="@mscorier.dll,-1003"
"CheckedValue"= 0x0000000003 (3)
"ValueName"="2004"
"Type"="radio"
"DefaultValue"= 0x0000000003 (3)
"Text"="Disable"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SOIEAK\DOTNET\DOWNLOADUNSIGNED\QUERY]
"ValueName"="2004"
"Type"="radio"
"CheckedValue"= 0x0000000001 (1)
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"Text"="Prompt"
"DefaultValue"= 0x0000000003 (3)
"PlugUIText"="@mscorier.dll,-1005"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SOIEAK\DOTNET\MANIFESTPERMISSIONS]
"Bitmap"="C:\Windows\system32\mscorier.dll,2000"
"Type"="group"
"Text"="Permissions for components with manifests"
"PlugUIText"="@mscorier.dll,-1007"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SOIEAK\DOTNET\MANIFESTPERMISSIONS\DISABLE]
"PlugUIText"="@mscorier.dll,-1003"
"ValueName"="2007"
"Type"="radio"
"CheckedValue"= 0x0000000003 (3)
"DefaultValue"= 0x0000010000 (65536)
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"Text"="Disable"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SOIEAK\DOTNET\MANIFESTPERMISSIONS\HIGHSAFETY]
"DefaultValue"= 0x0000010000 (65536)
"CheckedValue"= 0x0000010000 (65536)
"PlugUIText"="@mscorier.dll,-1008"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"Text"="High Safety"
"ValueName"="2007"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\TemplatePolicies]
(No values found)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\TemplatePolicies\High]
"1001"= 0x0000000003 (3)
"1004"= 0x0000000003 (3)
"1200"= 0x0000000003 (3)
"1201"= 0x0000000003 (3)
"1206"= 0x0000000003 (3)
"1207"= 0x0000000003 (3)
"1208"= 0x0000000003 (3)
"1209"= 0x0000000003 (3)
"120A"= 0x0000000003 (3)
"120B"= 0x0000000003 (3)
"1400"= 0x0000000003 (3)
"1402"= 0x0000000003 (3)
"1405"= 0x0000000003 (3)
"1406"= 0x0000000003 (3)
"1407"= 0x0000000003 (3)
"1408"= 0x0000000003 (3)
"1409"= 0x0000000000 (0)
"1601"= 0x0000000001 (1)
"1604"= 0x0000000003 (3)
"1605"= 0x0000000000 (0)
"1606"= 0x0000000003 (3)
"1607"= 0x0000000003 (3)
"1608"= 0x0000000003 (3)
"1609"= 0x0000000001 (1)
"160A"= 0x0000000003 (3)
"1802"= 0x0000000001 (1)
"1803"= 0x0000000003 (3)
"1804"= 0x0000000003 (3)
"1809"= 0x0000000000 (0)
"180B"= 0x0000000001 (1)
"1A00"= 0x0000010000 (65536)
"1A02"= 0x0000000003 (3)
"1A03"= 0x0000000003 (3)
"1A04"= 0x0000000003 (3)
"1A05"= 0x0000000003 (3)
"1A06"= 0x0000000003 (3)
"1C00"= 0x0000000000 (0)
"2000"= 0x0000000003 (3)
"2005"= 0x0000000003 (3)
"2100"= 0x0000000003 (3)
"2101"= 0x0000000003 (3)
"2102"= 0x0000000003 (3)
"2103"= 0x0000000003 (3)
"2104"= 0x0000000003 (3)
"2105"= 0x0000000003 (3)
"2106"= 0x0000000003 (3)
"2200"= 0x0000000003 (3)
"2201"= 0x0000000003 (3)
"2300"= 0x0000000003 (3)
"2301"= 0x0000000000 (0)
"2400"= 0x0000000003 (3)
"2401"= 0x0000000003 (3)
"2402"= 0x0000000003 (3)
"2600"= 0x0000000003 (3)
"2700"= 0x0000000000 (0)
"Description"="Exclude content that could damage your computer."
"DisplayName"="High safety (very secure)"
"Icon"="wininet.dll#00001205"
"TemplateIndex"= 0x0000012000 (73728)
"2001"= 0x0000000003 (3)
"2007"= 0x0000000003 (3)
"2004"= 0x0000000003 (3)
"2107"= 0x0000000003 (3)
"2701"= 0x0000000003 (3)
"2702"= 0x0000000000 (0)
"2703"= 0x0000000003 (3)
"2708"= 0x0000000003 (3)
"2709"= 0x0000000003 (3)
"1812"= 0x0000000001 (1)
"140A"= 0x0000000000 (0)
"2302"= 0x0000000003 (3)
"270B"= 0x0000000003 (3)
"160B"= 0x0000000000 (0)
"2704"= 0x0000000003 (3)
"270C"= 0x0000000000 (0)
"270D"= 0x0000000003 (3)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\TemplatePolicies\Low]
"1001"= 0x0000000000 (0)
"1004"= 0x0000000001 (1)
"1200"= 0x0000000000 (0)
"1201"= 0x0000000001 (1)
"1206"= 0x0000000000 (0)
"1207"= 0x0000000000 (0)
"1208"= 0x0000000000 (0)
"1209"= 0x0000000000 (0)
"120A"= 0x0000000003 (3)
"120B"= 0x0000000000 (0)
"1400"= 0x0000000000 (0)
"1402"= 0x0000000000 (0)
"1405"= 0x0000000000 (0)
"1406"= 0x0000000000 (0)
"1407"= 0x0000000000 (0)
"1408"= 0x0000000000 (0)
"1409"= 0x0000000003 (3)
"1601"= 0x0000000000 (0)
"1604"= 0x0000000000 (0)
"1605"= 0x0000000000 (0)
"1606"= 0x0000000000 (0)
"1607"= 0x0000000000 (0)
"1608"= 0x0000000000 (0)
"1609"= 0x0000000001 (1)
"160A"= 0x0000000000 (0)
"1802"= 0x0000000000 (0)
"1803"= 0x0000000000 (0)
"1804"= 0x0000000000 (0)
"1809"= 0x0000000003 (3)
"1A00"= 0x0000000000 (0)
"1A02"= 0x0000000000 (0)
"1A03"= 0x0000000000 (0)
"1A04"= 0x0000000000 (0)
"1A05"= 0x0000000000 (0)
"1A06"= 0x0000000000 (0)
"1C00"= 0x0000030000 (196608)
"2000"= 0x0000000000 (0)
"2005"= 0x0000000000 (0)
"2100"= 0x0000000000 (0)
"2101"= 0x0000000001 (1)
"2102"= 0x0000000000 (0)
"2103"= 0x0000000000 (0)
"2104"= 0x0000000000 (0)
"2105"= 0x0000000000 (0)
"2106"= 0x0000000000 (0)
"2200"= 0x0000000000 (0)
"2201"= 0x0000000000 (0)
"2300"= 0x0000000001 (1)
"2301"= 0x0000000003 (3)
"2400"= 0x0000000000 (0)
"2401"= 0x0000000000 (0)
"2402"= 0x0000000000 (0)
"2600"= 0x0000000000 (0)
"2700"= 0x0000000003 (3)
"Description"="Do not warn before running potentially damaging content."
"DisplayName"="Low safety (very insecure)"
"Icon"="wininet.dll#00001207"
"TemplateIndex"= 0x0000010000 (65536)
"2001"= 0x0000000000 (0)
"2007"= 0x0000010000 (65536)
"2004"= 0x0000000000 (0)
"2107"= 0x0000000000 (0)
"2701"= 0x0000000000 (0)
"2702"= 0x0000000003 (3)
"2703"= 0x0000000000 (0)
"2708"= 0x0000000003 (3)
"2709"= 0x0000000003 (3)
"1812"= 0x0000000000 (0)
"140A"= 0x0000000000 (0)
"2302"= 0x0000000003 (3)
"270B"= 0x0000000000 (0)
"160B"= 0x0000000000 (0)
"2704"= 0x0000000000 (0)
"2108"= 0x0000000003 (3)
"270C"= 0x0000000003 (3)
"270D"= 0x0000000000 (0)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\TemplatePolicies\MedHigh]
"1001"= 0x0000000001 (1)
"1004"= 0x0000000003 (3)
"1200"= 0x0000000000 (0)
"1201"= 0x0000000003 (3)
"1206"= 0x0000000003 (3)
"1207"= 0x0000000003 (3)
"1208"= 0x0000000003 (3)
"1209"= 0x0000000003 (3)
"120A"= 0x0000000003 (3)
"120B"= 0x0000000003 (3)
"1400"= 0x0000000000 (0)
"1402"= 0x0000000000 (0)
"1405"= 0x0000000000 (0)
"1406"= 0x0000000003 (3)
"1407"= 0x0000000001 (1)
"1408"= 0x0000000003 (3)
"1409"= 0x0000000000 (0)
"1601"= 0x0000000000 (0)
"1604"= 0x0000000000 (0)
"1605"= 0x0000000000 (0)
"1606"= 0x0000000000 (0)
"1607"= 0x0000000003 (3)
"1608"= 0x0000000000 (0)
"1609"= 0x0000000001 (1)
"160A"= 0x0000000003 (3)
"1802"= 0x0000000000 (0)
"1803"= 0x0000000000 (0)
"1804"= 0x0000000001 (1)
"1809"= 0x0000000000 (0)
"1A00"= 0x0000020000 (131072)
"1A02"= 0x0000000000 (0)
"1A03"= 0x0000000000 (0)
"1A04"= 0x0000000003 (3)
"1A05"= 0x0000000001 (1)
"1A06"= 0x0000000000 (0)
"1C00"= 0x0000010000 (65536)
"2000"= 0x0000000000 (0)
"2005"= 0x0000000003 (3)
"2100"= 0x0000000000 (0)
"2101"= 0x0000000000 (0)
"2102"= 0x0000000003 (3)
"2103"= 0x0000000003 (3)
"2104"= 0x0000000003 (3)
"2105"= 0x0000000003 (3)
"2106"= 0x0000000000 (0)
"2200"= 0x0000000003 (3)
"2201"= 0x0000000003 (3)
"2300"= 0x0000000001 (1)
"2301"= 0x0000000000 (0)
"2400"= 0x0000000003 (3)
"2401"= 0x0000000000 (0)
"2402"= 0x0000000003 (3)
"2600"= 0x0000000000 (0)
"2700"= 0x0000000000 (0)
"Description"="Help prevent malware from accessing your computer."
"DisplayName"="Internet recommended safety (medium high security)"
"Icon"="wininet.dll#00001206"
"TemplateIndex"= 0x0000011500 (70912)
"2004"= 0x0000000000 (0)
"2007"= 0x0000010000 (65536)
"2001"= 0x0000000000 (0)
"2107"= 0x0000000003 (3)
"2701"= 0x0000000000 (0)
"2702"= 0x0000000000 (0)
"2703"= 0x0000000003 (3)
"2708"= 0x0000000003 (3)
"2709"= 0x0000000003 (3)
"1812"= 0x0000000001 (1)
"140A"= 0x0000000000 (0)
"2302"= 0x0000000003 (3)
"270B"= 0x0000000003 (3)
"160B"= 0x0000000000 (0)
"2704"= 0x0000000000 (0)
"270C"= 0x0000000000 (0)
"270D"= 0x0000000003 (3)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\TemplatePolicies\Medium]
"1001"= 0x0000000001 (1)
"1004"= 0x0000000003 (3)
"1200"= 0x0000000000 (0)
"1201"= 0x0000000003 (3)
"1206"= 0x0000000003 (3)
"1207"= 0x0000000000 (0)
"1208"= 0x0000000000 (0)
"1209"= 0x0000000003 (3)
"120A"= 0x0000000003 (3)
"120B"= 0x0000000000 (0)
"1400"= 0x0000000000 (0)
"1402"= 0x0000000000 (0)
"1405"= 0x0000000000 (0)
"1406"= 0x0000000003 (3)
"1407"= 0x0000000001 (1)
"1408"= 0x0000000000 (0)
"1409"= 0x0000000000 (0)
"1601"= 0x0000000000 (0)
"1604"= 0x0000000000 (0)
"1605"= 0x0000000000 (0)
"1606"= 0x0000000000 (0)
"1607"= 0x0000000003 (3)
"1608"= 0x0000000000 (0)
"1609"= 0x0000000001 (1)
"160A"= 0x0000000000 (0)
"1802"= 0x0000000000 (0)
"1803"= 0x0000000000 (0)
"1804"= 0x0000000001 (1)
"1809"= 0x0000000000 (0)
"1A00"= 0x0000020000 (131072)
"1A02"= 0x0000000000 (0)
"1A03"= 0x0000000000 (0)
"1A04"= 0x0000000003 (3)
"1A05"= 0x0000000001 (1)
"1A06"= 0x0000000000 (0)
"1C00"= 0x0000010000 (65536)
"2000"= 0x0000000000 (0)
"2005"= 0x0000000000 (0)
"2100"= 0x0000000000 (0)
"2101"= 0x0000000000 (0)
"2102"= 0x0000000003 (3)
"2103"= 0x0000000000 (0)
"2104"= 0x0000000000 (0)
"2105"= 0x0000000000 (0)
"2106"= 0x0000000000 (0)
"2200"= 0x0000000003 (3)
"2201"= 0x0000000003 (3)
"2300"= 0x0000000001 (1)
"2301"= 0x0000000000 (0)
"2400"= 0x0000000000 (0)
"2401"= 0x0000000000 (0)
"2402"= 0x0000000000 (0)
"2600"= 0x0000000000 (0)
"2700"= 0x0000000003 (3)
"Description"="Warn before running potentially damaging content."
"DisplayName"="Medium safety (medium security)"
"Icon"="wininet.dll#00001206"
"TemplateIndex"= 0x0000011000 (69632)
"2007"= 0x0000010000 (65536)
"2001"= 0x0000000000 (0)
"2004"= 0x0000000000 (0)
"2107"= 0x0000000000 (0)
"2701"= 0x0000000000 (0)
"2702"= 0x0000000000 (0)
"2703"= 0x0000000000 (0)
"2708"= 0x0000000003 (3)
"2709"= 0x0000000003 (3)
"1812"= 0x0000000000 (0)
"140A"= 0x0000000000 (0)
"2302"= 0x0000000003 (3)
"270B"= 0x0000000000 (0)
"160B"= 0x0000000000 (0)
"2704"= 0x0000000000 (0)
"2108"= 0x0000000003 (3)
"270C"= 0x0000000003 (3)
"270D"= 0x0000000000 (0)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\TemplatePolicies\MedLow]
"1001"= 0x0000000001 (1)
"1004"= 0x0000000003 (3)
"1200"= 0x0000000000 (0)
"1201"= 0x0000000003 (3)
"1206"= 0x0000000000 (0)
"1207"= 0x0000000000 (0)
"1208"= 0x0000000000 (0)
"1209"= 0x0000000000 (0)
"120A"= 0x0000000003 (3)
"120B"= 0x0000000000 (0)
"1400"= 0x0000000000 (0)
"1402"= 0x0000000000 (0)
"1405"= 0x0000000000 (0)
"1406"= 0x0000000001 (1)
"1407"= 0x0000000000 (0)
"1408"= 0x0000000000 (0)
"1409"= 0x0000000003 (3)
"1601"= 0x0000000000 (0)
"1604"= 0x0000000000 (0)
"1605"= 0x0000000000 (0)
"1606"= 0x0000000000 (0)
"1607"= 0x0000000000 (0)
"1608"= 0x0000000000 (0)
"1609"= 0x0000000001 (1)
"160A"= 0x0000000000 (0)
"1802"= 0x0000000000 (0)
"1803"= 0x0000000000 (0)
"1804"= 0x0000000001 (1)
"1809"= 0x0000000003 (3)
"1A00"= 0x0000020000 (131072)
"1A02"= 0x0000000000 (0)
"1A03"= 0x0000000000 (0)
"1A04"= 0x0000000000 (0)
"1A05"= 0x0000000000 (0)
"1A06"= 0x0000000000 (0)
"1C00"= 0x0000020000 (131072)
"2000"= 0x0000000000 (0)
"2005"= 0x0000000000 (0)
"2100"= 0x0000000000 (0)
"2101"= 0x0000000000 (0)
"2102"= 0x0000000000 (0)
"2103"= 0x0000000000 (0)
"2104"= 0x0000000000 (0)
"2105"= 0x0000000000 (0)
"2106"= 0x0000000000 (0)
"2200"= 0x0000000000 (0)
"2201"= 0x0000000000 (0)
"2300"= 0x0000000001 (1)
"2301"= 0x0000000003 (3)
"2400"= 0x0000000000 (0)
"2401"= 0x0000000000 (0)
"2402"= 0x0000000000 (0)
"2600"= 0x0000000000 (0)
"2700"= 0x0000000003 (3)
"Description"="Recommended for intranet."
"DisplayName"="Intranet recommended safety (less secure)"
"Icon"="wininet.dll#00001206"
"TemplateIndex"= 0x0000010500 (66816)
"2001"= 0x0000000000 (0)
"2004"= 0x0000000000 (0)
"2007"= 0x0000010000 (65536)
"2107"= 0x0000000000 (0)
"2701"= 0x0000000000 (0)
"2702"= 0x0000000003 (3)
"2703"= 0x0000000000 (0)
"2708"= 0x0000000003 (3)
"2709"= 0x0000000003 (3)
"1812"= 0x0000000000 (0)
"140A"= 0x0000000000 (0)
"2302"= 0x0000000003 (3)
"270B"= 0x0000000000 (0)
"160B"= 0x0000000000 (0)
"2704"= 0x0000000000 (0)
"2108"= 0x0000000003 (3)
"270C"= 0x0000000003 (3)
"270D"= 0x0000000000 (0)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Url History]
"Directory"="C:\Windows\History"
"CachePrefix"="Visited: "
"CacheLimit"=00 02 00 00  (REG_BINARY)
"DaysToKeep"= 0x0000000014 (20)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent]
(No values found)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\post platform]
(No values found)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\UA Tokens]
"MSN 2.0"=""
"MSN 2.5"=""

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp]
(No values found)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp\Passport Test]
"ConfigVersion"= 0x0000000000 (0)
"LoginServerRealm"="Passport.NET"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp\Tracing]
(No values found)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect"= 0x0000000001 (1)
"UNCAsIntranet"= 0x0000000000 (0)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults]
"file"= 0x0000000003 (3)
"ftp"= 0x0000000003 (3)
"http"= 0x0000000003 (3)
"https"= 0x0000000003 (3)
"@ivt"= 0x0000000001 (1)
"shell"= 0x0000000000 (0)
"ldap"= 0x0000000004 (4)
"news"= 0x0000000004 (4)
"snews"= 0x0000000004 (4)
"nntp"= 0x0000000004 (4)
"oecmd"= 0x0000000004 (4)
"knownfolder"= 0x0000000000 (0)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones]
(No values found)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]
"1001"= 0x0000000000 (0)
"1004"= 0x0000000000 (0)
"1200"= 0x0000000000 (0)
"1201"= 0x0000000000 (0)
"1206"= 0x0000000000 (0)
"1207"= 0x0000000000 (0)
"1208"= 0x0000000000 (0)
"1209"= 0x0000000000 (0)
"120A"= 0x0000000000 (0)
"120B"= 0x0000000000 (0)
"1400"= 0x0000000000 (0)
"1402"= 0x0000000000 (0)
"1405"= 0x0000000000 (0)
"1406"= 0x0000000000 (0)
"1407"= 0x0000000000 (0)
"1408"= 0x0000000000 (0)
"1409"= 0x0000000003 (3)
"1601"= 0x0000000000 (0)
"1604"= 0x0000000000 (0)
"1605"= 0x0000000000 (0)
"1606"= 0x0000000000 (0)
"1607"= 0x0000000000 (0)
"1608"= 0x0000000000 (0)
"1609"= 0x0000000001 (1)
"160A"= 0x0000000000 (0)
"1802"= 0x0000000000 (0)
"1803"= 0x0000000000 (0)
"1804"= 0x0000000001 (1)
"1805"= 0x0000000000 (0)
"1806"= 0x0000000000 (0)
"1807"= 0x0000000000 (0)
"1808"= 0x0000000000 (0)
"1809"= 0x0000000003 (3)
"180A"= 0x0000000000 (0)
"180C"= 0x0000000000 (0)
"180D"= 0x0000000000 (0)
"180E"= 0x0000000000 (0)
"180F"= 0x0000000000 (0)
"1A00"= 0x0000000000 (0)
"1A02"= 0x0000000000 (0)
"1A03"= 0x0000000000 (0)
"1A04"= 0x0000000000 (0)
"1A05"= 0x0000000000 (0)
"1A06"= 0x0000000000 (0)
"1A10"= 0x0000000000 (0)
"1C00"= 0x0000020000 (131072)
"2000"= 0x0000000000 (0)
"2005"= 0x0000000000 (0)
"2100"= 0x0000000000 (0)
"2101"= 0x0000000003 (3)
"2102"= 0x0000000000 (0)
"2103"= 0x0000000000 (0)
"2104"= 0x0000000000 (0)
"2105"= 0x0000000000 (0)
"2106"= 0x0000000000 (0)
"2200"= 0x0000000000 (0)
"2201"= 0x0000000000 (0)
"2300"= 0x0000000001 (1)
"2301"= 0x0000000003 (3)
"2400"= 0x0000000000 (0)
"2401"= 0x0000000000 (0)
"2402"= 0x0000000000 (0)
"2500"= 0x0000000003 (3)
"2600"= 0x0000000000 (0)
"2700"= 0x0000000003 (3)
"CurrentLevel"= 0x0000000000 (0)
"Description"="Your computer"
"DisplayName"="Computer"
"Flags"= 0x0000000021 (33)
"Icon"="shell32.dll#0016"
"LowIcon"="inetcpl.cpl#005422"
"PMDisplayName"="Computer [Protected Mode]"
"2004"= 0x0000000003 (3)
"2007"= 0x0000000003 (3)
"2001"= 0x0000000003 (3)
"2107"= 0x0000000000 (0)
"2701"= 0x0000000000 (0)
"2702"= 0x0000000003 (3)
"2703"= 0x0000000003 (3)
"2708"= 0x0000000003 (3)
"2709"= 0x0000000003 (3)
"1812"= 0x0000000000 (0)
"140A"= 0x0000000000 (0)
"2302"= 0x0000000003 (3)
"270B"= 0x0000000003 (3)
"160B"= 0x0000000000 (0)
"2704"= 0x0000000000 (0)
"1810"= 0x0000000003 (3)
"2108"= 0x0000000003 (3)
"1800"= 0x0000000000 (0)
"1E05"= 0x0000030000 (196608)
"270C"= 0x0000000003 (3)
"270D"= 0x0000000000 (0)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1]
"1001"= 0x0000000001 (1)
"1004"= 0x0000000003 (3)
"1200"= 0x0000000000 (0)
"1201"= 0x0000000000 (0)
"1206"= 0x0000000000 (0)
"1207"= 0x0000000000 (0)
"1208"= 0x0000000000 (0)
"1209"= 0x0000000000 (0)
"120A"= 0x0000000003 (3)
"120B"= 0x0000000000 (0)
"1400"= 0x0000000000 (0)
"1402"= 0x0000000000 (0)
"1405"= 0x0000000000 (0)
"1406"= 0x0000000001 (1)
"1407"= 0x0000000000 (0)
"1408"= 0x0000000000 (0)
"1409"= 0x0000000003 (3)
"1601"= 0x0000000000 (0)
"1604"= 0x0000000000 (0)
"1605"= 0x0000000000 (0)
"1606"= 0x0000000000 (0)
"1607"= 0x0000000000 (0)
"1608"= 0x0000000000 (0)
"1609"= 0x0000000001 (1)
"160A"= 0x0000000000 (0)
"1802"= 0x0000000000 (0)
"1803"= 0x0000000000 (0)
"1804"= 0x0000000001 (1)
"1805"= 0x0000000000 (0)
"1806"= 0x0000000000 (0)
"1807"= 0x0000000000 (0)
"1808"= 0x0000000000 (0)
"1809"= 0x0000000003 (3)
"180A"= 0x0000000000 (0)
"180C"= 0x0000000003 (3)
"180D"= 0x0000000000 (0)
"180E"= 0x0000000000 (0)
"180F"= 0x0000000000 (0)
"1A00"= 0x0000020000 (131072)
"1A02"= 0x0000000000 (0)
"1A03"= 0x0000000000 (0)
"1A04"= 0x0000000000 (0)
"1A05"= 0x0000000000 (0)
"1A06"= 0x0000000000 (0)
"1A10"= 0x0000000000 (0)
"1C00"= 0x0000020000 (131072)
"2000"= 0x0000000000 (0)
"2005"= 0x0000000000 (0)
"2100"= 0x0000000000 (0)
"2101"= 0x0000000000 (0)
"2102"= 0x0000000000 (0)
"2103"= 0x0000000000 (0)
"2104"= 0x0000000000 (0)
"2105"= 0x0000000000 (0)
"2106"= 0x0000000000 (0)
"2200"= 0x0000000000 (0)
"2201"= 0x0000000000 (0)
"2300"= 0x0000000001 (1)
"2301"= 0x0000000003 (3)
"2400"= 0x0000000000 (0)
"2401"= 0x0000000000 (0)
"2402"= 0x0000000000 (0)
"2500"= 0x0000000003 (3)
"2600"= 0x0000000000 (0)
"2700"= 0x0000000003 (3)
"CurrentLevel"= 0x0000010500 (66816)
"Description"="This zone is for all websites that are found on your intranet."
"DisplayName"="Local intranet"
"Flags"= 0x00000000db (219)
"Icon"="shell32.dll#0018"
"LowIcon"="inetcpl.cpl#005423"
"MinLevel"= 0x0000010000 (65536)
"PMDisplayName"="Local intranet [Protected Mode]"
"RecommendedLevel"= 0x0000010500 (66816)
"2004"= 0x0000000000 (0)
"2001"= 0x0000000000 (0)
"2007"= 0x0000010000 (65536)
"2107"= 0x0000000000 (0)
"2701"= 0x0000000000 (0)
"2702"= 0x0000000003 (3)
"2703"= 0x0000000000 (0)
"2708"= 0x0000000003 (3)
"2709"= 0x0000000003 (3)
"1812"= 0x0000000000 (0)
"140A"= 0x0000000000 (0)
"2302"= 0x0000000003 (3)
"270B"= 0x0000000000 (0)
"160B"= 0x0000000000 (0)
"2704"= 0x0000000000 (0)
"1810"= 0x0000000003 (3)
"2108"= 0x0000000003 (3)
"1800"= 0x0000000001 (1)
"1E05"= 0x0000020000 (131072)
"270C"= 0x0000000003 (3)
"270D"= 0x0000000000 (0)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]
"1001"= 0x0000000001 (1)
"1004"= 0x0000000003 (3)
"1200"= 0x0000000000 (0)
"1201"= 0x0000000000 (0)
"1206"= 0x0000000003 (3)
"1207"= 0x0000000000 (0)
"1208"= 0x0000000000 (0)
"1209"= 0x0000000003 (3)
"120A"= 0x0000000003 (3)
"120B"= 0x0000000000 (0)
"1400"= 0x0000000000 (0)
"1402"= 0x0000000000 (0)
"1405"= 0x0000000000 (0)
"1406"= 0x0000000003 (3)
"1407"= 0x0000000001 (1)
"1408"= 0x0000000000 (0)
"1409"= 0x0000000000 (0)
"1601"= 0x0000000000 (0)
"1604"= 0x0000000000 (0)
"1605"= 0x0000000000 (0)
"1606"= 0x0000000000 (0)
"1607"= 0x0000000003 (3)
"1608"= 0x0000000000 (0)
"1609"= 0x0000000001 (1)
"160A"= 0x0000000000 (0)
"1802"= 0x0000000000 (0)
"1803"= 0x0000000000 (0)
"1804"= 0x0000000001 (1)
"1805"= 0x0000000001 (1)
"1806"= 0x0000000001 (1)
"1807"= 0x0000000001 (1)
"1808"= 0x0000000000 (0)
"1809"= 0x0000000000 (0)
"180A"= 0x0000000003 (3)
"180C"= 0x0000000003 (3)
"180D"= 0x0000000000 (0)
"180E"= 0x0000000000 (0)
"180F"= 0x0000000000 (0)
"1A00"= 0x0000020000 (131072)
"1A02"= 0x0000000000 (0)
"1A03"= 0x0000000000 (0)
"1A04"= 0x0000000003 (3)
"1A05"= 0x0000000001 (1)
"1A06"= 0x0000000000 (0)
"1A10"= 0x0000000001 (1)
"1C00"= 0x0000010000 (65536)
"2000"= 0x0000000000 (0)
"2005"= 0x0000000000 (0)
"2100"= 0x0000000000 (0)
"2101"= 0x0000000000 (0)
"2102"= 0x0000000003 (3)
"2103"= 0x0000000000 (0)
"2104"= 0x0000000000 (0)
"2105"= 0x0000000000 (0)
"2106"= 0x0000000000 (0)
"2200"= 0x0000000003 (3)
"2201"= 0x0000000003 (3)
"2300"= 0x0000000001 (1)
"2301"= 0x0000000000 (0)
"2400"= 0x0000000000 (0)
"2401"= 0x0000000000 (0)
"2402"= 0x0000000000 (0)
"2500"= 0x0000000003 (3)
"2600"= 0x0000000000 (0)
"2700"= 0x0000000003 (3)
"CurrentLevel"= 0x0000011000 (69632)
"Description"="This zone contains web sites that you trust not to damage your computer or your files"
"DisplayName"="Trusted sites"
"Flags"= 0x0000000047 (71)
"Icon"="inetcpl.cpl#00004480"
"LowIcon"="inetcpl.cpl#005424"
"MinLevel"= 0x0000010000 (65536)
"PMDisplayName"="Trusted sites [Protected Mode]"
"RecommendedLevel"= 0x0000011000 (69632)
"2004"= 0x0000000000 (0)
"2007"= 0x0000010000 (65536)
"2001"= 0x0000000000 (0)
"2107"= 0x0000000000 (0)
"2701"= 0x0000000000 (0)
"2702"= 0x0000000000 (0)
"2703"= 0x0000000000 (0)
"2708"= 0x0000000003 (3)
"2709"= 0x0000000003 (3)
"1812"= 0x0000000000 (0)
"140A"= 0x0000000000 (0)
"2302"= 0x0000000003 (3)
"270B"= 0x0000000000 (0)
"160B"= 0x0000000000 (0)
"2704"= 0x0000000000 (0)
"1810"= 0x0000000003 (3)
"2108"= 0x0000000003 (3)
"1800"= 0x0000000001 (1)
"1E05"= 0x0000020000 (131072)
"270C"= 0x0000000003 (3)
"270D"= 0x0000000000 (0)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
"1001"= 0x0000000001 (1)
"1004"= 0x0000000003 (3)
"1200"= 0x0000000000 (0)
"1201"= 0x0000000000 (0)
"1206"= 0x0000000003 (3)
"1207"= 0x0000000003 (3)
"1208"= 0x0000000000 (0)
"1209"= 0x0000000003 (3)
"120A"= 0x0000000003 (3)
"120B"= 0x0000000003 (3)
"1400"= 0x0000000000 (0)
"1402"= 0x0000000000 (0)
"1405"= 0x0000000000 (0)
"1406"= 0x0000000003 (3)
"1407"= 0x0000000001 (1)
"1408"= 0x0000000003 (3)
"1409"= 0x0000000000 (0)
"1601"= 0x0000000000 (0)
"1604"= 0x0000000000 (0)
"1605"= 0x0000000000 (0)
"1606"= 0x0000000000 (0)
"1607"= 0x0000000003 (3)
"1608"= 0x0000000000 (0)
"1609"= 0x0000000001 (1)
"160A"= 0x0000000000 (0)
"1802"= 0x0000000000 (0)
"1803"= 0x0000000000 (0)
"1804"= 0x0000000001 (1)
"1805"= 0x0000000001 (1)
"1806"= 0x0000000001 (1)
"1807"= 0x0000000001 (1)
"1808"= 0x0000000000 (0)
"1809"= 0x0000000000 (0)
"180A"= 0x0000000003 (3)
"180C"= 0x0000000003 (3)
"180D"= 0x0000000001 (1)
"180E"= 0x0000000000 (0)
"180F"= 0x0000000000 (0)
"1A00"= 0x0000020000 (131072)
"1A02"= 0x0000000000 (0)
"1A03"= 0x0000000000 (0)
"1A04"= 0x0000000003 (3)
"1A05"= 0x0000000001 (1)
"1A06"= 0x0000000000 (0)
"1A10"= 0x0000000001 (1)
"1C00"= 0x0000010000 (65536)
"2000"= 0x0000000000 (0)
"2005"= 0x0000000003 (3)
"2100"= 0x0000000000 (0)
"2101"= 0x0000000000 (0)
"2102"= 0x0000000003 (3)
"2103"= 0x0000000003 (3)
"2104"= 0x0000000003 (3)
"2105"= 0x0000000003 (3)
"2106"= 0x0000000000 (0)
"2200"= 0x0000000003 (3)
"2201"= 0x0000000003 (3)
"2300"= 0x0000000001 (1)
"2301"= 0x0000000000 (0)
"2400"= 0x0000000000 (0)
"2401"= 0x0000000000 (0)
"2402"= 0x0000000000 (0)
"2500"= 0x0000000003 (3)
"2600"= 0x0000000000 (0)
"2700"= 0x0000000000 (0)
"CurrentLevel"= 0x0000011500 (70912)
"Description"="This zone is for Internet websites, except those listed in trusted and restricted zones."
"DisplayName"="Internet"
"Flags"= 0x0000000001 (1)
"Icon"="inetcpl.cpl#001313"
"LowIcon"="inetcpl.cpl#005425"
"MinLevel"= 0x0000011000 (69632)
"PMDisplayName"="Internet [Protected Mode]"
"RecommendedLevel"= 0x0000011500 (70912)
"2001"= 0x0000000000 (0)
"2004"= 0x0000000000 (0)
"2007"= 0x0000010000 (65536)
"2107"= 0x0000000003 (3)
"2701"= 0x0000000000 (0)
"2702"= 0x0000000000 (0)
"2703"= 0x0000000003 (3)
"2708"= 0x0000000003 (3)
"2709"= 0x0000000003 (3)
"1812"= 0x0000000001 (1)
"140A"= 0x0000000000 (0)
"2302"= 0x0000000003 (3)
"270B"= 0x0000000003 (3)
"160B"= 0x0000000000 (0)
"2704"= 0x0000000000 (0)
"1810"= 0x0000000003 (3)
"1800"= 0x0000000001 (1)
"1E05"= 0x0000020000 (131072)
"270C"= 0x0000000000 (0)
"270D"= 0x0000000003 (3)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4]
"1001"= 0x0000000003 (3)
"1004"= 0x0000000003 (3)
"1200"= 0x0000000000 (0)
"1201"= 0x0000000000 (0)
"1206"= 0x0000000003 (3)
"1207"= 0x0000000003 (3)
"1208"= 0x0000000000 (0)
"1209"= 0x0000000003 (3)
"120A"= 0x0000000003 (3)
"120B"= 0x0000000003 (3)
"1400"= 0x0000000003 (3)
"1402"= 0x0000000003 (3)
"1405"= 0x0000000003 (3)
"1406"= 0x0000000003 (3)
"1407"= 0x0000000003 (3)
"1408"= 0x0000000003 (3)
"1409"= 0x0000000000 (0)
"1601"= 0x0000000001 (1)
"1604"= 0x0000000003 (3)
"1605"= 0x0000000000 (0)
"1606"= 0x0000000003 (3)
"1607"= 0x0000000003 (3)
"1608"= 0x0000000000 (0)
"1609"= 0x0000000001 (1)
"160A"= 0x0000000003 (3)
"1802"= 0x0000000001 (1)
"1803"= 0x0000000003 (3)
"1804"= 0x0000000001 (1)
"1805"= 0x0000000001 (1)
"1806"= 0x0000000003 (3)
"1807"= 0x0000000001 (1)
"1808"= 0x0000000000 (0)
"1809"= 0x0000000000 (0)
"180A"= 0x0000000003 (3)
"180B"= 0x0000000001 (1)
"180C"= 0x0000000003 (3)
"180d"= 0x0000000001 (1)
"180E"= 0x0000000003 (3)
"180F"= 0x0000000003 (3)
"1A00"= 0x0000010000 (65536)
"1A02"= 0x0000000003 (3)
"1A03"= 0x0000000003 (3)
"1A04"= 0x0000000003 (3)
"1A05"= 0x0000000003 (3)
"1A06"= 0x0000000003 (3)
"1A10"= 0x0000000003 (3)
"1C00"= 0x0000000000 (0)
"2000"= 0x0000000003 (3)
"2005"= 0x0000000003 (3)
"2100"= 0x0000000003 (3)
"2101"= 0x0000000003 (3)
"2102"= 0x0000000003 (3)
"2103"= 0x0000000003 (3)
"2104"= 0x0000000003 (3)
"2105"= 0x0000000003 (3)
"2106"= 0x0000000003 (3)
"2200"= 0x0000000003 (3)
"2201"= 0x0000000003 (3)
"2300"= 0x0000000003 (3)
"2301"= 0x0000000000 (0)
"2400"= 0x0000000003 (3)
"2401"= 0x0000000003 (3)
"2402"= 0x0000000003 (3)
"2500"= 0x0000000003 (3)
"2600"= 0x0000000003 (3)
"2700"= 0x0000000000 (0)
"CurrentLevel"= 0x0000012000 (73728)
"Description"="This zone is for websites that might damage your computer or your files."
"DisplayName"="Restricted sites"
"Flags"= 0x0000000003 (3)
"Icon"="inetcpl.cpl#00004481"
"LowIcon"="inetcpl.cpl#005426"
"MinLevel"= 0x0000012000 (73728)
"PMDisplayName"="Restricted sites [Protected Mode]"
"RecommendedLevel"= 0x0000012000 (73728)
"2001"= 0x0000000003 (3)
"2007"= 0x0000000003 (3)
"2004"= 0x0000000003 (3)
"2107"= 0x0000000003 (3)
"2701"= 0x0000000003 (3)
"2702"= 0x0000000000 (0)
"2703"= 0x0000000003 (3)
"2708"= 0x0000000003 (3)
"2709"= 0x0000000003 (3)
"1812"= 0x0000000001 (1)
"140A"= 0x0000000000 (0)
"2302"= 0x0000000003 (3)
"270B"= 0x0000000003 (3)
"160B"= 0x0000000000 (0)
"2704"= 0x0000000003 (3)
"1810"= 0x0000000003 (3)
"1800"= 0x0000000003 (3)
"1E05"= 0x0000010000 (65536)
"270C"= 0x0000000000 (0)
"270D"= 0x0000000003 (3)


[]
Hive unrecognized.

-= EOF =-


weti 19.08.2014 10:33

Teil 1 war wohl nicht mitgekommen:
Code:

SystemLook 30.07.11 by jpshortstuff
Log created at 11:02 on 19/08/2014 by Admin
Administrator - Elevation successful

========== regfind ==========

Searching for "proxyserver"
[HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\Internet]
"UseRWHlinkNavigation"="http://www.trojaner-board.de/157489-...new-post.html"
[HKEY_CURRENT_USER\Software\Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"=""
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"="http=127.0.0.1:8877;https=127.0.0.1:8877"
[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"="http=127.0.0.1:8877;https=127.0.0.1:8877"
[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"="http=127.0.0.1:8877;https=127.0.0.1:8877"
[HKEY_USERS\S-1-5-21-79635218-2301998975-3311727660-1000\Software\Microsoft\Office\14.0\Common\Internet]
"UseRWHlinkNavigation"="http://www.trojaner-board.de/157489-...new-post.html"
[HKEY_USERS\S-1-5-21-79635218-2301998975-3311727660-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"="http=127.0.0.1:8877;https=127.0.0.1:8877"
[HKEY_USERS\S-1-5-21-79635218-2301998975-3311727660-1000\Software\Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"="http=127.0.0.1:8877;https=127.0.0.1:8877"
[HKEY_USERS\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"="http=127.0.0.1:8877;https=127.0.0.1:8877"
[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"="http=127.0.0.1:8877;https=127.0.0.1:8877"

========== reg ==========

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"IE5_UA_Backup_Flag"="5.0"
"User Agent"="Mozilla/4.0 (compatible; MSIE 8.0; Win32)"
"EmailName"="User@"
"PrivDiscUiShown"= 0x0000000001 (1)
"EnableHttp1_1"= 0x0000000001 (1)
"WarnOnIntranet"= 0x0000000001 (1)
"MimeExclusionListForCache"="multipart/mixed multipart/x-mixed-replace multipart/x-byteranges "
"AutoConfigProxy"="wininet.dll"
"UseSchannelDirectly"=01 00 00 00  (REG_BINARY)
"WarnOnPost"=01 00 00 00  (REG_BINARY)
"UrlEncoding"= 0x0000000000 (0)
"SecureProtocols"= 0x0000000aa0 (2720)
"PrivacyAdvanced"= 0x0000000000 (0)
"ZonesSecurityUpgrade"=75 3a 48 3b d0 e5 ce 01  (REG_BINARY)
"DisableCachingOfSSLPages"= 0x0000000000 (0)
"WarnonZoneCrossing"= 0x0000000001 (1)
"CertificateRevocation"= 0x0000000001 (1)
"EnableNegotiate"= 0x0000000001 (1)
"MigrateProxy"= 0x0000000001 (1)
"ProxyEnable"= 0x0000000001 (1)
"GlobalUserOffline"= 0x0000000000 (0)
"WarnonBadCertRecving"= 0x0000000001 (1)
"WarnOnPostRedirect"= 0x0000000000 (0)
"WarnOnHTTPSToHTTPRedirect"= 0x0000000001 (1)
"ProxyOverride"="www;http;https"
"ProxyServer"="http=127.0.0.1:8877;https=127.0.0.1:8877"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache]
"Signature"="Client UrlCache MMF Ver 5.2"
"ContentLimit"= 0x00000000fa (250)
"TotalContentLimit"= 0x0000000000 (0)
"AppContainerTotalContentLimit"= 0x00000003e8 (1000)
"AppContainerContentLimit"= 0x0000000032 (50)
"Version"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix"=""
"CacheLimit"= 0x000003e800 (256000)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix"="Cookie:"
"CacheLimit"= 0x0000002000 (8192)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\DNTException]
"CachePrefix"="DNTException:"
"CachePath"="%APPDATA%\Microsoft\Windows\DNTException"
"CacheOptions"= 0x0000000300 (768)
"CacheRepair"= 0x0000000000 (0)
"CacheLimit"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\DOMStore]
"CachePath"="%USERPROFILE%\AppData\Local\Microsoft\Internet Explorer\DOMStore"
"CachePrefix"="DOMStore"
"CacheLimit"= 0x00000003e8 (1000)
"CacheOptions"= 0x0000000008 (8)
"CacheRepair"= 0x0000000000 (0)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\EmieSiteList]
"CachePrefix"="EmieSiteList:"
"CachePath"="%USERPROFILE%\AppData\Local\EmieSiteList"
"CacheOptions"= 0x0000000300 (768)
"CacheRepair"= 0x0000000000 (0)
"CacheLimit"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\EmieUserList]
"CachePrefix"="EmieUserList:"
"CachePath"="%USERPROFILE%\AppData\Local\EmieUserList"
"CacheOptions"= 0x0000000300 (768)
"CacheRepair"= 0x0000000000 (0)
"CacheLimit"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\feedplat]
"CachePath"="%USERPROFILE%\AppData\Local\Microsoft\Feeds Cache"
"CachePrefix"="feedplat:"
"CacheLimit"= 0x0000002000 (8192)
"CacheOptions"= 0x0000000000 (0)
"CacheRepair"= 0x0000000000 (0)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\iecompat]
"CachePrefix"="iecompat:"
"CachePath"="%APPDATA%\Microsoft\Windows\IECompatCache"
"CacheOptions"= 0x0000000309 (777)
"CacheRepair"= 0x0000000000 (0)
"CacheLimit"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\iecompatua]
"CachePrefix"="iecompatua:"
"CachePath"="%APPDATA%\Microsoft\Windows\iecompatuaCache"
"CacheOptions"= 0x0000000309 (777)
"CacheRepair"= 0x0000000000 (0)
"CacheLimit"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\iedownload]
"CachePath"="%APPDATA%\Microsoft\Windows\IEDownloadHistory"
"CachePrefix"="iedownload:"
"CacheLimit"= 0x0000002000 (8192)
"CacheOptions"= 0x0000000009 (9)
"CacheRepair"= 0x0000000000 (0)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\ietld]
"CachePath"="%APPDATA%\Microsoft\Windows\IETldCache"
"CachePrefix"="ietld:"
"CacheLimit"= 0x0000002000 (8192)
"CacheOptions"= 0x0000000009 (9)
"CacheRepair"= 0x0000000000 (0)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014072820140804]
"CachePrefix"=":2014072820140804: "
"CachePath"="%USERPROFILE%\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012014072820140804"
"CacheOptions"= 0x000000000b (11)
"CacheRepair"= 0x0000000000 (0)
"CacheLimit"= 0x0000002000 (8192)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014080420140811]
"CachePrefix"=":2014080420140811: "
"CachePath"="%USERPROFILE%\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012014080420140811"
"CacheOptions"= 0x000000000b (11)
"CacheRepair"= 0x0000000000 (0)
"CacheLimit"= 0x0000002000 (8192)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014081120140818]
"CachePrefix"=":2014081120140818: "
"CachePath"="%USERPROFILE%\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012014081120140818"
"CacheOptions"= 0x000000000b (11)
"CacheRepair"= 0x0000000000 (0)
"CacheLimit"= 0x0000002000 (8192)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014081820140819]
"CachePrefix"=":2014081820140819: "
"CachePath"="%USERPROFILE%\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012014081820140819"
"CacheOptions"= 0x000000000b (11)
"CacheRepair"= 0x0000000000 (0)
"CacheLimit"= 0x0000002000 (8192)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\PrivacIE:]
"CachePath"="%APPDATA%\Microsoft\Windows\PrivacIE"
"CachePrefix"="PrivacIE:"
"CacheLimit"= 0x0000000400 (1024)
"CacheOptions"= 0x0000000009 (9)
"CacheRepair"= 0x0000000000 (0)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\UserData]
"CachePath"="%APPDATA%\Microsoft\Internet Explorer\UserData"
"CachePrefix"="UserData"
"CacheLimit"= 0x00000003e8 (1000)
"CacheOptions"= 0x0000000008 (8)
"CacheRepair"= 0x0000000000 (0)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix"="Visited:"
"CacheLimit"= 0x0000002000 (8192)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache]
"Signature"="Client UrlCache MMF Ver 5.2"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Content]
"CachePrefix"=""
"CacheLimit"= 0x000003e800 (256000)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Cookies]
"CachePrefix"="Cookie:"
"CacheLimit"= 0x0000002000 (8192)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Extensible Cache]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Extensible Cache\DNTException]
"CachePrefix"="DNTException:"
"CachePath"="%APPDATA%\Microsoft\Windows\DNTException\Low"
"CacheOptions"= 0x0000000300 (768)
"CacheRepair"= 0x0000000000 (0)
"CacheLimit"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Extensible Cache\DOMStore]
"CachePath"="%USERPROFILE%\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore"
"CachePrefix"="DOMStore"
"CacheLimit"= 0x00000003e8 (1000)
"CacheOptions"= 0x0000000008 (8)
"CacheRepair"= 0x0000000000 (0)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Extensible Cache\EmieSiteList]
"CachePrefix"="EmieSiteList:"
"CachePath"="%USERPROFILE%\AppData\LocalLow\EmieSiteList"
"CacheOptions"= 0x0000000300 (768)
"CacheRepair"= 0x0000000000 (0)
"CacheLimit"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Extensible Cache\EmieUserList]
"CachePrefix"="EmieUserList:"
"CachePath"="%USERPROFILE%\AppData\LocalLow\EmieUserList"
"CacheOptions"= 0x0000000300 (768)
"CacheRepair"= 0x0000000000 (0)
"CacheLimit"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Extensible Cache\iecompat]
"CachePrefix"="iecompat:"
"CachePath"="%APPDATA%\Microsoft\Windows\IECompatCache\Low"
"CacheOptions"= 0x0000000309 (777)
"CacheRepair"= 0x0000000000 (0)
"CacheLimit"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Extensible Cache\iecompatua]
"CachePrefix"="iecompatua:"
"CachePath"="%APPDATA%\Microsoft\Windows\iecompatuaCache\Low"
"CacheOptions"= 0x0000000309 (777)
"CacheRepair"= 0x0000000000 (0)
"CacheLimit"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Extensible Cache\ietld]
"CachePath"="%APPDATA%\Microsoft\Windows\IETldCache\Low"
"CachePrefix"="ietld:"
"CacheLimit"= 0x0000002000 (8192)
"CacheOptions"= 0x0000000009 (9)
"CacheRepair"= 0x0000000000 (0)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Extensible Cache\PrivacIE:]
"CachePath"="%APPDATA%\Microsoft\Windows\PrivacIE\Low"
"CachePrefix"="PrivacIE:"
"CacheLimit"= 0x0000000400 (1024)
"CacheOptions"= 0x0000000009 (9)
"CacheRepair"= 0x0000000000 (0)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\History]
"CachePrefix"="Visited:"
"CacheLimit"= 0x0000002000 (8192)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\post platform]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\CACHE]
"Persistent"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings"=46 00 00 00 11 17 00 00 09 00 00 00 00 00 00 00 0e 00 00 00 77 77 77 3b 68 74 74 70 3b 68 74 74 70 73 00 00 00 00 05 00 00 00 00 00 00 00 a1 4c 73 21 ba 56 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 02 00 00 00 c0 a8 02 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 17 00 00 00 00 00 00 00 20 01 00 00 5e f5 79 fd 1c 1b 1d 06 3f 57 fd e1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  (REG_BINARY)
"SavedLegacySettings"=46 00 00 00 aa 36 00 00 09 00 00 00 00 00 00 00 0e 00 00 00 77 77 77 3b 68 74 74 70 3b 68 74 74 70 73 00 00 00 00 05 00 00 00 00 00 00 00 a1 4c 73 21 ba 56 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 02 00 00 00 c0 a8 02 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 17 00 00 00 00 00 00 00 20 01 00 00 5e f5 79 fd 1c 1b 1d 06 3f 57 fd e1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  (REG_BINARY)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0]
@=""
"DisplayName"="Computer"
"PMDisplayName"="Computer [Protected Mode]"
"Description"="Your computer"
"Icon"="shell32.dll#0016"
"LowIcon"="inetcpl.cpl#005422"
"CurrentLevel"= 0x0000000000 (0)
"Flags"= 0x0000000021 (33)
"1200"= 0x0000000003 (3)
"1400"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1]
@=""
"DisplayName"="Local intranet"
"PMDisplayName"="Local intranet [Protected Mode]"
"Description"="This zone contains all Web sites that are on your organization's intranet."
"Icon"="shell32.dll#0018"
"LowIcon"="inetcpl.cpl#005423"
"CurrentLevel"= 0x0000000000 (0)
"Flags"= 0x00000000db (219)
"1200"= 0x0000000003 (3)
"1400"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2]
@=""
"DisplayName"="Trusted sites"
"PMDisplayName"="Trusted sites [Protected Mode]"
"Description"="This zone contains Web sites that you trust not to damage your computer or data."
"Icon"="inetcpl.cpl#00004480"
"LowIcon"="inetcpl.cpl#005424"
"CurrentLevel"= 0x0000000000 (0)
"Flags"= 0x0000000021 (33)
"1200"= 0x0000000003 (3)
"1400"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3]
@=""
"DisplayName"="Internet"
"PMDisplayName"="Internet [Protected Mode]"
"Description"="This zone contains all Web sites you haven't placed in other zones"
"Icon"="inetcpl.cpl#001313"
"LowIcon"="inetcpl.cpl#005425"
"CurrentLevel"= 0x0000000000 (0)
"Flags"= 0x0000000021 (33)
"1200"= 0x0000000003 (3)
"1400"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4]
@=""
"DisplayName"="Restricted sites"
"PMDisplayName"="Restricted sites [Protected Mode]"
"Description"="This zone contains Web sites that could potentially damage your computer or data."
"Icon"="inetcpl.cpl#00004481"
"LowIcon"="inetcpl.cpl#005426"
"CurrentLevel"= 0x0000000000 (0)
"Flags"= 0x0000000021 (33)
"1200"= 0x0000000003 (3)
"1400"= 0x0000000003 (3)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Passport]
"NumRegistrationRuns"= 0x0000000006 (6)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Passport\LowDAMap]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Protocols]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Protocols\Mailto]
"UTF8Encoding"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\TemplatePolicies]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\TemplatePolicies\High]
"1400"= 0x0000000003 (3)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad]
"WpadLastNetwork"="{62F3D355-17BC-4659-AD54-81F97F8B860F}"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-1f-3f-35-cc-dc]
"WpadDecisionReason"= 0x0000000001 (1)
"WpadDecisionTime"=9a c4 e2 84 f6 c4 ce 01  (REG_BINARY)
"WpadDecision"= 0x0000000000 (0)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-1f-3f-35-cc-dc_9c-c7-a6-0d-aa-9b]
"WpadDecisionReason"= 0x0000000001 (1)
"WpadDecisionTime"=54 03 c0 56 76 71 ce 01  (REG_BINARY)
"WpadDecision"= 0x0000000000 (0)
"WpadDetectedUrl"=""

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9c-c7-a6-0d-aa-9b]
"WpadDecisionReason"= 0x0000000001 (1)
"WpadDecisionTime"=41 a4 36 2e 8c bb cf 01  (REG_BINARY)
"WpadDecision"= 0x0000000000 (0)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c0-25-06-2b-61-5d]
"WpadDecisionReason"= 0x0000000001 (1)
"WpadDecisionTime"=10 3d c5 c6 b5 74 cd 01  (REG_BINARY)
"WpadDecision"= 0x0000000000 (0)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1F3EECBD-495D-4D6D-990C-6631219E58E6}_{73EB4C80-49FD-452D-B285-3DCD3FC2BDB5}]
"WpadDecisionReason"= 0x0000000001 (1)
"WpadDecisionTime"=cc f3 bf 70 24 ed ce 01  (REG_BINARY)
"WpadDecision"= 0x0000000000 (0)
"WpadNetworkName"="Netzwerk  3"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{214D255B-9B82-4507-83F0-B99D43C0520D}]
"WpadDecisionReason"= 0x0000000001 (1)
"WpadDecisionTime"=10 3d c5 c6 b5 74 cd 01  (REG_BINARY)
"WpadDecision"= 0x0000000000 (0)
"WpadNetworkName"="Netzwerk"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{214D255B-9B82-4507-83F0-B99D43C0520D}\c0-25-06-2b-61-5d]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{62F3D355-17BC-4659-AD54-81F97F8B860F}]
"WpadDecisionReason"= 0x0000000001 (1)
"WpadDecisionTime"=9a c4 e2 84 f6 c4 ce 01  (REG_BINARY)
"WpadDecision"= 0x0000000000 (0)
"WpadNetworkName"="Netzwerk  2"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{62F3D355-17BC-4659-AD54-81F97F8B860F}\00-1f-3f-35-cc-dc]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{62F3D355-17BC-4659-AD54-81F97F8B860F}_{73EB4C80-49FD-452D-B285-3DCD3FC2BDB5}]
"WpadDecisionReason"= 0x0000000001 (1)
"WpadDecisionTime"=54 03 c0 56 76 71 ce 01  (REG_BINARY)
"WpadDecision"= 0x0000000000 (0)
"WpadNetworkName"="Netzwerk  2"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{62F3D355-17BC-4659-AD54-81F97F8B860F}_{73EB4C80-49FD-452D-B285-3DCD3FC2BDB5}\00-1f-3f-35-cc-dc_9c-c7-a6-0d-aa-9b]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{73EB4C80-49FD-452D-B285-3DCD3FC2BDB5}]
"WpadDecisionReason"= 0x0000000001 (1)
"WpadDecisionTime"=41 a4 36 2e 8c bb cf 01  (REG_BINARY)
"WpadDecision"= 0x0000000000 (0)
"WpadNetworkName"="Netzwerk  3"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{73EB4C80-49FD-452D-B285-3DCD3FC2BDB5}\9c-c7-a6-0d-aa-9b]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet"= 0x0000000001 (1)
"AutoDetect"= 0x0000000001 (1)
@=""
"ProxyBypass"= 0x0000000001 (1)
"IntranetName"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]
@=""

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\fritz.box]
"*"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\microsoft.com]
(No values found)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\microsoft.com\*.update]
"http"= 0x0000000002 (2)
"https"= 0x0000000002 (2)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults]
@=""
"http"= 0x0000000003 (3)
"https"= 0x0000000003 (3)
"ftp"= 0x0000000003 (3)
"file"= 0x0000000003 (3)
"@ivt"= 0x0000000001 (1)
"shell"= 0x0000000000 (0)
"knownfolder"= 0x0000000000 (0)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges]
@=""

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range1]
"*"= 0x0000000001 (1)
":Range"="192.168.178.1"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones]
@=""
"SecuritySafe"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]
"2004"= 0x0000000003 (3)
"2001"= 0x0000000003 (3)
@=""
"DisplayName"="Computer"
"PMDisplayName"="Computer [Protected Mode]"
"Description"="Your computer"
"Icon"="shell32.dll#0016"
"LowIcon"="inetcpl.cpl#005422"
"CurrentLevel"= 0x0000000000 (0)
"Flags"= 0x0000000021 (33)
"1200"= 0x0000000000 (0)
"1400"= 0x0000000000 (0)
"2007"= 0x0000000003 (3)
"1001"= 0x0000000000 (0)
"1004"= 0x0000000000 (0)
"1201"= 0x0000000001 (1)
"1206"= 0x0000000000 (0)
"1402"= 0x0000000000 (0)
"1405"= 0x0000000000 (0)
"1406"= 0x0000000000 (0)
"1407"= 0x0000000000 (0)
"1601"= 0x0000000000 (0)
"1604"= 0x0000000000 (0)
"1605"= 0x0000000000 (0)
"1606"= 0x0000000000 (0)
"1607"= 0x0000000000 (0)
"1608"= 0x0000000000 (0)
"1609"= 0x0000000001 (1)
"1800"= 0x0000000000 (0)
"1802"= 0x0000000000 (0)
"1803"= 0x0000000000 (0)
"1804"= 0x0000000000 (0)
"1805"= 0x0000000000 (0)
"1806"= 0x0000000000 (0)
"1807"= 0x0000000000 (0)
"1808"= 0x0000000000 (0)
"1809"= 0x0000000003 (3)
"1A00"= 0x0000000000 (0)
"1A02"= 0x0000000000 (0)
"1A03"= 0x0000000000 (0)
"1A04"= 0x0000000000 (0)
"1A05"= 0x0000000000 (0)
"1A06"= 0x0000000000 (0)
"1A10"= 0x0000000000 (0)
"1C00"= 0x0000020000 (131072)
"1E05"= 0x0000030000 (196608)
"2100"= 0x0000000000 (0)
"2101"= 0x0000000003 (3)
"2102"= 0x0000000000 (0)
"2200"= 0x0000000000 (0)
"2201"= 0x0000000000 (0)
"2300"= 0x0000000001 (1)
"2000"= 0x0000000000 (0)
"1207"= 0x0000000000 (0)
"1208"= 0x0000000000 (0)
"1209"= 0x0000000000 (0)
"120A"= 0x0000000000 (0)
"1408"= 0x0000000000 (0)
"160A"= 0x0000000000 (0)
"180A"= 0x0000000000 (0)
"180C"= 0x0000000000 (0)
"180D"= 0x0000000000 (0)
"2301"= 0x0000000003 (3)
"2103"= 0x0000000000 (0)
"2104"= 0x0000000000 (0)
"2105"= 0x0000000000 (0)
"2400"= 0x0000000000 (0)
"2401"= 0x0000000000 (0)
"2402"= 0x0000000000 (0)
"2600"= 0x0000000000 (0)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1]
"2004"= 0x0000000000 (0)
"2001"= 0x0000000000 (0)
@=""
"DisplayName"="Local intranet"
"PMDisplayName"="Local intranet [Protected Mode]"
"Description"="This zone contains all Web sites that are on your organization's intranet."
"Icon"="shell32.dll#0018"
"LowIcon"="inetcpl.cpl#005423"
"CurrentLevel"= 0x0000010500 (66816)
"Flags"= 0x00000001db (475)
"1200"= 0x0000000000 (0)
"1400"= 0x0000000000 (0)
"2500"= 0x0000000003 (3)
"2007"= 0x0000010000 (65536)
"1001"= 0x0000000001 (1)
"1004"= 0x0000000003 (3)
"1201"= 0x0000000003 (3)
"1206"= 0x0000000000 (0)
"1402"= 0x0000000000 (0)
"1405"= 0x0000000000 (0)
"1406"= 0x0000000001 (1)
"1407"= 0x0000000000 (0)
"1601"= 0x0000000000 (0)
"1604"= 0x0000000000 (0)
"1605"= 0x0000000000 (0)
"1606"= 0x0000000000 (0)
"1607"= 0x0000000000 (0)
"1608"= 0x0000000000 (0)
"1609"= 0x0000000001 (1)
"1800"= 0x0000000001 (1)
"1802"= 0x0000000000 (0)
"1803"= 0x0000000000 (0)
"1804"= 0x0000000001 (1)
"1805"= 0x0000000000 (0)
"1806"= 0x0000000000 (0)
"1807"= 0x0000000000 (0)
"1808"= 0x0000000000 (0)
"1809"= 0x0000000003 (3)
"1A00"= 0x0000020000 (131072)
"1A02"= 0x0000000000 (0)
"1A03"= 0x0000000000 (0)
"1A04"= 0x0000000000 (0)
"1A05"= 0x0000000000 (0)
"1A06"= 0x0000000000 (0)
"1A10"= 0x0000000000 (0)
"1C00"= 0x0000020000 (131072)
"1E05"= 0x0000020000 (131072)
"2100"= 0x0000000000 (0)
"2101"= 0x0000000000 (0)
"2102"= 0x0000000000 (0)
"2200"= 0x0000000000 (0)
"2201"= 0x0000000000 (0)
"2300"= 0x0000000001 (1)
"2000"= 0x0000000000 (0)
"1207"= 0x0000000000 (0)
"1208"= 0x0000000000 (0)
"1209"= 0x0000000000 (0)
"120A"= 0x0000000003 (3)
"1408"= 0x0000000000 (0)
"160A"= 0x0000000000 (0)
"180A"= 0x0000000000 (0)
"180C"= 0x0000000000 (0)
"180D"= 0x0000000000 (0)
"2301"= 0x0000000003 (3)
"2103"= 0x0000000000 (0)
"2104"= 0x0000000000 (0)
"2105"= 0x0000000000 (0)
"2400"= 0x0000000000 (0)
"2401"= 0x0000000000 (0)
"2402"= 0x0000000000 (0)
"2600"= 0x0000000000 (0)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]
"2001"= 0x0000000000 (0)
"2004"= 0x0000000000 (0)
@=""
"DisplayName"="Trusted sites"
"PMDisplayName"="Trusted sites [Protected Mode]"
"Description"="This zone contains Web sites that you trust not to damage your computer or data."
"Icon"="inetcpl.cpl#00004480"
"LowIcon"="inetcpl.cpl#005424"
"CurrentLevel"= 0x0000011000 (69632)
"Flags"= 0x0000000047 (71)
"1200"= 0x0000000000 (0)
"1400"= 0x0000000000 (0)
"1001"= 0x0000000001 (1)
"1004"= 0x0000000003 (3)
"1201"= 0x0000000003 (3)
"1206"= 0x0000000003 (3)
"1207"= 0x0000000000 (0)
"1208"= 0x0000000000 (0)
"1209"= 0x0000000003 (3)
"120A"= 0x0000000003 (3)
"1402"= 0x0000000000 (0)
"1405"= 0x0000000000 (0)
"1406"= 0x0000000003 (3)
"1407"= 0x0000000001 (1)
"1408"= 0x0000000000 (0)
"1409"= 0x0000000000 (0)
"1601"= 0x0000000000 (0)
"1604"= 0x0000000000 (0)
"1605"= 0x0000000000 (0)
"1606"= 0x0000000000 (0)
"1607"= 0x0000000003 (3)
"1608"= 0x0000000000 (0)
"1609"= 0x0000000001 (1)
"160A"= 0x0000000000 (0)
"1800"= 0x0000000001 (1)
"1802"= 0x0000000000 (0)
"1803"= 0x0000000000 (0)
"1804"= 0x0000000001 (1)
"1809"= 0x0000000000 (0)
"1A00"= 0x0000020000 (131072)
"1A02"= 0x0000000000 (0)
"1A03"= 0x0000000000 (0)
"1A04"= 0x0000000003 (3)
"1A05"= 0x0000000001 (1)
"1A06"= 0x0000000000 (0)
"1C00"= 0x0000010000 (65536)
"2000"= 0x0000000000 (0)
"2005"= 0x0000000000 (0)
"2100"= 0x0000000000 (0)
"2101"= 0x0000000000 (0)
"2102"= 0x0000000003 (3)
"2103"= 0x0000000000 (0)
"2104"= 0x0000000000 (0)
"2105"= 0x0000000000 (0)
"2106"= 0x0000000000 (0)
"2200"= 0x0000000003 (3)
"2201"= 0x0000000003 (3)
"2300"= 0x0000000001 (1)
"2301"= 0x0000000000 (0)
"2400"= 0x0000000000 (0)
"2401"= 0x0000000000 (0)
"2402"= 0x0000000000 (0)
"2600"= 0x0000000000 (0)
"2700"= 0x0000000003 (3)
"2007"= 0x0000010000 (65536)
"2107"= 0x0000000000 (0)
"2701"= 0x0000000000 (0)
"2702"= 0x0000000000 (0)
"2703"= 0x0000000000 (0)
"2708"= 0x0000000003 (3)
"2709"= 0x0000000003 (3)
"1812"= 0x0000000000 (0)
"140A"= 0x0000000000 (0)
"2302"= 0x0000000003 (3)
"270B"= 0x0000000000 (0)
"160B"= 0x0000000000 (0)
"2704"= 0x0000000000 (0)
"2108"= 0x0000000003 (3)
"1805"= 0x0000000001 (1)
"1806"= 0x0000000001 (1)
"1807"= 0x0000000001 (1)
"1808"= 0x0000000000 (0)
"1A10"= 0x0000000001 (1)
"1E05"= 0x0000020000 (131072)
"180A"= 0x0000000003 (3)
"180C"= 0x0000000000 (0)
"180D"= 0x0000000000 (0)
"120B"= 0x0000000000 (0)
"270C"= 0x0000000003 (3)
"270D"= 0x0000000000 (0)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
"2004"= 0x0000000000 (0)
"2001"= 0x0000000000 (0)
"{AEBA21FA-782A-4A90-978D-B72164C80120}"=1a 37 61 59 23 52 35 0c 7a 5f 20 17 2f 1e 1a 19 0e 2b 01 73 1e 28 1a 04 1b 0c 3b c2 21 27 53 0d 36 05 2c 05 04 3d 4f 3a 4a 44 33 3a 0a 06 12 68 53 7c 20 13 35 5d 4c 10 27 01 56 7a 2d 3f 38 4f 79 0f 16 26 75 53 1c 31 00 56 7a 3e 32 24 4f 79 1b 00 33 71 4d 23 32 29 7c 6a 35 31 34 40 72 3b 01 2e 5d 4c 2a 07 15 48 72 38 12 00 56 7a 3e 16 3c 71 4d 24 33 35 7c 72 35 0e 3c 1a 41 44 19 0f 31 3a 56 7a 2e 3e 31 0c 7c 6a 10 27 0c 05 5d 4c 39 19 12 15 61 54 2e 00 33 32 40 52 03 25 1f 05 5d 4c 2c 0c 0a 15 61 54 1a 26 1f 05 5d 4c 10 21 1d 1b 71 4d 3b 24 3a 21 6d 72 24 16 3c 32 40 72 21 0f 3a 1a 41 44 1b 1e 01 01 71 4d 32 23 30 27 6d 4d 1f 28 10 3c 56 7a 2f 2e 32 16 7c 6a 3a 12 3b 28 75 53 0b 3f 12 01 71 4d 23 32 29 27 75 53 12 30 32 1e 4f 79 12 38 17 01 71 4d 30 3e 37 27 6d 72 38 12 3f 04 41 44 0a 0e 32 28 49 5f 1c 24 0b 1b 36 21 41 7b 5b 24 39 31 7c 6a 2b 0e 25 75 53 1a 2e 26 41 72 34 16 26 71 4d 30 30 3a 7c 6a 07 33 1a 56 7a 3a 00 33 71 4d 23 32 29 7c 6a 1a 26 1a 40 52 24 3f 1a 6d 4d 1c 22 28 75 53 13 25 20 41 44 0a 0e (REG_BINARY)
"1A10"= 0x0000000001 (1)
"{A8A88C49-5EB2-4990-A1A2-0876022C854F}"=1a 37 61 59 23 52 35 0c 7a 5f 20 17 2f 1e 1a 19 0e 2b 01 73 1e 28 1a 04 1b 0c 3b c2 21 2d 53 49 07 25 0f 29 01 7c 50 68 3a 3b 34 4f 79 08 39 0d 49 72 33 1f 39 5d 4c 17 37 05 56 7a 2f 2e 32 4f 79 1f 12 3b 75 53 0b 3f 12 56 7a 3a 20 23 4f 79 12 05 33 71 4d 3a 31 29 7c 6a 2b 08 21 40 72 38 12 3f 5d 4c 39 1d 17 48 72 21 0f 03 56 7a 2f 06 22 32 40 52 2c 29 05 3a 56 7a 2e 3e 31 0c 7c 6a 2b 06 25 32 40 52 33 24 01 32 75 53 0b 3f 32 04 4f 79 1b 3b 1f 0c 40 72 3b 01 2d 1a 75 53 12 30 3f 04 4f 79 08 3f 09 0c 75 53 13 25 20 04 75 53 07 37 17 05 5d 4c 36 0a 1b 3a 56 72 35 0e 3c 3c 56 7a 2d 3f 38 16 7c 6a 17 37 01 1b 5d 4c 2a 0d 18 1f 61 54 12 12 3b 28 40 52 3f 3a 19 34 48 72 20 0c 17 01 71 4d 1a 26 1a 1b 5d 4c 2c 0c 17 01 71 4d 30 3e 37 27 6d 4d 1b 3b 0c 1b 5d 4c 39 1d 17 3c 56 7a 3b 2f 3f 16 15 39 5f 7b 42 29 1d 3c 71 4d 30 06 22 71 4d 32 23 30 7c 6a 2a 1e 19 75 53 1c 31 20 41 72 24 12 3b 71 4d 23 32 24 7c 6a 03 25 17 56 7a 25 05 33 71 4d 3a 31 29 7c 6a 10 21 09 40 52 27 2c 0b 6d 4d 0f 28 2a 75 53 08 3e 23 41 44 1b 1e (REG_BINARY)
@=""
"DisplayName"="Internet"
"PMDisplayName"="Internet [Protected Mode]"
"Description"="This zone contains all Web sites you haven't placed in other zones"
"Icon"="inetcpl.cpl#001313"
"LowIcon"="inetcpl.cpl#005425"
"CurrentLevel"= 0x0000011500 (70912)
"Flags"= 0x0000000001 (1)
"1200"= 0x0000000000 (0)
"1400"= 0x0000000000 (0)
"1001"= 0x0000000001 (1)
"1004"= 0x0000000003 (3)
"1201"= 0x0000000003 (3)
"1206"= 0x0000000003 (3)
"1207"= 0x0000000003 (3)
"1208"= 0x0000000003 (3)
"1209"= 0x0000000003 (3)
"120A"= 0x0000000003 (3)
"1402"= 0x0000000000 (0)
"1405"= 0x0000000000 (0)
"1406"= 0x0000000003 (3)
"1407"= 0x0000000001 (1)
"1408"= 0x0000000003 (3)
"1409"= 0x0000000000 (0)
"1601"= 0x0000000000 (0)
"1604"= 0x0000000000 (0)
"1605"= 0x0000000000 (0)
"1606"= 0x0000000000 (0)
"1607"= 0x0000000003 (3)
"1608"= 0x0000000000 (0)
"1609"= 0x0000000001 (1)
"160A"= 0x0000000003 (3)
"1800"= 0x0000000001 (1)
"1802"= 0x0000000000 (0)
"1803"= 0x0000000000 (0)
"1804"= 0x0000000001 (1)
"1809"= 0x0000000000 (0)
"1A00"= 0x0000020000 (131072)
"1A02"= 0x0000000000 (0)
"1A03"= 0x0000000000 (0)
"1A04"= 0x0000000003 (3)
"1A05"= 0x0000000001 (1)
"1A06"= 0x0000000000 (0)
"1C00"= 0x0000010000 (65536)
"2000"= 0x0000000000 (0)
"2005"= 0x0000000003 (3)
"2100"= 0x0000000000 (0)
"2101"= 0x0000000000 (0)
"2102"= 0x0000000003 (3)
"2103"= 0x0000000003 (3)
"2104"= 0x0000000003 (3)
"2105"= 0x0000000003 (3)
"2106"= 0x0000000000 (0)
"2200"= 0x0000000003 (3)
"2201"= 0x0000000003 (3)
"2300"= 0x0000000001 (1)
"2301"= 0x0000000000 (0)
"2400"= 0x0000000003 (3)
"2401"= 0x0000000000 (0)
"2402"= 0x0000000003 (3)
"2600"= 0x0000000000 (0)
"2700"= 0x0000000000 (0)
"2007"= 0x0000010000 (65536)
"2107"= 0x0000000003 (3)
"2701"= 0x0000000000 (0)
"2702"= 0x0000000000 (0)
"2703"= 0x0000000003 (3)
"2708"= 0x0000000003 (3)
"2709"= 0x0000000003 (3)
"1812"= 0x0000000001 (1)
"140A"= 0x0000000000 (0)
"2302"= 0x0000000003 (3)
"270B"= 0x0000000003 (3)
"160B"= 0x0000000000 (0)
"2704"= 0x0000000000 (0)
"1805"= 0x0000000001 (1)
"1806"= 0x0000000001 (1)
"1807"= 0x0000000001 (1)
"1808"= 0x0000000000 (0)
"1E05"= 0x0000020000 (131072)
"180A"= 0x0000000003 (3)
"180C"= 0x0000000003 (3)
"180D"= 0x0000000001 (1)
"120B"= 0x0000000003 (3)
"270C"= 0x0000000000 (0)
"270D"= 0x0000000003 (3)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4]
"2004"= 0x0000000003 (3)
"2001"= 0x0000000003 (3)
"1400"= 0x0000000003 (3)
"1C00"= 0x0000000000 (0)
"{AEBA21FA-782A-4A90-978D-B72164C80120}"=1a 37 61 59 23 52 35 0c 7a 5f 20 17 2f 1e 1a 19 0e 2b 01 73 13 37 13 12 14 1a 15 39  (REG_BINARY)
"1A10"= 0x0000000003 (3)
"{A8A88C49-5EB2-4990-A1A2-0876022C854F}"=1a 37 61 59 23 52 35 0c 7a 5f 20 17 2f 1e 1a 19 0e 2b 01 73 13 37 13 12 14 1a 15 39  (REG_BINARY)
@=""
"DisplayName"="Restricted sites"
"PMDisplayName"="Restricted sites [Protected Mode]"
"Description"="This zone contains Web sites that could potentially damage your computer or data."
"Icon"="inetcpl.cpl#00004481"
"LowIcon"="inetcpl.cpl#005426"
"CurrentLevel"= 0x0000012000 (73728)
"Flags"= 0x0000000003 (3)
"1200"= 0x0000000003 (3)
"2007"= 0x0000000003 (3)
"1001"= 0x0000000003 (3)
"1004"= 0x0000000003 (3)
"1201"= 0x0000000003 (3)
"1206"= 0x0000000003 (3)
"1402"= 0x0000000003 (3)
"1405"= 0x0000000003 (3)
"1406"= 0x0000000003 (3)
"1407"= 0x0000000003 (3)
"1601"= 0x0000000001 (1)
"1604"= 0x0000000003 (3)
"1605"= 0x0000000000 (0)
"1606"= 0x0000000003 (3)
"1607"= 0x0000000003 (3)
"1608"= 0x0000000003 (3)
"1609"= 0x0000000001 (1)
"1800"= 0x0000000003 (3)
"1802"= 0x0000000001 (1)
"1803"= 0x0000000003 (3)
"1804"= 0x0000000003 (3)
"1805"= 0x0000000001 (1)
"1806"= 0x0000000003 (3)
"1807"= 0x0000000001 (1)
"1808"= 0x0000000000 (0)
"1809"= 0x0000000000 (0)
"1A00"= 0x0000010000 (65536)
"1A02"= 0x0000000003 (3)
"1A03"= 0x0000000003 (3)
"1A04"= 0x0000000003 (3)
"1A05"= 0x0000000003 (3)
"1A06"= 0x0000000003 (3)
"1E05"= 0x0000010000 (65536)
"2100"= 0x0000000003 (3)
"2101"= 0x0000000003 (3)
"2102"= 0x0000000003 (3)
"2200"= 0x0000000003 (3)
"2201"= 0x0000000003 (3)
"2300"= 0x0000000003 (3)
"2000"= 0x0000000003 (3)
"1207"= 0x0000000003 (3)
"1208"= 0x0000000003 (3)
"1209"= 0x0000000003 (3)
"120A"= 0x0000000003 (3)
"1408"= 0x0000000003 (3)
"160A"= 0x0000000003 (3)
"180A"= 0x0000000003 (3)
"180B"= 0x0000000001 (1)
"180C"= 0x0000000003 (3)
"180D"= 0x0000000001 (1)
"2301"= 0x0000000000 (0)
"2103"= 0x0000000003 (3)
"2104"= 0x0000000003 (3)
"2105"= 0x0000000003 (3)
"2400"= 0x0000000003 (3)
"2401"= 0x0000000003 (3)
"2402"= 0x0000000003 (3)
"2600"= 0x0000000003 (3)


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"EnablePunycode"= 0x0000000001 (1)
"CodeBaseSearchPath"="CODEBASE"
"WarnOnIntranet"= 0x0000000001 (1)
"MinorVersion"="0"
"ActiveXCache"="C:\Windows\Downloaded Program Files"
"WarnOnPost"=01 00 00 00  (REG_BINARY)
"WarnonBadCertRecving"= 0x0000000001 (1)
"WarnOnPostRedirect"= 0x0000000000 (0)
"WarnOnZoneCrossing"= 0x0000000001 (1)
"WarnOnHTTPSToHTTPRedirect"= 0x0000000001 (1)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0]
"SpecialDomains"="lp. rg."

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache]
(No values found)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"PerUserItem"= 0x0000000001 (1)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"PerUserItem"= 0x0000000001 (1)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"PerUserItem"= 0x0000000001 (1)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent]
(No values found)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\post platform]
"Tablet PC 2.0"=""
".NET4.0C"=""
".NET4.0E"=""

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Accepted Documents]
"application"="application/x-ms-application"
"1"="image/jpeg"
"xaml"="application/xaml+xml"
"0"="image/gif"
"2"="image/pjpeg"
"xbap"="application/x-ms-xbap"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ActiveX Cache]
"0"="C:\Windows\Downloaded Program Files"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedBehaviors]
"#default#VML"= 0x0000000000 (0)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedDragImageExts]
".aif"= 0x0000000001 (1)
".aifc"= 0x0000000001 (1)
".aiff"= 0x0000000001 (1)
".art"= 0x0000000001 (1)
".asf"= 0x0000000001 (1)
".asx"= 0x0000000001 (1)
".au"= 0x0000000001 (1)
".avi"= 0x0000000001 (1)
".bm"= 0x0000000001 (1)
".bmp"= 0x0000000001 (1)
".dib"= 0x0000000001 (1)
".dvr-ms"= 0x0000000001 (1)
".emf"= 0x0000000001 (1)
".gif"= 0x0000000001 (1)
".ico"= 0x0000000001 (1)
".jfif"= 0x0000000001 (1)
".jpe"= 0x0000000001 (1)
".jpeg"= 0x0000000001 (1)
".jpg"= 0x0000000001 (1)
".m1v"= 0x0000000001 (1)
".m3u"= 0x0000000001 (1)
".mid"= 0x0000000001 (1)
".midi"= 0x0000000001 (1)
".mp2"= 0x0000000001 (1)
".mp2v"= 0x0000000001 (1)
".mp3"= 0x0000000001 (1)
".mpa"= 0x0000000001 (1)
".mpe"= 0x0000000001 (1)
".mpeg"= 0x0000000001 (1)
".mpg"= 0x0000000001 (1)
".mpv"= 0x0000000001 (1)
".mpv2"= 0x0000000001 (1)
".png"= 0x0000000001 (1)
".rmi"= 0x0000000001 (1)
".snd"= 0x0000000001 (1)
".tif"= 0x0000000001 (1)
".tiff"= 0x0000000001 (1)
".wav"= 0x0000000001 (1)
".wax"= 0x0000000001 (1)
".wm"= 0x0000000001 (1)
".wma"= 0x0000000001 (1)
".wmf"= 0x0000000001 (1)
".wmp"= 0x0000000001 (1)
".wmv"= 0x0000000001 (1)
".wmx"= 0x0000000001 (1)
".wvx"= 0x0000000001 (1)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedDragProtocols]
(No values found)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedDragProtocols\0]
"*"= 0x0000000000 (0)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedDragProtocols\1]
"http"= 0x0000000000 (0)
"https"= 0x0000000000 (0)
"javascript"= 0x0000000000 (0)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedDragProtocols\2]
"*"= 0x0000000000 (0)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedDragProtocols\3]
"http"= 0x0000000000 (0)
"https"= 0x0000000000 (0)
"javascript"= 0x0000000000 (0)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedDragProtocols\4]
"http"= 0x0000000000 (0)
"https"= 0x0000000000 (0)
"javascript"= 0x0000000000 (0)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ApprovedActiveXInstallSites]
(No values found)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache]
"CleanupTime"=00 00 00 00  (REG_BINARY)
"CleanupFactor"=19 00 00 00  (REG_BINARY)
"FreshnessInterval"=80 f4 03 00  (REG_BINARY)
"CleanupInterval"=80 51 01 00  (REG_BINARY)
"DebugFlag"=ff ff 00 00  (REG_BINARY)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths"=04 00 00 00  (REG_BINARY)
"Directory"="C:\Windows\Temporary Internet Files"
"Size"=24 01 00 00  (REG_BINARY)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Special Paths]
(No values found)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Special Paths\Cookies]
"Directory"="%USERPROFILE%\Cookies"
"CachePrefix"="Cookie:"
"CacheLimit"=00 04 00 00  (REG_BINARY)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Special Paths\History]
@="Software\Microsoft\Windows\CurrentVersion\Internet Settings\Url History"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"WinHttpSettings"=18 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00  (REG_BINARY)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters]
(No values found)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA]
(No values found)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Last Update]
(No values found)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Last Update\IEXPLOREV4]
"CurrentVerTimestamp"="Sun, 21 April 1996 01:00:00 GMT"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones]
(No values found)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0]
"1001"= 0x0000000001 (1)
"1004"= 0x0000000003 (3)
"1200"= 0x0000000003 (3)
"1201"= 0x0000000003 (3)
"1206"= 0x0000000000 (0)
"1207"= 0x0000000003 (3)
"1208"= 0x0000000003 (3)
"1209"= 0x0000000003 (3)
"120A"= 0x0000000003 (3)
"120B"= 0x0000000000 (0)
"1400"= 0x0000000001 (1)
"1402"= 0x0000000000 (0)
"1405"= 0x0000000000 (0)
"1406"= 0x0000000000 (0)
"1407"= 0x0000000001 (1)
"1408"= 0x0000000003 (3)
"1409"= 0x0000000003 (3)
"1601"= 0x0000000000 (0)
"1604"= 0x0000000000 (0)
"1605"= 0x0000000000 (0)
"1606"= 0x0000000000 (0)
"1607"= 0x0000000000 (0)
"1608"= 0x0000000000 (0)
"1609"= 0x0000000001 (1)
"160A"= 0x0000000000 (0)
"1802"= 0x0000000000 (0)
"1803"= 0x0000000000 (0)
"1804"= 0x0000000000 (0)
"1805"= 0x0000000000 (0)
"1806"= 0x0000000000 (0)
"1807"= 0x0000000000 (0)
"1808"= 0x0000000000 (0)
"1809"= 0x0000000003 (3)
"180A"= 0x0000000000 (0)
"180C"= 0x0000000000 (0)
"180D"= 0x0000000000 (0)
"180E"= 0x0000000000 (0)
"180F"= 0x0000000000 (0)
"1A00"= 0x0000000000 (0)
"1A02"= 0x0000000000 (0)
"1A03"= 0x0000000000 (0)
"1A04"= 0x0000000003 (3)
"1A05"= 0x0000000000 (0)
"1A06"= 0x0000000000 (0)
"1A10"= 0x0000000000 (0)
"1C00"= 0x0000000000 (0)
"2000"= 0x0000010000 (65536)
"2005"= 0x0000000003 (3)
"2100"= 0x0000000003 (3)
"2101"= 0x0000000003 (3)
"2102"= 0x0000000003 (3)
"2103"= 0x0000000003 (3)
"2104"= 0x0000000003 (3)
"2105"= 0x0000000003 (3)
"2106"= 0x0000000003 (3)
"2200"= 0x0000000003 (3)
"2201"= 0x0000000003 (3)
"2301"= 0x0000000003 (3)
"2400"= 0x0000000000 (0)
"2401"= 0x0000000000 (0)
"2402"= 0x0000000000 (0)
"2500"= 0x0000000003 (3)
"2600"= 0x0000000000 (0)
"2700"= 0x0000000003 (3)
"CurrentLevel"= 0x0000000000 (0)
"Description"="Your computer"
"DisplayName"="Computer"
"Flags"= 0x0000000021 (33)
"Icon"="shell32.dll#0016"
"LowIcon"="inetcpl.cpl#005422"
"PMDisplayName"="Computer [Protected Mode]"
"2107"= 0x0000000003 (3)
"2701"= 0x0000000003 (3)
"2702"= 0x0000000003 (3)
"2703"= 0x0000000003 (3)
"2708"= 0x0000000003 (3)
"2709"= 0x0000000003 (3)
"1812"= 0x0000000000 (0)
"140A"= 0x0000000000 (0)
"2302"= 0x0000000003 (3)
"270B"= 0x0000000003 (3)
"160B"= 0x0000000000 (0)
"2704"= 0x0000000003 (3)
"1810"= 0x0000000003 (3)
"1800"= 0x0000000000 (0)
"1E05"= 0x0000030000 (196608)
"270C"= 0x0000000003 (3)
"270D"= 0x0000000003 (3)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1]
"1001"= 0x0000000001 (1)
"1004"= 0x0000000003 (3)
"1200"= 0x0000000003 (3)
"1201"= 0x0000000003 (3)
"1206"= 0x0000000000 (0)
"1207"= 0x0000000003 (3)
"1208"= 0x0000000003 (3)
"1209"= 0x0000000003 (3)
"120A"= 0x0000000003 (3)
"120B"= 0x0000000000 (0)
"1400"= 0x0000000001 (1)
"1402"= 0x0000000000 (0)
"1405"= 0x0000000000 (0)
"1406"= 0x0000000001 (1)
"1407"= 0x0000000001 (1)
"1408"= 0x0000000003 (3)
"1409"= 0x0000000003 (3)
"1601"= 0x0000000000 (0)
"1604"= 0x0000000000 (0)
"1605"= 0x0000000000 (0)
"1606"= 0x0000000000 (0)
"1607"= 0x0000000000 (0)
"1608"= 0x0000000000 (0)
"1609"= 0x0000000001 (1)
"160A"= 0x0000000003 (3)
"1802"= 0x0000000000 (0)
"1803"= 0x0000000000 (0)
"1804"= 0x0000000001 (1)
"1805"= 0x0000000000 (0)
"1806"= 0x0000000000 (0)
"1807"= 0x0000000000 (0)
"1808"= 0x0000000000 (0)
"1809"= 0x0000000003 (3)
"180A"= 0x0000000000 (0)
"180C"= 0x0000000003 (3)
"180D"= 0x0000000000 (0)
"180E"= 0x0000000000 (0)
"180F"= 0x0000000000 (0)
"1A00"= 0x0000020000 (131072)
"1A02"= 0x0000000000 (0)
"1A03"= 0x0000000000 (0)
"1A04"= 0x0000000003 (3)
"1A05"= 0x0000000000 (0)
"1A06"= 0x0000000000 (0)
"1A10"= 0x0000000000 (0)
"1C00"= 0x0000000000 (0)
"2000"= 0x0000010000 (65536)
"2005"= 0x0000000003 (3)
"2100"= 0x0000000003 (3)
"2101"= 0x0000000003 (3)
"2102"= 0x0000000003 (3)
"2103"= 0x0000000003 (3)
"2104"= 0x0000000003 (3)
"2105"= 0x0000000003 (3)
"2106"= 0x0000000003 (3)
"2200"= 0x0000000003 (3)
"2201"= 0x0000000003 (3)
"2301"= 0x0000000003 (3)
"2400"= 0x0000000000 (0)
"2401"= 0x0000000000 (0)
"2402"= 0x0000000000 (0)
"2500"= 0x0000000003 (3)
"2600"= 0x0000000000 (0)
"2700"= 0x0000000000 (0)
"CurrentLevel"= 0x0000000000 (0)
"Description"="This zone contains all Web sites that are on your organization's intranet."
"DisplayName"="Local intranet"
"Flags"= 0x00000000db (219)
"Icon"="shell32.dll#0018"
"LowIcon"="inetcpl.cpl#005423"
"PMDisplayName"="Local intranet [Protected Mode]"
"2107"= 0x0000000003 (3)
"2701"= 0x0000000003 (3)
"2702"= 0x0000000003 (3)
"2703"= 0x0000000000 (0)
"2708"= 0x0000000003 (3)
"2709"= 0x0000000003 (3)
"1812"= 0x0000000000 (0)
"140A"= 0x0000000000 (0)
"2302"= 0x0000000003 (3)
"270B"= 0x0000000000 (0)
"160B"= 0x0000000000 (0)
"2704"= 0x0000000003 (3)
"1810"= 0x0000000003 (3)
"1800"= 0x0000000001 (1)
"1E05"= 0x0000030000 (196608)
"270C"= 0x0000000000 (0)
"270D"= 0x0000000003 (3)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2]
"1001"= 0x0000000001 (1)
"1004"= 0x0000000003 (3)
"1200"= 0x0000000003 (3)
"1201"= 0x0000000003 (3)
"1206"= 0x0000000003 (3)
"1207"= 0x0000000003 (3)
"1208"= 0x0000000003 (3)
"1209"= 0x0000000003 (3)
"120A"= 0x0000000003 (3)
"120B"= 0x0000000000 (0)
"1400"= 0x0000000001 (1)
"1402"= 0x0000000000 (0)
"1405"= 0x0000000000 (0)
"1406"= 0x0000000003 (3)
"1407"= 0x0000000001 (1)
"1408"= 0x0000000003 (3)
"1409"= 0x0000000000 (0)
"1601"= 0x0000000000 (0)
"1604"= 0x0000000000 (0)
"1605"= 0x0000000000 (0)
"1606"= 0x0000000000 (0)
"1607"= 0x0000000003 (3)
"1608"= 0x0000000000 (0)
"1609"= 0x0000000001 (1)
"160A"= 0x0000000003 (3)
"1802"= 0x0000000000 (0)
"1803"= 0x0000000000 (0)
"1804"= 0x0000000001 (1)
"1805"= 0x0000000001 (1)
"1806"= 0x0000000001 (1)
"1807"= 0x0000000001 (1)
"1808"= 0x0000000000 (0)
"1809"= 0x0000000003 (3)
"180A"= 0x0000000003 (3)
"180C"= 0x0000000003 (3)
"180D"= 0x0000000000 (0)
"180E"= 0x0000000000 (0)
"180F"= 0x0000000000 (0)
"1A00"= 0x0000020000 (131072)
"1A02"= 0x0000000000 (0)
"1A03"= 0x0000000000 (0)
"1A04"= 0x0000000003 (3)
"1A05"= 0x0000000001 (1)
"1A06"= 0x0000000000 (0)
"1A10"= 0x0000000001 (1)
"1C00"= 0x0000000000 (0)
"2000"= 0x0000010000 (65536)
"2005"= 0x0000000003 (3)
"2100"= 0x0000000003 (3)
"2101"= 0x0000000003 (3)
"2102"= 0x0000000003 (3)
"2103"= 0x0000000003 (3)
"2104"= 0x0000000003 (3)
"2105"= 0x0000000003 (3)
"2106"= 0x0000000003 (3)
"2200"= 0x0000000003 (3)
"2201"= 0x0000000003 (3)
"2301"= 0x0000000000 (0)
"2400"= 0x0000000000 (0)
"2401"= 0x0000000000 (0)
"2402"= 0x0000000000 (0)
"2500"= 0x0000000003 (3)
"2600"= 0x0000000000 (0)
"2700"= 0x0000000000 (0)
"CurrentLevel"= 0x0000000000 (0)
"Description"="This zone contains Web sites that you trust not to damage your computer or data."
"DisplayName"="Trusted sites"
"Flags"= 0x0000000021 (33)
"Icon"="inetcpl.cpl#00004480"
"LowIcon"="inetcpl.cpl#005424"
"PMDisplayName"="Trusted sites [Protected Mode]"
"2107"= 0x0000000003 (3)
"2701"= 0x0000000000 (0)
"2702"= 0x0000000000 (0)
"2703"= 0x0000000000 (0)
"2708"= 0x0000000003 (3)
"2709"= 0x0000000003 (3)
"1812"= 0x0000000000 (0)
"140A"= 0x0000000000 (0)
"2302"= 0x0000000003 (3)
"270B"= 0x0000000000 (0)
"160B"= 0x0000000000 (0)
"2704"= 0x0000000000 (0)
"1810"= 0x0000000003 (3)
"1800"= 0x0000000001 (1)
"1E05"= 0x0000020000 (131072)
"270C"= 0x0000000000 (0)
"270D"= 0x0000000003 (3)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3]
"1001"= 0x0000000001 (1)
"1004"= 0x0000000003 (3)
"1200"= 0x0000000003 (3)
"1201"= 0x0000000003 (3)
"1206"= 0x0000000003 (3)
"1207"= 0x0000000003 (3)
"1208"= 0x0000000003 (3)
"1209"= 0x0000000003 (3)
"120A"= 0x0000000003 (3)
"120B"= 0x0000000003 (3)
"1400"= 0x0000000001 (1)
"1402"= 0x0000000000 (0)
"1405"= 0x0000000000 (0)
"1406"= 0x0000000003 (3)
"1407"= 0x0000000001 (1)
"1408"= 0x0000000003 (3)
"1409"= 0x0000000000 (0)
"1601"= 0x0000000000 (0)
"1604"= 0x0000000000 (0)
"1605"= 0x0000000000 (0)
"1606"= 0x0000000000 (0)
"1607"= 0x0000000003 (3)
"1608"= 0x0000000000 (0)
"1609"= 0x0000000001 (1)
"160A"= 0x0000000003 (3)
"1802"= 0x0000000000 (0)
"1803"= 0x0000000000 (0)
"1804"= 0x0000000001 (1)
"1805"= 0x0000000001 (1)
"1806"= 0x0000000001 (1)
"1807"= 0x0000000001 (1)
"1808"= 0x0000000000 (0)
"1809"= 0x0000000000 (0)
"180A"= 0x0000000003 (3)
"180C"= 0x0000000003 (3)
"180D"= 0x0000000001 (1)
"180E"= 0x0000000000 (0)
"180F"= 0x0000000000 (0)
"1A00"= 0x0000020000 (131072)
"1A02"= 0x0000000000 (0)
"1A03"= 0x0000000000 (0)
"1A04"= 0x0000000003 (3)
"1A05"= 0x0000000001 (1)
"1A06"= 0x0000000000 (0)
"1A10"= 0x0000000001 (1)
"1C00"= 0x0000000000 (0)
"2000"= 0x0000010000 (65536)
"2005"= 0x0000000003 (3)
"2100"= 0x0000000003 (3)
"2101"= 0x0000000003 (3)
"2102"= 0x0000000003 (3)
"2103"= 0x0000000003 (3)
"2104"= 0x0000000003 (3)
"2105"= 0x0000000003 (3)
"2200"= 0x0000000003 (3)
"2106"= 0x0000000003 (3)
"2201"= 0x0000000003 (3)
"2301"= 0x0000000000 (0)
"2400"= 0x0000000000 (0)
"2401"= 0x0000000000 (0)
"2402"= 0x0000000000 (0)
"2500"= 0x0000000000 (0)
"2600"= 0x0000000000 (0)
"2700"= 0x0000000000 (0)
"CurrentLevel"= 0x0000000000 (0)
"Description"="This zone contains all Web sites you haven't placed in other zones"
"DisplayName"="Internet"
"Flags"= 0x0000000021 (33)
"Icon"="inetcpl.cpl#001313"
"LowIcon"="inetcpl.cpl#005425"
"PMDisplayName"="Internet [Protected Mode]"
"2107"= 0x0000000003 (3)
"2701"= 0x0000000003 (3)
"2702"= 0x0000000000 (0)
"2703"= 0x0000000003 (3)
"2708"= 0x0000000003 (3)
"2709"= 0x0000000003 (3)
"1812"= 0x0000000001 (1)
"140A"= 0x0000000000 (0)
"2302"= 0x0000000003 (3)
"270B"= 0x0000000003 (3)
"160B"= 0x0000000000 (0)
"2704"= 0x0000000003 (3)
"1810"= 0x0000000003 (3)
"1800"= 0x0000000001 (1)
"1E05"= 0x0000030000 (196608)
"270C"= 0x0000000000 (0)
"270D"= 0x0000000003 (3)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4]
"1001"= 0x0000000003 (3)
"1004"= 0x0000000003 (3)
"1200"= 0x0000000003 (3)
"1201"= 0x0000000003 (3)
"1206"= 0x0000000003 (3)
"1207"= 0x0000000003 (3)
"1208"= 0x0000000003 (3)
"1209"= 0x0000000003 (3)
"120A"= 0x0000000003 (3)
"120B"= 0x0000000003 (3)
"1400"= 0x0000000003 (3)
"1402"= 0x0000000003 (3)
"1405"= 0x0000000003 (3)
"1406"= 0x0000000003 (3)
"1407"= 0x0000000003 (3)
"1408"= 0x0000000003 (3)
"1409"= 0x0000000000 (0)
"1601"= 0x0000000001 (1)
"1604"= 0x0000000003 (3)
"1605"= 0x0000000000 (0)
"1606"= 0x0000000003 (3)
"1607"= 0x0000000003 (3)
"1608"= 0x0000000003 (3)
"1609"= 0x0000000001 (1)
"160A"= 0x0000000003 (3)
"1802"= 0x0000000001 (1)
"1803"= 0x0000000003 (3)
"1804"= 0x0000000003 (3)
"1805"= 0x0000000001 (1)
"1806"= 0x0000000003 (3)
"1807"= 0x0000000001 (1)
"1808"= 0x0000000000 (0)
"1809"= 0x0000000000 (0)
"180A"= 0x0000000003 (3)
"180B"= 0x0000000003 (3)
"180C"= 0x0000000003 (3)
"180D"= 0x0000000001 (1)
"180E"= 0x0000000003 (3)
"180F"= 0x0000000003 (3)
"1A00"= 0x0000010000 (65536)
"1A02"= 0x0000000003 (3)
"1A03"= 0x0000000003 (3)
"1A04"= 0x0000000003 (3)
"1A05"= 0x0000000003 (3)
"1A06"= 0x0000000003 (3)
"1A10"= 0x0000000003 (3)
"1C00"= 0x0000000000 (0)
"2000"= 0x0000000003 (3)
"2005"= 0x0000000003 (3)
"2100"= 0x0000000003 (3)
"2101"= 0x0000000003 (3)
"2102"= 0x0000000003 (3)
"2103"= 0x0000000003 (3)
"2104"= 0x0000000003 (3)
"2105"= 0x0000000003 (3)
"2106"= 0x0000000003 (3)
"2200"= 0x0000000003 (3)
"2201"= 0x0000000003 (3)
"2301"= 0x0000000000 (0)
"2400"= 0x0000000003 (3)
"2401"= 0x0000000003 (3)
"2402"= 0x0000000003 (3)
"2500"= 0x0000000000 (0)
"2600"= 0x0000000003 (3)
"2700"= 0x0000000000 (0)
"CurrentLevel"= 0x0000000000 (0)
"Description"="This zone contains Web sites that could potentially damage your computer or data."
"DisplayName"="Restricted sites"
"Flags"= 0x0000000021 (33)
"Icon"="inetcpl.cpl#00004481"
"2107"= 0x0000000003 (3)
"2701"= 0x0000000003 (3)
"2702"= 0x0000000000 (0)
"2703"= 0x0000000003 (3)
"2708"= 0x0000000003 (3)
"2709"= 0x0000000003 (3)
"1812"= 0x0000000001 (1)
"140A"= 0x0000000000 (0)
"2302"= 0x0000000003 (3)
"270B"= 0x0000000003 (3)
"160B"= 0x0000000000 (0)
"2704"= 0x0000000003 (3)
"1810"= 0x0000000003 (3)
"1800"= 0x0000000003 (3)
"1E05"= 0x0000030000 (196608)
"270C"= 0x0000000000 (0)
"270D"= 0x0000000003 (3)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\NoFileLifetimeExtension]
".pub"=""
".vsi"=""

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P]
(No values found)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History]
(No values found)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Passport]
(No values found)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Secure Mime Handlers]
"CorTransientLoader.CorLoad.1"=""

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO]
(No values found)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4774"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,1321"
"Text"="ActiveX Controls and plugins"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ACTIVEX]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4775"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,1321"
"HelpID"="iexplore.hlp#50499"
"Text"="Run ActiveX controls and plugins"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ACTIVEX\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1200"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ACTIVEX\APPROVE]
"CheckedValue"= 0x0000010000 (65536)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4806"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1200"
"Text"="Administrator approved"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ACTIVEX\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1200"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ACTIVEX\QUERY]
"CheckedValue"= 0x0000000001 (1)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4804"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1200"
"Text"="Prompt"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ACTIVEX_OPTIN]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4897"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,1321"
"Text"="Allow previously unused ActiveX controls to run without prompt"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ACTIVEX_OPTIN\DISABLE]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1208"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ACTIVEX_OPTIN\ENABLE]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1208"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ACTIVEX_OVERRIDE_DOMAINLIST]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4900"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,1321"
"Text"="Only allow approved domains to use ActiveX without prompt"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ACTIVEX_OVERRIDE_DOMAINLIST\DISABLE]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="120B"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ACTIVEX_OVERRIDE_DOMAINLIST\ENABLE]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="120B"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ALLOW_DYNSRC_VIDEO]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4899"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,1321"
"Text"="Display video and animation on a webpage that does not use external media player"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ALLOW_DYNSRC_VIDEO\DISABLE]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="120A"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ALLOW_DYNSRC_VIDEO\ENABLE]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="120A"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\AUTOMATIC_ACTIVEX_UI]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4889"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,1321"
"Text"="Automatic prompting for ActiveX controls"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\AUTOMATIC_ACTIVEX_UI\DISABLE]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2201"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\AUTOMATIC_ACTIVEX_UI\ENABLE]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2201"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\BBHVR]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4884"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,1321"
"Text"="Binary behaviors"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\BBHVR\APPROVE]
"CheckedValue"= 0x0000010000 (65536)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4806"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2000"
"Text"="Administrator approved"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\BBHVR\DISABLE]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2000"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\BBHVR\ENABLE]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2000"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\BBHVR\PROMPT]
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\BBHVR\QUERY]
"CheckedValue"= 0x0000000001 (1)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4804"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2000"
"Text"="Prompt"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ENABLE]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4776"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,1321"
"Text"="Download signed ActiveX controls"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ENABLE\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1001"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ENABLE\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1001"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\ENABLE\QUERY]
"CheckedValue"= 0x0000000001 (1)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4804"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1001"
"Text"="Prompt"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\FILTER]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4923"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,1321"
"Text"="Allow ActiveX Filtering"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\FILTER\DISABLE]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2702"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\FILTER\ENABLE]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="2702"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\SAFETY]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4783"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,1321"
"Text"="Initialize and script ActiveX controls not marked as safe for scripting"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\SAFETY\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1201"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\SAFETY\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1201"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\SAFETY\QUERY]
"CheckedValue"= 0x0000000001 (1)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4804"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1201"
"Text"="Prompt"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\SCRIPTLETRUN]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4780"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,1321"
"Text"="Allow Scriptlets"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\SCRIPTLETRUN\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1209"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\SCRIPTLETRUN\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1209"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\SCRIPTLETRUN\QUERY]
"CheckedValue"= 0x0000000001 (1)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4804"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1209"
"Text"="Prompt"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\SCRIPTSAFE]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4784"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,1321"
"RequiresReboot"= 0x0000000001 (1)
"Text"="Script ActiveX controls marked safe for scripting"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\SCRIPTSAFE\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1405"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\SCRIPTSAFE\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1405"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\SCRIPTSAFE\QUERY]
"CheckedValue"= 0x0000000001 (1)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4804"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1405"
"Text"="Prompt"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\UNSIGNEDACTIVEX]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4777"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,1321"
"Text"="Download unsigned ActiveX controls"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\UNSIGNEDACTIVEX\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1004"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\UNSIGNEDACTIVEX\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1004"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\UNSIGNEDACTIVEX\QUERY]
"CheckedValue"= 0x0000000001 (1)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4804"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1004"
"Text"="Prompt"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\VALIDATION]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4924"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,1321"
"Text"="Run antimalware software on ActiveX controls"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\VALIDATION\DISABLE]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000000 (0)
"ValueName"="270C"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\ACTIVE_CONTENT\VALIDATION\ENABLE]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000000 (0)
"ValueName"="270C"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\AUTH]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4788"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,1323"
"Text"="User Authentication"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\AUTH\LOGON]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4790"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,1323"
"HelpID"="iexplore.hlp#50283"
"Text"="Logon"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\AUTH\LOGON\ANONYMOUS]
"CheckedValue"= 0x0000030000 (196608)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4807"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"HelpID"="iexplore.hlp#50283"
"DefaultValue"= 0x0000030000 (196608)
"ValueName"="1A00"
"Text"="Anonymous logon"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\AUTH\LOGON\ASK]
"CheckedValue"= 0x0000010000 (65536)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4808"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"HelpID"="iexplore.hlp#50283"
"DefaultValue"= 0x0000030000 (196608)
"ValueName"="1A00"
"Text"="Prompt for user name and password"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\AUTH\LOGON\COND]
"CheckedValue"= 0x0000020000 (131072)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4810"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"HelpID"="iexplore.hlp#50283"
"DefaultValue"= 0x0000030000 (196608)
"ValueName"="1A00"
"Text"="Automatic logon only in Intranet zone"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\AUTH\LOGON\SILENT]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4809"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"HelpID"="iexplore.hlp#50283"
"DefaultValue"= 0x0000030000 (196608)
"ValueName"="1A00"
"Text"="Automatic logon with current user name and password"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOTNET]
"Type"="group"
"Text"=".Net Framework"
"PlugUIText"="@mscorier.dll,-1001"
"Bitmap"="C:\Windows\system32\mscorier.dll,2000"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOTNET\DOWNLOAD]
"Text"="Download managed code"
"PlugUIText"="@mscorier.dll,-1006"
"Bitmap"="C:\Windows\system32\mscorier.dll,2000"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOTNET\DOWNLOAD\ALLOW]
"Type"="radio"
"CheckedValue"= 0x0000000000 (0)
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"DefaultValue"= 0x0000000003 (3)
"PlugUIText"="@mscorier.dll,-1004"
"Text"="Enable"
"ValueName"="2001"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOTNET\DOWNLOAD\DENY]
"Type"="radio"
"Text"="Disable"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"ValueName"="2001"
"PlugUIText"="@mscorier.dll,-1003"
"CheckedValue"= 0x0000000003 (3)
"DefaultValue"= 0x0000000003 (3)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOTNET\DOWNLOAD\QUERY]
"ValueName"="2001"
"PlugUIText"="@mscorier.dll,-1005"
"DefaultValue"= 0x0000000003 (3)
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"Text"="Prompt"
"Type"="radio"
"CheckedValue"= 0x0000000001 (1)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOTNET\DOWNLOADUNSIGNED]
"Text"="Download unsigned managed code"
"Bitmap"="C:\Windows\system32\mscorier.dll,2000"
"PlugUIText"="@mscorier.dll,-1002"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOTNET\DOWNLOADUNSIGNED\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"Text"="Enable"
"PlugUIText"="@mscorier.dll,-1004"
"DefaultValue"= 0x0000000003 (3)
"Type"="radio"
"ValueName"="2004"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOTNET\DOWNLOADUNSIGNED\DENY]
"Text"="Disable"
"ValueName"="2004"
"CheckedValue"= 0x0000000003 (3)
"Type"="radio"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"DefaultValue"= 0x0000000003 (3)
"PlugUIText"="@mscorier.dll,-1003"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOTNET\DOWNLOADUNSIGNED\QUERY]
"Text"="Prompt"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"ValueName"="2004"
"PlugUIText"="@mscorier.dll,-1005"
"CheckedValue"= 0x0000000001 (1)
"DefaultValue"= 0x0000000003 (3)
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOTNET\MANIFESTPERMISSIONS]
"Bitmap"="C:\Windows\system32\mscorier.dll,2000"
"PlugUIText"="@mscorier.dll,-1007"
"Text"="Permissions for components with manifests"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOTNET\MANIFESTPERMISSIONS\DISABLE]
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"PlugUIText"="@mscorier.dll,-1003"
"DefaultValue"= 0x0000010000 (65536)
"Type"="radio"
"CheckedValue"= 0x0000000003 (3)
"ValueName"="2007"
"Text"="Disable"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOTNET\MANIFESTPERMISSIONS\HIGHSAFETY]
"DefaultValue"= 0x0000010000 (65536)
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"Text"="High Safety"
"PlugUIText"="@mscorier.dll,-1008"
"Type"="radio"
"ValueName"="2007"
"CheckedValue"= 0x0000010000 (65536)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOWNLOAD]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4791"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4486"
"Text"="Downloads"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOWNLOAD\FILEDOWNLOAD]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4792"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4486"
"Text"="File download"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOWNLOAD\FILEDOWNLOAD\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1803"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOWNLOAD\FILEDOWNLOAD\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1803"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOWNLOAD\FONTDOWNLOAD]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4793"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4486"
"Text"="Font download"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOWNLOAD\FONTDOWNLOAD\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1604"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOWNLOAD\FONTDOWNLOAD\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1604"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\DOWNLOAD\FONTDOWNLOAD\QUERY]
"CheckedValue"= 0x0000000001 (1)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4804"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1604"
"Text"="Prompt"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\JAVAPER]
"Text"="Java VM"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\JAVAPER\JAVA]
(No values found)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\JAVAPER\JAVA\CUSTOM]
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\JAVAPER\JAVA\DISABLE]
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\JAVAPER\JAVA\HIGH]
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\JAVAPER\JAVA\LOW]
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\JAVAPER\JAVA\MEDIUM]
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4794"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4443"
"Text"="Miscellaneous"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\ClientCertPrompt]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4862"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4443"
"Text"="Don't prompt for client certificate selection when no certificates or only one certificate exists"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\ClientCertPrompt\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1A04"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\ClientCertPrompt\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1A04"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\CrossDomainData]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4785"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4443"
"Text"="Access data sources across domains"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\CrossDomainData\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1406"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\CrossDomainData\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1406"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\CrossDomainData\QUERY]
"CheckedValue"= 0x0000000001 (1)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4804"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1406"
"Text"="Prompt"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\DRAGDROP]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4796"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4443"
"Text"="Drag and drop or copy and paste files"
"Type"="group"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\DRAGDROP\ALLOW]
"CheckedValue"= 0x0000000000 (0)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4803"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1802"
"Text"="Enable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\DRAGDROP\DENY]
"CheckedValue"= 0x0000000003 (3)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4805"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1802"
"Text"="Disable"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\DRAGDROP\QUERY]
"CheckedValue"= 0x0000000001 (1)
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4804"
"HKeyRoot2"= 0x0080000002 (-2147483646)
"RegPoliciesPath"="SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"RegPath"="SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%s"
"HKeyRoot"= 0x0080000001 (-2147483647)
"DefaultValue"= 0x0000000003 (3)
"ValueName"="1802"
"Text"="Prompt"
"Type"="radio"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SO\MISC\DRAGDROP_XDOM_ACROSSWINDOWS]
"PlugUIText"="@C:\Windows\System32\inetcpl.cpl,-4800"
"Bitmap"="C:\Windows\System32\inetcpl.cpl,4443"
"Text"="Allow dragging of content between domains into separate windows"
"Type"="group"


cosinus 19.08.2014 10:58

Bitte so korrigieren, dass alles in CODE-Tags steht. Sonst wird es extrem unübersichtlich.

weti 19.08.2014 11:58

Habe ich doch gemacht! Drei Teile, alle im Code-Tag. Leider ist zwischendurch ein Teil ohne Code-Tag (ich glaube der erst Teil ohne Code reingerutscht, weil euer Server wohl überlastet war, gab es keine Verbindung und dann muss es wohl passiert sein) und leider kann ich das nicht mehr rückgängig machen. Aber wenn du die drei Textboxen zusammen nimmst, hast du das komplette Logfile.

oder vielleicht hier als komprimierter Anhang.

cosinus 19.08.2014 13:54

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

reg: reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyEnable" /d 0 /t REG_DWORD /f
reg: reg delete "HKCU\Software\Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyServer" /f
reg: reg delete "HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyServer" /f
reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyServer" /f
reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyServer" /f
reg: reg delete "HKU\S-1-5-21-79635218-2301998975-3311727660-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyServer" /f
reg: reg delete "HKU\S-1-5-21-79635218-2301998975-3311727660-1000\Software\Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyServer" /f
reg: reg delete "HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyServer" /f
reg: reg delete "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyServer" /f


Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.


weti 19.08.2014 14:11

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 17-08-2014 01
Ran by Admin at 2014-08-19 15:11:16 Run:2
Running from C:\Users\Admin\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
reg: reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyEnable" /d 0 /t REG_DWORD /f
reg: reg delete "HKCU\Software\Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyServer" /f
reg: reg delete "HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyServer" /f
reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyServer" /f
reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyServer" /f
reg: reg delete "HKU\S-1-5-21-79635218-2301998975-3311727660-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyServer" /f
reg: reg delete "HKU\S-1-5-21-79635218-2301998975-3311727660-1000\Software\Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyServer" /f
reg: reg delete "HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyServer" /f
reg: reg delete "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyServer" /f
       
*****************


========= reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyEnable" /d 0 /t REG_DWORD /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


========= reg delete "HKCU\Software\Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyServer" /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


========= reg delete "HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyServer" /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


========= reg delete "HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyServer" /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


========= reg delete "HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyServer" /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


========= reg delete "HKU\S-1-5-21-79635218-2301998975-3311727660-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyServer" /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


========= reg delete "HKU\S-1-5-21-79635218-2301998975-3311727660-1000\Software\Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyServer" /f =========

FEHLER: Der angegebene Registrierungsschlssel bzw. Wert wurde nicht gefunden.


========= End of Reg: =========


========= reg delete "HKU\S-1-5-21-79635218-2301998975-3311727660-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyServer" /f =========

FEHLER: Der angegebene Registrierungsschlssel bzw. Wert wurde nicht gefunden.


========= End of Reg: =========


========= reg delete "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "ProxyServer" /f =========

FEHLER: Der angegebene Registrierungsschlssel bzw. Wert wurde nicht gefunden.


========= End of Reg: =========


==== End of Fixlog ====


cosinus 19.08.2014 14:12

Ok. Windows rebooten und ProxySetting Verhalten prüfen!

weti 19.08.2014 14:39

Nein - leider auch kein Erfolg.

cosinus 19.08.2014 15:02

Irgendwas läuft da noch, was ständig den Proxy aktiviert :balla:

Probieren wir mal OTL aus, mit FRST hab ich zuletzt nix mehr gesehen


Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop (falls noch nicht vorhanden)
  • Doppelklick auf die OTL.exe
  • Vista und Win7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Oben findest Du ein Kästchen mit Ausgabe. Wähle bitte Minimale Ausgabe
  • Unter Extra Registrierung, wähle bitte Benutze SafeList
  • Klicke nun auf Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles hier in den Thread.
Hinweis: im eigenen Interesse solltest Du Deinen Namen mit *** (Sternchen) ersetzen.

weti 19.08.2014 16:01

Code:

OTL Extras logfile created on: 19.08.2014 16:46:39 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Admin\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.17239)
Locale: 00000407 | Country: German | Language: DEU | Date Format: dd.MM.yyyy
 
7,98 Gb Total Physical Memory | 6,02 Gb Available Physical Memory | 75,51% Memory free
15,95 Gb Paging File | 13,89 Gb Available in Paging File | 87,07% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 111,69 Gb Total Space | 46,11 Gb Free Space | 41,29% Space Free | Partition Type: NTFS
Drive D: | 465,76 Gb Total Space | 361,31 Gb Free Space | 77,57% Space Free | Partition Type: NTFS
Drive E: | 465,76 Gb Total Space | 311,57 Gb Free Space | 66,89% Space Free | Partition Type: NTFS
Drive H: | 596,17 Gb Total Space | 487,39 Gb Free Space | 81,75% Space Free | Partition Type: NTFS
 
Computer Name: xxx | User Name: xxx | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UpdatesDisableNotify" = 0
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
========== Firewall Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{F932C618-5ED2-4D50-A10A-2D5563074AAB}" = lport=5353 | protocol=17 | dir=in | app=c:\program files (x86)\google\chrome\application\chrome.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"TCP Query User{31991025-F11E-44D1-8697-EF4AE5F6ECC6}C:\program files (x86)\estos\procall one\ecticlientone.exe" = protocol=6 | dir=in | app=c:\program files (x86)\estos\procall one\ecticlientone.exe |
"TCP Query User{A8021564-58E9-43C0-AF01-4187A3AF4259}C:\program files (x86)\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"UDP Query User{E5CB92FB-9AEB-4CA7-93FC-B3D553755ED9}C:\program files (x86)\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"UDP Query User{F57B618D-80C3-44E4-92CA-EB15CD2EE408}C:\program files (x86)\estos\procall one\ecticlientone.exe" = protocol=17 | dir=in | app=c:\program files (x86)\estos\procall one\ecticlientone.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{1DF99F8F-31BC-4058-B750-DC0C86FC0038}" = Evoluent Mouse Manager
"{230D1595-57DA-4933-8C4E-375797EBB7E1}" = Bluetooth Win7 Suite (64)
"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)
"{26A24AE4-039D-4CA4-87B4-2F86417055FF}" = Java 7 Update 55 (64-bit)
"{2EDC2FA3-1F34-34E5-9085-588C9EFD1CC6}" = Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610
"{421E2E8D-F119-431D-A1F4-5F78989BEC75}" = PDF-XChange Pro 4.0
"{48C0866E-57EB-444C-8371-8E4321066BC3}" = Network64
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{4E3C43BF-52C0-4FAC-8E36-E2B4872A7F4F}" = TSP7
"{558B5965-CC1B-4AF1-BA07-5D6832404050}" = Adobe Photoshop Lightroom 5.4 64-bit
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{67048E0C-29A5-534C-FF67-83C4BF948D48}" = AMD Drag and Drop Transcoding
"{6BFAB6C1-6D46-46DB-A538-A269907C9F2F}" = Network64
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{70DFF8B2-44A3-2C2C-FB21-783E8291265F}" = ATI Catalyst Install Manager
"{764384C5-BCA9-307C-9AAC-FD443662686A}" = Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610
"{787136D2-F0F8-4625-AA3F-72D7795AC842}" = Apple Mobile Device Support
"{7AB6F8D7-7804-4662-BE8C-1AFCCD602D9F}" = Microsoft-Maus- und Tastatur-Center
"{7DEBE4EB-6B40-3766-BB35-5CBBC385DA37}" = Microsoft .NET Framework 4.5.1
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031" = Microsoft .NET Framework 4.5.1 (Deutsch)
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" = Microsoft .NET Framework 4.5.1
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant
"{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1" = PDF-Viewer
"{A9E695CB-A6AA-4B4C-9754-BA3CFF1C3B00}" = HP Officejet Pro 8000 A809 Series
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{AEEC99DE-C6EA-443C-BFF5-7AB75F720BE7}" = TSP7
"{B8BA155B-1E75-405F-9CB4-8A99615D09DC}" = iTunes
"{BCCC97EE-E162-448C-8847-59718FF29B04}" = Intel(R) Network Connections 15.6.25.0
"{C513739C-5F16-37B5-9ACF-99925FF1C1F3}" = Microsoft .NET Framework 4.5.1 (DEU)
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D87047B9-BBC5-9941-00B4-719B9E56CACC}" = ATI AVIVO64 Codecs
"{D9B52C63-4209-7129-BF10-FA5DCD38579E}" = ccc-utility64
"{FF21C3E6-97FD-474F-9518-8DCBE94C2854}" = 64 Bit HP CIO Components Installer
"BullGuard" = BullGuard
"CCleaner" = CCleaner
"HP Imaging Device Functions" = HP Imaging Device Functions 14.0
"HP Smart Web Printing" = HP Smart Web Printing 4.60
"HP Solution Center & Imaging Support Tools" = HP Solution Center 14.0
"HPExtendedCapabilities" = HP Customer Participation Program 14.0
"Microsoft Mouse and Keyboard Center" = Microsoft-Maus- und Tastatur-Center
"PROSetDX" = Intel(R) Network Connections 15.6.25.0
"Shop for HP Supplies" = Shop for HP Supplies
"Unlocker" = Unlocker 1.9.1-x64
"VLC media player" = VLC media player
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{06092909-8851-C581-F990-7195076FDAEF}" = CCC Help Czech
"{079F01C3-751A-43BA-BBB6-6239D4F0F19A}" = EASY Office
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{09F26C15-F1FE-4560-9AF2-41A7052B1B76}" = QuickScan 4.6.1
"{0CA04779-346C-30FD-EB9B-8EEA2CE094B3}" = CCC Help Thai
"{0F3A02CF-09B1-4B49-BE02-A70790F18B56}" = StarMoney
"{0FAEAEC8-F458-4AE2-89B8-BF680FD245D5}" = 8000A809_eDocs
"{1000ACF5-0BCF-4FC0-B4F5-F044317F9155}" = ProductContext
"{111EE7DF-FC45-40C7-98A7-753AC46B12FB}" = QuickTime 7
"{11F9A376-342F-4297-82DA-1F6EA8ED4B6B}" = PSE12 STI Installer
"{1458BB78-1DC5-4BC0-B9A3-2B644F5A8105}" = DeviceDiscovery
"{150B6201-E9E6-4DFB-960E-CCBD53FBDDED}" = HPProductAssistant
"{185F9795-9663-4F13-9EF9-307A282ADB5A}" = ph
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1B3B5C60-70B8-F022-5497-03FD2772586C}" = CCC Help Greek
"{1C160168-BF5B-72FE-BAFA-6DD5F737404C}" = CCC Help Chinese Standard
"{1ED3EBF6-A130-4B3B-B01A-C29B067798B3}" = CCC Help Finnish
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F30C083-169A-48AA-A24A-427194AEAB84}" = ESTOS ProCall One
"{26A24AE4-039D-4CA4-87B4-2F03217065FF}" = Java 7 Update 65
"{278AD90C-D27D-AA89-58DF-AD13852D51CA}" = CCC Help Spanish
"{292F0F52-B62D-4E71-921B-89A682402201}" = Toolbox
"{2A075BB4-E976-4278-BF3F-E5C6945D84C0}" = bl
"{2CDBFF1A-6433-E94D-CA25-831FDB9775E9}" = CCC Help Italian
"{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component
"{31DED885-1124-0E58-97FB-73E4EF692E8D}" = CCC Help Hungarian
"{33B670D7-8A06-DA5B-0341-5630D1E12007}" = ccc-core-static
"{366584A4-1D35-49B2-97B3-C803DDFCC543}" = myPrintMileage (Officejet Pro 8000 A809)
"{38D65ABC-A00B-6E13-2EF3-826CFC8CFC14}" = CCC Help French
"{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}" = JMicron JMB36X Driver
"{3B4325A0-43CD-10D1-64F6-BD2F90DCB756}" = Catalyst Control Center Graphics Previews Vista
"{3D6AD258-61EA-35F5-812C-B7A02152996E}" = Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610
"{3F8B39A4-B7CE-B036-941C-A8DB57676B04}" = CCC Help Norwegian
"{4622F96A-780B-48B8-8304-1CD8A40043E8}" = MailWasherPro
"{4A1946BC-2D29-40EE-9783-51150DD6F21C}" = Firmen-SMS
"{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}" = Google Earth Plug-in
"{4ACF9BBA-E137-7309-7BF9-567ADAB6B4E6}" = CCC Help Turkish
"{4B74BC31-B353-4B8F-8CBE-DAB4FF326FF1}" = sysTPL
"{51AD839D-CE11-B9E3-227D-03BC89F227C8}" = CCC Help Danish
"{55043DDE-D718-C7F7-9B4C-2B3D818D8A1F}" = Catalyst Control Center InstallProxy
"{5774B4C1-8579-D5D9-8D38-A0CE32B6736C}" = CCC Help German
"{5A6DB7C1-E646-4842-A562-49C5EB8F2B47}" = StarMoney
"{5B025634-7D5B-4B8D-BE2A-7943C1CF2D5D}" = Status
"{5B4B2623-E55E-451C-B448-5761B92ADE04}" = StarMoney 9.0
"{5D19BB0D-9B04-5B85-9295-4E11BCB1C2C3}" = CCC Help Polish
"{60341104-FC8E-EF26-12CB-93B17DF55976}" = CCC Help Japanese
"{62161867-51F1-9FB8-0E6E-FE49D89CBB71}" = CCC Help Dutch
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{65589581-920C-CAE1-58C2-2149D3AA3F39}" = HydraVision
"{6657DA03-A39B-472C-8458-6292E128A3D9}" = MailWasherPro
"{66815B84-05B8-4FA3-AACA-3E7C434F78B8}_is1" = Password Depot 5
"{66D6C49D-B4F4-423A-85EA-3AF843115A91}" = StarMoney
"{6A7E9B60-4698-F505-CAD3-05F8AB22FB61}" = CCC Help Russian
"{6B4AD1A9-E73A-4184-9D6B-072F8A3C5EBA}" = VoiceOver Kit
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{74DC0593-6BC6-4001-AD5F-D810AFB68D86}" = HP Update
"{75794DD1-5D69-4E33-A141-C3D4B0724C71}" = Catalyst Control Center Graphics Previews Common
"{777B751F-C904-4BD7-8DFF-81F97A3C0BC5}" = Adobe Photoshop Elements 12
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}" = Skype™ 6.16
"{7CE47764-9A8F-380D-FB9E-FCFC37B9F727}" = CCC Help Korean
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{8927E07C-97F7-4A54-88FB-D976F50DD46E}" = Turbo Lister 2
"{8A6CC564-4900-4282-8BD1-B3C419432148}" = HPScanjet7650Corporate
"{8CCA32E6-9A53-41D5-91F8-5ACF71FBEBD4}" = HPScanjet7650Corporate
"{8EE94FD8-5F52-4463-A340-185D16328158}" = WebReg
"{8FF6F5CA-4E30-4E3B-B951-204CAAA2716A}" = SmartWebPrinting
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{91B33C97-0CE8-6ABD-1CF4-0DAF2CCF492A}_is1" = Ashampoo Slideshow Studio HD 3 v.3.0.3
"{91B33C97-93EB-244C-F687-71D85E45A206}_is1" = Ashampoo Burning Studio 12 v.12.0.5
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{95716cce-fc71-413f-8ad5-56c2892d4b3a}" = Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610
"{974025B1-769B-49E9-817C-C638ABE8F372}" = HP IDF Software
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D80A7B7-DC01-485D-AE93-710D559B5C56}" = Elements 12 Organizer
"{9ED77550-AF66-2B7E-97E1-34B3BFDEAC6D}" = CCC Help Swedish
"{a1909659-0a08-4554-8af1-2175904903a1}" = Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA9F9385-5FB1-415A-AEBE-5C46DB792450}" = yourMail free edition
"{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}" = Apple Application Support
"{AC35A885-0F8F-4857-B7DA-6E8DFB43E6B3}" = HPSSupply
"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.08) - Deutsch
"{AF37176A-78CA-545B-34EF-8B6A21514DD1}" = Adobe Help Manager
"{B9830694-3D4A-40CC-AB27-5A8C9E160200}" = BPDSoftware
"{BB3447F6-9553-4AA9-960E-0DB5310C5779}" = GPBaseService2
"{BC5DD87B-0143-4D14-AAE6-97109614DC6B}" = SolutionCenter
"{BDE7CE44-145A-47E3-9A75-9FBD49D9B46B}" = 8000A809
"{C5F7045B-193F-418C-A4DE-27F76F28841E}" = BPDSoftware_Ini
"{C982ACFF-5997-4B7D-B3E1-CF7273A06FB2}" = Perfect Effects 8
"{CD178FDD-086A-4C2E-935E-8CDB747B0F29}" = GO Contact Sync Mod
"{CD31E63D-47FD-491C-8117-CF201D0AFAB5}" = TrayApp
"{CF255306-5B68-401F-87BA-AA62BEA6888C}" = 8000A809_Help
"{D360FA88-17C8-4F14-B67F-13AAF9607B12}" = MarketResearch
"{DDA34038-89BD-4804-B0B8-DC48D5DFB463}" = Catalyst Control Center - Branding
"{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}" = Asmedia ASM104x USB 3.0 Host Controller Driver
"{E7D4E834-93EB-351F-B8FB-82CDAE623003}" = Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610
"{E8454B5F-4122-864C-002D-31F878D2CBF4}" = CCC Help English
"{EC1F15E1-F3CC-46EE-B7A5-849A08ED60DC}}_is1" = PantsOff 2.0
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E6252F-8DC2-B508-D412-1C427CDB3448}" = CCC Help Portuguese
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F82C6574-AD88-4B40-A432-970BC77F1BD2}" = DesignPro 5
"{F902AB2B-7816-4CBD-A385-F2549F62956B}" = StarMoney
"{FA0FF682-CC70-4C57-93CD-E276F3E7537E}" = BufferChm
"{FC338210-F594-11D3-BA24-00001C3AB4DF}" = cyberJack Base Components
"{FCB6F9DC-A0FF-621E-DE53-877E63864DD1}" = CCC Help Chinese Traditional
"{FE4466A3-76B3-A9F4-9B22-150D6F8B4647}" = Catalyst Control Center Localization All
"Adobe Flash Player ActiveX" = Adobe Flash Player 14 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 14 Plugin
"Adobe Photoshop Elements 12" = Adobe Photoshop Elements 12
"AttachmentsManager_is1" = AttachmentsManager 1.8.6
"AVMWLANCLI" = AVM FRITZ!WLAN
"baywotch4_is1" = BayWotch Update v4.2.24
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Help Manager
"CUEcards 2000" = CUEcards 2000
"DasTelefonbuch Deutschland" = Das Telefonbuch Deutschland
"DVDFab 9_is1" = DVDFab 9.1.5.9 (25/07/2014)
"FreeCommander XE_is1" = FreeCommander XE
"FreeCommander_is1" = FreeCommander 2009.02b
"FreeFileSync" = FreeFileSync 6.0
"Google Chrome" = Google Chrome
"HP Photo Creations" = HP Photo Creations
"HP Scanjet 7650 Document ISIS/TWAIN" = HP Scanjet 7650 Document ISIS/TWAIN
"InstallShield_{F82C6574-AD88-4B40-A432-970BC77F1BD2}" = DesignPro 5
"instplugin" = instplugin
"InvelosDVDProfiler_is1" = DVD Profiler Version 3.8.2
"IrfanView" = IrfanView (remove only)
"LastPass" = LastPass (uninstall only)
"MagniDriver" = marvell 91xx driver
"Malwarebytes Anti-Malware_is1" = Malwarebytes Anti-Malware Version 2.0.2.1012
"MOBackup-DatensicherungfürOutlook" = MOBackup - Datensicherung für Outlook (Vollversion)
"Mozilla Firefox 32.0 (x86 de)" = Mozilla Firefox 32.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MUSICWIZARD_is1" = Music Wizard Professional 8.0.9
"Office14.SingleImage" = Microsoft Office Home and Business 2010
"Opera 12.17.1863" = Opera 12.17
"PhraseExpress_is1" = PhraseExpress v10.1.59
"Revo Uninstaller" = Revo Uninstaller 1.95
"SchnapperPlus" = SchnapperPlus 1.9.11
"Startup Manager 1.5_is1" = Startup Manager 1.5
"SumatraPDF" = SumatraPDF
"Textbausteinverwaltung Outlook Add-In_is1" = Textbausteinverwaltung Outlook Add-In v10.0.0
"tksuite_tksuite_server" = AGFEO TK-Suite Server
"WizMouse_is1" = WizMouse v1.7.0.3
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-79635218-2301998975-3311727660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"yourMail free edition" = yourMail free edition
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 15.08.2014 03:43:27 | Computer Name = xxx  | Source = Application Hang | ID = 1002
Description = Programm mobackup.exe, Version 7.95.114.698 kann nicht mehr unter
Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in
 der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem
zu suchen.    Prozess-ID: 480    Startzeit: 01cfb85c704c735b    Endzeit: 5    Anwendungspfad: C:\Program
 Files (x86)\MOBackup\mobackup.exe    Berichts-ID: d60f7b6a-244f-11e4-9d7e-0026831840ab

 
Error - 16.08.2014 14:20:06 | Computer Name = xxx  | Source = WinMgmt | ID = 10
Description =
 
Error - 18.08.2014 03:32:18 | Computer Name = xxx  | Source = WinMgmt | ID = 10
Description =
 
Error - 18.08.2014 03:40:28 | Computer Name = xxx  | Source = Windows Backup | ID = 4103
Description =
 
Error - 19.08.2014 03:51:01 | Computer Name = xxx  | Source = WinMgmt | ID = 10
Description =
 
Error - 19.08.2014 04:07:46 | Computer Name = xxx  | Source = SideBySide | ID = 16842832
Description = Fehler beim Generieren des Aktivierungskontexts für "d:\Download\Aktuell\esetsmartinstaller_deu.exe".
 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche
 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.
In
 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente
 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 
Error - 19.08.2014 05:01:21 | Computer Name = xxx  | Source = WinMgmt | ID = 10
Description =
 
Error - 19.08.2014 09:39:05 | Computer Name = xxx  | Source = WinMgmt | ID = 10
Description =
 
Error - 19.08.2014 10:41:49 | Computer Name = xxx  | Source = Application Hang | ID = 1002
Description = Programm OTL.exe, Version 3.2.69.0 kann nicht mehr unter Windows ausgeführt
 werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 1fc0    Startzeit:
 01cfbbbb68972ec4    Endzeit: 2    Anwendungspfad: C:\Users\Admin\Desktop\OTL.exe    Berichts-ID:
 
 
Error - 19.08.2014 10:44:56 | Computer Name = xxx  | Source = WinMgmt | ID = 10
Description =
 
[ System Events ]
Error - 18.08.2014 03:30:26 | Computer Name = xxx  | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?16.?08.?2014 um 21:10:11 unerwartet heruntergefahren.
 
Error - 18.08.2014 03:32:29 | Computer Name = xxx  | Source = Service Control Manager | ID = 7022
Description = Der Dienst "BullGuard firewall service" wurde nicht richtig gestartet.
 
Error - 19.08.2014 03:49:12 | Computer Name = xxx  | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?18.?08.?2014 um 21:02:23 unerwartet heruntergefahren.
 
Error - 19.08.2014 03:51:13 | Computer Name = xxx  | Source = Service Control Manager | ID = 7022
Description = Der Dienst "BullGuard firewall service" wurde nicht richtig gestartet.
 
Error - 19.08.2014 04:59:28 | Computer Name = xxx  | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?19.?08.?2014 um 10:58:06 unerwartet heruntergefahren.
 
Error - 19.08.2014 05:01:27 | Computer Name = xxx  | Source = Service Control Manager | ID = 7022
Description = Der Dienst "BullGuard firewall service" wurde nicht richtig gestartet.
 
Error - 19.08.2014 09:37:14 | Computer Name = xxx  | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?19.?08.?2014 um 15:35:39 unerwartet heruntergefahren.
 
Error - 19.08.2014 09:39:11 | Computer Name = xxx  | Source = Service Control Manager | ID = 7022
Description = Der Dienst "BullGuard firewall service" wurde nicht richtig gestartet.
 
Error - 19.08.2014 10:43:03 | Computer Name = xxx  | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?19.?08.?2014 um 16:42:08 unerwartet heruntergefahren.
 
Error - 19.08.2014 10:45:03 | Computer Name = xxx  | Source = Service Control Manager | ID = 7022
Description = Der Dienst "BullGuard firewall service" wurde nicht richtig gestartet.
 
 
< End of report >

Und OTL-txt
Code:

OTL logfile created on: 19.08.2014 16:46:39 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Admin\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.17239)
Locale: 00000407 | Country: German | Language: DEU | Date Format: dd.MM.yyyy
 
7,98 Gb Total Physical Memory | 6,02 Gb Available Physical Memory | 75,51% Memory free
15,95 Gb Paging File | 13,89 Gb Available in Paging File | 87,07% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 111,69 Gb Total Space | 46,11 Gb Free Space | 41,29% Space Free | Partition Type: NTFS
Drive D: | 465,76 Gb Total Space | 361,31 Gb Free Space | 77,57% Space Free | Partition Type: NTFS
Drive E: | 465,76 Gb Total Space | 311,57 Gb Free Space | 66,89% Space Free | Partition Type: NTFS
Drive H: | 596,17 Gb Total Space | 487,39 Gb Free Space | 81,75% Space Free | Partition Type: NTFS
 
Computer Name: xxx | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Admin\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\BullGuard Ltd\BullGuard\Files32\Spamfilter\LittleHook.exe (BullGuard Ltd.)
PRC - C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe (Star Finanz-Software Entwicklung und Vertriebs GmbH)
PRC - C:\Program Files (x86)\PhraseExpress\phraseexpress.exe (Bartels Media GmbH)
PRC - C:\Program Files (x86)\Opera\opera.exe (Opera Software)
PRC - C:\Program Files (x86)\sysTPL\sysTPLMonitor.exe (Tlapia)
PRC - C:\Windows\SysWOW64\nlssrv32.exe (Nalpeiron Ltd.)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\ESTOS\ProCall One\ECtiClientOne.exe (ESTOS GmbH)
PRC - C:\Program Files (x86)\sysTPL\sysTPLService.exe (Tlapia)
PRC - C:\Program Files (x86)\WizMouse\WizMouse.exe ()
PRC - C:\Program Files (x86)\AGFEO\Tk-Suite\tkserver\tksock.exe (AGFEO      )
PRC - C:\Program Files (x86)\AGFEO\Tk-Suite\tkserver\tkmedia.exe (AGFEO      )
PRC - C:\Program Files (x86)\AGFEO\Tk-Suite\tools\ctimon.exe (AGFEO      )
PRC - C:\Windows\SysWOW64\cjpcsc.exe (REINER SCT)
PRC - C:\Program Files (x86)\TVG\OnlineUpdate\OnlineUpdateSvc.exe ()
PRC - C:\Program Files (x86)\avmwlanstick\WLanNetService.exe (AVM Berlin)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files (x86)\PhraseExpress\pexlang.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files (x86)\WizMouse\WizMouse.exe ()
MOD - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF ()
MOD - C:\Program Files (x86)\ESTOS\ProCall One\TfD.dll ()
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - (IEEtwCollectorService) -- C:\Windows\SysNative\IEEtwCollector.exe (Microsoft Corporation)
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (Intel® PROSet Monitoring Service) -- C:\Windows\SysNative\IPROSetMonitor.exe (Intel Corporation)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (BsCache) -- c:\Programme\BullGuard Ltd\BullGuard\BsCache.dll (BullGuard Ltd.)
SRV - (BsBackup) -- c:\Programme\BullGuard Ltd\BullGuard\BsBackup.dll (BullGuard Ltd.)
SRV - (BsFileScan) -- c:\Programme\BullGuard Ltd\BullGuard\BsFileScan.dll (BullGuard Ltd.)
SRV - (BsScanner) -- c:\Programme\BullGuard Ltd\BullGuard\BullGuardScanner.exe (BullGuard Ltd.)
SRV - (BsBhvScan) -- c:\Programme\BullGuard Ltd\BullGuard\BullGuardBhvScanner.exe (BullGuard Ltd.)
SRV - (BsFire) -- c:\Programme\BullGuard Ltd\BullGuard\BsFire.dll (BullGuard Ltd.)
SRV - (BsMain) -- c:\Programme\BullGuard Ltd\BullGuard\BsMain.dll (BullGuard Ltd.)
SRV - (BsMailProxy) -- c:\Programme\BullGuard Ltd\BullGuard\BsMailProxy\BsMailProxy.dll (BullGuard Ltd.)
SRV - (BsUpdate) -- c:\Programme\BullGuard Ltd\BullGuard\BullGuardUpdate.exe (BullGuard Ltd.)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (StarMoney 9.0 OnlineUpdate) -- C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe (Star Finanz-Software Entwicklung und Vertriebs GmbH)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (sysTPLMonitor.exe) -- C:\Program Files (x86)\sysTPL\sysTPLMonitor.exe (Tlapia)
SRV - (nlsX86cc) -- C:\Windows\SysWOW64\nlssrv32.exe (Nalpeiron Ltd.)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (sysTPLService.exe) -- C:\Program Files (x86)\sysTPL\sysTPLService.exe (Tlapia)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (AdobeActiveFileMonitor12.0) -- C:\Program Files (x86)\Adobe\Elements 12 Organizer\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)
SRV - (tksock) -- C:\Program Files (x86)\AGFEO\Tk-Suite\tkserver\tksock.exe (AGFEO      )
SRV - (cjpcsc) -- C:\Windows\SysWOW64\cjpcsc.exe (REINER SCT)
SRV - (TVGOnlineUpdateSvc) -- C:\Program Files (x86)\TVG\OnlineUpdate\OnlineUpdateSvc.exe ()
SRV - (AtherosSvc) -- C:\Program Files (x86)\Bluetooth Suite\AdminService.exe (Atheros Commnucations)
SRV - (HPSLPSVC) -- C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL (Hewlett-Packard Co.)
SRV - (AVM WLAN Connection Service) -- C:\Program Files (x86)\avmwlanstick\WLanNetService.exe (AVM Berlin)
SRV - (osppsvc) -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (BdAgent) -- C:\Windows\SysNative\drivers\BdAgent.sys (BullGuard Ltd.)
DRV:64bit: - (BdSpy) -- C:\Windows\SysNative\drivers\BdSpy.sys (BullGuard Ltd.)
DRV:64bit: - (AFW) -- C:\Windows\SysNative\drivers\afw.sys (Agnitum Ltd.)
DRV:64bit: - (BdNet) -- C:\Windows\SysNative\drivers\BdNet.sys (BullGuard Ltd.)
DRV:64bit: - (NovaShieldTDIDriver) -- C:\Windows\SysNative\drivers\NSNetmon.sys (BullGuard Ltd.)
DRV:64bit: - (NovaShieldFilterDriver) -- C:\Windows\SysNative\drivers\NSKernel.sys (BullGuard Ltd.)
DRV:64bit: - (afwcore) -- C:\Windows\SysNative\drivers\afwcore.sys (Agnitum Ltd.)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (tap0901) -- C:\Windows\SysNative\drivers\tap0901.sys (The OpenVPN Project)
DRV:64bit: - (Trufos) -- C:\Windows\SysNative\drivers\Trufos.sys (BitDefender S.R.L.)
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (wacomrouterfilter) -- C:\Windows\SysNative\drivers\wacomrouterfilter.sys (Wacom Technology)
DRV:64bit: - (WacHidRouter) -- C:\Windows\SysNative\drivers\wachidrouter.sys (Wacom Technology)
DRV:64bit: - (hidkmdf) -- C:\Windows\SysNative\drivers\hidkmdf.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (ssudmdm) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (dg_ssudbus) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Corel Corporation)
DRV:64bit: - (vidsflt67) -- C:\Windows\SysNative\drivers\vsflt67.sys (Acronis)
DRV:64bit: - (fltsrv) -- C:\Windows\SysNative\drivers\fltsrv.sys (Acronis)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (cjusb) -- C:\Windows\SysNative\drivers\cjusb.sys (REINER SCT)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (asmtxhci) -- C:\Windows\SysNative\drivers\asmtxhci.sys (ASMedia Technology Inc)
DRV:64bit: - (asmthub3) -- C:\Windows\SysNative\drivers\asmthub3.sys (ASMedia Technology Inc)
DRV:64bit: - (dmvsc) -- C:\Windows\SysNative\drivers\dmvsc.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (BTATH_A2DP) -- C:\Windows\SysNative\drivers\btath_a2dp.sys (Atheros)
DRV:64bit: - (BtFilter) -- C:\Windows\SysNative\drivers\btfilter.sys (Atheros)
DRV:64bit: - (BTATH_HCRP) -- C:\Windows\SysNative\drivers\btath_hcrp.sys (Atheros)
DRV:64bit: - (BTATH_RCP) -- C:\Windows\SysNative\drivers\btath_rcp.sys (Atheros)
DRV:64bit: - (BTATH_LWFLT) -- C:\Windows\SysNative\drivers\btath_lwflt.sys (Atheros)
DRV:64bit: - (ATHDFU) -- C:\Windows\SysNative\drivers\AthDfu.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (AthBTPort) -- C:\Windows\SysNative\drivers\btath_flt.sys (Atheros)
DRV:64bit: - (BTATH_BUS) -- C:\Windows\SysNative\drivers\btath_bus.sys (Atheros)
DRV:64bit: - (fwlanusb4) -- C:\Windows\SysNative\drivers\fwlanusb4.sys (AVM GmbH)
DRV:64bit: - (avmeject) -- C:\Windows\SysNative\drivers\avmeject.sys (AVM Berlin)
DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (e1cexpress) -- C:\Windows\SysNative\drivers\e1c62x64.sys (Intel Corporation)
DRV:64bit: - (mv91xx) -- C:\Windows\SysNative\drivers\mv91xx.sys (Marvell Semiconductor, Inc.)
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (JRAID) -- C:\Windows\SysNative\drivers\jraid.sys (JMicron Technology Corp.)
DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (ATI Technologies, Inc.)
DRV:64bit: - (EvoMouseDriverFilterHidUsb) -- C:\Windows\SysNative\drivers\EvoMouseDriverFilterHidUsb.sys (Evoluent)
DRV:64bit: - (EvoMouseDriverMini) -- C:\Windows\SysNative\drivers\EvoMouseDriverMini.sys ()
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (FPCIBASE) -- C:\Windows\SysNative\drivers\fpcibase.sys (AVM Berlin)
DRV:64bit: - (AVMCOWAN) -- C:\Windows\SysNative\drivers\avmcowan.sys (AVM GmbH)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (RimUsb) -- C:\Windows\SysNative\drivers\RimUsb_AMD64.sys (Research In Motion Limited)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <-loopback>;
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:8878;https=127.0.0.1:8878
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <-loopback>;
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:8878;https=127.0.0.1:8878
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:8878;https=127.0.0.1:8878
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:8878;https=127.0.0.1:8878
 
IE - HKU\S-1-5-21-79635218-2301998975-3311727660-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\S-1-5-21-79635218-2301998975-3311727660-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-79635218-2301998975-3311727660-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 95 43 21 BB B7 74 CD 01  [binary data]
IE - HKU\S-1-5-21-79635218-2301998975-3311727660-1000\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-79635218-2301998975-3311727660-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR
IE - HKU\S-1-5-21-79635218-2301998975-3311727660-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-21-79635218-2301998975-3311727660-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = www;http;https
IE - HKU\S-1-5-21-79635218-2301998975-3311727660-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:8878;https=127.0.0.1:8878
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Startpage HTTPS - Deutsch"
FF - prefs.js..browser.search.selectedEngine: "Startpage HTTPS - Deutsch"
FF - prefs.js..browser.startup.homepage: "https://www.google.de/?gws_rd=ssl"
FF - prefs.js..extensions.enabledAddons: secureLogin%40blueimp.net:1.0.3
FF - prefs.js..extensions.enabledAddons: %7B0FED7D55-65D4-47b6-A6DE-9A4ADB55355F%7D:1.0.8
FF - prefs.js..extensions.enabledAddons: %7Bd40f5e7b-d2cf-4856-b441-cc613eeffbe3%7D:1.68
FF - prefs.js..extensions.enabledAddons: firegestures%40xuldev.org:1.8.7
FF - prefs.js..extensions.enabledAddons: antiphishing%40bullguard:2.1
FF - prefs.js..extensions.enabledAddons: tiletabs%40DW-dev:11.11
FF - prefs.js..extensions.enabledAddons: %7B9fb7d178-155a-4318-9173-1a8eaaea7fe4%7D:2.1.20
FF - prefs.js..extensions.enabledAddons: support%40lastpass.com:3.1.54
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:32.0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.55.2: C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.55.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.5: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF:64bit: - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.65.2: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.65.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5: C:\ProgramData\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF - HKCU\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF - HKCU\Software\MozillaPlugins\wacom.com/WacomTabletPlugin: C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll File not found
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\antiphishing@bullguard: c:\program files\bullguard ltd\bullguard\Files32\Antiphishing\FF\antiphishing@bullguard\ [2014.08.01 07:53:02 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014.05.04 22:22:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 32.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2014.08.18 10:10:37 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 32.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2014.08.18 10:10:37 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014.05.04 22:22:05 | 000,000,000 | ---D | M]
 
[2012.08.09 11:12:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Extensions
[2014.08.19 16:18:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\tefcdjqq.default\extensions
[2013.01.07 16:52:22 | 000,000,000 | ---D | M] (Autocopy) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\tefcdjqq.default\extensions\{0FED7D55-65D4-47b6-A6DE-9A4ADB55355F}
[2014.08.19 16:18:28 | 000,000,000 | ---D | M] (LastPass) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\tefcdjqq.default\extensions\support@lastpass.com
[2014.07.01 09:39:42 | 000,394,918 | ---- | M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\tefcdjqq.default\extensions\firegestures@xuldev.org.xpi
[2012.11.27 11:35:29 | 000,083,379 | ---- | M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\tefcdjqq.default\extensions\secureLogin@blueimp.net.xpi
[2014.08.07 19:54:41 | 000,132,559 | ---- | M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\tefcdjqq.default\extensions\tiletabs@DW-dev.xpi
[2014.08.15 13:46:51 | 000,370,444 | ---- | M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\tefcdjqq.default\extensions\{9fb7d178-155a-4318-9173-1a8eaaea7fe4}.xpi
[2012.09.17 16:10:51 | 000,138,614 | ---- | M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\tefcdjqq.default\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi
[2013.07.15 11:17:41 | 000,001,644 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\tefcdjqq.default\searchplugins\acoon.xml
[2013.11.20 22:21:44 | 000,001,793 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\tefcdjqq.default\searchplugins\search_engine.xml
[2014.08.19 15:06:06 | 000,005,783 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\tefcdjqq.default\searchplugins\startpage-https---deutsch.xml
[2013.07.15 11:20:30 | 000,001,997 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\tefcdjqq.default\searchplugins\wolframalpha.xml
[2014.08.18 10:10:37 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions
[2014.08.18 10:10:37 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2014.08.01 07:53:02 | 000,000,000 | ---D | M] (BullGuard Safe Browsing) -- C:\PROGRAM FILES\BULLGUARD LTD\BULLGUARD\FILES32\ANTIPHISHING\FF\ANTIPHISHING@BULLGUARD
 
========== Chrome  ==========
 
CHR - default_search_provider:  ()
CHR - default_search_provider: search_url =
CHR - default_search_provider: suggest_url =
CHR - homepage: hxxp://www.netvibes.com/privatepage/4#Home
CHR - plugin: Error reading preferences file
CHR - Extension: Google Docs = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\
CHR - Extension: Google Drive = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_1\
CHR - Extension: https://translate.google.de/#pl/de/Kochany%20 = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkmlelhnmpnjbijdijnmagddkjnjkihn\2014.7.28.44814_0\
CHR - Extension: YouTube = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_1\
CHR - Extension: Google-Suche = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_1\
CHR - Extension: Google Kalender = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjicmeblgpmajnghnpcppodonldlgfn\4.5.3_0\
CHR - Extension: LastPass: Free Password Manager = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd\3.1.53_0\
CHR - Extension: Yoono - Twitter, Facebook, LinkedIn, YouTubeâ„¢ = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jkkenjlnjfemconejajakbijbheoffli\0.2.7.32_0\
CHR - Extension: Smooth Gestures = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfkgmnnajiljnolcgolmmgnecgldgeld\0.17.14_0\
CHR - Extension: Google Maps = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lneaknkopdijkpnocmklfnjbeapigfbh\5.2.7_0\
CHR - Extension: Google Wallet = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_1\
CHR - Extension: ImTranslator: Google Translate = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\noaijdpnepcgjemiklgfkcfbkokogabh\2.10_0\
CHR - Extension: Picasa = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\onlgmecjpnejhfeofkgbfgnmdlipdejb\6.2.2_0\
CHR - Extension: Google Mail = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_2\
 
O1 HOSTS File: ([2014.08.12 14:33:34 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2:64bit: - BHO: (LastPass Vault) - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll ()
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (PDFXChange 4.0 IE Plugin) - {42DFA04F-0F16-418e-B80C-AB97A5AFAD39} - C:\Programme\Tracker Software\PDF-XChange 4\PXCIEAddin4.dll (Tracker Softaware)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (CIESpeechBHO Class) - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
O2 - BHO: (LastPass Vault) - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program Files (x86)\LastPass\LPToolbar.dll ()
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (LastPass Toolbar) - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll ()
O3 - HKLM\..\Toolbar: (PDFXChange 4.0 IE Plugin) - {42DFA04F-0F16-418e-B80C-AB97A5AFAD39} - C:\Programme\Tracker Software\PDF-XChange 4\PXCIEAddin4.dll (Tracker Softaware)
O3 - HKLM\..\Toolbar: (LastPass Toolbar) - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar.dll ()
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [AthBtTray] C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe (Atheros Commnucations)
O4:64bit: - HKLM..\Run: [AtherosBtStack] C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe (Atheros Communications)
O4:64bit: - HKLM..\Run: [BgDelayStartup] c:\program files\bullguard ltd\bullguard\BgDelayStartup.exe (BullGuard Ltd.)
O4:64bit: - HKLM..\Run: [BullGuard] C:\Program Files\BullGuard Ltd\BullGuard\bullguard.exe (BullGuard Ltd.)
O4:64bit: - HKLM..\Run: [BullGuardUpdate2] c:\Programme\BullGuard Ltd\BullGuard\BullGuardUpdate2.exe (BullGuard Ltd.)
O4:64bit: - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [IntelliType Pro] C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\S-1-5-21-79635218-2301998975-3311727660-1000..\Run: [CAHeadless] C:\Program Files (x86)\Adobe\Elements 12 Organizer\CAHeadless\ElementsAutoAnalyzer.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Evoluent Mouse Manager.lnk = C:\Windows\Installer\{1DF99F8F-31BC-4058-B750-DC0C86FC0038}\_97D7716B285C2208949646.exe ()
O4 - Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PhraseExpress.lnk = C:\Program Files (x86)\PhraseExpress\phraseexpress.exe (Bartels Media GmbH)
O4 - Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ProCall One.lnk = C:\Program Files (x86)\ESTOS\ProCall One\ECtiClientOne.exe (ESTOS GmbH)
O4 - Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TK-Suite Client.lnk = C:\Program Files (x86)\AGFEO\Tk-Suite\tools\ctimon.exe (AGFEO      )
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-79635218-2301998975-3311727660-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-79635218-2301998975-3311727660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-79635218-2301998975-3311727660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8:64bit: - Extra context menu item: An SchnapperPlus senden - C:\Program Files (x86)\SchnapperPlus\SchnapperPlusMenu.js ()
O8:64bit: - Extra context menu item: LastPass - file://C:\Users\Admin\AppData\LocalLow\LastPass\context.html?cmd=lastpass File not found
O8:64bit: - Extra context menu item: LastPass Fill Forms - file://C:\Users\Admin\AppData\LocalLow\LastPass\context.html?cmd=fillforms File not found
O8 - Extra context menu item: An SchnapperPlus senden - C:\Program Files (x86)\SchnapperPlus\SchnapperPlusMenu.js ()
O8 - Extra context menu item: LastPass - file://C:\Users\Admin\AppData\LocalLow\LastPass\context.html?cmd=lastpass File not found
O8 - Extra context menu item: LastPass Fill Forms - file://C:\Users\Admin\AppData\LocalLow\LastPass\context.html?cmd=fillforms File not found
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Report to BullGuard - {27FD17FB-CF63-486b-B2BE-8D8781CBEA01} - c:\Programme\BullGuard Ltd\BullGuard\Antiphishing\IE\BgAntiphishingIE.dll (BullGuard Ltd.)
O9:64bit: - Extra Button: LastPass - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll ()
O9:64bit: - Extra 'Tools' menuitem : LastPass - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll ()
O9:64bit: - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - Reg Error: Value error. File not found
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra Button: SchnapperPro - {D6243B39-211B-440E-B4C5-26D2A579CAC8} - Reg Error: Key error. File not found
O9 - Extra Button: Report to BullGuard - {27FD17FB-CF63-486b-B2BE-8D8781CBEA01} - c:\Programme\BullGuard Ltd\BullGuard\Files32\Antiphishing\IE\BgAntiphishingIE.dll (BullGuard Ltd.)
O9 - Extra Button: LastPass - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\Program Files (x86)\LastPass\LPToolbar.dll ()
O9 - Extra 'Tools' menuitem : LastPass - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\Program Files (x86)\LastPass\LPToolbar.dll ()
O9 - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
O9 - Extra Button: SchnapperPlus - {D6243B39-211B-440D-B4C5-26D2A579CAC8} - Reg Error: Key error. File not found
O9 - Extra Button: SchnapperPro - {D6243B39-211B-440E-B4C5-26D2A579CAC8} - Reg Error: Key error. File not found
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-79635218-2301998975-3311727660-1000\..Trusted Domains: fritz.box ([]* in Local intranet)
O15 - HKU\S-1-5-21-79635218-2301998975-3311727660-1000\..Trusted Ranges: Range1 ([*] in Local intranet)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{87FCBD50-A555-483F-9C0D-42278E9F207F}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D5CCB04B-1782-436A-B015-120A581C63E4}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (C:\Windows\System32\BgGamingMonitor.dll) - C:\Windows\SysNative\BgGamingMonitor.dll (BullGuard Ltd.)
O20:64bit: - AppInit_DLLs: (c:\PROGRA~1\BULLGU~1\BULLGU~1\BgAgent.dll) - c:\Programme\BullGuard Ltd\BullGuard\BgAgent.dll (BullGuard Ltd.)
O20 - AppInit_DLLs: (C:\Windows\System32\BgGamingMonitor.dll) - C:\Windows\SysWOW64\BgGamingMonitor.dll (BullGuard Ltd.)
O20 - AppInit_DLLs: (c:\PROGRA~1\BULLGU~1\BULLGU~1\Files32\BgAgent.dll) - c:\Programme\BullGuard Ltd\BullGuard\Files32\BgAgent.dll (BullGuard Ltd.)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2014.08.19 10:57:20 | 000,000,000 | ---D | M] - D:\Autosave -- [ NTFS ]
O32 - AutoRun File - [2014.08.14 21:34:12 | 000,000,000 | ---D | M] - E:\Autosave -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2014.08.19 16:43:12 | 000,000,000 | R--D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
[2014.08.19 16:38:00 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Admin\Desktop\OTL.exe
[2014.08.18 15:37:32 | 000,153,712 | ---- | C] (BullGuard Ltd.) -- C:\Windows\SysNative\BgGamingMonitor.dll
[2014.08.18 15:37:32 | 000,140,280 | ---- | C] (BullGuard Ltd.) -- C:\Windows\SysWow64\BgGamingMonitor.dll
[2014.08.18 15:37:32 | 000,076,624 | ---- | C] (BullGuard Ltd.) -- C:\Windows\SysNative\BGLsp.dll
[2014.08.18 15:37:32 | 000,064,336 | ---- | C] (BullGuard Ltd.) -- C:\Windows\SysWow64\BGLsp.dll
[2014.08.18 10:10:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2014.08.15 16:00:00 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\PackageAware
[2014.08.13 23:27:41 | 001,389,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\icardagt.exe
[2014.08.13 23:27:41 | 000,619,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\icardagt.exe
[2014.08.13 23:27:41 | 000,171,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\infocardapi.dll
[2014.08.13 23:27:41 | 000,099,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\infocardapi.dll
[2014.08.13 23:27:40 | 000,008,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\icardres.dll
[2014.08.13 23:27:40 | 000,008,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\icardres.dll
[2014.08.13 23:27:37 | 000,035,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\TsWpfWrp.exe
[2014.08.13 23:27:37 | 000,035,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\TsWpfWrp.exe
[2014.08.13 23:08:20 | 000,007,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\KBDYAK.DLL
[2014.08.13 23:08:20 | 000,007,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KBDYAK.DLL
[2014.08.13 23:08:20 | 000,007,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\KBDTAT.DLL
[2014.08.13 23:08:20 | 000,007,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KBDTAT.DLL
[2014.08.13 23:08:20 | 000,007,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KBDRU1.DLL
[2014.08.13 23:08:20 | 000,007,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KBDBASH.DLL
[2014.08.13 23:08:20 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\KBDRU1.DLL
[2014.08.13 23:08:20 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\KBDRU.DLL
[2014.08.13 23:08:20 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KBDRU.DLL
[2014.08.13 23:08:20 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\KBDBASH.DLL
[2014.08.13 23:08:17 | 003,241,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msi.dll
[2014.08.13 23:08:17 | 001,941,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\authui.dll
[2014.08.13 23:08:17 | 001,805,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\authui.dll
[2014.08.13 23:08:17 | 000,504,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msihnd.dll
[2014.08.13 23:08:17 | 000,112,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\consent.exe
[2014.08.13 23:08:16 | 000,337,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msihnd.dll
[2014.08.13 23:08:15 | 000,404,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\gdi32.dll
[2014.08.13 23:08:13 | 000,597,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9diag.dll
[2014.08.13 23:08:13 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\JavaScriptCollectionAgent.dll
[2014.08.13 23:08:13 | 000,069,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2014.08.13 23:08:13 | 000,060,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll
[2014.08.13 23:08:13 | 000,051,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieetwproxystub.dll
[2014.08.13 23:08:13 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwproxystub.dll
[2014.08.13 23:08:13 | 000,032,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2014.08.13 23:08:12 | 002,001,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2014.08.13 23:08:12 | 000,692,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2014.08.13 23:08:12 | 000,631,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2014.08.13 23:08:12 | 000,452,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll
[2014.08.13 23:08:12 | 000,438,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2014.08.13 23:08:12 | 000,111,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollector.exe
[2014.08.13 23:08:12 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2014.08.13 23:08:12 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2014.08.13 23:08:12 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollectorres.dll
[2014.08.13 23:08:11 | 002,087,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2014.08.13 23:08:11 | 001,068,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmlmedia.dll
[2014.08.13 23:08:11 | 000,112,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2014.08.13 23:08:11 | 000,066,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2014.08.13 23:08:10 | 000,704,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll
[2014.08.13 23:08:10 | 000,598,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2014.08.13 23:08:10 | 000,292,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll
[2014.08.13 23:08:10 | 000,164,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll
[2014.08.13 23:08:10 | 000,085,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2014.08.13 23:08:10 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MshtmlDac.dll
[2014.08.13 23:08:09 | 005,824,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2014.08.13 23:08:09 | 001,249,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll
[2014.08.13 23:08:09 | 000,846,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll
[2014.08.13 23:08:09 | 000,758,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9diag.dll
[2014.08.13 23:08:09 | 000,548,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2014.08.13 23:08:09 | 000,139,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2014.08.13 23:08:08 | 000,940,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe
[2014.08.13 23:08:08 | 000,195,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll
[2014.08.13 23:08:08 | 000,083,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MshtmlDac.dll
[2014.08.13 23:04:38 | 001,216,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rpcrt4.dll
[2014.08.13 23:04:37 | 000,529,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\aepdu.dll
[2014.08.13 23:04:37 | 000,424,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\aeinv.dll
[2014.08.13 16:37:23 | 000,122,584 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys
[2014.08.13 16:37:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
[2014.08.13 16:37:17 | 000,091,352 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbamchameleon.sys
[2014.08.13 16:37:17 | 000,063,704 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mwac.sys
[2014.08.13 16:37:17 | 000,025,816 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2014.08.13 16:37:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes Anti-Malware
[2014.08.12 17:56:06 | 000,000,000 | ---D | C] -- C:\FRST
[2014.08.12 16:39:54 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2014.08.10 18:29:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2014.07.30 20:25:06 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\CSV-JS
[2014.07.29 10:13:01 | 000,000,000 | --SD | C] -- C:\Users\Admin\Documents\Meine Datenquellen
[2014.07.28 20:54:10 | 000,272,808 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2014.07.28 20:54:08 | 000,175,528 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2014.07.28 20:54:08 | 000,175,528 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2014.07.28 20:54:08 | 000,098,216 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2014.07.28 20:54:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2014.07.24 20:42:11 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2014.07.24 20:37:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\VS Revo Group
[2014.07.24 20:37:55 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller
[2014.07.24 20:30:13 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\Malware
[2014.07.24 18:48:43 | 006,574,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mstscax.dll
[2014.07.24 18:48:43 | 005,694,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mstscax.dll
[2014.07.24 16:27:09 | 003,178,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorets.dll
[2014.07.24 16:27:09 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RdpGroupPolicyExtension.dll
[2014.07.24 16:17:11 | 000,019,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys
[2014.07.24 16:17:10 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpudd.dll
[2014.07.24 16:17:10 | 000,228,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpendp_winip.dll
[2014.07.24 16:17:10 | 000,192,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rdpendp_winip.dll
[2014.07.24 15:52:15 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\TsUsbGDCoInstaller.dll
[2014.07.24 15:52:14 | 001,068,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mstsc.exe
[2014.07.24 15:52:14 | 000,420,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wksprt.exe
[2014.07.24 15:52:14 | 000,083,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\TSWbPrxy.exe
[2014.07.24 15:52:14 | 000,062,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tsgqec.dll
[2014.07.24 15:52:14 | 000,056,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys
[2014.07.24 15:52:14 | 000,056,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MsRdpWebAccess.dll
[2014.07.24 15:52:14 | 000,053,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tsgqec.dll
[2014.07.24 15:52:14 | 000,050,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MsRdpWebAccess.dll
[2014.07.24 15:52:14 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wksprtPS.dll
[2014.07.24 15:52:14 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wksprtPS.dll
[2014.07.24 15:52:14 | 000,013,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\TsUsbRedirectionGroupPolicyControl.exe
[2014.07.24 15:52:14 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\TsUsbRedirectionGroupPolicyExtension.dll
[2014.07.24 15:52:13 | 001,147,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mstsc.exe
[2014.07.24 15:52:13 | 001,057,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdvidcrl.dll
[2014.07.24 15:52:13 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rdvidcrl.dll
[2014.07.24 15:15:15 | 001,030,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\TSWorkspace.dll
[2014.07.24 15:15:15 | 000,792,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\TSWorkspace.dll
[2014.07.24 14:38:24 | 000,000,000 | --SD | C] -- C:\Windows\SysWow64\Microsoft
 
========== Files - Modified Within 30 Days ==========
 
[2014.08.19 16:49:00 | 001,637,932 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2014.08.19 16:49:00 | 000,702,942 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2014.08.19 16:49:00 | 000,661,426 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2014.08.19 16:49:00 | 000,150,582 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2014.08.19 16:49:00 | 000,127,046 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2014.08.19 16:47:00 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2014.08.19 16:45:05 | 000,000,512 | ---- | M] () -- C:\Windows\SysNative\F39D4DE6-98B8-4E05-91BD-549E8A8248BD
[2014.08.19 16:43:10 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2014.08.19 16:43:05 | 000,000,035 | ---- | M] () -- C:\Users\Public\Documents\AtherosServiceConfig.ini
[2014.08.19 16:43:02 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2014.08.19 16:43:00 | 2129,084,415 | -HS- | M] () -- C:\hiberfil.sys
[2014.08.19 16:38:00 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Admin\Desktop\OTL.exe
[2014.08.19 16:29:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2014.08.19 16:29:00 | 000,000,338 | ---- | M] () -- C:\Windows\tasks\HP Photo Creations Communicator.job
[2014.08.19 15:46:14 | 000,032,368 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2014.08.19 15:46:14 | 000,032,368 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2014.08.19 15:37:18 | 006,305,968 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2014.08.18 15:37:29 | 000,076,624 | ---- | M] (BullGuard Ltd.) -- C:\Windows\SysNative\BGLsp.dll
[2014.08.18 15:37:29 | 000,064,336 | ---- | M] (BullGuard Ltd.) -- C:\Windows\SysWow64\BGLsp.dll
[2014.08.18 15:37:28 | 000,140,280 | ---- | M] (BullGuard Ltd.) -- C:\Windows\SysWow64\BgGamingMonitor.dll
[2014.08.18 15:37:27 | 000,153,712 | ---- | M] (BullGuard Ltd.) -- C:\Windows\SysNative\BgGamingMonitor.dll
[2014.08.15 16:00:02 | 000,000,372 | ---- | M] () -- C:\Windows\tasks\yourMail free edition Updates for Admin-PC_Admin.job
[2014.08.14 21:24:53 | 000,122,584 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys
[2014.08.12 14:33:34 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2014.08.07 04:06:41 | 000,529,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\aepdu.dll
[2014.08.07 04:01:34 | 000,424,448 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\aeinv.dll
[2014.07.28 20:54:03 | 000,272,808 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2014.07.28 20:54:03 | 000,175,528 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2014.07.28 20:54:03 | 000,175,528 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2014.07.28 20:54:03 | 000,098,216 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2014.07.28 09:12:35 | 000,000,146 | ---- | M] () -- C:\Users\Admin\Desktop\Internetoptionen - Verknüpfung.lnk
[2014.07.25 16:01:41 | 000,004,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollectorres.dll
[2014.07.25 15:30:30 | 000,066,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2014.07.25 15:28:35 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwproxystub.dll
[2014.07.25 15:28:27 | 000,548,352 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2014.07.25 15:25:45 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\MshtmlDac.dll
[2014.07.25 15:10:00 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2014.07.25 15:03:50 | 000,598,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2014.07.25 15:00:51 | 000,139,264 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2014.07.25 15:00:25 | 000,111,616 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollector.exe
[2014.07.25 14:59:28 | 000,758,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9diag.dll
[2014.07.25 14:47:25 | 000,940,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe
[2014.07.25 14:40:12 | 000,452,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll
[2014.07.25 14:34:49 | 000,061,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2014.07.25 14:33:08 | 000,051,200 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieetwproxystub.dll
[2014.07.25 14:30:32 | 000,061,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\MshtmlDac.dll
[2014.07.25 14:28:15 | 005,824,512 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2014.07.25 14:28:05 | 000,072,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\JavaScriptCollectionAgent.dll
[2014.07.25 14:19:18 | 000,195,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll
[2014.07.25 14:17:33 | 000,032,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2014.07.25 14:17:26 | 000,085,504 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2014.07.25 14:15:32 | 000,000,076 | ---- | M] () -- C:\Windows\SETSCAN.INI
[2014.07.25 14:12:35 | 000,438,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2014.07.25 14:10:53 | 000,292,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll
[2014.07.25 14:10:15 | 000,112,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2014.07.25 14:08:47 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9diag.dll
[2014.07.25 13:47:50 | 000,631,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2014.07.25 13:43:16 | 000,060,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll
[2014.07.25 13:42:31 | 000,692,736 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2014.07.25 13:39:29 | 002,087,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2014.07.25 13:39:25 | 001,249,280 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll
[2014.07.25 13:36:30 | 000,164,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll
[2014.07.25 13:34:04 | 000,069,632 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2014.07.25 13:07:49 | 002,001,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2014.07.25 13:07:10 | 001,068,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmlmedia.dll
[2014.07.25 12:17:47 | 000,846,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll
[2014.07.25 12:09:19 | 000,704,512 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll
[2014.07.24 14:35:27 | 001,354,223 | ---- | M] () -- C:\AdwCleaner(17).exe
 
========== Files Created - No Company Name ==========
 
[2014.08.19 16:45:05 | 000,000,512 | ---- | C] () -- C:\Windows\SysNative\F39D4DE6-98B8-4E05-91BD-549E8A8248BD
[2014.07.28 09:12:35 | 000,000,146 | ---- | C] () -- C:\Users\Admin\Desktop\Internetoptionen - Verknüpfung.lnk
[2014.07.24 14:54:23 | 004,009,167 | ---- | C] () -- C:\ServicesRepair.exe
[2014.07.24 14:54:06 | 001,354,223 | ---- | C] () -- C:\AdwCleaner(17).exe
[2014.05.04 22:20:36 | 000,252,027 | ---- | C] () -- C:\Windows\hpwins21.dat
[2014.05.04 22:20:36 | 000,000,575 | ---- | C] () -- C:\Windows\hpwmdl21.dat
[2014.03.26 11:23:30 | 000,001,456 | ---- | C] () -- C:\Users\Admin\AppData\Local\Adobe Für Web speichern 12.0 Prefs
[2014.02.14 10:13:56 | 158,105,199 | ---- | C] () -- C:\Users\Admin\AppData\Local\ACCCx2_4_1_351.zip.aamdownload
[2014.02.14 10:13:56 | 000,001,943 | ---- | C] () -- C:\Users\Admin\AppData\Local\ACCCx2_4_1_351.zip.aamdownload.aamd
[2013.12.26 16:25:09 | 000,000,132 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\Adobe CS5-Voreinstellungen für BMP-Format
[2013.10.17 18:25:09 | 000,000,076 | ---- | C] () -- C:\Windows\SETSCAN.INI
[2013.08.09 10:57:03 | 000,006,656 | ---- | C] () -- C:\Users\Admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013.07.27 20:01:54 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013.07.27 20:01:54 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013.07.27 20:01:54 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013.07.27 20:01:54 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013.07.27 20:01:54 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013.06.27 18:05:28 | 145,388,814 | ---- | C] () -- C:\Users\Admin\AppData\Local\ACCCx183.zip.aamdownload
[2013.06.27 18:05:28 | 000,001,811 | ---- | C] () -- C:\Users\Admin\AppData\Local\ACCCx183.zip.aamdownload.aamd
[2012.11.30 17:03:00 | 000,002,560 | ---- | C] () -- C:\Windows\_MSRSTRT.EXE
[2012.11.12 21:04:39 | 000,038,431 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\Kommagetrennte Werte (Windows).ADR
[2012.11.10 21:02:10 | 000,012,963 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\Kommagetrennte Werte (Windows).CAL
[2012.11.06 19:13:11 | 000,012,959 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\Kommagetrennte Werte (DOS).CAL
[2012.09.26 21:57:14 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2012.09.26 21:57:14 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2012.09.26 21:57:14 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2012.09.26 21:57:14 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2014.06.25 04:05:42 | 014,175,744 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2014.06.25 03:41:30 | 012,874,240 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2014.03.05 12:10:58 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\2404
[2014.04.01 15:30:26 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\24486
[2014.03.19 15:48:16 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\30098
[2012.08.09 21:27:53 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\6C7ABAED-16CE-4F62-AF45-9E84302346F5
[2012.08.11 20:37:46 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\AceBIT
[2012.08.09 21:24:08 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Acronis
[2012.08.14 11:03:22 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\AGFEO
[2012.12.11 20:49:24 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Ashampoo
[2014.03.12 20:54:57 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Ashampoo Slideshow Studio HD 3
[2012.09.19 20:27:09 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Avery
[2014.06.23 18:30:10 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\BayWotch4
[2014.07.25 08:13:07 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\BullGuard
[2013.01.26 21:15:37 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Canneverbe Limited
[2013.02.27 19:52:15 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2013.02.27 17:53:45 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
[2013.09.01 20:31:17 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\ComCenter
[2012.08.14 18:03:21 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\DasTelefonbuch Deutschland
[2014.04.01 15:31:42 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\DVDFab9
[2013.11.14 11:57:45 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\ESM-Tools
[2014.03.11 15:57:11 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\ESTOS
[2013.10.31 22:22:21 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\EurekaLab s.a.s
[2012.08.09 09:53:12 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Firetrust
[2014.04.29 10:34:31 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Foxit Scanner Images
[2013.11.28 23:12:10 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Foxit Software
[2013.05.30 20:53:35 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\FreeCommander
[2013.03.31 18:16:51 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\FreeFileSync
[2014.02.26 21:09:02 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\GoContactSyncMOD
[2014.03.09 18:56:58 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\IrfanView
[2013.10.11 15:59:40 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\ISIS Drivers
[2013.10.17 20:42:11 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\MOBackup
[2012.09.03 18:13:29 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Music Wizard
[2014.02.11 21:11:00 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\No Company Name
[2014.05.08 09:33:06 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\onOne Software
[2012.08.08 17:08:41 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Opera
[2013.02.27 18:34:15 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\PACE Anti-Piracy
[2013.02.27 18:52:01 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\PDAppFlex
[2014.07.25 14:00:14 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\PhraseExpress
[2013.06.30 12:30:34 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Q-Dir
[2012.11.20 18:23:10 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Samsung
[2014.06.22 14:02:29 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\SchnapperPlus
[2012.10.09 14:13:02 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\SmartTools
[2013.10.03 18:21:28 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\SumatraPDF
[2013.02.01 14:58:02 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\TeamViewer
[2013.11.06 15:19:28 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Tracker Software
[2012.08.14 18:03:21 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\TVG
[2013.11.05 16:29:58 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Visan
[2014.03.11 13:04:15 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Wacom
[2014.01.25 17:27:50 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\wacomid-desktop-launcher
[2012.08.09 10:35:06 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\yourTime
 
========== Purity Check ==========
 
 

< End of report >


cosinus 19.08.2014 17:18

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

C:\Users\Admin\AppData\Roaming\2404
C:\Users\Admin\AppData\Roaming\24486
C:\Users\Admin\AppData\Roaming\30098


Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.


weti 19.08.2014 18:14


FRST Logfile:
Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-08-2014 01
Ran by Admin (administrator) on ADMIN-PC on 19-08-2014 19:13:33
Running from C:\Users\Admin\Desktop
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(AVM Berlin) C:\Program Files (x86)\avmwlanstick\WLanNetService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(BullGuard Ltd.) C:\Program Files\BullGuard Ltd\BullGuard\BullGuard.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
(BullGuard Ltd.) C:\Program Files\BullGuard Ltd\BullGuard\BullGuardBhvScanner.exe
(BullGuard Ltd.) C:\Program Files\BullGuard Ltd\BullGuard\BullGuardScanner.exe
(BullGuard Ltd.) C:\Program Files\BullGuard Ltd\BullGuard\BullGuardUpdate.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(REINER SCT) C:\Windows\SysWOW64\cjpcsc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Nalpeiron Ltd.) C:\Windows\SysWOW64\nlssrv32.exe
(Star Finanz-Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe
(Evoluent) C:\Program Files\Evoluent\VMouse\EvoMouseExec.exe
(Bartels Media GmbH) C:\Program Files (x86)\PhraseExpress\phraseexpress.exe
(Tlapia) C:\Program Files (x86)\sysTPL\sysTPLMonitor.exe
(ESTOS GmbH) C:\Program Files (x86)\ESTOS\ProCall One\ECtiClientOne.exe
(AGFEO      ) C:\Program Files (x86)\AGFEO\Tk-Suite\tools\ctimon.exe
(AGFEO      ) C:\Program Files (x86)\AGFEO\Tk-Suite\tkserver\tksock.exe
() C:\Program Files (x86)\TVG\OnlineUpdate\OnlineUpdateSvc.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(AGFEO      ) C:\Program Files (x86)\AGFEO\Tk-Suite\tkserver\tkmedia.exe
() C:\Program Files (x86)\WizMouse\WizMouse.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(BullGuard Ltd.) C:\Program Files\BullGuard Ltd\BullGuard\Files32\Spamfilter\LittleHook.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Opera Software) C:\Program Files (x86)\Opera\opera.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Tlapia) C:\Program Files (x86)\sysTPL\sysTPLService.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 12 Organizer\PhotoshopElementsFileAgent.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [BullGuardUpdate2] => c:\program files\bullguard ltd\bullguard\BullGuardUpdate2.exe [2933584 2014-08-18] (BullGuard Ltd.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11613288 2010-11-19] (Realtek Semiconductor)
HKLM\...\Run: [IntelliType Pro] => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [1464944 2012-11-02] (Microsoft Corporation)
HKLM\...\Run: [IntelliPoint] => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2076272 2012-11-02] (Microsoft Corporation)
HKLM\...\Run: [BullGuard] => C:\Program Files\BullGuard Ltd\BullGuard\bullguard.exe [1324368 2014-08-18] (BullGuard Ltd.)
HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [613536 2010-10-27] (Atheros Communications)
HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [379040 2010-10-27] (Atheros Commnucations)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472984 2013-06-03] (Adobe Systems Incorporated)
HKLM\...\Run: [BgDelayStartup] => c:\program files\bullguard ltd\bullguard\BgDelayStartup.exe [86352 2014-08-18] (BullGuard Ltd.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-08-25] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [JMB36X IDE Setup] => C:\Windows\RaidTool\xInsIDE.exe [43632 2010-01-19] ()
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKU\S-1-5-21-79635218-2301998975-3311727660-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.)
HKU\S-1-5-21-79635218-2301998975-3311727660-1000\...\Run: [CAHeadless] => C:\Program Files (x86)\Adobe\Elements 12 Organizer\CAHeadless\ElementsAutoAnalyzer.exe [1401040 2014-05-09] (Adobe Systems Incorporated)
AppInit_DLLs: C:\Windows\System32\BgGamingMonitor.dll => C:\Windows\System32\BgGamingMonitor.dll [153712 2014-08-18] (BullGuard Ltd.)
AppInit_DLLs:  c:\PROGRA~1\BULLGU~1\BULLGU~1\BgAgent.dll => c:\Program Files\BullGuard Ltd\BullGuard\BgAgent.dll [100656 2014-07-31] (BullGuard Ltd.)
AppInit_DLLs-x32: C:\Windows\System32\BgGamingMonitor.dll => C:\Windows\SysWOW64\BgGamingMonitor.dll [140280 2014-08-18] (BullGuard Ltd.)
AppInit_DLLs-x32:  c:\PROGRA~1\BULLGU~1\BULLGU~1\Files32\BgAgent.dll => c:\Program Files\BullGuard Ltd\BullGuard\Files32\BgAgent.dll [86200 2014-07-31] (BullGuard Ltd.)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Evoluent Mouse Manager.lnk
ShortcutTarget: Evoluent Mouse Manager.lnk -> C:\Windows\Installer\{1DF99F8F-31BC-4058-B750-DC0C86FC0038}\_97D7716B285C2208949646.exe ()
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PhraseExpress.lnk
ShortcutTarget: PhraseExpress.lnk -> C:\Program Files (x86)\PhraseExpress\phraseexpress.exe (Bartels Media GmbH)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ProCall One.lnk
ShortcutTarget: ProCall One.lnk -> C:\Program Files (x86)\ESTOS\ProCall One\ECtiClientOne.exe (ESTOS GmbH)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TK-Suite Client.lnk
ShortcutTarget: TK-Suite Client.lnk -> C:\Program Files (x86)\AGFEO\Tk-Suite\tools\ctimon.exe (AGFEO      )
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Evoluent Mouse Manager.lnk
ShortcutTarget: Evoluent Mouse Manager.lnk -> C:\Windows\Installer\{1DF99F8F-31BC-4058-B750-DC0C86FC0038}\_97D7716B285C2208949646.exe ()
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PhraseExpress.lnk
ShortcutTarget: PhraseExpress.lnk -> C:\Program Files (x86)\PhraseExpress\phraseexpress.exe (Bartels Media GmbH)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ProCall One.lnk
ShortcutTarget: ProCall One.lnk -> C:\Program Files (x86)\ESTOS\ProCall One\ECtiClientOne.exe (ESTOS GmbH)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TK-Suite Client.lnk
ShortcutTarget: TK-Suite Client.lnk -> C:\Program Files (x86)\AGFEO\Tk-Suite\tools\ctimon.exe (AGFEO      )
ShellIconOverlayIdentifiers: BackupOverlayErr -> {8749448C-D907-45BF-A842-4D3898894AC8} => C:\Program Files\BullGuard Ltd\BullGuard\BackupShellHook.dll (BullGuard Ltd.)
ShellIconOverlayIdentifiers: BackupOverlayInProgress -> {3FFBF330-7839-476B-BE14-2C8597CE11B6} => C:\Program Files\BullGuard Ltd\BullGuard\BackupShellHook.dll (BullGuard Ltd.)
ShellIconOverlayIdentifiers: BackupOverlaySynced -> {C62CF4DB-48CB-4B03-BFD0-30A29125FA49} => C:\Program Files\BullGuard Ltd\BullGuard\BackupShellHook.dll (BullGuard Ltd.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:8878;https=127.0.0.1:8878
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x954321BBB774CD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: LastPass Vault -> {95D9ECF5-2A4D-4550-BE49-70D42F71296E} -> C:\Program Files (x86)\LastPass\LPToolbar_x64.dll ()
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: PDFXChange 4.0 IE Plugin -> {42DFA04F-0F16-418e-B80C-AB97A5AFAD39} -> C:\Program Files\Tracker Software\PDF-XChange 4\PXCIEAddin4.dll (Tracker Softaware)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: LastPass Vault -> {95D9ECF5-2A4D-4550-BE49-70D42F71296E} -> C:\Program Files (x86)\LastPass\LPToolbar.dll ()
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll ()
Toolbar: HKLM-x32 - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar.dll ()
Toolbar: HKLM-x32 - PDFXChange 4.0 IE Plugin - {42DFA04F-0F16-418e-B80C-AB97A5AFAD39} - C:\Program Files\Tracker Software\PDF-XChange 4\PXCIEAddin4.dll (Tracker Softaware)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default
FF DefaultSearchEngine: Startpage HTTPS - Deutsch
FF SelectedSearchEngine: Startpage HTTPS - Deutsch
FF Homepage: https://www.google.de/?gws_rd=ssl
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll No File
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 -> C:\ProgramData\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin HKCU: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll No File
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default\searchplugins\acoon.xml
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default\searchplugins\search_engine.xml
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default\searchplugins\startpage-https---deutsch.xml
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default\searchplugins\wolframalpha.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: LastPass - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default\Extensions\support@lastpass.com [2014-08-19]
FF Extension: Autocopy - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default\Extensions\{0FED7D55-65D4-47b6-A6DE-9A4ADB55355F} [2013-01-07]
FF Extension: FireGestures - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default\Extensions\firegestures@xuldev.org.xpi [2012-08-09]
FF Extension: Secure Login - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default\Extensions\secureLogin@blueimp.net.xpi [2012-08-16]
FF Extension: Tile Tabs - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default\Extensions\tiletabs@DW-dev.xpi [2014-05-06]
FF Extension: FootieFox - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default\Extensions\{9fb7d178-155a-4318-9173-1a8eaaea7fe4}.xpi [2014-08-15]
FF Extension: BetterPrivacy - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2012-09-17]
FF HKLM-x32\...\Firefox\Extensions: [antiphishing@bullguard] - c:\program files\bullguard ltd\bullguard\Files32\Antiphishing\FF\antiphishing@bullguard
FF Extension: BullGuard Safe Browsing - c:\program files\bullguard ltd\bullguard\Files32\Antiphishing\FF\antiphishing@bullguard [2013-07-29]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-05-04]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

Chrome:
=======
CHR HomePage: hxxp://www.netvibes.com/privatepage/4#Home
CHR StartupUrls: "hxxp://blog.24stundenbetreut.com/", "chrome-extension://jkkenjlnjfemconejajakbijbheoffli/chrome/sidebar.html?v=__YOONO_BUILD__"
CHR DefaultSuggestURL: {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter}
CHR Extension: (Google Docs) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-07-28]
CHR Extension: (Google Drive) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-07-23]
CHR Extension: (https://translate.google.de/#pl/de/Kochany%20) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkmlelhnmpnjbijdijnmagddkjnjkihn [2014-07-28]
CHR Extension: (YouTube) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-07-23]
CHR Extension: (Google-Suche) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-07-23]
CHR Extension: (Google Kalender) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjicmeblgpmajnghnpcppodonldlgfn [2014-07-28]
CHR Extension: (LastPass: Free Password Manager) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd [2014-07-28]
CHR Extension: (Yoono - Twitter, Facebook, LinkedIn, YouTube™) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jkkenjlnjfemconejajakbijbheoffli [2014-07-28]
CHR Extension: (Smooth Gestures) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfkgmnnajiljnolcgolmmgnecgldgeld [2014-07-28]
CHR Extension: (Google Maps) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lneaknkopdijkpnocmklfnjbeapigfbh [2014-07-28]
CHR Extension: (Google Wallet) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-07-23]
CHR Extension: (ImTranslator: Google Translate) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\noaijdpnepcgjemiklgfkcfbkokogabh [2014-07-28]
CHR Extension: (Picasa) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\onlgmecjpnejhfeofkgbfgnmdlipdejb [2014-07-28]
CHR Extension: (Google Mail) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-07-23]
CHR HKLM-x32\...\Chrome\Extension: [hdokiejnpimakedhajhdlcegeplioahd] - C:\Program Files (x86)\LastPass\lpchrome.crx [2012-08-28]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdobeActiveFileMonitor12.0; C:\Program Files (x86)\Adobe\Elements 12 Organizer\PhotoshopElementsFileAgent.exe [181152 2013-09-03] (Adobe Systems Incorporated)
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [52896 2010-10-27] (Atheros Commnucations) [File not signed]
R2 AVM WLAN Connection Service; C:\Program Files (x86)\avmwlanstick\WlanNetService.exe [376832 2010-10-22] (AVM Berlin) [File not signed]
R2 BsBackup; c:\program files\bullguard ltd\bullguard\BsBackup.dll [729936 2014-08-18] (BullGuard Ltd.)
R2 BsBhvScan; c:\program files\bullguard ltd\bullguard\BullGuardBhvScanner.exe [531280 2014-08-18] (BullGuard Ltd.)
R2 BsCache; c:\program files\bullguard ltd\bullguard\BsCache.dll [145232 2014-08-18] (BullGuard Ltd.)
R2 BsFileScan; c:\program files\bullguard ltd\bullguard\BsFileScan.dll [420176 2014-08-18] (BullGuard Ltd.)
R2 BsFire; c:\program files\bullguard ltd\bullguard\BsFire.dll [767312 2014-08-18] (BullGuard Ltd.)
R2 BsMailProxy; c:\program files\bullguard ltd\bullguard\BsMailProxy\BsMailProxy.dll [750416 2014-08-18] (BullGuard Ltd.)
R2 BsMain; c:\program files\bullguard ltd\bullguard\bsmain.dll [507728 2014-08-18] (BullGuard Ltd.)
R2 BsScanner; c:\program files\bullguard ltd\bullguard\BullGuardScanner.exe [281424 2014-08-18] (BullGuard Ltd.)
R2 BsUpdate; c:\program files\bullguard ltd\bullguard\BullGuardUpdate.exe [366928 2014-08-18] (BullGuard Ltd.)
R2 cjpcsc; C:\Windows\SysWOW64\cjpcsc.exe [514128 2012-03-19] (REINER SCT)
R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1039360 2010-10-22] (Hewlett-Packard Co.) [File not signed]
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
R2 StarMoney 9.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe [697488 2014-07-04] (Star Finanz-Software Entwicklung und Vertriebs GmbH)
R2 sysTPLMonitor.exe; C:\Program Files (x86)\sysTPL\sysTPLMonitor.exe [399640 2014-02-07] (Tlapia)
R2 sysTPLService.exe; C:\Program Files (x86)\sysTPL\sysTPLService.exe [397080 2013-09-29] (Tlapia)
R2 tksock; C:\Program Files (x86)\AGFEO\Tk-Suite\tkserver\tksock.exe [2220664 2013-08-20] (AGFEO      )
R2 TVGOnlineUpdateSvc; C:\Program Files (x86)\TVG\OnlineUpdate\OnlineUpdateSvc.exe [398128 2010-12-14] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 AFW; C:\Windows\System32\DRIVERS\afw.sys [42760 2014-05-19] (Agnitum Ltd.)
R3 afwcore; C:\Windows\System32\DRIVERS\afwcore.sys [469256 2014-05-19] (Agnitum Ltd.)
R3 AVMCOWAN; C:\Windows\System32\DRIVERS\AVMCOWAN.sys [79872 2009-06-10] (AVM GmbH)
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2010-10-22] (AVM Berlin)
R1 BdAgent; C:\Windows\System32\DRIVERS\BdAgent.sys [117184 2014-05-28] (BullGuard Ltd.)
R3 BdNet; C:\Windows\System32\drivers\BdNet.sys [34896 2014-05-19] (BullGuard Ltd.)
R1 BdSpy; C:\Windows\System32\drivers\BdSpy.sys [67680 2014-05-19] (BullGuard Ltd.)
R3 cjusb; C:\Windows\System32\DRIVERS\cjusb.sys [34672 2011-03-29] (REINER SCT)
R3 EvoMouseDriverFilterHidUsb; C:\Windows\System32\DRIVERS\EvoMouseDriverFilterHidUsb.sys [25656 2010-06-23] (Evoluent)
R3 EvoMouseDriverMini; C:\Windows\System32\drivers\EvoMouseDriverMini.sys [22584 2010-06-23] ()
R3 FPCIBASE; C:\Windows\System32\DRIVERS\fpcibase.sys [899328 2009-06-10] (AVM Berlin)
S3 fwlanusb4; C:\Windows\System32\DRIVERS\fwlanusb4.sys [1293824 2010-10-22] (AVM GmbH)
R1 NovaShieldFilterDriver; C:\Windows\System32\DRIVERS\NSKernel.sys [296368 2014-05-19] (BullGuard Ltd.)
R1 NovaShieldTDIDriver; C:\Windows\System32\DRIVERS\NSNetmon.sys [27544 2014-05-19] (BullGuard Ltd.)
R0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2012-08-10] (Corel Corporation)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [27520 2007-05-14] (Research In Motion Limited)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [350160 2013-01-25] (BitDefender S.R.L.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-19 19:13 - 2014-08-19 19:13 - 00028215 _____ () C:\Users\Admin\Desktop\FRST.txt
2014-08-19 19:12 - 2014-08-19 19:12 - 00000111 _____ () C:\Users\Admin\Desktop\Fixlist.txt
2014-08-19 16:52 - 2014-08-19 16:52 - 00139892 _____ () C:\Users\Admin\Desktop\OTL.Txt
2014-08-19 16:52 - 2014-08-19 16:52 - 00057124 _____ () C:\Users\Admin\Desktop\Extras.Txt
2014-08-19 16:45 - 2014-08-19 16:45 - 00000512 _____ () C:\Windows\system32\F39D4DE6-98B8-4E05-91BD-549E8A8248BD
2014-08-19 16:43 - 2014-08-19 16:43 - 00000000 ___RD () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2014-08-18 15:37 - 2014-08-18 15:37 - 00153712 _____ (BullGuard Ltd.) C:\Windows\system32\BgGamingMonitor.dll
2014-08-18 15:37 - 2014-08-18 15:37 - 00140280 _____ (BullGuard Ltd.) C:\Windows\SysWOW64\BgGamingMonitor.dll
2014-08-18 15:37 - 2014-08-18 15:37 - 00076624 _____ (BullGuard Ltd.) C:\Windows\system32\BGLsp.dll
2014-08-18 15:37 - 2014-08-18 15:37 - 00064336 _____ (BullGuard Ltd.) C:\Windows\SysWOW64\BGLsp.dll
2014-08-18 10:10 - 2014-08-18 10:10 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-08-15 16:00 - 2014-08-15 16:00 - 00000000 ____D () C:\Users\Admin\AppData\Local\PackageAware
2014-08-14 19:47 - 2014-08-19 09:49 - 00000784 _____ () C:\Windows\PFRO.log
2014-08-14 19:36 - 2014-08-19 16:43 - 00000784 _____ () C:\Windows\setupact.log
2014-08-14 19:36 - 2014-08-14 19:36 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-13 23:27 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-13 23:27 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-13 23:27 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-13 23:27 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-13 23:27 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-13 23:27 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-13 23:27 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-13 23:27 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-13 23:08 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-13 23:08 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-13 23:08 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-13 23:08 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-13 23:08 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-13 23:08 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-13 23:08 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-13 23:08 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-13 23:08 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-13 23:08 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-13 23:08 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-13 23:08 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-13 23:08 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-13 23:08 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-13 23:08 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-13 23:08 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-13 23:08 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-13 23:08 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-13 23:08 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-13 23:08 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-13 23:08 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-13 23:08 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-13 23:08 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-08-13 23:08 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-08-13 23:08 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-13 23:08 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-13 23:08 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-13 23:08 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-13 23:08 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-13 23:08 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-13 23:08 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-13 23:08 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-13 23:08 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-13 23:08 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-13 23:08 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-08-13 23:08 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-13 23:08 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-13 23:08 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-13 23:08 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-13 23:08 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-13 23:08 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-13 23:08 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-13 23:08 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-13 23:08 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-13 23:08 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-13 23:08 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-13 23:08 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-13 23:08 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-13 23:08 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-08-13 23:08 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-13 23:08 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-13 23:08 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-13 23:08 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-13 23:08 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-08-13 23:08 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-13 23:08 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-13 23:08 - 2014-07-16 05:25 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-13 23:08 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-13 23:08 - 2014-07-16 04:46 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-13 23:08 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-13 23:08 - 2014-07-16 04:12 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-13 23:08 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-08-13 23:08 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-08-13 23:08 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-08-13 23:08 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-08-13 23:08 - 2014-07-09 04:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-08-13 23:08 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-08-13 23:08 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-08-13 23:08 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-08-13 23:08 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-08-13 23:08 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-08-13 23:08 - 2014-07-09 00:38 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-08-13 23:08 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-08-13 23:08 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-08-13 23:08 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-08-13 23:08 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-13 23:08 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-13 23:08 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-13 23:08 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-13 23:08 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-13 23:08 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-13 23:08 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-13 23:08 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-13 23:04 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-13 23:04 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-13 23:04 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-13 23:04 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-13 16:37 - 2014-08-14 21:24 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-13 16:37 - 2014-08-13 16:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-13 16:37 - 2014-08-13 16:37 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-08-13 16:37 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-13 16:37 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-13 16:37 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-12 17:56 - 2014-08-19 19:13 - 00000000 ____D () C:\FRST
2014-08-12 17:54 - 2014-08-19 15:10 - 02101760 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe
2014-08-12 16:48 - 2014-08-12 16:48 - 00000081 _____ () C:\Users\Admin\Desktop\bsi.txt
2014-08-12 16:39 - 2014-08-12 16:39 - 00031682 _____ () C:\ComboFix.txt
2014-08-10 18:29 - 2014-08-10 18:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-07-30 20:25 - 2014-07-30 20:28 - 00000000 ____D () C:\Users\Admin\Desktop\CSV-JS
2014-07-29 10:13 - 2014-07-29 10:13 - 00000000 ___SD () C:\Users\Admin\Documents\Meine Datenquellen
2014-07-28 20:54 - 2014-07-28 20:54 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-07-28 20:54 - 2014-07-28 20:54 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-07-28 20:54 - 2014-07-28 20:54 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-07-28 20:54 - 2014-07-28 20:54 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-07-28 20:54 - 2014-07-28 20:54 - 00000000 ____D () C:\Program Files (x86)\Java
2014-07-28 09:12 - 2014-07-28 09:12 - 00000146 _____ () C:\Users\Admin\Desktop\Internetoptionen - Verknüpfung.lnk
2014-07-25 16:54 - 2014-07-25 17:38 - 00004858 _____ () C:\dvdfab_burn_vso.log
2014-07-24 20:42 - 2014-07-24 20:42 - 00000000 ____D () C:\Windows\ERUNT
2014-07-24 20:37 - 2014-07-24 20:37 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-07-24 20:30 - 2014-08-19 16:38 - 00000000 ____D () C:\Users\Admin\Desktop\Malware
2014-07-24 18:48 - 2014-01-09 04:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-07-24 18:48 - 2014-01-04 00:44 - 06574592 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-07-24 16:27 - 2014-05-08 11:32 - 03178496 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-07-24 16:27 - 2014-05-08 11:32 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2014-07-24 16:17 - 2012-08-23 16:13 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2014-07-24 16:17 - 2012-08-23 16:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2014-07-24 16:17 - 2012-08-23 13:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll
2014-07-24 16:17 - 2012-08-23 12:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll
2014-07-24 15:52 - 2013-10-02 04:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2014-07-24 15:52 - 2013-10-02 04:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2014-07-24 15:52 - 2013-10-02 04:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2014-07-24 15:52 - 2013-10-02 03:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2014-07-24 15:52 - 2013-10-02 03:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2014-07-24 15:52 - 2013-10-02 03:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-07-24 15:52 - 2013-10-02 03:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2014-07-24 15:52 - 2013-10-02 02:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2014-07-24 15:52 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll
2014-07-24 15:52 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll
2014-07-24 15:52 - 2013-10-02 02:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2014-07-24 15:52 - 2013-10-02 02:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2014-07-24 15:52 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2014-07-24 15:52 - 2013-10-02 01:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-07-24 15:52 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2014-07-24 15:52 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-07-24 15:15 - 2013-09-25 04:23 - 01030144 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-07-24 15:15 - 2013-09-25 03:57 - 00792576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-07-24 14:54 - 2014-07-24 14:35 - 01354223 _____ () C:\AdwCleaner(17).exe
2014-07-24 14:54 - 2013-07-14 17:32 - 04009167 _____ () C:\ServicesRepair.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-19 19:13 - 2014-08-19 19:13 - 00028215 _____ () C:\Users\Admin\Desktop\FRST.txt
2014-08-19 19:13 - 2014-08-12 17:56 - 00000000 ____D () C:\FRST
2014-08-19 19:13 - 2013-07-29 10:57 - 00000000 ____D () C:\ProgramData\BullGuard
2014-08-19 19:12 - 2014-08-19 19:12 - 00000111 _____ () C:\Users\Admin\Desktop\Fixlist.txt
2014-08-19 19:11 - 2012-08-08 17:43 - 00000000 ____D () C:\Users\Admin\Documents\Outlook-Dateien
2014-08-19 18:47 - 2012-08-23 11:08 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-19 18:43 - 2012-08-09 13:28 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Skype
2014-08-19 18:29 - 2013-11-05 16:29 - 00000338 _____ () C:\Windows\Tasks\HP Photo Creations Communicator.job
2014-08-19 18:29 - 2012-08-08 09:58 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-19 16:52 - 2014-08-19 16:52 - 00139892 _____ () C:\Users\Admin\Desktop\OTL.Txt
2014-08-19 16:52 - 2014-08-19 16:52 - 00057124 _____ () C:\Users\Admin\Desktop\Extras.Txt
2014-08-19 16:52 - 2009-07-14 06:45 - 00032368 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-19 16:52 - 2009-07-14 06:45 - 00032368 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-19 16:49 - 2010-11-21 08:50 - 00702942 _____ () C:\Windows\system32\perfh007.dat
2014-08-19 16:49 - 2010-11-21 08:50 - 00150582 _____ () C:\Windows\system32\perfc007.dat
2014-08-19 16:49 - 2009-07-14 07:13 - 01637932 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-19 16:47 - 2012-08-07 17:37 - 01792372 _____ () C:\Windows\WindowsUpdate.log
2014-08-19 16:45 - 2014-08-19 16:45 - 00000512 _____ () C:\Windows\system32\F39D4DE6-98B8-4E05-91BD-549E8A8248BD
2014-08-19 16:43 - 2014-08-19 16:43 - 00000000 ___RD () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2014-08-19 16:43 - 2014-08-14 19:36 - 00000784 _____ () C:\Windows\setupact.log
2014-08-19 16:43 - 2014-06-24 10:32 - 00003608 _____ () C:\Windows\System32\Tasks\WizMouse
2014-08-19 16:43 - 2012-08-23 11:08 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-19 16:43 - 2012-08-07 17:47 - 00000035 _____ () C:\Users\Public\Documents\AtherosServiceConfig.ini
2014-08-19 16:43 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-19 16:42 - 2012-08-08 17:46 - 00000000 ____D () C:\Users\Admin\Documents\PhraseExpress
2014-08-19 16:42 - 2012-08-08 17:05 - 00238596 _____ () C:\Windows\system32\config\afw_db.conf
2014-08-19 16:42 - 2012-08-08 17:05 - 00000224 _____ () C:\Windows\system32\config\afw_hm.conf
2014-08-19 16:38 - 2014-07-24 20:30 - 00000000 ____D () C:\Users\Admin\Desktop\Malware
2014-08-19 16:13 - 2013-04-10 10:26 - 00000000 ____D () C:\Users\Admin\~tmp
2014-08-19 15:37 - 2009-07-14 06:45 - 06305968 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-19 15:10 - 2014-08-12 17:54 - 02101760 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe
2014-08-19 10:59 - 2012-08-09 11:12 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-08-19 10:18 - 2013-10-15 20:16 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{D781DCA7-39F3-4ADE-9B92-F10BCBB64E55}
2014-08-19 09:59 - 2014-06-20 07:55 - 00000000 ____D () C:\Users\Admin\AppData\Local\Adobe
2014-08-19 09:49 - 2014-08-14 19:47 - 00000784 _____ () C:\Windows\PFRO.log
2014-08-18 15:37 - 2014-08-18 15:37 - 00153712 _____ (BullGuard Ltd.) C:\Windows\system32\BgGamingMonitor.dll
2014-08-18 15:37 - 2014-08-18 15:37 - 00140280 _____ (BullGuard Ltd.) C:\Windows\SysWOW64\BgGamingMonitor.dll
2014-08-18 15:37 - 2014-08-18 15:37 - 00076624 _____ (BullGuard Ltd.) C:\Windows\system32\BGLsp.dll
2014-08-18 15:37 - 2014-08-18 15:37 - 00064336 _____ (BullGuard Ltd.) C:\Windows\SysWOW64\BGLsp.dll
2014-08-18 15:27 - 2012-09-03 17:50 - 00000000 ____D () C:\Program Files (x86)\Music Wizard
2014-08-18 10:10 - 2014-08-18 10:10 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-08-15 16:00 - 2014-08-15 16:00 - 00000000 ____D () C:\Users\Admin\AppData\Local\PackageAware
2014-08-15 16:00 - 2013-05-20 17:49 - 00000000 __HDC () C:\Users\Admin\AppData\Local\{C6B707E6-325A-4AB7-BC10-1D3EB2DDFF13}
2014-08-15 16:00 - 2012-08-09 10:35 - 00000372 _____ () C:\Windows\Tasks\yourMail free edition Updates for Admin-PC_Admin.job
2014-08-14 21:24 - 2014-08-13 16:37 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-14 19:44 - 2013-03-31 18:29 - 00000000 ____D () C:\Program Files (x86)\StarMoney 9.0
2014-08-14 19:39 - 2012-08-13 19:48 - 00000000 ____D () C:\Users\Admin\AppData\Local\CrashDumps
2014-08-14 19:36 - 2014-08-14 19:36 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-14 09:04 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-08-14 08:27 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-08-13 23:33 - 2012-08-08 11:23 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-08-13 23:30 - 2013-08-16 08:52 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-13 23:29 - 2012-08-07 17:59 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-08-13 23:27 - 2014-05-07 09:21 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-08-13 16:37 - 2014-08-13 16:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-13 16:37 - 2014-08-13 16:37 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-08-13 10:24 - 2012-08-07 17:37 - 00000000 ____D () C:\Users\Admin
2014-08-12 16:48 - 2014-08-12 16:48 - 00000081 _____ () C:\Users\Admin\Desktop\bsi.txt
2014-08-12 16:39 - 2014-08-12 16:39 - 00031682 _____ () C:\ComboFix.txt
2014-08-12 16:39 - 2013-07-27 20:01 - 00000000 ____D () C:\Qoobox
2014-08-12 16:38 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-08-10 19:55 - 2012-08-12 19:38 - 00000000 ____D () C:\Users\Admin\Desktop\Medien
2014-08-10 18:38 - 2014-02-07 11:59 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\vlc
2014-08-10 18:30 - 2012-12-17 18:31 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\dvdcss
2014-08-10 18:29 - 2014-08-10 18:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-08-08 16:59 - 2014-07-02 21:02 - 00000000 ____D () C:\Users\Admin\Desktop\Bullguard
2014-08-08 09:14 - 2012-08-08 16:52 - 00000000 ____D () C:\Users\Admin\Desktop\Tools
2014-08-07 04:06 - 2014-08-13 23:04 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-07 04:01 - 2014-08-13 23:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-06 15:43 - 2012-12-13 20:58 - 00000000 ____D () C:\Windows\System32\Tasks\NCH Software
2014-08-05 09:20 - 2010-11-21 05:27 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-08-01 01:41 - 2014-08-13 23:08 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-01 01:16 - 2014-08-13 23:08 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-30 20:28 - 2014-07-30 20:25 - 00000000 ____D () C:\Users\Admin\Desktop\CSV-JS
2014-07-29 10:13 - 2014-07-29 10:13 - 00000000 ___SD () C:\Users\Admin\Documents\Meine Datenquellen
2014-07-28 20:54 - 2014-07-28 20:54 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-07-28 20:54 - 2014-07-28 20:54 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-07-28 20:54 - 2014-07-28 20:54 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-07-28 20:54 - 2014-07-28 20:54 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-07-28 20:54 - 2014-07-28 20:54 - 00000000 ____D () C:\Program Files (x86)\Java
2014-07-28 09:12 - 2014-07-28 09:12 - 00000146 _____ () C:\Users\Admin\Desktop\Internetoptionen - Verknüpfung.lnk
2014-07-25 17:40 - 2012-08-14 16:05 - 00000000 ____D () C:\Users\Admin\Desktop\Brennen
2014-07-25 17:39 - 2014-04-01 15:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDFab 9
2014-07-25 17:39 - 2014-04-01 15:31 - 00000000 ____D () C:\Program Files (x86)\DVDFab 9
2014-07-25 17:39 - 2013-12-11 20:35 - 00000000 ____D () C:\Users\Admin\Documents\DVDFab9
2014-07-25 17:38 - 2014-07-25 16:54 - 00004858 _____ () C:\dvdfab_burn_vso.log
2014-07-25 16:52 - 2014-08-13 23:08 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-25 16:02 - 2014-08-13 23:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-25 16:01 - 2014-08-13 23:08 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-25 15:51 - 2014-08-13 23:08 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-25 15:30 - 2014-08-13 23:08 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-25 15:28 - 2014-08-13 23:08 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-25 15:28 - 2014-08-13 23:08 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-25 15:25 - 2014-08-13 23:08 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-25 15:25 - 2014-08-13 23:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-25 15:11 - 2014-08-13 23:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-25 15:10 - 2014-08-13 23:08 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-25 15:04 - 2014-08-13 23:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-25 15:03 - 2014-08-13 23:08 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-25 15:00 - 2014-08-13 23:08 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-25 15:00 - 2014-08-13 23:08 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-25 14:59 - 2014-08-13 23:08 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-25 14:47 - 2014-08-13 23:08 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-25 14:40 - 2014-08-13 23:08 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-25 14:34 - 2014-08-13 23:08 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-25 14:34 - 2014-08-13 23:08 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-25 14:33 - 2014-08-13 23:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-25 14:30 - 2014-08-13 23:08 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-25 14:28 - 2014-08-13 23:08 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-25 14:28 - 2014-08-13 23:08 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-25 14:21 - 2014-08-13 23:08 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-25 14:19 - 2014-08-13 23:08 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-25 14:18 - 2014-08-13 23:08 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-25 14:17 - 2014-08-13 23:08 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-25 14:17 - 2014-08-13 23:08 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-25 14:15 - 2013-10-17 18:25 - 00000076 _____ () C:\Windows\SETSCAN.INI
2014-07-25 14:12 - 2014-08-13 23:08 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-25 14:10 - 2014-08-13 23:08 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-25 14:10 - 2014-08-13 23:08 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-25 14:08 - 2014-08-13 23:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-25 14:06 - 2014-08-13 23:08 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-25 14:00 - 2012-08-09 17:17 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\PhraseExpress
2014-07-25 13:52 - 2014-08-13 23:08 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-25 13:47 - 2014-08-13 23:08 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-25 13:43 - 2014-08-13 23:08 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-25 13:42 - 2014-08-13 23:08 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-25 13:39 - 2014-08-13 23:08 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-25 13:39 - 2014-08-13 23:08 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-25 13:36 - 2014-08-13 23:08 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-25 13:34 - 2014-08-13 23:08 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-25 13:29 - 2014-08-13 23:08 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-25 13:23 - 2014-08-13 23:08 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-25 13:13 - 2014-08-13 23:08 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-25 13:07 - 2014-08-13 23:08 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-25 13:07 - 2014-08-13 23:08 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-25 13:03 - 2014-08-13 23:08 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-25 12:52 - 2014-08-13 23:08 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-25 12:26 - 2014-08-13 23:08 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-25 12:17 - 2014-08-13 23:08 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-25 12:09 - 2014-08-13 23:08 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-25 12:05 - 2014-08-13 23:08 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-25 12:00 - 2014-08-13 23:08 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-25 10:37 - 2013-01-16 12:16 - 00000000 ____D () C:\Program Files\CCleaner
2014-07-25 08:13 - 2013-07-29 10:57 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\BullGuard
2014-07-24 20:42 - 2014-07-24 20:42 - 00000000 ____D () C:\Windows\ERUNT
2014-07-24 20:37 - 2014-07-24 20:37 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-07-24 16:15 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-07-24 15:37 - 2013-03-11 15:06 - 00000000 ____D () C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet
2014-07-24 14:40 - 2012-12-04 14:12 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-07-24 14:40 - 2012-12-04 14:12 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-07-24 14:35 - 2014-07-24 14:54 - 01354223 _____ () C:\AdwCleaner(17).exe
2014-07-24 09:52 - 2012-12-04 14:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-07-21 20:51 - 2012-08-07 17:53 - 00088800 _____ () C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-21 20:29 - 2013-04-04 20:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-18 10:27

==================== End Of Log ============================

--- --- ---

cosinus 19.08.2014 22:12

Das ist kein Fixlog.

weti 20.08.2014 08:53

oh, sch... ich hab den 'scan'button gedrückt, sorry! Hier jetzt:
Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 17-08-2014 01
Ran by Admin at 2014-08-20 09:52:26 Run:3
Running from C:\Users\Admin\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\Users\Admin\AppData\Roaming\2404
C:\Users\Admin\AppData\Roaming\24486
C:\Users\Admin\AppData\Roaming\30098
*****************

C:\Users\Admin\AppData\Roaming\2404 => Moved successfully.
C:\Users\Admin\AppData\Roaming\24486 => Moved successfully.
C:\Users\Admin\AppData\Roaming\30098 => Moved successfully.

==== End of Fixlog ====


cosinus 20.08.2014 08:55

  • Deaktiviere dein Anti-Viren-Programm.
  • Gehe zum Ordner C:\FRST\Quarantine.
  • Rechtsklicke auf den Ordner Quarantine und wähle > Senden an > Zip-komprimierter Ordner.
  • Es wird eine zip-Datei mit dem Namen Quarantine.zip im Ordner FRST erstellt.
  • Lade die Quarantine.zip im Upload-Channel hoch.
  • Klicke dazu auf Durchsuchen, navigiere zu der zip-Datei ( C:\FRST\Quarantine.zip ) und klicke auf Öffnen.
  • Klicke abschließend auf Hochladen.
  • Vielen Dank für deine Hilfe.
  • Aktiviere dein Anti-Viren-Programm wieder.

weti 20.08.2014 09:31

ist oben

cosinus 20.08.2014 10:20

Ok, aber die Ordner die mit FRST gekickt waren leer...
Lass uns nochmal einen Fix mit OTL machen

Fixen mit OTL

  • Starte bitte die OTL.exe.
  • Kopiere nun den Inhalt aus der Codebox in die Textbox.
Code:

:OTL
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <-loopback>;
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:8878;https=127.0.0.1:8878
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <-loopback>;
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:8878;https=127.0.0.1:8878
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:8878;https=127.0.0.1:8878
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:8878;https=127.0.0.1:8878
IE - HKU\S-1-5-21-79635218-2301998975-3311727660-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-21-79635218-2301998975-3311727660-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = www;http;https
IE - HKU\S-1-5-21-79635218-2301998975-3311727660-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:8878;https=127.0.0.1:8878
FF - prefs.js..browser.search.defaultenginename: "Startpage HTTPS - Deutsch"
FF - prefs.js..browser.search.selectedEngine: "Startpage HTTPS - Deutsch"
FF - user.js - File not found

  • Solltest du deinen Benutzernamen z. B. durch "*****" unkenntlich gemacht haben, so füge an entsprechender Stelle deinen richtigen Benutzernamen ein. Andernfalls wird der Fix nicht funktionieren.
  • Schließe bitte nun alle Programme.
  • Klicke nun bitte auf den Fix Button.
  • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
  • Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
    ( Auch zu finden unter C:\_OTL\MovedFiles\<Uhrzeit_Datum>.txt)
    Kopiere nun den Inhalt hier in Deinen Thread

weti 20.08.2014 10:32

mmmh, bei mir sind einige Datein und Unterordner in dem Quarantine-Ordner.

Ok. hier das OTL-Logfile:
Code:

========== OTL ==========
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
HKU\S-1-5-21-79635218-2301998975-3311727660-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-21-79635218-2301998975-3311727660-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
HKU\S-1-5-21-79635218-2301998975-3311727660-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
Prefs.js: "Startpage HTTPS - Deutsch" removed from browser.search.defaultenginename
Prefs.js: "Startpage HTTPS - Deutsch" removed from browser.search.selectedEngine
 
OTL by OldTimer - Version 3.2.69.0 log created on 08202014_112721


cosinus 20.08.2014 11:50

Die Proxy-Settings werden aber trotzdem bei jedem Neustart wieder auf 127.0.0.1 gesetzt, oder?

weti 20.08.2014 12:09

Ja.

cosinus 20.08.2014 12:19

Dann komme ich so auch nicht mehr weiter. Bei dem was ich bisher über Google fand, also ähnliche Fälle, ist man davon ausgegangen, dass das Phänomen keinen Schädling als Ursache hat.

weti 20.08.2014 12:52

Ok, Cosinus. Das sind klare Worte. Wie Andy Brehme schon sagte: Das Unmögliche möglich zu machen, ist ein Ding der Unmöglichkeit! :-)

Ich habe jetzt mal probeweise die alternativen Suchmaschinen (ixquick, startpage etc.) rausgeschmissen. Wenn es was bringt, melde ich es dir.

Dank dir noch einmal für deine Hilfe und Zeit. Bis denne mal (so sagen wir in Ostwestfalen ;-))

weti 22.08.2014 10:02

Hi Cosinus,
ich habe nun auch aufgegeben: es sind weder die Suchmachschinen, noch die Firewall.
Ich lass es jetzt einfach so.

Oder hast du vielleicht eine Idee, ob man ein Makro o.ä. schreben kann, welches den Proxy wieder deaktiviert (so sind es immer fünf manuelle Klicks)?

tocksick 22.08.2014 13:17

Hallo Weti,

bitte deinstalliere das Programm sysTPL, reboote deinen Computer und berichte ob das Problem nun behoben ist.

cosinus 22.08.2014 14:34

sysTPL? Sieht aus, als wenn das schon länger auf dem Rechner drauf sei :wtf:

weti 22.08.2014 17:34

Ich denke, das war's! Tocksick scheint ins Goldene getroffen zu haben :daumenhoc. Ich habe den PC jetzt dreimal neu gestartet und siehe da - Problem behoben. :party:
:dankeschoen: :dankeschoen: :dankeschoen:

cosinus 23.08.2014 00:26

Sehr schön :daumenhoc

Das Zeug scheint aber nicht als Malware eingestuft zu sein. Du kannst dich nicht an sysTPL erinnern oder?

Bootsektor 23.08.2014 02:18

sysTPL - sysTPL.exe - Program Information

;)

cosinus 23.08.2014 15:20

Ok...genau den Artikel hab ich nicht gefunden. :wtf:

M-K-D-B 24.08.2014 08:43

Zitat:

Zitat von Bootsektor (Beitrag 1348394)

Oder man schaut, was FRST sagt :)
Zitat:

sysTPL (HKLM-x32\...\{4B74BC31-B353-4B8F-8CBE-DAB4FF326FF1}) (Version: 1.0.0 - Tlapia) <==== ATTENTION
Sollte AdwCleaner in der aktuellsten Version eigentlich entfernen... ;)

cosinus 24.08.2014 14:17

Stimmt, der letzte Lauf des AdwCleaners vom TO ist schon einige Wochen her....

@weti: Lade mal den AdwCleaner neu runter

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Bootsektor 24.08.2014 14:58

Meines Wissens nach hat der TO doch sysTPL deinstalliert und ist jetzt ohne Probleme. :)

cosinus 24.08.2014 15:17

Jop, aber würde mich interessieren ob ein aktueller adwCleaner noch was findet

weti 24.08.2014 18:40

In folgenden Logdateien der Programme, die du mir genannt hast wurde die sysTPL gefunden. Allerdings weiß ich nicht, ob das als Malware eingestuft wurde:
FRST.txt v. 19.08.
Extras.txt v. 19.08.
OTL.txt v. 19.08.
Addition.txt vo. 12.08
Combofix.txt vom 12.08.

Hier die neue Logdatei vom ADWcleaner:
Code:

# AdwCleaner v3.308 - Bericht erstellt am 24/08/2014 um 19:31:08
# Aktualisiert 20/08/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Admin - ADMIN-PC
# Gestartet von : C:\Users\Admin\Desktop\adwcleaner_3.308.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Users\Admin\AppData\Local\PackageAware

***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sysTPL_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sysTPL_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sysTPLMonitor_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sysTPLMonitor_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sysTPLService_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sysTPLService_RASMANCS

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17239


-\\ Mozilla Firefox v32.0 (x86 de)

[ Datei : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tefcdjqq.default\prefs.js ]


-\\ Google Chrome v36.0.1985.143

[ Datei : C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [1477 octets] - [24/08/2014 19:29:35]
AdwCleaner[S0].txt - [1398 octets] - [24/08/2014 19:31:08]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1458 octets] ##########


cosinus 24.08.2014 21:42

Ok, adwCleaner hat noch was gefunden. Hätte ich mal gleich auf das Datum deines letzten adwCleaner-Logs geachtet wäre mir diese Pein erspart geblieben :headbang:

weti 25.08.2014 08:50

Lieber Cosinus,
don't worry.
Ich halte es mit der altenglischen Weisheit: Nobody is perfect (Kein Körper ist perfekt). :nono:
Es ist mit sowieso ein Rätsel, wie du in der Masse von Buchstaben in den Logs überhaupt was sehen kannst! :crazy:
Also meine uneingeschränkte Bewunderung hast du allemal :daumenhoc


Alle Zeitangaben in WEZ +1. Es ist jetzt 04:53 Uhr.

Copyright ©2000-2024, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129