Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Bekanntes Problem mit Onlinebanking-Trojaner auch bei mir | Bitte um Hilfe (https://www.trojaner-board.de/89465-bekanntes-problem-onlinebanking-trojaner-mir-bitte-um-hilfe.html)

sxhor 13.08.2010 22:12
Bekanntes Problem mit Onlinebanking-Trojaner auch bei mir | Bitte um Hilfe
 
Hallo Leute,
ich habe wohl dieselben Probleme wie die anderen hier im Forum:

- Onlinebanking bei Postbank, Abfrage von 40 Tans (habe meinen Zugang sperren lassen und bekomme in den nächsten Tagen neue Daten)
- Einmal "^" drücken generiert sofort "^^"
- Internet Explorer Forumlare haben graue Schriftfarbe und sind teilweise mit Linie umrandet
- Seiten bauen sich langsam auf

Ich war leider auch intensiver Nutzer von kino.to und habs wahrscheinlich daher...

Habe in diesem Zusammenhang zwei Anliegen:
1. Hätte ich mit einem Produkt wie Avira Antivirus "Professional" die Infektion verhindern können?
2. Könnt Ihr mir bitte helfen, wie ich das Teil ohne eine Formatierung der Festplatte wieder los werde?


Vielen Dank schonmal!!!!!!

Hier die Logfiles von Malwarebytes und OTL:

Malwarebytes:

Code:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4424

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

13.08.2010 23:04:17
mbam-log-2010-08-13 (23-04-17).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 393464
Laufzeit: 2 Stunde(n), 12 Minute(n), 53 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{1e03ac06-04c9-b24b-40e9-59a1378cd597} (Trojan.ZbotR.Gen) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Users\Nici\AppData\Roaming\Ceyd\epcuy.exe (Trojan.ZbotR.Gen) -> Quarantined and deleted successfully.

OTL.txt:


Code:
OTL logfile created on: 13.08.2010 14:37:27 - Run 2
OTL by OldTimer - Version 3.2.9.1    Folder = C:\Users\****\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 51,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 66,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 111,57 Gb Total Space | 19,93 Gb Free Space | 17,86% Space Free | Partition Type: NTFS
Drive D: | 111,55 Gb Total Space | 45,95 Gb Free Space | 41,20% Space Free | Partition Type: NTFS
Drive E: | 4,21 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive F: | 3,74 Gb Total Space | 3,24 Gb Free Space | 86,66% Space Free | Partition Type: FAT32
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: ****-PC
Current User Name: ****
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\****\AppData\Local\Temp\is-87CN6.tmp\mbam-setup-1.46.tmp ()
PRC - C:\Users\****\AppData\Local\Temp\is-HJG11.tmp\mbam-setup-1.46.tmp ()
PRC - C:\Users\****\Desktop\mbam-setup-1.46.exe (Malwarebytes Corporation                                    )
PRC - C:\Users\****\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
PRC - C:\Programme\phonostar-Player\phonostarTimer.exe ()
PRC - C:\Programme\Internet Explorer\iexplore.exe (Microsoft Corporation)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe (CANON INC.)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Users\****\AppData\Local\Temp\RtkBtMnt.exe (Realtek Semiconductor Corp.)
PRC - C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
PRC - C:\Programme\PC Connectivity Solution\Transports\NclUSBSrv.exe ()
PRC - C:\Programme\Nokia\Nokia PC Suite 6\PCSuite.exe (Nokia)
PRC - C:\Programme\Nokia\Nokia PC Suite 6\PcSync2.exe (Time Information Services Ltd.)
PRC - C:\Programme\Common Files\Nokia\MPAPI\MPAPI3s.exe (Nokia Corporation)
PRC - C:\Programme\PC Connectivity Solution\Transports\NclRSSrv.exe ()
PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Windows\System32\wsqmcons.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - \\?\C:\Windows\System32\wbem\WMIADAP.EXE ()
PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation)
PRC - C:\Programme\Internet Explorer\ieuser.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conime.exe (Microsoft Corporation)
PRC - C:\Programme\PC Connectivity Solution\Transports\NclIrSrv.exe ()
PRC - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe ()
PRC - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe (acer)
PRC - C:\Programme\Launch Manager\LManager.exe (Dritek System Inc.)
PRC - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe (Acer Inc.)
PRC - C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
PRC - C:\Acer\Empowering Technology\eNet\eNet Service.exe (Acer Inc.)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe (HiTRSUT)
PRC - C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe (HiTRUST)
PRC - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe (Acer Inc.)
PRC - C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Programme\Brother\Brmfcmon\BrMfcWnd.exe (Brother Industries, Ltd.)
PRC - C:\Programme\Brother\ControlCenter3\BrccMCtl.exe (Brother Industries, Ltd.)
PRC - C:\Programme\Brother\Brmfcmon\BrMfcMon.exe (Brother Industries, Ltd.)
PRC - C:\Programme\ScanSoft\PaperPort\pptd40nt.exe (Nuance Communications, Inc.)
PRC - C:\Acer\Mobility Center\MobilityService.exe ()
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\****\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (CLTNetCnService) -- c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe File not found
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (ServiceLayer) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (eSettingsService) -- C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe ()
SRV - (WMIService) -- C:\Acer\Empowering Technology\ePower\ePowerSvc.exe (acer)
SRV - (eRecoveryService) -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe (Acer Inc.)
SRV - (eNet Service) -- C:\Acer\Empowering Technology\eNet\eNet Service.exe (Acer Inc.)
SRV - (eDataSecurity Service) -- C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe (HiTRSUT)
SRV - (eLockService) -- C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe (Acer Inc.)
SRV - (IAANTMON) Intel(R) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
SRV - (MobilityService) -- C:\Acer\Mobility Center\MobilityService.exe ()
SRV - (SQLWriter) -- C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (WisINT15) -- C:\Elements\1stboot\WisINT15.SYS File not found
DRV - (NwlnkFwd) -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (blbdrive) -- C:\Windows\System32\drivers\blbdrive.sys File not found
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (tapvpn) -- C:\Windows\System32\drivers\tapvpn.sys (The OpenVPN Project)
DRV - (NSCIRDA) -- C:\Windows\System32\drivers\nscirda.sys (National Semiconductor Corporation)
DRV - (WINUSB) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (int15) -- C:\Windows\System32\drivers\int15.sys (Acer, Inc.)
DRV - (UsbserFilt) -- C:\Windows\System32\drivers\usbser_lowerfltj.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (nmwcd) -- C:\Windows\System32\drivers\ccdcmb.sys (Nokia)
DRV - (upperdev) -- C:\Windows\System32\drivers\usbser_lowerflt.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (nmwcdc) -- C:\Windows\System32\drivers\ccdcmbo.sys (Nokia)
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (pccsmcfd) -- C:\Windows\System32\drivers\pccsmcfd.sys (Nokia)
DRV - (SynTP) -- C:\Windows\System32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (NETw4v32) Intel(R) -- C:\Windows\System32\drivers\NETw4v32.sys (Intel Corporation)
DRV - (SNP2UVC) USB2.0 PC Camera (SNP2UVC) -- C:\Windows\System32\drivers\snp2uvc.sys ()
DRV - (NTIDrvr) -- C:\Windows\System32\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (tifm21) -- C:\Windows\System32\drivers\tifm21.sys (Texas Instruments)
DRV - (PSDNServ) -- C:\Windows\system32\drivers\PSDNServ.sys (HiTRUST)
DRV - (psdvdisk) -- C:\Windows\system32\drivers\psdvdisk.sys (HiTRUST)
DRV - (PSDFilter) -- C:\Windows\system32\DRIVERS\psdfilter.sys (HiTRUST)
DRV - (iaStor) -- C:\Windows\system32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (b57nd60x) -- C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation)
DRV - (btwaudio) -- C:\Windows\System32\drivers\btwaudio.sys (Broadcom Corporation.)
DRV - (btwrchid) -- C:\Windows\System32\drivers\btwrchid.sys (Broadcom Corporation.)
DRV - (btwavdt) -- C:\Windows\System32\drivers\btwavdt.sys (Broadcom Corporation.)
DRV - (HSF_DPV) -- C:\Windows\System32\drivers\HSX_DPV.sys (Conexant Systems, Inc.)
DRV - (HSXHWAZL) -- C:\Windows\System32\drivers\HSXHWAZL.sys (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\Windows\System32\drivers\HSX_CNXT.sys (Conexant Systems, Inc.)
DRV - (XAudio) -- C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.)
DRV - (DKbFltr) -- C:\Windows\System32\drivers\DKbFltr.sys (Dritek System Inc.)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) -- C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (HSFHWAZL) -- C:\Windows\System32\drivers\VSTAZL3.SYS (Conexant Systems, Inc.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation)
DRV - (NETw3v32) Intel(R) -- C:\Windows\System32\drivers\NETw3v32.sys (Intel® Corporation)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (ialm) -- C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.intl.acer.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.intl.acer.yahoo.com
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SEARCH PAGE = hxxp://de.rd.yahoo.com/customize/ycomp/defaults/sp/*hxxp://de.yahoo.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://global.acer.com [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
[2010.08.13 12:56:18 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.07.11 08:59:19 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010.04.26 09:55:45 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.04.12 17:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll
[2006.03.22 04:27:56 | 000,098,304 | ---- | M] (Zylom) -- C:\Programme\Mozilla Firefox\plugins\npzylomgamesplayer.dll
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Programme\AskBarDis\bar\bin\askBar.dll (Ask.com)
O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\System32\ActiveToolBand.dll (HiTRUST)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Programme\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Programme\AskBarDis\bar\bin\askBar.dll (Ask.com)
O4 - HKLM..\Run: [Acer Tour]  File not found
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe (HiTRUST)
O4 - HKLM..\Run: [eRecoveryService]  File not found
O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4 - HKLM..\Run: [IJNetworkScanUtility] C:\Programme\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe (CANON INC.)
O4 - HKLM..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [LanguageShortcut] C:\Program Files\CyberLink\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [LManager] C:\Programme\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [NWEReboot]  File not found
O4 - HKLM..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PLFSetL] C:\Windows\PLFSetL.exe (sonix)
O4 - HKLM..\Run: [PPort11reminder] C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Skytel] C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ()
O4 - HKLM..\Run: [SynTPStart] C:\Programme\Synaptics\SynTP\SynTPStart.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe (Acer Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [{1E03AC06-04C9-B24B-40E9-59A1378CD597}] C:\Users\****\AppData\Roaming\Ceyd\epcuy.exe (rhsa)
O4 - HKCU..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (Acer Inc.)
O4 - HKCU..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe File not found
O4 - HKCU..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe (Time Information Services Ltd.)
O4 - HKCU..\Run: [PC Suite Tray] C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe (Nokia)
O4 - HKCU..\Run: [phonostarTimer] C:\Programme\phonostar-Player\phonostarTimer.exe ()
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\****\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office1\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\****\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\****\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{1ddea49e-7f31-11dd-806a-000000000000}\Shell - "" = AutoRun
O33 - MountPoints2\{1ddea49e-7f31-11dd-806a-000000000000}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -- File not found
O33 - MountPoints2\{2a24c3ba-cf54-11dd-83b8-000000000000}\Shell\AutoRun\command - "" = F:\Menu.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.08.13 14:36:32 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Roaming\Malwarebytes
[2010.08.13 14:36:23 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.08.13 14:36:21 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.08.13 14:36:21 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.08.13 14:36:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.08.13 14:36:08 | 006,153,352 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\****\Desktop\mbam-setup-1.46.exe
[2010.08.13 13:50:19 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Users\****\Desktop\OTL.exe
[2010.08.13 13:23:56 | 000,000,000 | ---D | C] -- C:\PerfLogs
[2010.08.05 10:50:39 | 000,000,000 | ---D | C] -- C:\Programme\NotenAssistent
[2010.08.03 09:08:55 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.07.29 16:42:35 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Roaming\PhotoScape
[2010.07.29 16:41:12 | 000,000,000 | ---D | C] -- C:\Programme\PhotoScape
[2010.07.23 02:47:24 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Roaming\Ceyd
[2008.02.20 13:43:37 | 000,172,032 | ---- | C] ( ) -- C:\Windows\System32\rsnp2uvc.dll
[2008.02.20 13:43:37 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\csnp2uvc.dll
[2007.07.04 18:20:35 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\Interop.Shell32.dll
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\****\Desktop\*.tmp files -> C:\Users\****\Desktop\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.08.13 14:39:33 | 005,242,880 | -HS- | M] () -- C:\Users\****\NTUSER.DAT
[2010.08.13 14:39:19 | 001,418,600 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010.08.13 14:39:19 | 000,618,430 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2010.08.13 14:39:19 | 000,587,178 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.08.13 14:39:19 | 000,122,648 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2010.08.13 14:39:19 | 000,101,250 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.08.13 14:36:25 | 000,000,822 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.08.13 14:36:05 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
[2010.08.13 14:35:54 | 006,153,352 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\****\Desktop\mbam-setup-1.46.exe
[2010.08.13 14:21:53 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.08.13 14:21:52 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.08.13 14:21:42 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.08.13 14:21:39 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.08.13 14:21:10 | 2145,837,056 | -HS- | M] () -- C:\hiberfil.sys
[2010.08.13 14:09:28 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2010.08.13 14:09:17 | 000,524,288 | -HS- | M] () -- C:\Users\****\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2010.08.13 14:09:17 | 000,065,536 | -HS- | M] () -- C:\Users\****\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010.08.13 14:09:00 | 002,122,251 | -H-- | M] () -- C:\Users\****\AppData\Local\IconCache.db
[2010.08.13 13:50:26 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\****\Desktop\OTL.exe
[2010.08.13 13:37:42 | 000,000,749 | RH-- | M] () -- C:\Windows\WindowsShell.Manifest
[2010.08.13 13:31:51 | 000,593,368 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010.08.13 13:07:08 | 000,101,888 | ---- | M] (Infineon Technologies AG) -- C:\Windows\System32\ifxcardm.dll
[2010.08.13 13:07:03 | 000,082,432 | ---- | M] (Gemalto, Inc.) -- C:\Windows\System32\axaltocm.dll
[2010.08.13 12:55:26 | 000,079,360 | ---- | M] () -- C:\Users\****\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.08.13 12:52:54 | 000,102,736 | ---- | M] () -- C:\Users\****\Desktop\bookmarks-2010-08-13.json
[2010.08.13 10:37:33 | 000,000,416 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{93CB5FD6-1A39-47DD-8245-9E837189822B}.job
[2010.08.05 10:50:39 | 000,002,046 | ---- | M] () -- C:\Users\Public\Desktop\NotenAssistent.lnk
[2010.08.03 22:17:59 | 000,008,192 | -H-- | M] () -- C:\Users\****\Documents\photothumb.db
[2010.08.03 15:25:10 | 000,180,256 | ---- | M] () -- C:\Users\****\AppData\Local\GDIPFONTCACHEV1.DAT
[2010.08.03 09:08:51 | 000,000,996 | ---- | M] () -- C:\Users\****\Desktop\DVDVideoSoft Free Studio.lnk
[2010.07.31 21:36:23 | 000,084,431 | ---- | M] () -- C:\Users\****\Desktop\studbesch_C1CAF894DBC017CC258732E067D93BD7.cit-prod-tomcat4.pdf
[2010.07.31 21:36:07 | 000,094,570 | ---- | M] () -- C:\Users\****\Desktop\studausweis_C1CAF894DBC017CC258732E067D93BD7.cit-prod-tomcat4.pdf
[2010.07.28 20:42:45 | 000,001,395 | -H-- | M] () -- C:\Users\****\Documents\maxdesk.ini2
[2010.07.28 20:42:45 | 000,000,148 | -H-- | M] () -- C:\Users\****\Documents\PP11Thumbs.ptn2
[2010.07.19 12:02:09 | 000,069,632 | ---- | M] () -- C:\Users\****\Documents\Essensliste.doc
[2010.07.15 15:28:20 | 000,029,108 | ---- | M] () -- C:\Users\****\Documents\Kochplan Töpfe.docx
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\****\Desktop\*.tmp files -> C:\Users\****\Desktop\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.08.13 14:36:25 | 000,000,822 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.08.13 14:36:05 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
[2010.08.13 12:52:54 | 000,102,736 | ---- | C] () -- C:\Users\****\Desktop\bookmarks-2010-08-13.json
[2010.08.05 10:50:39 | 000,002,046 | ---- | C] () -- C:\Users\Public\Desktop\NotenAssistent.lnk
[2010.08.03 22:17:59 | 000,008,192 | -H-- | C] () -- C:\Users\****\Documents\photothumb.db
[2010.08.03 09:08:47 | 000,000,996 | ---- | C] () -- C:\Users\****\Desktop\DVDVideoSoft Free Studio.lnk
[2010.07.31 21:36:23 | 000,084,431 | ---- | C] () -- C:\Users\****\Desktop\studbesch_C1CAF894DBC017CC258732E067D93BD7.cit-prod-tomcat4.pdf
[2010.07.31 21:36:07 | 000,094,570 | ---- | C] () -- C:\Users\****\Desktop\studausweis_C1CAF894DBC017CC258732E067D93BD7.cit-prod-tomcat4.pdf
[2010.07.18 18:38:29 | 000,069,632 | ---- | C] () -- C:\Users\****\Documents\Essensliste.doc
[2010.07.15 15:28:19 | 000,029,108 | ---- | C] () -- C:\Users\****\Documents\Kochplan Töpfe.docx
[2009.08.28 17:36:34 | 000,000,025 | ---- | C] () -- C:\Windows\auerword.ini
[2009.05.22 13:43:45 | 000,012,288 | ---- | C] () -- C:\Windows\impborl.dll
[2009.03.05 18:25:51 | 000,000,032 | ---- | C] () -- C:\Windows\Menu.INI
[2009.02.23 15:01:18 | 000,043,520 | ---- | C] () -- C:\Windows\System32\CmdLineExt03.dll
[2009.02.17 19:42:44 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2009.02.16 00:18:51 | 000,000,032 | ---- | C] () -- C:\Windows\CD_Start.INI
[2009.01.03 15:12:36 | 000,108,032 | ---- | C] () -- C:\Windows\System32\sh33w32.dll
[2008.11.06 18:37:32 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll
[2008.11.06 18:34:00 | 000,000,416 | ---- | C] () -- C:\Windows\System32\dtu100.dll.manifest
[2008.11.06 18:34:00 | 000,000,416 | ---- | C] () -- C:\Windows\System32\dpl100.dll.manifest
[2008.11.06 18:33:02 | 000,012,288 | ---- | C] () -- C:\Windows\System32\DivXWMPExtType.dll
[2008.08.03 12:52:06 | 000,116,224 | ---- | C] () -- C:\Windows\System32\redmonnt.dll
[2008.07.31 17:24:58 | 000,000,311 | ---- | C] () -- C:\Windows\keytrans.ini
[2008.07.31 17:24:33 | 000,006,866 | ---- | C] () -- C:\Windows\Keytran1.ini
[2008.07.31 15:51:06 | 000,000,474 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2008.07.31 15:51:06 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI
[2008.07.31 15:47:18 | 000,031,664 | ---- | C] () -- C:\Windows\maxlink.ini
[2008.07.31 13:15:23 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2008.02.20 23:22:30 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2008.02.20 14:17:06 | 000,015,656 | ---- | C] () -- C:\Windows\System32\drivers\int15_64.sys
[2008.02.20 14:12:14 | 000,065,536 | ---- | C] () -- C:\Windows\System32\NATTraversal.dll
[2008.02.20 13:43:38 | 001,749,376 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys
[2008.02.20 13:43:38 | 000,028,032 | ---- | C] () -- C:\Windows\System32\drivers\sncduvc.sys
[2008.02.20 13:43:37 | 001,749,376 | ---- | C] () -- C:\Windows\System32\snp2uvc.sys
[2008.02.20 13:43:37 | 000,028,032 | ---- | C] () -- C:\Windows\System32\sncduvc.sys
[2008.02.20 13:43:37 | 000,000,131 | ---- | C] () -- C:\Windows\System32\PidList.ini
[2008.02.20 13:43:37 | 000,000,131 | ---- | C] () -- C:\Windows\PidList.ini
[2007.07.05 05:31:13 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIBUN4.dll
[2007.07.05 02:54:52 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2007.07.04 18:20:33 | 000,331,776 | ---- | C] () -- C:\Windows\System32\ScrollBarLib.dll
[2007.07.04 17:32:20 | 000,001,132 | ---- | C] () -- C:\Windows\RtDefLvl.ini
[2007.04.25 17:33:22 | 000,266,240 | ---- | C] () -- C:\Windows\System32\NotesExtmngr.dll
[2007.04.25 17:32:50 | 000,204,800 | ---- | C] () -- C:\Windows\System32\NotesActnMenu.dll
[2007.04.25 17:32:46 | 000,086,016 | ---- | C] () -- C:\Windows\System32\MSNSpook.dll
[2007.04.25 17:31:00 | 000,028,672 | ---- | C] () -- C:\Windows\System32\BatchCrypto.dll
[2007.04.25 17:30:52 | 000,073,728 | ---- | C] () -- C:\Windows\System32\APISlice.dll
[2007.04.25 17:30:44 | 000,063,488 | ---- | C] () -- C:\Windows\System32\ShowErrMsg.dll
[2007.04.18 11:19:21 | 000,872,448 | ---- | C] () -- C:\Windows\iconv.dll
[2007.04.18 11:19:21 | 000,743,424 | ---- | C] () -- C:\Windows\libxml2.dll
[2007.04.18 11:19:21 | 000,000,041 | ---- | C] () -- C:\Windows\PreLaunch.ini
[2007.03.30 00:00:40 | 000,203,264 | R--- | C] () -- C:\Windows\System32\CddbCdda.dll
[2007.01.19 20:11:16 | 000,389,120 | ---- | C] () -- C:\Windows\System32\btwhidcs.dll
[2006.12.25 16:44:48 | 000,022,016 | ---- | C] () -- C:\Windows\System32\MailFormat_U.dll
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:25:21 | 000,061,440 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2003.02.20 17:53:42 | 000,005,702 | ---- | C] () -- C:\Windows\System32\OUTLPERF.INI
[2002.05.16 01:38:40 | 000,091,136 | ---- | C] () -- C:\Windows\System32\mp4fil32.dll
[2002.05.04 15:19:00 | 000,049,152 | ---- | C] () -- C:\Windows\System32\avisynthEx.dll
[2002.04.21 20:30:14 | 000,151,552 | ---- | C] () -- C:\Windows\System32\OggDS.dll
[2002.04.02 00:16:30 | 000,454,656 | ---- | C] () -- C:\Windows\System32\VorbisEnc.dll
[2002.04.02 00:16:14 | 000,118,784 | ---- | C] () -- C:\Windows\System32\vorbis.dll
[2002.04.02 00:15:40 | 000,011,264 | ---- | C] () -- C:\Windows\System32\ogg.dll
[2001.12.26 16:12:30 | 000,065,536 | ---- | C] () -- C:\Windows\System32\multiplex_vcd.dll
[2001.11.14 13:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll
[2001.09.03 23:46:38 | 000,110,592 | ---- | C] () -- C:\Windows\System32\Hmpg12.dll
[2001.07.30 16:33:56 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC.dll
[2001.07.23 22:04:36 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC_MMX.dll
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:85DA68FC
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:87FA5E8A
< End of report >
Extras.txt:

Code:
OTL Extras logfile created on: 13.08.2010 14:37:27 - Run 2
OTL by OldTimer - Version 3.2.9.1    Folder = C:\Users\****\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 51,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 66,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 111,57 Gb Total Space | 19,93 Gb Free Space | 17,86% Space Free | Partition Type: NTFS
Drive D: | 111,55 Gb Total Space | 45,95 Gb Free Space | 41,20% Space Free | Partition Type: NTFS
Drive E: | 4,21 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive F: | 3,74 Gb Total Space | 3,24 Gb Free Space | 86,66% Space Free | Partition Type: FAT32
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: ****-PC
Current User Name: ****
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [CEWE FOTOSCHAU] -- "C:\Program Files\CeWe Color\Mein CEWE FOTOBUCH\CEWE FOTOSCHAU.exe" -d "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Mein CEWE FOTOBUCH] -- "C:\Program Files\CeWe Color\Mein CEWE FOTOBUCH\Mein CEWE FOTOBUCH.exe" "%1" ()
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~3\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UacDisableNotify" = 0
"InternetSettingsDisableNotify" = 0
"AutoUpdateDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{001B472E-26AD-4E37-925A-EA82117F0FC8}" = rport=10243 | protocol=6 | dir=out | app=system |
"{0837FEF0-D363-4C0B-816A-79CAE7435D3B}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{1234D8F6-D5F8-4DEF-8C55-52BCED3F2ECD}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{129897C7-2F57-4346-BF73-87981C0A970E}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{187CE648-3B54-4277-844D-B0862A008780}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{1F0A1488-86FF-4E9D-8552-34BC57AFD403}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{214881B0-B8CF-4B3D-8607-3F3F669BE0BE}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{33E69D96-D647-49DE-AF91-1E1FC7EBABA3}" = lport=5721 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdc.exe,-4002 |
"{47A8EB99-A27F-4A68-943C-C1A79666F854}" = lport=1034 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdc.exe,-4003 |
"{53E30610-5502-4B58-BDF4-C724ECC06F10}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{7D9690C6-72D1-4E19-8916-820C0BA07C9E}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{89F63EE6-3E42-4E6B-9F85-E43873861C58}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{99BA877F-E487-4330-986C-B0A544273D80}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{A562013D-7C6D-42F8-B6B7-3CE7251B5798}" = lport=2869 | protocol=6 | dir=in | app=system |
"{A8EB947C-9346-4A03-8FA7-993B87339887}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{B62F0A3C-9736-4D16-A539-88C7EB795615}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{BBFCA833-F83E-4425-AB34-62D9A3228E3D}" = lport=10243 | protocol=6 | dir=in | app=system |
"{C4E0224A-CF22-4821-ABA0-883739A969EF}" = lport=5721 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdc.exe,-4002 |
"{D4B8A5AF-13CF-4FA0-A5FF-F8033F9775FB}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdc.exe,-4006 |
"{EB4A7972-E2E1-4492-A0F4-02ADF18FC09E}" = lport=1034 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdc.exe,-4003 |
"{F0A23AC1-8F68-4A18-89B5-5FFC95960EE6}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdc.exe,-4006 |
"{F8D4DA82-EBE2-4E1F-B8FE-25B1FA3FD437}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{FADF7306-196C-404F-B418-3519DCC6ED8E}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0DA6C8F6-8D7B-48F2-96BA-75A3D9124091}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{11D74191-954E-4E67-9766-36E95514B6FB}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{1265CA9D-EBC9-46BD-AC2A-CA8342643681}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{290F105C-8AC3-4474-8EB1-1CD6696F97F7}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{298E349D-CEDA-417C-B41D-1002CAA4565A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{39468D80-A2B2-449B-AB84-F40695BB4139}" = protocol=6 | dir=out | app=system |
"{5D5D8012-AF81-4261-8CD6-810295253C43}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{82731926-F854-45A7-9621-3E7A4CCB55AC}" = dir=in | app=c:\program files\cyberlink\powerdvd\powerdvd.exe |
"{9F474F74-0144-4553-AE08-AC0AFE5F39E7}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A0B40CE2-6C38-436F-BE59-90C27BCBDF98}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{A84B34F8-6D2C-45E1-B9A4-2F637B32F8FB}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{ADD9C9C4-4297-4075-B7DF-4EDD54DF57EE}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{E28B0FB7-2A76-4B66-8F04-0F57445641CE}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E6A56C57-96EE-4EC0-B186-711F33262CA4}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E94B5131-E860-40F3-96AA-723B1F46DAD4}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{F29355A2-3CE6-4D67-BB02-4E9DF18954B1}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"TCP Query User{1F396F7F-F874-4033-9210-094AB06AA91D}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe |
"TCP Query User{2C1DCDF1-8A64-4B8F-B21B-839A1A83A1B2}C:\program files\orbitdownloader\orbitnet.exe" = protocol=6 | dir=in | app=c:\program files\orbitdownloader\orbitnet.exe |
"TCP Query User{46FA8B15-48BD-4825-B00B-0366A986DF4A}C:\program files\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"TCP Query User{76F58847-9753-4ECA-A420-6E120D1F571E}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"TCP Query User{8FB197D3-AEC7-491A-AC7D-1C51D271DB77}C:\windows\system32\taskeng.exe" = protocol=6 | dir=in | app=c:\windows\system32\taskeng.exe |
"TCP Query User{9A88EA22-A153-4724-817B-F28059C6D1D3}C:\windows\system32\taskeng.exe" = protocol=6 | dir=in | app=c:\windows\system32\taskeng.exe |
"TCP Query User{C06BE2CF-4700-437A-8D7B-061F300CCDAE}C:\program files\tvuplayer\tvuplayer.exe" = protocol=6 | dir=in | app=c:\program files\tvuplayer\tvuplayer.exe |
"TCP Query User{CDB6A074-9B94-433F-ACCD-E5D426861989}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{E7B1755E-59F5-4365-8029-02DBF6828B63}C:\program files\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"TCP Query User{F024AEE3-7E4C-4938-B0AB-3E318E4AF080}C:\program files\icq6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6\icq.exe |
"UDP Query User{0E81E263-6338-47F5-8BBB-906855B09868}C:\program files\orbitdownloader\orbitnet.exe" = protocol=17 | dir=in | app=c:\program files\orbitdownloader\orbitnet.exe |
"UDP Query User{290BC30F-144F-42B9-9998-3A80455D3B20}C:\windows\system32\taskeng.exe" = protocol=17 | dir=in | app=c:\windows\system32\taskeng.exe |
"UDP Query User{2CE911BE-3658-4B0D-B615-7914421F41C4}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{3919ACD9-C4B8-4E5F-B02C-735FF1A85FF1}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"UDP Query User{85622D43-019C-4EEE-8992-A2CA31F13F08}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe |
"UDP Query User{95276F31-7650-4354-9E42-67623B771D42}C:\program files\icq6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6\icq.exe |
"UDP Query User{9BF88250-B39F-4548-9969-F70978FDFE0D}C:\windows\system32\taskeng.exe" = protocol=17 | dir=in | app=c:\windows\system32\taskeng.exe |
"UDP Query User{A0B7B2BB-4415-4D7D-8869-BB35BE327038}C:\program files\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"UDP Query User{A5056430-8F33-4365-BD22-7B44F210E590}C:\program files\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"UDP Query User{D4BBD2D9-A4E3-4D67-A218-17D258989CF5}C:\program files\tvuplayer\tvuplayer.exe" = protocol=17 | dir=in | app=c:\program files\tvuplayer\tvuplayer.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0138F525-6C8A-333F-A105-14AE030B9A54}" = Visual C++ 9.0 CRT (x86) WinSXS MSM
"{02F020A7-4981-4F6E-C40D-5BA7C007D518}" = ccc-core-static
"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
"{0762EBC7-0C57-76DD-F1B9-0E69B867C802}" = Catalyst Control Center Graphics Light
"{089523E6-D681-1B0C-6458-CC42C5CA5DEF}" = Catalyst Control Center Localization Finnish
"{09298F26-A95C-31E2-9D95-2C60F586F075}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{11316260-6666-467B-AC34-183FCB5D4335}" = Acer Mobility Center Plug-In
"{116FF17B-1A30-4FC2-9B01-5BC5BD46B0B3}" = Acer eLock Management
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP560_series" = Canon MP560 series MP Drivers
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"{17533FFD-37B6-A54A-1654-AD053A247A37}" = Catalyst Control Center Localization Swedish
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1A5E5061-543A-5722-7441-7BC6CF1C5C62}" = Catalyst Control Center Localization Portuguese
"{1E239B20-E618-41D4-47E3-C3AE4A066214}" = Catalyst Control Center Core Implementation
"{1F2A5DF9-40E1-4644-ADBD-D80F347BA6C8}" = Windows Mobile-Gerätecenter
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{26976749-1A33-20A5-DCE9-63EFEEAECA03}" = Catalyst Control Center Localization Greek
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 20
"{2DFB5485-A3EF-4298-9280-4AF80C9F4BE9}" = Microsoft SQL Server VSS Writer
"{332CC6BF-E6C7-48EE-BA3D-435E576AD67F}" = PaperPort Image Printer
"{347952D7-B923-36BE-B35C-99B4C7809795}" = Catalyst Control Center Localization Turkish
"{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = Acer Crystal Eye Webcam Video Class Camera
"{3B810746-962A-2A85-E733-3E62EF3D4BEB}" = Catalyst Control Center Localization Thai
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CE4B975-A5C1-43C0-A565-C00F0ABFC94C}" = PC-Bibliothek 3.0
"{4E5EE953-0D92-A385-E3A0-FBFCB2DE15AA}" = EA Download Manager UI
"{4EA46C71-CF0B-E932-F09E-81E83D4C3A4E}" = Catalyst Control Center Localization German
"{4EC13867-3C71-0CEC-88BC-FA0D308966FF}" = Catalyst Control Center Localization Chinese Standard
"{4F1DCA42-2030-437C-A94E-736692A499C1}" = Nokia Connectivity Cable Driver
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{502B07AB-9DD1-F9AC-7D1A-6F265003FBFD}" = Catalyst Control Center Localization French
"{505AFDC0-5E72-4928-8368-5DEA385E3647}" = CorelDRAW Graphics Suite 12
"{547DCEC7-DD2A-47E9-82C7-5CF1EAB526DA}" = Microsoft SQL Server Native Client
"{58E5844B-7CE2-413D-83D1-99294BF6C74F}" = Acer ePower Management
"{5AFEABF5-7411-4C29-9FA9-71ABE880662D}" = Nokia PC Suite
"{5C39E087-5518-7F09-7DCF-12073726CF84}" = Catalyst Control Center Localization Czech
"{5E6F1230-06E8-C7A9-89B7-09C0414BCC9E}" = Catalyst Control Center Localization Danish
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5
"{60FCDA4F-8008-FBDF-FFEC-EA5101E9F3F4}" = Catalyst Control Center Localization Japanese
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{67ADE9AF-5CD9-4089-8825-55DE4B366799}" = NTI Backup NOW! 4.7
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6DFA698C-EB46-412F-9886-93B2C8617841}" = Catalyst Control Center - Branding
"{6F7EA6CA-79F4-44A0-A370-8E82BB16534A}" = NTI Shadow
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{76E1503E-8DBB-3521-1880-5B2D288163F2}" = Catalyst Control Center Localization Norwegian
"{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7D083C9E-3822-4FCE-BCB8-F39B16880C60}" = Catalyst Control Center Localization Dutch
"{88637F72-B46E-43F9-B306-6DA1FF478D51}" = WIDCOMM Bluetooth Software 6.0.1.3900
"{89280B77-24FA-9C0B-3BF0-8ED7E8873644}" = Catalyst Control Center Localization Spanish
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel(R) Matrix Storage Manager
"{90A40407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{94389919-B0AA-4882-9BE8-9F0B004ECA35}" = Acer Tour
"{95FB5C06-F577-D340-5B40-9F1243F30CDD}" = Catalyst Control Center Localization Korean
"{97BA58C3-4AB1-47FB-92BC-5F739007242A}" = NotenAssistent
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{99B7756C-AA8B-1EDD-697B-2B198BDCC34B}" = Catalyst Control Center Localization Russian
"{99E862CC-6F69-4D39-99AA-DBF71BF3B585}" = OpenOffice.org 3.1
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3FEC306-FBFF-4B0D-95B9-F9C67C65079E}" = Brother MFL-Pro Suite
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AA047D7C-5E7C-4878-B75C-77589151B563}" = Acer Crystal Eye webcam
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AB6097D9-D722-4987-BD9E-A076E2848EE2}" = Acer Empowering Technology
"{AB71E8EA-902A-654F-0E08-862CA0328764}" = ccc-utility
"{AC4BB070-A5CB-86C8-659F-85C62E27F046}" = Catalyst Control Center Localization Polish
"{AC76BA86-7AD7-1033-7B44-A81300000003}" = Adobe Reader 8.1.4
"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8
"{AEEAE013-92F1-4515-B278-139F1A692A36}" = Acer eDataSecurity Management
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{AF255B94-DFE9-5977-1F82-0D9E4073EABD}" = Catalyst Control Center Localization Hungarian
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B6C89654-A6A2-477C-873B-724EC1C56407}" = ScanSoft PaperPort 11
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BE1826A9-7EEE-492A-B3BC-DEF3DFAE37EE}" = TIPCI
"{BE6C4D32-7CDB-8639-3595-984859850522}" = ATI Catalyst Install Manager
"{BF839132-BD43-4056-ACBF-4377F4A88E2A}" = Acer ePresentation Management
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = Die Sims™ 3
"{C06554A1-2C1E-4D20-B613-EE62C79927CC}" = Acer eNet Management
"{C1E37C71-121A-6811-153A-705C0A368CD3}" = Catalyst Control Center Localization Italian
"{CB8CA439-DA83-419C-A4CF-5A0A50025144}" = Windows Mobile-Gerätecenter: Treiberupdate
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe  1.4.142.1
"{CE65A9A0-9686-45C6-9098-3C9543A412F0}" = Acer eSettings Management
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D3B3B9B2-FE73-44CB-8C0A-F737D92F991B}" = Broadcom Gigabit Integrated Controller
"{D9782503-10D1-A2D4-A5B7-C081C7B63708}" = Catalyst Control Center Localization Chinese Traditional
"{DB780B85-B4B5-4864-A49C-9B706B169C93}" = TIPCI
"{DF213333-DA71-48E9-9AB5-9FA7A5584E5D}" = "Arbeitsblätter gestalten - blitzschnell mit Word"
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E9BC886E-0D8A-4EF5-B793-30DB776C6E2C}" = PC Connectivity Solution
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"3A5DEFA413DDE699DBA6EBE0A63534ACA524D30F" = Windows-Treiberpaket - Nokia pccsmcfd  (10/12/2007 6.85.4.0)
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11
"Ask Toolbar_is1" = Ask Toolbar
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Canon MP560 series Benutzerregistrierung" = Canon MP560 series Benutzerregistrierung
"Canon_IJ_Network_Scan_UTILITY" = Canon IJ Network Scan Utility
"Canon_IJ_Network_UTILITY" = Canon IJ Network Tool
"CanonMyPrinter" = Canon Utilities My Printer
"CanonSolutionMenu" = Canon Utilities Solution Menu
"CBF192A85B624E32B8D19ADEEF2DCFC5BC3AA73A" = Windows-Treiberpaket - Nokia Modem  (03/05/2008 3.7)
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFAOR2C06_118" = HDAUDIO Soft Data Fax Modem with SmartCP
"com.ea.Vault.919CACB699904AC5D41B606703500DD39747C02D.1" = EA Download Manager UI
"CUEcards 2000" = CUEcards 2000
"Diesterweg - Bausteine Fibel" = Diesterweg - Bausteine Fibel
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"E092B2EBF2FFE83E896F8F7F829A7B5D7D1B2F9D" = Windows-Treiberpaket - Nokia Modem  (03/13/2008 6.86.0.1)
"EA Download Manager" = EA Download Manager
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4
"Free YouTube Download_is1" = Free YouTube Download 2.3
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.7
"FreePDF_XP" = FreePDF XP (Remove only)
"GPL Ghostscript 8.56" = GPL Ghostscript 8.56
"GPL Ghostscript Fonts" = GPL Ghostscript Fonts
"GridVista" = Acer GridVista
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"ICQToolbar" = ICQ Toolbar
"InstallShield_{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"InstallShield_{6F7EA6CA-79F4-44A0-A370-8E82BB16534A}" = NTI Shadow
"InstallShield_{BE1826A9-7EEE-492A-B3BC-DEF3DFAE37EE}" = Texas Instruments PCIxx21/x515/xx12 drivers.
"InstallShield_{DB780B85-B4B5-4864-A49C-9B706B169C93}" = Texas Instruments PCIxx21/x515/xx12 drivers.
"LManager" = Launch Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mein CEWE FOTOBUCH" = Mein CEWE FOTOBUCH
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MILA_lets-smile" = MILA_lets-smile  Screen Saver
"MP Navigator EX 3.0" = Canon MP Navigator EX 3.0
"Nokia PC Suite" = Nokia PC Suite
"phonostar3RadioPlayer_is1" = phonostar-Player Version 3.01.5
"PhotoScape" = PhotoScape
"Picasa 3" = Picasa 3
"RealPlayer 6.0" = RealPlayer
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"RollerCoaster Tycoon 3_is1" = RollerCoaster Tycoon 3
"Schulschriften" = Schulschriften
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.0.1
"WinRAR archiver" = WinRAR archiver
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 07.12.2009 03:12:09 | Computer Name = ****-PC | Source = WerSvc | ID = 5007
Description =
 
Error - 07.12.2009 07:32:48 | Computer Name = ****-PC | Source = Application Hang | ID = 1002
Description = Programm OUTLOOK.EXE, Version 11.0.5510.0 arbeitet nicht mehr mit
Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über
 das Problem zu suchen.  Prozess-ID: 1784  Anfangszeit: 01ca770bea15e88c  Zeitpunkt der
 Beendigung: 469
 
Error - 07.12.2009 08:35:43 | Computer Name = ****-PC | Source = Microsoft Office 11 | ID = 2001
Description =
 
Error - 07.12.2009 11:25:19 | Computer Name = ****-PC | Source = Application Hang | ID = 1002
Description = Programm OUTLOOK.EXE, Version 11.0.5510.0 arbeitet nicht mehr mit
Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über
 das Problem zu suchen.  Prozess-ID: 1674  Anfangszeit: 01ca7739c9fb494c  Zeitpunkt der
 Beendigung: 13
 
Error - 08.12.2009 03:58:52 | Computer Name = ****-PC | Source = WerSvc | ID = 5007
Description =
 
Error - 08.12.2009 05:43:07 | Computer Name = ****-PC | Source = Application Hang | ID = 1002
Description = Programm OUTLOOK.EXE, Version 11.0.5510.0 arbeitet nicht mehr mit
Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über
 das Problem zu suchen.  Prozess-ID: df0  Anfangszeit: 01ca77e399d727cc  Zeitpunkt der
 Beendigung: 505
 
Error - 08.12.2009 14:10:58 | Computer Name = ****-PC | Source = WerSvc | ID = 5007
Description =
 
Error - 08.12.2009 14:55:01 | Computer Name = ****-PC | Source = Application Hang | ID = 1002
Description = Programm OUTLOOK.EXE, Version 11.0.5510.0 arbeitet nicht mehr mit
Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über
 das Problem zu suchen.  Prozess-ID: 14c8  Anfangszeit: 01ca783108295eab  Zeitpunkt der
 Beendigung: 442
 
Error - 09.12.2009 03:43:58 | Computer Name = ****-PC | Source = WerSvc | ID = 5007
Description =
 
Error - 09.12.2009 17:26:28 | Computer Name = ****-PC | Source = Application Hang | ID = 1002
Description = Programm OUTLOOK.EXE, Version 11.0.5510.0 arbeitet nicht mehr mit
Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über
 das Problem zu suchen.  Prozess-ID: 15b4  Anfangszeit: 01ca78fe2a834aa9  Zeitpunkt der
 Beendigung: 29
 
[ OSession Events ]
Error - 26.02.2009 06:18:20 | Computer Name = ****-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 7720
 seconds with 5280 seconds of active time.  This session ended with a crash.
 
Error - 03.10.2009 13:02:57 | Computer Name = ****-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 36
 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error - 09.10.2009 08:45:24 | Computer Name = ****-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 1934
 seconds with 1860 seconds of active time.  This session ended with a crash.
 
Error - 29.05.2010 15:23:53 | Computer Name = ****-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 19582
 seconds with 13440 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 13.08.2010 07:33:14 | Computer Name = ****-PC | Source = HTTP | ID = 15016
Description =
 
Error - 13.08.2010 07:34:06 | Computer Name = ****-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 13.08.2010 07:37:02 | Computer Name = ****-PC | Source = WMPNetworkSvc | ID = 866321
Description =
 
Error - 13.08.2010 07:37:02 | Computer Name = ****-PC | Source = WMPNetworkSvc | ID = 866317
Description =
 
Error - 13.08.2010 07:37:02 | Computer Name = ****-PC | Source = WMPNetworkSvc | ID = 866321
Description =
 
Error - 13.08.2010 07:37:02 | Computer Name = ****-PC | Source = WMPNetworkSvc | ID = 866317
Description =
 
Error - 13.08.2010 07:37:39 | Computer Name = ****-PC | Source = Microsoft-Windows-Eventlog | ID = 30
Description =
 
Error - 13.08.2010 08:09:14 | Computer Name = ****-PC | Source = DCOM | ID = 10010
Description =
 
Error - 13.08.2010 08:21:42 | Computer Name = ****-PC | Source = HTTP | ID = 15016
Description =
 
Error - 13.08.2010 08:22:21 | Computer Name = ****-PC | Source = Service Control Manager | ID = 7000
Description =
 
 
< End of report >



Nochmals jetzt schon vielen DANK!!

Grüße
SG

markusg 13.08.2010 22:15
ok, will nur sagen, dass ich formatieren für das sicherste halte.
otl scan mit folgenden einstellungen:
Doppelklick auf die OTL.exe
(user von Windows 7 und Vista: Rechtsklick als Administrator ausführen)
1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
2. Hake an "scan all users"
3. Unter "Extra Registry wähle:
"Use Safelist" "LOP Check" "Purity Check"
4. Kopiere in die Textbox:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
5. Klicke "Scan"
6. 2 reporte werden erstellt:
OTL.Txt
Extras.Txt
poste beide logs

sxhor 13.08.2010 22:40
Hallo,
danke für die schnelle Nachricht. Hier die beiden Files mit den richtigen Einstellungen:


OTL.txt

Code:
OTL logfile created on: 13.08.2010 23:22:00 - Run 3
OTL by OldTimer - Version 3.2.9.1    Folder = C:\Users\****\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 51,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 69,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 111,57 Gb Total Space | 19,94 Gb Free Space | 17,87% Space Free | Partition Type: NTFS
Drive D: | 111,55 Gb Total Space | 45,95 Gb Free Space | 41,20% Space Free | Partition Type: NTFS
Drive E: | 4,21 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive F: | 3,74 Gb Total Space | 3,24 Gb Free Space | 86,66% Space Free | Partition Type: FAT32
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: ****-PC
Current User Name: ****
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\****\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\phonostar-Player\phonostarTimer.exe ()
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe (CANON INC.)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Adobe\Reader 8.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
PRC - C:\Users\****\AppData\Local\Temp\RtkBtMnt.exe (Realtek Semiconductor Corp.)
PRC - C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
PRC - C:\Programme\PC Connectivity Solution\Transports\NclUSBSrv.exe ()
PRC - C:\Programme\Nokia\Nokia PC Suite 6\PCSuite.exe (Nokia)
PRC - C:\Programme\Nokia\Nokia PC Suite 6\PcSync2.exe (Time Information Services Ltd.)
PRC - C:\Programme\Common Files\Nokia\MPAPI\MPAPI3s.exe (Nokia Corporation)
PRC - C:\Programme\PC Connectivity Solution\Transports\NclRSSrv.exe ()
PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - \\?\C:\Windows\System32\wbem\WMIADAP.EXE ()
PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation)
PRC - C:\Programme\Internet Explorer\ieuser.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conime.exe (Microsoft Corporation)
PRC - C:\Programme\PC Connectivity Solution\Transports\NclIrSrv.exe ()
PRC - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe ()
PRC - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe (acer)
PRC - C:\Programme\Launch Manager\LManager.exe (Dritek System Inc.)
PRC - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe (Acer Inc.)
PRC - C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
PRC - C:\Acer\Empowering Technology\eNet\eNet Service.exe (Acer Inc.)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe (HiTRSUT)
PRC - C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe (HiTRUST)
PRC - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe (Acer Inc.)
PRC - C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Programme\Brother\Brmfcmon\BrMfcWnd.exe (Brother Industries, Ltd.)
PRC - C:\Programme\Brother\ControlCenter3\BrccMCtl.exe (Brother Industries, Ltd.)
PRC - C:\Programme\Brother\Brmfcmon\BrMfcMon.exe (Brother Industries, Ltd.)
PRC - C:\Programme\ScanSoft\PaperPort\pptd40nt.exe (Nuance Communications, Inc.)
PRC - C:\Acer\Mobility Center\MobilityService.exe ()
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\****\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (CLTNetCnService) -- c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe File not found
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (ServiceLayer) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (eSettingsService) -- C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe ()
SRV - (WMIService) -- C:\Acer\Empowering Technology\ePower\ePowerSvc.exe (acer)
SRV - (eRecoveryService) -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe (Acer Inc.)
SRV - (eNet Service) -- C:\Acer\Empowering Technology\eNet\eNet Service.exe (Acer Inc.)
SRV - (eDataSecurity Service) -- C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe (HiTRSUT)
SRV - (eLockService) -- C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe (Acer Inc.)
SRV - (IAANTMON) Intel(R) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
SRV - (MobilityService) -- C:\Acer\Mobility Center\MobilityService.exe ()
SRV - (SQLWriter) -- C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (WisINT15) -- C:\Elements\1stboot\WisINT15.SYS File not found
DRV - (NwlnkFwd) -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (blbdrive) -- C:\Windows\System32\drivers\blbdrive.sys File not found
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (tapvpn) -- C:\Windows\System32\drivers\tapvpn.sys (The OpenVPN Project)
DRV - (NSCIRDA) -- C:\Windows\System32\drivers\nscirda.sys (National Semiconductor Corporation)
DRV - (WINUSB) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (int15) -- C:\Windows\System32\drivers\int15.sys (Acer, Inc.)
DRV - (UsbserFilt) -- C:\Windows\System32\drivers\usbser_lowerfltj.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (nmwcd) -- C:\Windows\System32\drivers\ccdcmb.sys (Nokia)
DRV - (upperdev) -- C:\Windows\System32\drivers\usbser_lowerflt.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (nmwcdc) -- C:\Windows\System32\drivers\ccdcmbo.sys (Nokia)
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (pccsmcfd) -- C:\Windows\System32\drivers\pccsmcfd.sys (Nokia)
DRV - (SynTP) -- C:\Windows\System32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (NETw4v32) Intel(R) -- C:\Windows\System32\drivers\NETw4v32.sys (Intel Corporation)
DRV - (SNP2UVC) USB2.0 PC Camera (SNP2UVC) -- C:\Windows\System32\drivers\snp2uvc.sys ()
DRV - (NTIDrvr) -- C:\Windows\System32\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (tifm21) -- C:\Windows\System32\drivers\tifm21.sys (Texas Instruments)
DRV - (PSDNServ) -- C:\Windows\system32\drivers\PSDNServ.sys (HiTRUST)
DRV - (psdvdisk) -- C:\Windows\system32\drivers\psdvdisk.sys (HiTRUST)
DRV - (PSDFilter) -- C:\Windows\system32\DRIVERS\psdfilter.sys (HiTRUST)
DRV - (iaStor) -- C:\Windows\system32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (b57nd60x) -- C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation)
DRV - (btwaudio) -- C:\Windows\System32\drivers\btwaudio.sys (Broadcom Corporation.)
DRV - (btwrchid) -- C:\Windows\System32\drivers\btwrchid.sys (Broadcom Corporation.)
DRV - (btwavdt) -- C:\Windows\System32\drivers\btwavdt.sys (Broadcom Corporation.)
DRV - (HSF_DPV) -- C:\Windows\System32\drivers\HSX_DPV.sys (Conexant Systems, Inc.)
DRV - (HSXHWAZL) -- C:\Windows\System32\drivers\HSXHWAZL.sys (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\Windows\System32\drivers\HSX_CNXT.sys (Conexant Systems, Inc.)
DRV - (XAudio) -- C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.)
DRV - (DKbFltr) -- C:\Windows\System32\drivers\DKbFltr.sys (Dritek System Inc.)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) -- C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (HSFHWAZL) -- C:\Windows\System32\drivers\VSTAZL3.SYS (Conexant Systems, Inc.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation)
DRV - (NETw3v32) Intel(R) -- C:\Windows\System32\drivers\NETw3v32.sys (Intel® Corporation)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (ialm) -- C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.intl.acer.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.intl.acer.yahoo.com
 
 
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://global.acer.com [binary data]
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://global.acer.com [binary data]
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1860453707-579634664-3134055765-1003\SOFTWARE\Microsoft\Internet Explorer\Main,SEARCH PAGE = hxxp://de.rd.yahoo.com/customize/ycomp/defaults/sp/*hxxp://de.yahoo.com
IE - HKU\S-1-5-21-1860453707-579634664-3134055765-1003\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKU\S-1-5-21-1860453707-579634664-3134055765-1003\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKU\S-1-5-21-1860453707-579634664-3134055765-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://global.acer.com [binary data]
IE - HKU\S-1-5-21-1860453707-579634664-3134055765-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
IE - HKU\S-1-5-21-1860453707-579634664-3134055765-1003\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2
IE - HKU\S-1-5-21-1860453707-579634664-3134055765-1003\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-1860453707-579634664-3134055765-1003\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKU\S-1-5-21-1860453707-579634664-3134055765-1003\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-1860453707-579634664-3134055765-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
[2010.08.13 12:56:18 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.07.11 08:59:19 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010.04.26 09:55:45 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.04.12 17:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll
[2006.03.22 04:27:56 | 000,098,304 | ---- | M] (Zylom) -- C:\Programme\Mozilla Firefox\plugins\npzylomgamesplayer.dll
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Programme\AskBarDis\bar\bin\askBar.dll (Ask.com)
O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\System32\ActiveToolBand.dll (HiTRUST)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Programme\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKU\S-1-5-21-1860453707-579634664-3134055765-1003\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKU\S-1-5-21-1860453707-579634664-3134055765-1003\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Programme\AskBarDis\bar\bin\askBar.dll (Ask.com)
O4 - HKLM..\Run: [Acer Tour]  File not found
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe (HiTRUST)
O4 - HKLM..\Run: [eRecoveryService]  File not found
O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4 - HKLM..\Run: [IJNetworkScanUtility] C:\Programme\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe (CANON INC.)
O4 - HKLM..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [LanguageShortcut] C:\Program Files\CyberLink\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [LManager] C:\Programme\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NWEReboot]  File not found
O4 - HKLM..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PLFSetL] C:\Windows\PLFSetL.exe (sonix)
O4 - HKLM..\Run: [PPort11reminder] C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Skytel] C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ()
O4 - HKLM..\Run: [SynTPStart] C:\Programme\Synaptics\SynTP\SynTPStart.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe (Acer Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-1860453707-579634664-3134055765-1003..\Run: [{1E03AC06-04C9-B24B-40E9-59A1378CD597}] C:\Users\****\AppData\Roaming\Ceyd\epcuy.exe File not found
O4 - HKU\S-1-5-21-1860453707-579634664-3134055765-1003..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (Acer Inc.)
O4 - HKU\S-1-5-21-1860453707-579634664-3134055765-1003..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe File not found
O4 - HKU\S-1-5-21-1860453707-579634664-3134055765-1003..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe (Time Information Services Ltd.)
O4 - HKU\S-1-5-21-1860453707-579634664-3134055765-1003..\Run: [PC Suite Tray] C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe (Nokia)
O4 - HKU\S-1-5-21-1860453707-579634664-3134055765-1003..\Run: [phonostarTimer] C:\Programme\phonostar-Player\phonostarTimer.exe ()
O4 - Startup: C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\****\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office1\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\****\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\****\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{1ddea49e-7f31-11dd-806a-000000000000}\Shell - "" = AutoRun
O33 - MountPoints2\{1ddea49e-7f31-11dd-806a-000000000000}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -- File not found
O33 - MountPoints2\{2a24c3ba-cf54-11dd-83b8-000000000000}\Shell\AutoRun\command - "" = F:\Menu.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 11.0.3
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 11.0.3
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
Drivers32: msacm.divxa32 - DivXa32.acm File not found
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codec - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.i420 - C:\Windows\System32\i420vfw.dll (www.helixcommunity.org)
Drivers32: vidc.VP60 - C:\Windows\System32\vp6vfw.dll (On2.com)
Drivers32: vidc.VP61 - C:\Windows\System32\vp6vfw.dll (On2.com)
Drivers32: vidc.yv12 - C:\Windows\System32\yv12vfw.dll (www.helixcommunity.org)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.08.13 14:36:32 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Roaming\Malwarebytes
[2010.08.13 14:36:23 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.08.13 14:36:21 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.08.13 14:36:21 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.08.13 14:36:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.08.13 14:36:08 | 006,153,352 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\****\Desktop\mbam-setup-1.46.exe
[2010.08.13 13:50:19 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Users\****\Desktop\OTL.exe
[2010.08.13 13:23:56 | 000,000,000 | ---D | C] -- C:\PerfLogs
[2010.08.05 10:50:39 | 000,000,000 | ---D | C] -- C:\Programme\NotenAssistent
[2010.08.03 09:08:55 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.07.29 16:42:35 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Roaming\PhotoScape
[2010.07.29 16:41:12 | 000,000,000 | ---D | C] -- C:\Programme\PhotoScape
[2010.07.23 02:47:24 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Roaming\Ceyd
[2008.02.20 13:43:37 | 000,172,032 | ---- | C] ( ) -- C:\Windows\System32\rsnp2uvc.dll
[2008.02.20 13:43:37 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\csnp2uvc.dll
[2007.07.04 18:20:35 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\Interop.Shell32.dll
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\****\Desktop\*.tmp files -> C:\Users\****\Desktop\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.08.13 23:24:50 | 000,618,430 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2010.08.13 23:24:50 | 000,587,178 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.08.13 23:24:50 | 000,122,648 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2010.08.13 23:24:50 | 000,101,250 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.08.13 23:24:49 | 001,418,600 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010.08.13 23:21:31 | 005,242,880 | -HS- | M] () -- C:\Users\****\NTUSER.DAT
[2010.08.13 23:18:29 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.08.13 23:18:28 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.08.13 23:18:23 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.08.13 23:18:20 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.08.13 23:18:16 | 2145,837,056 | -HS- | M] () -- C:\hiberfil.sys
[2010.08.13 23:12:15 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2010.08.13 23:12:01 | 000,524,288 | -HS- | M] () -- C:\Users\****\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2010.08.13 23:12:01 | 000,065,536 | -HS- | M] () -- C:\Users\****\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010.08.13 23:11:59 | 002,126,265 | -H-- | M] () -- C:\Users\****\AppData\Local\IconCache.db
[2010.08.13 14:36:25 | 000,000,822 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.08.13 14:36:05 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
[2010.08.13 14:35:54 | 006,153,352 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\****\Desktop\mbam-setup-1.46.exe
[2010.08.13 13:50:26 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\****\Desktop\OTL.exe
[2010.08.13 13:37:42 | 000,000,749 | RH-- | M] () -- C:\Windows\WindowsShell.Manifest
[2010.08.13 13:31:51 | 000,593,368 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010.08.13 13:07:08 | 000,101,888 | ---- | M] (Infineon Technologies AG) -- C:\Windows\System32\ifxcardm.dll
[2010.08.13 13:07:03 | 000,082,432 | ---- | M] (Gemalto, Inc.) -- C:\Windows\System32\axaltocm.dll
[2010.08.13 12:55:26 | 000,079,360 | ---- | M] () -- C:\Users\****\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.08.13 12:52:54 | 000,102,736 | ---- | M] () -- C:\Users\****\Desktop\bookmarks-2010-08-13.json
[2010.08.13 10:37:33 | 000,000,416 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{93CB5FD6-1A39-47DD-8245-9E837189822B}.job
[2010.08.05 10:50:39 | 000,002,046 | ---- | M] () -- C:\Users\Public\Desktop\NotenAssistent.lnk
[2010.08.03 22:17:59 | 000,008,192 | -H-- | M] () -- C:\Users\****\Documents\photothumb.db
[2010.08.03 15:25:10 | 000,180,256 | ---- | M] () -- C:\Users\****\AppData\Local\GDIPFONTCACHEV1.DAT
[2010.08.03 09:08:51 | 000,000,996 | ---- | M] () -- C:\Users\****\Desktop\DVDVideoSoft Free Studio.lnk
[2010.07.31 21:36:23 | 000,084,431 | ---- | M] () -- C:\Users\****\Desktop\studbesch_C1CAF894DBC017CC258732E067D93BD7.cit-prod-tomcat4.pdf
[2010.07.31 21:36:07 | 000,094,570 | ---- | M] () -- C:\Users\****\Desktop\studausweis_C1CAF894DBC017CC258732E067D93BD7.cit-prod-tomcat4.pdf
[2010.07.28 20:42:45 | 000,001,395 | -H-- | M] () -- C:\Users\****\Documents\maxdesk.ini2
[2010.07.28 20:42:45 | 000,000,148 | -H-- | M] () -- C:\Users\****\Documents\PP11Thumbs.ptn2
[2010.07.19 12:02:09 | 000,069,632 | ---- | M] () -- C:\Users\****\Documents\Essensliste.doc
[2010.07.15 15:28:20 | 000,029,108 | ---- | M] () -- C:\Users\****\Documents\Kochplan Töpfe.docx
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\****\Desktop\*.tmp files -> C:\Users\****\Desktop\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.08.13 14:36:25 | 000,000,822 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.08.13 14:36:05 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
[2010.08.13 12:52:54 | 000,102,736 | ---- | C] () -- C:\Users\****\Desktop\bookmarks-2010-08-13.json
[2010.08.05 10:50:39 | 000,002,046 | ---- | C] () -- C:\Users\Public\Desktop\NotenAssistent.lnk
[2010.08.03 22:17:59 | 000,008,192 | -H-- | C] () -- C:\Users\****\Documents\photothumb.db
[2010.08.03 09:08:47 | 000,000,996 | ---- | C] () -- C:\Users\****\Desktop\DVDVideoSoft Free Studio.lnk
[2010.07.31 21:36:23 | 000,084,431 | ---- | C] () -- C:\Users\****\Desktop\studbesch_C1CAF894DBC017CC258732E067D93BD7.cit-prod-tomcat4.pdf
[2010.07.31 21:36:07 | 000,094,570 | ---- | C] () -- C:\Users\****\Desktop\studausweis_C1CAF894DBC017CC258732E067D93BD7.cit-prod-tomcat4.pdf
[2010.07.18 18:38:29 | 000,069,632 | ---- | C] () -- C:\Users\****\Documents\Essensliste.doc
[2010.07.15 15:28:19 | 000,029,108 | ---- | C] () -- C:\Users\****\Documents\Kochplan Töpfe.docx
[2009.08.28 17:36:34 | 000,000,025 | ---- | C] () -- C:\Windows\auerword.ini
[2009.05.22 13:43:45 | 000,012,288 | ---- | C] () -- C:\Windows\impborl.dll
[2009.03.05 18:25:51 | 000,000,032 | ---- | C] () -- C:\Windows\Menu.INI
[2009.02.23 15:01:18 | 000,043,520 | ---- | C] () -- C:\Windows\System32\CmdLineExt03.dll
[2009.02.17 19:42:44 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2009.02.16 00:18:51 | 000,000,032 | ---- | C] () -- C:\Windows\CD_Start.INI
[2009.01.03 15:12:36 | 000,108,032 | ---- | C] () -- C:\Windows\System32\sh33w32.dll
[2008.11.06 18:37:32 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll
[2008.11.06 18:34:00 | 000,000,416 | ---- | C] () -- C:\Windows\System32\dtu100.dll.manifest
[2008.11.06 18:34:00 | 000,000,416 | ---- | C] () -- C:\Windows\System32\dpl100.dll.manifest
[2008.11.06 18:33:02 | 000,012,288 | ---- | C] () -- C:\Windows\System32\DivXWMPExtType.dll
[2008.08.03 12:52:06 | 000,116,224 | ---- | C] () -- C:\Windows\System32\redmonnt.dll
[2008.07.31 17:24:58 | 000,000,311 | ---- | C] () -- C:\Windows\keytrans.ini
[2008.07.31 17:24:33 | 000,006,866 | ---- | C] () -- C:\Windows\Keytran1.ini
[2008.07.31 15:51:06 | 000,000,474 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2008.07.31 15:51:06 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI
[2008.07.31 15:47:18 | 000,031,664 | ---- | C] () -- C:\Windows\maxlink.ini
[2008.07.31 13:15:23 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2008.02.20 23:22:30 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2008.02.20 14:17:06 | 000,015,656 | ---- | C] () -- C:\Windows\System32\drivers\int15_64.sys
[2008.02.20 14:12:14 | 000,065,536 | ---- | C] () -- C:\Windows\System32\NATTraversal.dll
[2008.02.20 13:43:38 | 001,749,376 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys
[2008.02.20 13:43:38 | 000,028,032 | ---- | C] () -- C:\Windows\System32\drivers\sncduvc.sys
[2008.02.20 13:43:37 | 001,749,376 | ---- | C] () -- C:\Windows\System32\snp2uvc.sys
[2008.02.20 13:43:37 | 000,028,032 | ---- | C] () -- C:\Windows\System32\sncduvc.sys
[2008.02.20 13:43:37 | 000,000,131 | ---- | C] () -- C:\Windows\System32\PidList.ini
[2008.02.20 13:43:37 | 000,000,131 | ---- | C] () -- C:\Windows\PidList.ini
[2007.07.05 05:31:13 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIBUN4.dll
[2007.07.05 02:54:52 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2007.07.04 18:20:33 | 000,331,776 | ---- | C] () -- C:\Windows\System32\ScrollBarLib.dll
[2007.07.04 17:32:20 | 000,001,132 | ---- | C] () -- C:\Windows\RtDefLvl.ini
[2007.04.25 17:33:22 | 000,266,240 | ---- | C] () -- C:\Windows\System32\NotesExtmngr.dll
[2007.04.25 17:32:50 | 000,204,800 | ---- | C] () -- C:\Windows\System32\NotesActnMenu.dll
[2007.04.25 17:32:46 | 000,086,016 | ---- | C] () -- C:\Windows\System32\MSNSpook.dll
[2007.04.25 17:31:00 | 000,028,672 | ---- | C] () -- C:\Windows\System32\BatchCrypto.dll
[2007.04.25 17:30:52 | 000,073,728 | ---- | C] () -- C:\Windows\System32\APISlice.dll
[2007.04.25 17:30:44 | 000,063,488 | ---- | C] () -- C:\Windows\System32\ShowErrMsg.dll
[2007.04.18 11:19:21 | 000,872,448 | ---- | C] () -- C:\Windows\iconv.dll
[2007.04.18 11:19:21 | 000,743,424 | ---- | C] () -- C:\Windows\libxml2.dll
[2007.04.18 11:19:21 | 000,000,041 | ---- | C] () -- C:\Windows\PreLaunch.ini
[2007.03.30 00:00:40 | 000,203,264 | R--- | C] () -- C:\Windows\System32\CddbCdda.dll
[2007.01.19 20:11:16 | 000,389,120 | ---- | C] () -- C:\Windows\System32\btwhidcs.dll
[2006.12.25 16:44:48 | 000,022,016 | ---- | C] () -- C:\Windows\System32\MailFormat_U.dll
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:25:21 | 000,061,440 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2003.02.20 17:53:42 | 000,005,702 | ---- | C] () -- C:\Windows\System32\OUTLPERF.INI
[2002.05.16 01:38:40 | 000,091,136 | ---- | C] () -- C:\Windows\System32\mp4fil32.dll
[2002.05.04 15:19:00 | 000,049,152 | ---- | C] () -- C:\Windows\System32\avisynthEx.dll
[2002.04.21 20:30:14 | 000,151,552 | ---- | C] () -- C:\Windows\System32\OggDS.dll
[2002.04.02 00:16:30 | 000,454,656 | ---- | C] () -- C:\Windows\System32\VorbisEnc.dll
[2002.04.02 00:16:14 | 000,118,784 | ---- | C] () -- C:\Windows\System32\vorbis.dll
[2002.04.02 00:15:40 | 000,011,264 | ---- | C] () -- C:\Windows\System32\ogg.dll
[2001.12.26 16:12:30 | 000,065,536 | ---- | C] () -- C:\Windows\System32\multiplex_vcd.dll
[2001.11.14 13:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll
[2001.09.03 23:46:38 | 000,110,592 | ---- | C] () -- C:\Windows\System32\Hmpg12.dll
[2001.07.30 16:33:56 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC.dll
[2001.07.23 22:04:36 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC_MMX.dll
 
========== LOP Check ==========
 
[2009.02.23 15:01:32 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Atari
[2009.01.18 10:23:29 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Audacity
[2009.02.17 20:10:00 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\avidemux
[2010.05.19 12:55:29 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Canon
[2009.05.31 13:10:55 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\CasaPortale.de
[2010.08.13 23:04:17 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Ceyd
[2009.11.09 11:44:02 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\de.zdf.alisa.AlisaDesktopWidget.294A8AB744E6A718EBCDAB4DFBEB66CC44041F8F.1
[2010.08.03 09:08:55 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\DVDVideoSoftIEHelpers
[2009.02.17 21:23:00 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\FLV Extract
[2009.02.17 19:51:48 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\GrabPro
[2008.09.09 21:16:41 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\ICQ
[2008.08.31 17:16:15 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\IrfanView
[2009.02.23 14:59:17 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Leadertech
[2009.12.15 18:39:49 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Nokia
[2009.01.05 00:41:10 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\OpenOffice.org
[2009.02.17 20:00:29 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Orbit
[2009.12.15 17:44:53 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\PC Suite
[2010.04.12 09:55:10 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\phonostar GmbH
[2010.04.12 09:48:11 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\phonostar-Player
[2010.08.03 22:26:26 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\PhotoScape
[2008.10.29 15:57:14 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\ScanSoft
[2008.08.31 17:04:05 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Shedko Badges
[2008.12.15 18:25:39 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\SpinTop
[2010.08.13 13:03:16 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Vasiu
[2008.08.03 10:16:14 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Zylom
[2010.08.13 23:12:20 | 000,032,534 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2010.08.13 10:37:33 | 000,000,416 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{93CB5FD6-1A39-47DD-8245-9E837189822B}.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2009.11.09 11:43:12 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Adobe
[2009.02.23 15:01:32 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Atari
[2008.07.31 12:47:59 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\ATI
[2009.01.18 10:23:29 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Audacity
[2009.02.17 20:10:00 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\avidemux
[2008.08.04 18:32:38 | 000,000,000 | R--D | M] -- C:\Users\****\AppData\Roaming\Brother
[2010.05.19 12:55:29 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Canon
[2009.05.31 13:10:55 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\CasaPortale.de
[2010.08.13 23:04:17 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Ceyd
[2009.10.22 21:04:36 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Corel
[2008.09.17 14:27:42 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\CyberLink
[2009.11.09 11:44:02 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\de.zdf.alisa.AlisaDesktopWidget.294A8AB744E6A718EBCDAB4DFBEB66CC44041F8F.1
[2009.02.15 12:39:40 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\DivX
[2010.08.12 21:58:26 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\dvdcss
[2010.08.03 09:08:55 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\DVDVideoSoftIEHelpers
[2009.02.17 21:23:00 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\FLV Extract
[2009.02.17 19:51:48 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\GrabPro
[2009.01.03 15:36:15 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Help
[2008.09.09 21:16:41 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\ICQ
[2008.08.03 10:16:14 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Identities
[2008.07.31 15:48:45 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\InstallShield
[2008.08.31 17:16:15 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\IrfanView
[2009.02.23 14:59:17 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Leadertech
[2008.07.31 12:47:31 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Macromedia
[2010.08.13 14:36:32 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Malwarebytes
[2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Media Center Programs
[2010.03.06 21:32:33 | 000,000,000 | --SD | M] -- C:\Users\****\AppData\Roaming\Microsoft
[2010.08.13 12:56:12 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Mozilla
[2009.12.15 18:39:49 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Nokia
[2009.01.05 00:41:10 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\OpenOffice.org
[2009.02.17 20:00:29 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Orbit
[2009.12.15 17:44:53 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\PC Suite
[2010.04.12 09:55:10 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\phonostar GmbH
[2010.04.12 09:48:11 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\phonostar-Player
[2010.08.03 22:26:26 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\PhotoScape
[2008.08.01 22:12:39 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Real
[2008.10.29 15:57:14 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\ScanSoft
[2008.08.31 17:04:05 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Shedko Badges
[2010.08.12 10:54:44 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Skype
[2010.08.12 10:49:29 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\skypePM
[2008.12.15 18:25:39 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\SpinTop
[2008.09.10 14:50:51 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\U3
[2010.08.13 13:03:16 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Vasiu
[2010.08.12 22:47:01 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\vlc
[2008.08.03 10:16:14 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Zylom
 
< %APPDATA%\*.exe /s >
[2010.03.17 13:22:08 | 000,038,784 | ---- | M] () -- C:\Users\****\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2010.06.12 16:57:45 | 002,568,656 | ---- | M] (Adobe Systems, Inc.) -- C:\Users\****\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
[2009.08.28 17:36:41 | 000,000,766 | R--- | M] () -- C:\Users\****\AppData\Roaming\Microsoft\Installer\{DF213333-DA71-48E9-9AB5-9FA7A5584E5D}\Symbolng.exe
[2009.08.28 17:36:41 | 000,000,766 | R--- | M] () -- C:\Users\****\AppData\Roaming\Microsoft\Installer\{DF213333-DA71-48E9-9AB5-9FA7A5584E5D}\Symbolngelb.exe
[2009.06.04 11:21:25 | 000,010,134 | R--- | M] () -- C:\Users\****\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
[2009.10.02 10:00:40 | 000,583,168 | ---- | M] () -- C:\Users\****\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\uno_packages\1B5E.tmp_\sun-pdfimport.oxt\xpdfimport.exe
[2010.04.12 09:49:37 | 000,045,056 | ---- | M] () -- C:\Users\****\AppData\Roaming\phonostar-Player\update.exe
[2006.08.15 10:15:04 | 000,110,592 | ---- | M] () -- C:\Users\****\AppData\Roaming\U3\temp\cleanup.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2007.07.04 17:17:27 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=8B10CE1C1F9F1D47E4DEB1A547A00CD4 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_8ed06b47\AGP440.sys
[2007.07.04 17:17:27 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=8B10CE1C1F9F1D47E4DEB1A547A00CD4 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.16400_none_b82caac9c18a4e3b\AGP440.sys
[2007.07.04 17:17:27 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=BF34B4A0E0B64440C5389AA6B902F4AD -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.20496_none_b85af81edaeb8461\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2008.01.19 09:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\drivers\atapi.sys
[2008.01.19 09:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.19 09:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2007.07.04 17:18:24 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=9E7E85EC61D1C9C3171CC08427108863 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_5a9555b4\atapi.sys
[2007.07.04 17:18:24 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=9E7E85EC61D1C9C3171CC08427108863 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20509_none_dbe4850d3d78c736\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: ENETHOOK.DLL  >
[2007.06.13 17:53:50 | 000,090,112 | R--- | M] (acer) MD5=B6A1D439109F7294C1BE14D5DC0C41AC -- C:\Acer\Empowering Technology\eNet\eNetHook.dll
[2007.06.13 17:53:50 | 000,090,112 | R--- | M] (acer) MD5=B6A1D439109F7294C1BE14D5DC0C41AC -- C:\Windows\System32\eNetHook.dll
 
< MD5 for: IASTOR.SYS  >
[2007.03.21 12:58:56 | 000,304,920 | ---- | M] (Intel Corporation) MD5=997E8F5939F2D12CD9F2E6B395724C16 -- C:\Programme\Intel\Intel Matrix Storage Manager\Driver\IaStor.sys
[2007.03.21 12:58:56 | 000,304,920 | ---- | M] (Intel Corporation) MD5=997E8F5939F2D12CD9F2E6B395724C16 -- C:\Windows\System32\drivers\iaStor.sys
[2007.03.21 12:58:56 | 000,304,920 | ---- | M] (Intel Corporation) MD5=997E8F5939F2D12CD9F2E6B395724C16 -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_3a63e5a6\iaStor.sys
[2007.03.21 12:59:30 | 000,381,720 | ---- | M] (Intel Corporation) MD5=9D7ED4275702E2FC409F2CC563245740 -- C:\Programme\Intel\Intel Matrix Storage Manager\Driver64\IaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2008.01.19 09:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.19 09:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2008.01.19 09:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\System32\netlogon.dll
[2008.01.19 09:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.19 09:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.19 09:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.19 09:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\System32\scecli.dll
[2008.01.19 09:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2007.07.04 17:26:07 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=63B4F59D7C89B1BF5277F1FFEFD491CD -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll
[2007.07.04 17:26:07 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=9D9F061EDA75425FC67F0365E3467C86 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll
[2006.11.02 11:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll
[2008.01.19 09:36:46 | 000,627,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
[2008.01.19 09:36:46 | 000,627,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2008.01.19 09:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\System32\winlogon.exe
[2008.01.19 09:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys
[2008.01.19 07:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.19 07:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006.11.02 12:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2007.10.04 09:02:42 | 000,356,352 | ---- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 -- C:\Windows\System32\ATIDEMGX.dll
[2008.01.19 09:34:08 | 000,347,136 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\dxtmsft.dll
[2008.01.19 09:34:08 | 000,214,528 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\dxtrans.dll
[2008.01.19 09:38:03 | 000,242,744 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rsaenh.dll
[2008.01.19 09:36:10 | 000,225,792 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\SLC.dll
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:85DA68FC
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:87FA5E8A
< End of report >

THX

SG

sxhor 13.08.2010 22:41
... Und hier noch der Extras.txt-File

Extras.txt

Code:
OTL Extras logfile created on: 13.08.2010 23:22:00 - Run 3
OTL by OldTimer - Version 3.2.9.1    Folder = C:\Users\****\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 51,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 69,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 111,57 Gb Total Space | 19,94 Gb Free Space | 17,87% Space Free | Partition Type: NTFS
Drive D: | 111,55 Gb Total Space | 45,95 Gb Free Space | 41,20% Space Free | Partition Type: NTFS
Drive E: | 4,21 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive F: | 3,74 Gb Total Space | 3,24 Gb Free Space | 86,66% Space Free | Partition Type: FAT32
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: ****-PC
Current User Name: ****
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [CEWE FOTOSCHAU] -- "C:\Program Files\CeWe Color\Mein CEWE FOTOBUCH\CEWE FOTOSCHAU.exe" -d "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Mein CEWE FOTOBUCH] -- "C:\Program Files\CeWe Color\Mein CEWE FOTOBUCH\Mein CEWE FOTOBUCH.exe" "%1" ()
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~3\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UacDisableNotify" = 0
"InternetSettingsDisableNotify" = 0
"AutoUpdateDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{001B472E-26AD-4E37-925A-EA82117F0FC8}" = rport=10243 | protocol=6 | dir=out | app=system |
"{0837FEF0-D363-4C0B-816A-79CAE7435D3B}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{1234D8F6-D5F8-4DEF-8C55-52BCED3F2ECD}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{129897C7-2F57-4346-BF73-87981C0A970E}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{187CE648-3B54-4277-844D-B0862A008780}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{1F0A1488-86FF-4E9D-8552-34BC57AFD403}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{214881B0-B8CF-4B3D-8607-3F3F669BE0BE}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{33E69D96-D647-49DE-AF91-1E1FC7EBABA3}" = lport=5721 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdc.exe,-4002 |
"{47A8EB99-A27F-4A68-943C-C1A79666F854}" = lport=1034 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdc.exe,-4003 |
"{53E30610-5502-4B58-BDF4-C724ECC06F10}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{7D9690C6-72D1-4E19-8916-820C0BA07C9E}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{89F63EE6-3E42-4E6B-9F85-E43873861C58}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{99BA877F-E487-4330-986C-B0A544273D80}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{A562013D-7C6D-42F8-B6B7-3CE7251B5798}" = lport=2869 | protocol=6 | dir=in | app=system |
"{A8EB947C-9346-4A03-8FA7-993B87339887}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{B62F0A3C-9736-4D16-A539-88C7EB795615}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{BBFCA833-F83E-4425-AB34-62D9A3228E3D}" = lport=10243 | protocol=6 | dir=in | app=system |
"{C4E0224A-CF22-4821-ABA0-883739A969EF}" = lport=5721 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdc.exe,-4002 |
"{D4B8A5AF-13CF-4FA0-A5FF-F8033F9775FB}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdc.exe,-4006 |
"{EB4A7972-E2E1-4492-A0F4-02ADF18FC09E}" = lport=1034 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdc.exe,-4003 |
"{F0A23AC1-8F68-4A18-89B5-5FFC95960EE6}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdc.exe,-4006 |
"{F8D4DA82-EBE2-4E1F-B8FE-25B1FA3FD437}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{FADF7306-196C-404F-B418-3519DCC6ED8E}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0DA6C8F6-8D7B-48F2-96BA-75A3D9124091}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{11D74191-954E-4E67-9766-36E95514B6FB}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{1265CA9D-EBC9-46BD-AC2A-CA8342643681}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{290F105C-8AC3-4474-8EB1-1CD6696F97F7}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{298E349D-CEDA-417C-B41D-1002CAA4565A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{39468D80-A2B2-449B-AB84-F40695BB4139}" = protocol=6 | dir=out | app=system |
"{5D5D8012-AF81-4261-8CD6-810295253C43}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{82731926-F854-45A7-9621-3E7A4CCB55AC}" = dir=in | app=c:\program files\cyberlink\powerdvd\powerdvd.exe |
"{9F474F74-0144-4553-AE08-AC0AFE5F39E7}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A0B40CE2-6C38-436F-BE59-90C27BCBDF98}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{A84B34F8-6D2C-45E1-B9A4-2F637B32F8FB}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{ADD9C9C4-4297-4075-B7DF-4EDD54DF57EE}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{E28B0FB7-2A76-4B66-8F04-0F57445641CE}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E6A56C57-96EE-4EC0-B186-711F33262CA4}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E94B5131-E860-40F3-96AA-723B1F46DAD4}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{F29355A2-3CE6-4D67-BB02-4E9DF18954B1}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"TCP Query User{1F396F7F-F874-4033-9210-094AB06AA91D}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe |
"TCP Query User{2C1DCDF1-8A64-4B8F-B21B-839A1A83A1B2}C:\program files\orbitdownloader\orbitnet.exe" = protocol=6 | dir=in | app=c:\program files\orbitdownloader\orbitnet.exe |
"TCP Query User{46FA8B15-48BD-4825-B00B-0366A986DF4A}C:\program files\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"TCP Query User{76F58847-9753-4ECA-A420-6E120D1F571E}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"TCP Query User{793E3879-6149-4E61-ADA6-0EA007F5AB3C}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"TCP Query User{8FB197D3-AEC7-491A-AC7D-1C51D271DB77}C:\windows\system32\taskeng.exe" = protocol=6 | dir=in | app=c:\windows\system32\taskeng.exe |
"TCP Query User{9A88EA22-A153-4724-817B-F28059C6D1D3}C:\windows\system32\taskeng.exe" = protocol=6 | dir=in | app=c:\windows\system32\taskeng.exe |
"TCP Query User{C06BE2CF-4700-437A-8D7B-061F300CCDAE}C:\program files\tvuplayer\tvuplayer.exe" = protocol=6 | dir=in | app=c:\program files\tvuplayer\tvuplayer.exe |
"TCP Query User{CDB6A074-9B94-433F-ACCD-E5D426861989}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{E7B1755E-59F5-4365-8029-02DBF6828B63}C:\program files\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"TCP Query User{F024AEE3-7E4C-4938-B0AB-3E318E4AF080}C:\program files\icq6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6\icq.exe |
"UDP Query User{0E81E263-6338-47F5-8BBB-906855B09868}C:\program files\orbitdownloader\orbitnet.exe" = protocol=17 | dir=in | app=c:\program files\orbitdownloader\orbitnet.exe |
"UDP Query User{290BC30F-144F-42B9-9998-3A80455D3B20}C:\windows\system32\taskeng.exe" = protocol=17 | dir=in | app=c:\windows\system32\taskeng.exe |
"UDP Query User{2CE911BE-3658-4B0D-B615-7914421F41C4}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{3919ACD9-C4B8-4E5F-B02C-735FF1A85FF1}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"UDP Query User{5F04CAF8-B87D-40D0-BCBB-1F025E2C7E9A}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"UDP Query User{85622D43-019C-4EEE-8992-A2CA31F13F08}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe |
"UDP Query User{95276F31-7650-4354-9E42-67623B771D42}C:\program files\icq6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6\icq.exe |
"UDP Query User{9BF88250-B39F-4548-9969-F70978FDFE0D}C:\windows\system32\taskeng.exe" = protocol=17 | dir=in | app=c:\windows\system32\taskeng.exe |
"UDP Query User{A0B7B2BB-4415-4D7D-8869-BB35BE327038}C:\program files\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"UDP Query User{A5056430-8F33-4365-BD22-7B44F210E590}C:\program files\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"UDP Query User{D4BBD2D9-A4E3-4D67-A218-17D258989CF5}C:\program files\tvuplayer\tvuplayer.exe" = protocol=17 | dir=in | app=c:\program files\tvuplayer\tvuplayer.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0138F525-6C8A-333F-A105-14AE030B9A54}" = Visual C++ 9.0 CRT (x86) WinSXS MSM
"{02F020A7-4981-4F6E-C40D-5BA7C007D518}" = ccc-core-static
"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
"{0762EBC7-0C57-76DD-F1B9-0E69B867C802}" = Catalyst Control Center Graphics Light
"{089523E6-D681-1B0C-6458-CC42C5CA5DEF}" = Catalyst Control Center Localization Finnish
"{09298F26-A95C-31E2-9D95-2C60F586F075}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{11316260-6666-467B-AC34-183FCB5D4335}" = Acer Mobility Center Plug-In
"{116FF17B-1A30-4FC2-9B01-5BC5BD46B0B3}" = Acer eLock Management
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP560_series" = Canon MP560 series MP Drivers
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"{17533FFD-37B6-A54A-1654-AD053A247A37}" = Catalyst Control Center Localization Swedish
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1A5E5061-543A-5722-7441-7BC6CF1C5C62}" = Catalyst Control Center Localization Portuguese
"{1E239B20-E618-41D4-47E3-C3AE4A066214}" = Catalyst Control Center Core Implementation
"{1F2A5DF9-40E1-4644-ADBD-D80F347BA6C8}" = Windows Mobile-Gerätecenter
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{26976749-1A33-20A5-DCE9-63EFEEAECA03}" = Catalyst Control Center Localization Greek
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 20
"{2DFB5485-A3EF-4298-9280-4AF80C9F4BE9}" = Microsoft SQL Server VSS Writer
"{332CC6BF-E6C7-48EE-BA3D-435E576AD67F}" = PaperPort Image Printer
"{347952D7-B923-36BE-B35C-99B4C7809795}" = Catalyst Control Center Localization Turkish
"{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = Acer Crystal Eye Webcam Video Class Camera
"{3B810746-962A-2A85-E733-3E62EF3D4BEB}" = Catalyst Control Center Localization Thai
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CE4B975-A5C1-43C0-A565-C00F0ABFC94C}" = PC-Bibliothek 3.0
"{4E5EE953-0D92-A385-E3A0-FBFCB2DE15AA}" = EA Download Manager UI
"{4EA46C71-CF0B-E932-F09E-81E83D4C3A4E}" = Catalyst Control Center Localization German
"{4EC13867-3C71-0CEC-88BC-FA0D308966FF}" = Catalyst Control Center Localization Chinese Standard
"{4F1DCA42-2030-437C-A94E-736692A499C1}" = Nokia Connectivity Cable Driver
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{502B07AB-9DD1-F9AC-7D1A-6F265003FBFD}" = Catalyst Control Center Localization French
"{505AFDC0-5E72-4928-8368-5DEA385E3647}" = CorelDRAW Graphics Suite 12
"{547DCEC7-DD2A-47E9-82C7-5CF1EAB526DA}" = Microsoft SQL Server Native Client
"{58E5844B-7CE2-413D-83D1-99294BF6C74F}" = Acer ePower Management
"{5AFEABF5-7411-4C29-9FA9-71ABE880662D}" = Nokia PC Suite
"{5C39E087-5518-7F09-7DCF-12073726CF84}" = Catalyst Control Center Localization Czech
"{5E6F1230-06E8-C7A9-89B7-09C0414BCC9E}" = Catalyst Control Center Localization Danish
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5
"{60FCDA4F-8008-FBDF-FFEC-EA5101E9F3F4}" = Catalyst Control Center Localization Japanese
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{67ADE9AF-5CD9-4089-8825-55DE4B366799}" = NTI Backup NOW! 4.7
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6DFA698C-EB46-412F-9886-93B2C8617841}" = Catalyst Control Center - Branding
"{6F7EA6CA-79F4-44A0-A370-8E82BB16534A}" = NTI Shadow
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{76E1503E-8DBB-3521-1880-5B2D288163F2}" = Catalyst Control Center Localization Norwegian
"{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7D083C9E-3822-4FCE-BCB8-F39B16880C60}" = Catalyst Control Center Localization Dutch
"{88637F72-B46E-43F9-B306-6DA1FF478D51}" = WIDCOMM Bluetooth Software 6.0.1.3900
"{89280B77-24FA-9C0B-3BF0-8ED7E8873644}" = Catalyst Control Center Localization Spanish
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel(R) Matrix Storage Manager
"{90A40407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{94389919-B0AA-4882-9BE8-9F0B004ECA35}" = Acer Tour
"{95FB5C06-F577-D340-5B40-9F1243F30CDD}" = Catalyst Control Center Localization Korean
"{97BA58C3-4AB1-47FB-92BC-5F739007242A}" = NotenAssistent
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{99B7756C-AA8B-1EDD-697B-2B198BDCC34B}" = Catalyst Control Center Localization Russian
"{99E862CC-6F69-4D39-99AA-DBF71BF3B585}" = OpenOffice.org 3.1
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3FEC306-FBFF-4B0D-95B9-F9C67C65079E}" = Brother MFL-Pro Suite
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AA047D7C-5E7C-4878-B75C-77589151B563}" = Acer Crystal Eye webcam
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AB6097D9-D722-4987-BD9E-A076E2848EE2}" = Acer Empowering Technology
"{AB71E8EA-902A-654F-0E08-862CA0328764}" = ccc-utility
"{AC4BB070-A5CB-86C8-659F-85C62E27F046}" = Catalyst Control Center Localization Polish
"{AC76BA86-7AD7-1033-7B44-A81300000003}" = Adobe Reader 8.1.4
"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8
"{AEEAE013-92F1-4515-B278-139F1A692A36}" = Acer eDataSecurity Management
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{AF255B94-DFE9-5977-1F82-0D9E4073EABD}" = Catalyst Control Center Localization Hungarian
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B6C89654-A6A2-477C-873B-724EC1C56407}" = ScanSoft PaperPort 11
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BE1826A9-7EEE-492A-B3BC-DEF3DFAE37EE}" = TIPCI
"{BE6C4D32-7CDB-8639-3595-984859850522}" = ATI Catalyst Install Manager
"{BF839132-BD43-4056-ACBF-4377F4A88E2A}" = Acer ePresentation Management
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = Die Sims™ 3
"{C06554A1-2C1E-4D20-B613-EE62C79927CC}" = Acer eNet Management
"{C1E37C71-121A-6811-153A-705C0A368CD3}" = Catalyst Control Center Localization Italian
"{CB8CA439-DA83-419C-A4CF-5A0A50025144}" = Windows Mobile-Gerätecenter: Treiberupdate
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe  1.4.142.1
"{CE65A9A0-9686-45C6-9098-3C9543A412F0}" = Acer eSettings Management
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D3B3B9B2-FE73-44CB-8C0A-F737D92F991B}" = Broadcom Gigabit Integrated Controller
"{D9782503-10D1-A2D4-A5B7-C081C7B63708}" = Catalyst Control Center Localization Chinese Traditional
"{DB780B85-B4B5-4864-A49C-9B706B169C93}" = TIPCI
"{DF213333-DA71-48E9-9AB5-9FA7A5584E5D}" = "Arbeitsblätter gestalten - blitzschnell mit Word"
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E9BC886E-0D8A-4EF5-B793-30DB776C6E2C}" = PC Connectivity Solution
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"3A5DEFA413DDE699DBA6EBE0A63534ACA524D30F" = Windows-Treiberpaket - Nokia pccsmcfd  (10/12/2007 6.85.4.0)
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11
"Ask Toolbar_is1" = Ask Toolbar
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Canon MP560 series Benutzerregistrierung" = Canon MP560 series Benutzerregistrierung
"Canon_IJ_Network_Scan_UTILITY" = Canon IJ Network Scan Utility
"Canon_IJ_Network_UTILITY" = Canon IJ Network Tool
"CanonMyPrinter" = Canon Utilities My Printer
"CanonSolutionMenu" = Canon Utilities Solution Menu
"CBF192A85B624E32B8D19ADEEF2DCFC5BC3AA73A" = Windows-Treiberpaket - Nokia Modem  (03/05/2008 3.7)
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFAOR2C06_118" = HDAUDIO Soft Data Fax Modem with SmartCP
"com.ea.Vault.919CACB699904AC5D41B606703500DD39747C02D.1" = EA Download Manager UI
"CUEcards 2000" = CUEcards 2000
"Diesterweg - Bausteine Fibel" = Diesterweg - Bausteine Fibel
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"E092B2EBF2FFE83E896F8F7F829A7B5D7D1B2F9D" = Windows-Treiberpaket - Nokia Modem  (03/13/2008 6.86.0.1)
"EA Download Manager" = EA Download Manager
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4
"Free YouTube Download_is1" = Free YouTube Download 2.3
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.7
"FreePDF_XP" = FreePDF XP (Remove only)
"GPL Ghostscript 8.56" = GPL Ghostscript 8.56
"GPL Ghostscript Fonts" = GPL Ghostscript Fonts
"GridVista" = Acer GridVista
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"ICQToolbar" = ICQ Toolbar
"InstallShield_{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"InstallShield_{6F7EA6CA-79F4-44A0-A370-8E82BB16534A}" = NTI Shadow
"InstallShield_{BE1826A9-7EEE-492A-B3BC-DEF3DFAE37EE}" = Texas Instruments PCIxx21/x515/xx12 drivers.
"InstallShield_{DB780B85-B4B5-4864-A49C-9B706B169C93}" = Texas Instruments PCIxx21/x515/xx12 drivers.
"LManager" = Launch Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mein CEWE FOTOBUCH" = Mein CEWE FOTOBUCH
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MILA_lets-smile" = MILA_lets-smile  Screen Saver
"MP Navigator EX 3.0" = Canon MP Navigator EX 3.0
"Nokia PC Suite" = Nokia PC Suite
"phonostar3RadioPlayer_is1" = phonostar-Player Version 3.01.5
"PhotoScape" = PhotoScape
"Picasa 3" = Picasa 3
"RealPlayer 6.0" = RealPlayer
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"RollerCoaster Tycoon 3_is1" = RollerCoaster Tycoon 3
"Schulschriften" = Schulschriften
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.0.1
"WinRAR archiver" = WinRAR archiver
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 07.12.2009 08:35:43 | Computer Name = ****-PC | Source = Microsoft Office 11 | ID = 2001
Description =
 
Error - 07.12.2009 11:25:19 | Computer Name = ****-PC | Source = Application Hang | ID = 1002
Description = Programm OUTLOOK.EXE, Version 11.0.5510.0 arbeitet nicht mehr mit
Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über
 das Problem zu suchen.  Prozess-ID: 1674  Anfangszeit: 01ca7739c9fb494c  Zeitpunkt der
 Beendigung: 13
 
Error - 08.12.2009 03:58:52 | Computer Name = ****-PC | Source = WerSvc | ID = 5007
Description =
 
Error - 08.12.2009 05:43:07 | Computer Name = ****-PC | Source = Application Hang | ID = 1002
Description = Programm OUTLOOK.EXE, Version 11.0.5510.0 arbeitet nicht mehr mit
Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über
 das Problem zu suchen.  Prozess-ID: df0  Anfangszeit: 01ca77e399d727cc  Zeitpunkt der
 Beendigung: 505
 
Error - 08.12.2009 14:10:58 | Computer Name = ****-PC | Source = WerSvc | ID = 5007
Description =
 
Error - 08.12.2009 14:55:01 | Computer Name = ****-PC | Source = Application Hang | ID = 1002
Description = Programm OUTLOOK.EXE, Version 11.0.5510.0 arbeitet nicht mehr mit
Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über
 das Problem zu suchen.  Prozess-ID: 14c8  Anfangszeit: 01ca783108295eab  Zeitpunkt der
 Beendigung: 442
 
Error - 09.12.2009 03:43:58 | Computer Name = ****-PC | Source = WerSvc | ID = 5007
Description =
 
Error - 09.12.2009 17:26:28 | Computer Name = ****-PC | Source = Application Hang | ID = 1002
Description = Programm OUTLOOK.EXE, Version 11.0.5510.0 arbeitet nicht mehr mit
Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über
 das Problem zu suchen.  Prozess-ID: 15b4  Anfangszeit: 01ca78fe2a834aa9  Zeitpunkt der
 Beendigung: 29
 
Error - 10.12.2009 04:17:13 | Computer Name = ****-PC | Source = WerSvc | ID = 5007
Description =
 
Error - 11.12.2009 04:05:13 | Computer Name = ****-PC | Source = WerSvc | ID = 5007
Description =
 
[ OSession Events ]
Error - 26.02.2009 06:18:20 | Computer Name = ****-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 7720
 seconds with 5280 seconds of active time.  This session ended with a crash.
 
Error - 03.10.2009 13:02:57 | Computer Name = ****-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 36
 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error - 09.10.2009 08:45:24 | Computer Name = ****-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 1934
 seconds with 1860 seconds of active time.  This session ended with a crash.
 
Error - 29.05.2010 15:23:53 | Computer Name = ****-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 19582
 seconds with 13440 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 13.08.2010 12:48:08 | Computer Name = ****-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 13.08.2010 um 15:48:13 unerwartet heruntergefahren.
 
Error - 13.08.2010 12:48:09 | Computer Name = ****-PC | Source = HTTP | ID = 15016
Description =
 
Error - 13.08.2010 12:49:01 | Computer Name = ****-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 13.08.2010 12:49:01 | Computer Name = ****-PC | Source = Service Control Manager | ID = 7009
Description =
 
Error - 13.08.2010 12:49:01 | Computer Name = ****-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 13.08.2010 14:37:33 | Computer Name = ****-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 13.08.2010 um 20:30:08 unerwartet heruntergefahren.
 
Error - 13.08.2010 14:37:35 | Computer Name = ****-PC | Source = HTTP | ID = 15016
Description =
 
Error - 13.08.2010 14:37:43 | Computer Name = ****-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 13.08.2010 17:18:23 | Computer Name = ****-PC | Source = HTTP | ID = 15016
Description =
 
Error - 13.08.2010 17:18:32 | Computer Name = ****-PC | Source = Service Control Manager | ID = 7000
Description =
 
 
< End of report >

THX
SG

markusg 13.08.2010 22:54
hmm du updatest dein system nicht, schaust filme auf dubiosen seiten und machst dann noch online banking? ganz schön mutig.....
du brauchst kein avira professional, du solltest dir erst mal über dein surfverhalten gedanken machen und über regelmäßige updates.
weist du noch die genaue seite, bzw den suchbegriff? wenn ja, sende ihn mir als persönliche nachicht.

bitte erstelle und poste ein combofix log.
Ein Leitfaden und Tutorium zur Nutzung von ComboFix

sxhor 13.08.2010 23:16
Sers,
der Rechner ist von ner Freundin. Sie macht immer brav die automatischen Updates, ich habe heute aber festgestellt, dass die SPs z.B. offenbar nicht automatisch installiert wurden. Habe erst heute morgen SP1 von Vista draufgeworfen. Sie dachte eben, es reicht wenn man die automatischen Updates aktiviert und hin und wieder ein gelbes Ausrufezeichen beim Herunterfahren signalisiert das Updates installiert werden.


Hier der Combofix-Log


Code:
ComboFix 10-08-12.03 - **** 14.08.2010  0:02.1.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6001.1.1252.49.1031.18.2046.1015 [GMT 2:00]
ausgeführt von:: c:\users\****\Desktop\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
SP: AntiVir Desktop *disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
SP: Windows-Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Acer Crystal Eye Webcam Video Class Camera
c:\programdata\Microsoft\Windows\Start Menu\Programs\Acer Crystal Eye Webcam Video Class Camera \Uninstall.lnk
c:\users\****\AppData\Roaming\Ceyd\epcuy.exe
c:\windows\Temp\log.txt

.
(((((((((((((((((((((((  Dateien erstellt von 2010-07-13 bis 2010-08-13  ))))))))))))))))))))))))))))))
.

2010-08-13 22:08 . 2010-08-13 22:08        --------        d-----w-        c:\users\Default\AppData\Local\temp
2010-08-13 12:36 . 2010-08-13 12:36        --------        d-----w-        c:\users\****\AppData\Roaming\Malwarebytes
2010-08-13 12:36 . 2010-04-29 13:39        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-13 12:36 . 2010-08-13 12:36        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2010-08-13 12:36 . 2010-08-13 12:36        --------        d-----w-        c:\programdata\Malwarebytes
2010-08-13 12:36 . 2010-04-29 13:39        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys
2010-08-13 11:23 . 2010-08-13 11:23        --------        d-----w-        C:\PerfLogs
2010-08-05 08:50 . 2010-08-05 08:50        --------        d-----w-        c:\program files\NotenAssistent
2010-08-03 07:08 . 2010-08-03 07:08        --------        d-----w-        c:\users\****\AppData\Roaming\DVDVideoSoftIEHelpers
2010-07-29 14:42 . 2010-08-03 20:26        --------        d-----w-        c:\users\****\AppData\Roaming\PhotoScape
2010-07-29 14:41 . 2010-07-29 14:41        --------        d-----w-        c:\program files\PhotoScape
2010-07-23 00:47 . 2010-08-13 21:04        --------        d-----w-        c:\users\****\AppData\Roaming\Ceyd

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-13 21:24 . 2007-07-05 01:03        618430        ----a-w-        c:\windows\system32\perfh007.dat
2010-08-13 21:24 . 2007-07-05 01:03        122648        ----a-w-        c:\windows\system32\perfc007.dat
2010-08-13 21:12 . 2008-02-20 11:42        12        ----a-w-        c:\windows\bthservsdp.dat
2010-08-13 12:36 . 2010-08-13 12:36        0        ---ha-w-        c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2010-08-13 11:27 . 2006-11-02 12:37        --------        d-----w-        c:\program files\Windows Calendar
2010-08-13 11:27 . 2006-11-02 12:37        --------        d-----w-        c:\program files\Windows Sidebar
2010-08-13 11:27 . 2006-11-02 11:18        --------        d-----w-        c:\program files\Windows Mail
2010-08-13 11:27 . 2006-11-02 12:37        --------        d-----w-        c:\program files\Windows Collaboration
2010-08-13 11:27 . 2006-11-02 12:37        --------        d-----w-        c:\program files\Windows Journal
2010-08-13 11:27 . 2006-11-02 12:37        --------        d-----w-        c:\program files\Windows Photo Gallery
2010-08-13 11:26 . 2006-11-02 12:37        --------        d-----w-        c:\program files\Windows Defender
2010-08-13 11:23 . 2006-11-02 10:25        665600        ----a-w-        c:\windows\inf\drvindex.dat
2010-08-13 11:07 . 2006-11-02 10:32        101888        ----a-w-        c:\windows\system32\ifxcardm.dll
2010-08-13 11:07 . 2006-11-02 10:32        82432        ----a-w-        c:\windows\system32\axaltocm.dll
2010-08-13 11:03 . 2008-10-16 08:24        --------        d-----w-        c:\users\****\AppData\Roaming\Vasiu
2010-08-12 20:47 . 2009-08-13 12:28        --------        d-----w-        c:\users\****\AppData\Roaming\vlc
2010-08-12 19:58 . 2008-11-02 11:27        --------        d-----w-        c:\users\****\AppData\Roaming\dvdcss
2010-08-12 08:54 . 2008-09-15 11:11        --------        d-----w-        c:\users\****\AppData\Roaming\Skype
2010-08-12 08:49 . 2008-09-15 11:14        --------        d-----w-        c:\users\****\AppData\Roaming\skypePM
2010-08-03 13:25 . 2008-07-31 10:46        180256        ----a-w-        c:\users\****\AppData\Local\GDIPFONTCACHEV1.DAT
2010-08-03 13:05 . 2009-01-04 22:41        1        ----a-w-        c:\users\****\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-08-03 07:08 . 2009-02-17 18:02        --------        d-----w-        c:\program files\Common Files\DVDVideoSoft
2010-07-20 11:41 . 2007-07-04 16:10        --------        d-----w-        c:\programdata\Microsoft Help
2010-07-11 16:27 . 2008-08-03 10:52        --------        d-----w-        c:\programdata\FreePDF
2010-07-11 06:59 . 2010-07-11 06:58        --------        d-----r-        c:\program files\Skype
2010-07-11 06:58 . 2010-07-11 06:58        --------        d-----w-        c:\program files\Common Files\Skype
2010-07-11 06:58 . 2008-09-15 11:10        --------        d-----w-        c:\programdata\Skype
2010-06-15 13:26 . 2010-06-15 13:26        1079048        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2010-06-12 14:57 . 2010-06-12 14:57        2568656        ----a-w-        c:\users\****\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
2010-05-21 12:14 . 2009-10-03 07:52        221568        ------w-        c:\windows\system32\MpSigStub.exe
2008-02-20 21:35 . 2008-02-20 21:27        8192        --sha-w-        c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-08-26 09:32        279944        ----a-w-        c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-08-26 279944]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-08-26 279944]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-05-22 151552]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PCSync2.exe" [2008-03-26 1232896]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-04-16 1079808]
"phonostarTimer"="c:\program files\phonostar-Player\phonostarTimer.exe" [2010-03-26 39936]
"Skype"="c:\program files\Skype\\Phone\Skype.exe" [2010-05-13 26192168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-03-21 174872]
"RtHDVCpl"="RtHDVCpl.exe" [2007-05-29 4472832]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-09-07 1021224]
"PLFSetL"="c:\windows\PLFSetL.exe" [2007-07-05 94208]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-09-07 102400]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2007-10-28 72736]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-10-11 62760]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-04-25 457216]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2007-10-17 858632]
"WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdc.exe" [2007-01-24 563080]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-01-29 30248]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-01-29 46632]
"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-02-01 255528]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2007-03-12 663552]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-01-26 65536]
"FreePDF Assistant"="c:\program files\FreePDF_XP\fpassist.exe" [2007-06-26 312320]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-07-27 1983816]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-03-18 767312]
"IJNetworkScanUtility"="c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe" [2009-05-19 136544]
"Skytel"="Skytel.exe" [2007-05-29 1826816]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]

c:\users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

R3 WisINT15;WisINT15;c:\elements\1stboot\WisINT15.SYS [x]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2007-02-08 179712]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs        REG_MULTI_SZ          BthServ
WindowsMobile        REG_MULTI_SZ          wcescomm rapimgr
LocalServiceRestricted        REG_MULTI_SZ          WcesComm RapiMgr
.
Inhalt des "geplante Tasks" Ordners

2010-08-13 c:\windows\Tasks\User_Feed_Synchronization-{93CB5FD6-1A39-47DD-8245-9E837189822B}.job
- c:\windows\system32\msfeedssync.exe [2008-08-03 07:33]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://start.icq.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = hxxp://de.intl.acer.yahoo.com
uSearchURL,(Default) = hxxp://de.rd.yahoo.com/customize/ycomp/defaults/su/*hxxp://de.yahoo.com
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Free YouTube to Mp3 Converter - c:\users\****\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: {9F23F801-DDF5-40FA-8889-E48F1B948A54} = 10.4.32.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

HKCU-Run-EA Core - c:\program files\Electronic Arts\EADM\Core.exe
HKCU-Run-{1E03AC06-04C9-B24B-40E9-59A1378CD597} - c:\users\****\AppData\Roaming\Ceyd\epcuy.exe
HKLM-Run-Acer Tour - (no file)
HKLM-Run-eRecoveryService - (no file)
HKLM-Run-NWEReboot - (no file)
AddRemove-Diesterweg - Bausteine Fibel - d:\progra~1\DIESTE~1\UNWISE.EXE



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-08-14 00:09
Windows 6.0.6001 Service Pack 1 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2010-08-14  00:12:45
ComboFix-quarantined-files.txt  2010-08-13 22:12

Vor Suchlauf: 18 Verzeichnis(se), 20.962.914.304 Bytes frei
Nach Suchlauf: 21 Verzeichnis(se), 22.641.205.248 Bytes frei

- - End Of File - - 5DDF84BB0E0EC0CCD07D7DE65EC4BD97

Grüße
SG

markusg 13.08.2010 23:19
ok öffne "mein computer" (arbeitsplatz) dort c: dann rechtsklick auf qoobox, und zu qoobox.rar oder zip hinzufügen, das an uns hochladen.
http://www.trojaner-board.de/54791-a...ner-board.html
wenns ne fehlermeldung gibt, öffne den ordner, qwähle quarantain und lad den hoch.
gib bescheid, wenn das erledigt ist

sxhor 13.08.2010 23:24
Erledigt. Was lade ich da eigentlich zu euch hoch??

Grüße
SG

markusg 13.08.2010 23:35
update bitte malwarebytes und mache nen komplett scan, funde löschen, log posten

markusg 13.08.2010 23:35
eine malware datei.

sxhor 13.08.2010 23:36
Mache ich morgen, ich melde mich wieder!

Vielen Dank bis hierher!

Grüße
SG

sxhor 14.08.2010 12:38
Guten Morgen,
habe jetzt wie empfohlen den Malwarebytes lauf erneuert durchgeführt.

Hier das log:


Code:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4427

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

14.08.2010 10:39:25
mbam-log-2010-08-14 (10-39-25).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 383836
Laufzeit: 1 Stunde(n), 54 Minute(n), 26 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Würde mich freuen, wenn nochmal jemand drüber schauen könnte!

Grüße
SG

markusg 14.08.2010 12:41
jetzt erst mal windows updates, servicepack 2 fehlt, ie 8 ebenso. dann ne neue otl.txt posten.

sxhor 15.08.2010 10:47
Guten Morgen,
Updates und SP2 sind drin. Hier die gewünschten Logs:


OTL.txt [Konnte es leider nicht hochladen, deshalb hier als zip... hoffe das geht i.O.]:

Anhang 8240


Extras.txt:

Code:
OTL Extras logfile created on: 15.08.2010 10:50:41 - Run 4
OTL by OldTimer - Version 3.2.9.1    Folder = C:\Users\****\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18943)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 48,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 65,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 111,57 Gb Total Space | 15,76 Gb Free Space | 14,13% Space Free | Partition Type:

NTFS
Drive D: | 111,55 Gb Total Space | 45,96 Gb Free Space | 41,20% Space Free | Partition Type:

NTFS
Drive E: | 4,21 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive F: | 3,74 Gb Total Space | 2,88 Gb Free Space | 76,99% Space Free | Partition Type: FAT32
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: ****-PC
Current User Name: ****
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft

Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%

\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --

playlist-enqueue "%1" ()
Directory [CEWE FOTOSCHAU] -- "C:\Program Files\CeWe Color\Mein CEWE FOTOBUCH\CEWE

FOTOSCHAU.exe" -d "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Mein CEWE FOTOBUCH] -- "C:\Program Files\CeWe Color\Mein CEWE FOTOBUCH\Mein CEWE

FOTOBUCH.exe" "%1" ()
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~3\Office12\ONENOTE.EXE "%L" (Microsoft

Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-

playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft

Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 1
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy

\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy

\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy

\StandardProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy

\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy

\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy

\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy

\FirewallRules]
"{001B472E-26AD-4E37-925A-EA82117F0FC8}" = rport=10243 | protocol=6 | dir=out | app=system |
"{05895E4D-D17F-430B-87F1-1DEF25199407}" = lport=5721 | protocol=6 | dir=in | name=@

%systemroot%\windowsmobile\wmdc.exe,-4002 |
"{0837FEF0-D363-4C0B-816A-79CAE7435D3B}" = lport=999 | protocol=6 | dir=in | app=%systemroot%

\windowsmobile\wmdhost.exe |
"{1234D8F6-D5F8-4DEF-8C55-52BCED3F2ECD}" = lport=2177 | protocol=17 | dir=in | svc=qwave |

app=%systemroot%\system32\svchost.exe |
"{129897C7-2F57-4346-BF73-87981C0A970E}" = lport=999 | protocol=6 | dir=in | app=%systemroot%

\windowsmobile\wmdhost.exe |
"{187CE648-3B54-4277-844D-B0862A008780}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%

\windowsmobile\wmdhost.exe |
"{1F0A1488-86FF-4E9D-8552-34BC57AFD403}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr |

app=%systemroot%\system32\svchost.exe |
"{214881B0-B8CF-4B3D-8607-3F3F669BE0BE}" = rport=2177 | protocol=17 | dir=out | svc=qwave |

app=%systemroot%\system32\svchost.exe |
"{2D67F7E3-342F-481C-B917-986B4CCEAD54}" = lport=1034 | protocol=6 | dir=in | name=@

%systemroot%\windowsmobile\wmdc.exe,-4003 |
"{33E69D96-D647-49DE-AF91-1E1FC7EBABA3}" = lport=5721 | protocol=6 | dir=in | name=@

%systemroot%\windowsmobile\wmdc.exe,-4002 |
"{47A8EB99-A27F-4A68-943C-C1A79666F854}" = lport=1034 | protocol=6 | dir=in | name=@

%systemroot%\windowsmobile\wmdc.exe,-4003 |
"{53E30610-5502-4B58-BDF4-C724ECC06F10}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv |

app=%systemroot%\system32\svchost.exe |
"{642B3212-758E-4260-8AEB-7FDC3AF0AA7C}" = lport=990 | protocol=6 | dir=in | svc=rapimgr |

app=%systemroot%\system32\svchost.exe |
"{798167F6-1C82-41C7-BDEF-30FE34DD382D}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%

\windowsmobile\wmdhost.exe |
"{7D9690C6-72D1-4E19-8916-820C0BA07C9E}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr |

app=%systemroot%\system32\svchost.exe |
"{89F63EE6-3E42-4E6B-9F85-E43873861C58}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv |

app=%systemroot%\system32\svchost.exe |
"{8F6E8BBA-08C9-4916-8387-72138B067AA7}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr |

app=%systemroot%\system32\svchost.exe |
"{99BA877F-E487-4330-986C-B0A544273D80}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=

%systemroot%\system32\svchost.exe |
"{A562013D-7C6D-42F8-B6B7-3CE7251B5798}" = lport=2869 | protocol=6 | dir=in | app=system |
"{A8EB947C-9346-4A03-8FA7-993B87339887}" = rport=2177 | protocol=6 | dir=out | svc=qwave |

app=%systemroot%\system32\svchost.exe |
"{B62F0A3C-9736-4D16-A539-88C7EB795615}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%

\windowsmobile\wmdhost.exe |
"{BBFCA833-F83E-4425-AB34-62D9A3228E3D}" = lport=10243 | protocol=6 | dir=in | app=system |
"{C06E0A12-7397-44FC-9DFD-A290270BE91A}" = lport=26675 | protocol=6 | dir=in | name=@

%systemroot%\windowsmobile\wmdc.exe,-4006 |
"{C4E0224A-CF22-4821-ABA0-883739A969EF}" = lport=5721 | protocol=6 | dir=in | name=@

%systemroot%\windowsmobile\wmdc.exe,-4002 |
"{D4B8A5AF-13CF-4FA0-A5FF-F8033F9775FB}" = lport=26675 | protocol=6 | dir=in | name=@

%systemroot%\windowsmobile\wmdc.exe,-4006 |
"{DE9C2925-1B05-4148-984C-C8016257FE47}" = lport=999 | protocol=6 | dir=in | app=%systemroot%

\windowsmobile\wmdhost.exe |
"{EB4A7972-E2E1-4492-A0F4-02ADF18FC09E}" = lport=1034 | protocol=6 | dir=in | name=@

%systemroot%\windowsmobile\wmdc.exe,-4003 |
"{F0A23AC1-8F68-4A18-89B5-5FFC95960EE6}" = lport=26675 | protocol=6 | dir=in | name=@

%systemroot%\windowsmobile\wmdc.exe,-4006 |
"{F8D4DA82-EBE2-4E1F-B8FE-25B1FA3FD437}" = lport=990 | protocol=6 | dir=in | svc=rapimgr |

app=%systemroot%\system32\svchost.exe |
"{FADF7306-196C-404F-B418-3519DCC6ED8E}" = lport=990 | protocol=6 | dir=in | svc=rapimgr |

app=%systemroot%\system32\svchost.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy

\FirewallRules]
"{0DA6C8F6-8D7B-48F2-96BA-75A3D9124091}" = protocol=6 | dir=in | app=c:\program files\microsoft

office\office12\onenote.exe |
"{11D74191-954E-4E67-9766-36E95514B6FB}" = protocol=17 | dir=out | app=%programfiles%\windows

media player\wmpnetwk.exe |
"{1265CA9D-EBC9-46BD-AC2A-CA8342643681}" = protocol=6 | dir=out | app=%programfiles%\windows

media player\wmplayer.exe |
"{290F105C-8AC3-4474-8EB1-1CD6696F97F7}" = protocol=17 | dir=out | app=%programfiles%\windows

media player\wmplayer.exe |
"{298E349D-CEDA-417C-B41D-1002CAA4565A}" = protocol=6 | dir=out | app=%programfiles%\windows

media player\wmpnetwk.exe |
"{39468D80-A2B2-449B-AB84-F40695BB4139}" = protocol=6 | dir=out | app=system |
"{5D5D8012-AF81-4261-8CD6-810295253C43}" = dir=in | app=c:\program files\skype\phone\skype.exe

|
"{82731926-F854-45A7-9621-3E7A4CCB55AC}" = dir=in | app=c:\program files\cyberlink\powerdvd

\powerdvd.exe |
"{9F474F74-0144-4553-AE08-AC0AFE5F39E7}" = protocol=6 | dir=out | app=%programfiles%\windows

media player\wmplayer.exe |
"{A0B40CE2-6C38-436F-BE59-90C27BCBDF98}" = protocol=17 | dir=in | app=%programfiles%\windows

media player\wmplayer.exe |
"{A84B34F8-6D2C-45E1-B9A4-2F637B32F8FB}" = protocol=17 | dir=in | app=%programfiles%\windows

media player\wmplayer.exe |
"{ADD9C9C4-4297-4075-B7DF-4EDD54DF57EE}" = protocol=17 | dir=in | app=c:\program files

\microsoft office\office12\onenote.exe |
"{E28B0FB7-2A76-4B66-8F04-0F57445641CE}" = protocol=6 | dir=in | app=%programfiles%\windows

media player\wmpnetwk.exe |
"{E6A56C57-96EE-4EC0-B186-711F33262CA4}" = protocol=17 | dir=in | app=%programfiles%\windows

media player\wmpnetwk.exe |
"{E94B5131-E860-40F3-96AA-723B1F46DAD4}" = protocol=17 | dir=out | app=%programfiles%\windows

media player\wmplayer.exe |
"{F29355A2-3CE6-4D67-BB02-4E9DF18954B1}" = protocol=6 | dir=out | svc=upnphost | app=

%systemroot%\system32\svchost.exe |
"TCP Query User{1F396F7F-F874-4033-9210-094AB06AA91D}C:\program files\icq6.5\icq.exe" =

protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe |
"TCP Query User{2C1DCDF1-8A64-4B8F-B21B-839A1A83A1B2}C:\program files\orbitdownloader

\orbitnet.exe" = protocol=6 | dir=in | app=c:\program files\orbitdownloader\orbitnet.exe |
"TCP Query User{46FA8B15-48BD-4825-B00B-0366A986DF4A}C:\program files\electronic arts\eadm

\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"TCP Query User{76F58847-9753-4ECA-A420-6E120D1F571E}C:\windows\explorer.exe" = protocol=6 |

dir=in | app=c:\windows\explorer.exe |
"TCP Query User{793E3879-6149-4E61-ADA6-0EA007F5AB3C}C:\windows\explorer.exe" = protocol=6 |

dir=in | app=c:\windows\explorer.exe |
"TCP Query User{8FB197D3-AEC7-491A-AC7D-1C51D271DB77}C:\windows\system32\taskeng.exe" =

protocol=6 | dir=in | app=c:\windows\system32\taskeng.exe |
"TCP Query User{9A88EA22-A153-4724-817B-F28059C6D1D3}C:\windows\system32\taskeng.exe" =

protocol=6 | dir=in | app=c:\windows\system32\taskeng.exe |
"TCP Query User{C06BE2CF-4700-437A-8D7B-061F300CCDAE}C:\program files\tvuplayer\tvuplayer.exe"

= protocol=6 | dir=in | app=c:\program files\tvuplayer\tvuplayer.exe |
"TCP Query User{CDB6A074-9B94-433F-ACCD-E5D426861989}C:\program files\mozilla firefox

\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{E7B1755E-59F5-4365-8029-02DBF6828B63}C:\program files\electronic arts\eadm

\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"TCP Query User{F024AEE3-7E4C-4938-B0AB-3E318E4AF080}C:\program files\icq6\icq.exe" =

protocol=6 | dir=in | app=c:\program files\icq6\icq.exe |
"UDP Query User{0E81E263-6338-47F5-8BBB-906855B09868}C:\program files\orbitdownloader

\orbitnet.exe" = protocol=17 | dir=in | app=c:\program files\orbitdownloader\orbitnet.exe |
"UDP Query User{290BC30F-144F-42B9-9998-3A80455D3B20}C:\windows\system32\taskeng.exe" =

protocol=17 | dir=in | app=c:\windows\system32\taskeng.exe |
"UDP Query User{2CE911BE-3658-4B0D-B615-7914421F41C4}C:\program files\mozilla firefox

\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{3919ACD9-C4B8-4E5F-B02C-735FF1A85FF1}C:\windows\explorer.exe" = protocol=17 |

dir=in | app=c:\windows\explorer.exe |
"UDP Query User{5F04CAF8-B87D-40D0-BCBB-1F025E2C7E9A}C:\windows\explorer.exe" = protocol=17 |

dir=in | app=c:\windows\explorer.exe |
"UDP Query User{85622D43-019C-4EEE-8992-A2CA31F13F08}C:\program files\icq6.5\icq.exe" =

protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe |
"UDP Query User{95276F31-7650-4354-9E42-67623B771D42}C:\program files\icq6\icq.exe" =

protocol=17 | dir=in | app=c:\program files\icq6\icq.exe |
"UDP Query User{9BF88250-B39F-4548-9969-F70978FDFE0D}C:\windows\system32\taskeng.exe" =

protocol=17 | dir=in | app=c:\windows\system32\taskeng.exe |
"UDP Query User{A0B7B2BB-4415-4D7D-8869-BB35BE327038}C:\program files\electronic arts\eadm

\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"UDP Query User{A5056430-8F33-4365-BD22-7B44F210E590}C:\program files\electronic arts\eadm

\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"UDP Query User{D4BBD2D9-A4E3-4D67-A218-17D258989CF5}C:\program files\tvuplayer\tvuplayer.exe"

= protocol=17 | dir=in | app=c:\program files\tvuplayer\tvuplayer.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0138F525-6C8A-333F-A105-14AE030B9A54}" = Visual C++ 9.0 CRT (x86) WinSXS MSM
"{02F020A7-4981-4F6E-C40D-5BA7C007D518}" = ccc-core-static
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-

Setup (Englisch)
"{0762EBC7-0C57-76DD-F1B9-0E69B867C802}" = Catalyst Control Center Graphics Light
"{089523E6-D681-1B0C-6458-CC42C5CA5DEF}" = Catalyst Control Center Localization Finnish
"{09298F26-A95C-31E2-9D95-2C60F586F075}" = Microsoft Visual C++ 2008 Redistributable - x86

9.0.21022
"{11316260-6666-467B-AC34-183FCB5D4335}" = Acer Mobility Center Plug-In
"{116FF17B-1A30-4FC2-9B01-5BC5BD46B0B3}" = Acer eLock Management
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP560_series" = Canon MP560 series MP Drivers
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"{17533FFD-37B6-A54A-1654-AD053A247A37}" = Catalyst Control Center Localization Swedish
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1A5E5061-543A-5722-7441-7BC6CF1C5C62}" = Catalyst Control Center Localization Portuguese
"{1E239B20-E618-41D4-47E3-C3AE4A066214}" = Catalyst Control Center Core Implementation
"{1F2A5DF9-40E1-4644-ADBD-D80F347BA6C8}" = Windows Mobile-Gerätecenter
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{26976749-1A33-20A5-DCE9-63EFEEAECA03}" = Catalyst Control Center Localization Greek
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 20
"{2DFB5485-A3EF-4298-9280-4AF80C9F4BE9}" = Microsoft SQL Server VSS Writer
"{332CC6BF-E6C7-48EE-BA3D-435E576AD67F}" = PaperPort Image Printer
"{347952D7-B923-36BE-B35C-99B4C7809795}" = Catalyst Control Center Localization Turkish
"{35C0A1E4-D02A-412C-841F-266DBB116ABB}" = Intel(R) PROSet/Wireless WiFi-Software
"{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = Acer Crystal Eye Webcam Video Class Camera
"{3B810746-962A-2A85-E733-3E62EF3D4BEB}" = Catalyst Control Center Localization Thai
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CE4B975-A5C1-43C0-A565-C00F0ABFC94C}" = PC-Bibliothek 3.0
"{4E5EE953-0D92-A385-E3A0-FBFCB2DE15AA}" = EA Download Manager UI
"{4EA46C71-CF0B-E932-F09E-81E83D4C3A4E}" = Catalyst Control Center Localization German
"{4EC13867-3C71-0CEC-88BC-FA0D308966FF}" = Catalyst Control Center Localization Chinese

Standard
"{4F1DCA42-2030-437C-A94E-736692A499C1}" = Nokia Connectivity Cable Driver
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{502B07AB-9DD1-F9AC-7D1A-6F265003FBFD}" = Catalyst Control Center Localization French
"{505AFDC0-5E72-4928-8368-5DEA385E3647}" = CorelDRAW Graphics Suite 12
"{547DCEC7-DD2A-47E9-82C7-5CF1EAB526DA}" = Microsoft SQL Server Native Client
"{58E5844B-7CE2-413D-83D1-99294BF6C74F}" = Acer ePower Management
"{5AFEABF5-7411-4C29-9FA9-71ABE880662D}" = Nokia PC Suite
"{5C39E087-5518-7F09-7DCF-12073726CF84}" = Catalyst Control Center Localization Czech
"{5E6F1230-06E8-C7A9-89B7-09C0414BCC9E}" = Catalyst Control Center Localization Danish
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5
"{60FCDA4F-8008-FBDF-FFEC-EA5101E9F3F4}" = Catalyst Control Center Localization Japanese
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office

suites
"{67ADE9AF-5CD9-4089-8825-55DE4B366799}" = NTI Backup NOW! 4.7
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6DFA698C-EB46-412F-9886-93B2C8617841}" = Catalyst Control Center - Branding
"{6F7EA6CA-79F4-44A0-A370-8E82BB16534A}" = NTI Shadow
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{76E1503E-8DBB-3521-1880-5B2D288163F2}" = Catalyst Control Center Localization Norwegian
"{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7D083C9E-3822-4FCE-BCB8-F39B16880C60}" = Catalyst Control Center Localization Dutch
"{88637F72-B46E-43F9-B306-6DA1FF478D51}" = WIDCOMM Bluetooth Software 6.0.1.3900
"{89280B77-24FA-9C0B-3BF0-8ED7E8873644}" = Catalyst Control Center Localization Spanish
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel(R) Matrix Storage Manager
"{90A40407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{94389919-B0AA-4882-9BE8-9F0B004ECA35}" = Acer Tour
"{95FB5C06-F577-D340-5B40-9F1243F30CDD}" = Catalyst Control Center Localization Korean
"{97BA58C3-4AB1-47FB-92BC-5F739007242A}" = NotenAssistent
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{99B7756C-AA8B-1EDD-697B-2B198BDCC34B}" = Catalyst Control Center Localization Russian
"{99E862CC-6F69-4D39-99AA-DBF71BF3B585}" = OpenOffice.org 3.1
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86

9.0.30729.17
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3FEC306-FBFF-4B0D-95B9-F9C67C65079E}" = Brother MFL-Pro Suite
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity

Components
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AA047D7C-5E7C-4878-B75C-77589151B563}" = Acer Crystal Eye webcam
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AB6097D9-D722-4987-BD9E-A076E2848EE2}" = Acer Empowering Technology
"{AB71E8EA-902A-654F-0E08-862CA0328764}" = ccc-utility
"{AC4BB070-A5CB-86C8-659F-85C62E27F046}" = Catalyst Control Center Localization Polish
"{AC76BA86-7AD7-1033-7B44-A81300000003}" = Adobe Reader 8.1.4
"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8
"{AEEAE013-92F1-4515-B278-139F1A692A36}" = Acer eDataSecurity Management
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{AF255B94-DFE9-5977-1F82-0D9E4073EABD}" = Catalyst Control Center Localization Hungarian
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B6C89654-A6A2-477C-873B-724EC1C56407}" = ScanSoft PaperPort 11
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BE1826A9-7EEE-492A-B3BC-DEF3DFAE37EE}" = TIPCI
"{BE6C4D32-7CDB-8639-3595-984859850522}" = ATI Catalyst Install Manager
"{BF839132-BD43-4056-ACBF-4377F4A88E2A}" = Acer ePresentation Management
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = Die Sims™ 3
"{C06554A1-2C1E-4D20-B613-EE62C79927CC}" = Acer eNet Management
"{C1E37C71-121A-6811-153A-705C0A368CD3}" = Catalyst Control Center Localization Italian
"{CB8CA439-DA83-419C-A4CF-5A0A50025144}" = Windows Mobile-Gerätecenter: Treiberupdate
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe  1.4.142.1
"{CE65A9A0-9686-45C6-9098-3C9543A412F0}" = Acer eSettings Management
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D3B3B9B2-FE73-44CB-8C0A-F737D92F991B}" = Broadcom Gigabit Integrated Controller
"{D9782503-10D1-A2D4-A5B7-C081C7B63708}" = Catalyst Control Center Localization Chinese

Traditional
"{DB780B85-B4B5-4864-A49C-9B706B169C93}" = TIPCI
"{DF213333-DA71-48E9-9AB5-9FA7A5584E5D}" = "Arbeitsblätter gestalten - blitzschnell mit Word"
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E9BC886E-0D8A-4EF5-B793-30DB776C6E2C}" = PC Connectivity Solution
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU

Language Pack
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86

9.0.21022
"3A5DEFA413DDE699DBA6EBE0A63534ACA524D30F" = Windows-Treiberpaket - Nokia pccsmcfd  (10/12/2007

6.85.4.0)
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007

Microsoft Office suites
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11
"Ask Toolbar_is1" = Ask Toolbar
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Canon MP560 series Benutzerregistrierung" = Canon MP560 series Benutzerregistrierung
"Canon_IJ_Network_Scan_UTILITY" = Canon IJ Network Scan Utility
"Canon_IJ_Network_UTILITY" = Canon IJ Network Tool
"CanonMyPrinter" = Canon Utilities My Printer
"CanonSolutionMenu" = Canon Utilities Solution Menu
"CBF192A85B624E32B8D19ADEEF2DCFC5BC3AA73A" = Windows-Treiberpaket - Nokia Modem  (03/05/2008

3.7)
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFAOR2C06_118" = HDAUDIO Soft Data Fax Modem with SmartCP
"com.ea.Vault.919CACB699904AC5D41B606703500DD39747C02D.1" = EA Download Manager UI
"CUEcards 2000" = CUEcards 2000
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"E092B2EBF2FFE83E896F8F7F829A7B5D7D1B2F9D" = Windows-Treiberpaket - Nokia Modem  (03/13/2008

6.86.0.1)
"EA Download Manager" = EA Download Manager
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4
"Free YouTube Download_is1" = Free YouTube Download 2.3
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.7
"FreePDF_XP" = FreePDF XP (Remove only)
"GPL Ghostscript 8.56" = GPL Ghostscript 8.56
"GPL Ghostscript Fonts" = GPL Ghostscript Fonts
"GridVista" = Acer GridVista
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"ICQToolbar" = ICQ Toolbar
"InstallShield_{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"InstallShield_{6F7EA6CA-79F4-44A0-A370-8E82BB16534A}" = NTI Shadow
"InstallShield_{BE1826A9-7EEE-492A-B3BC-DEF3DFAE37EE}" = Texas Instruments PCIxx21/x515/xx12

drivers.
"InstallShield_{DB780B85-B4B5-4864-A49C-9B706B169C93}" = Texas Instruments PCIxx21/x515/xx12

drivers.
"LManager" = Launch Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mein CEWE FOTOBUCH" = Mein CEWE FOTOBUCH
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language

Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4

Client Profile DEU Language Pack
"MILA_lets-smile" = MILA_lets-smile  Screen Saver
"MP Navigator EX 3.0" = Canon MP Navigator EX 3.0
"Nokia PC Suite" = Nokia PC Suite
"phonostar3RadioPlayer_is1" = phonostar-Player Version 3.01.5
"PhotoScape" = PhotoScape
"Picasa 3" = Picasa 3
"ProInst" = Intel PROSet Wireless
"RealPlayer 6.0" = RealPlayer
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"RollerCoaster Tycoon 3_is1" = RollerCoaster Tycoon 3
"Schulschriften" = Schulschriften
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.0.1
"WinRAR archiver" = WinRAR archiver
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 06.12.2009 10:50:48 | Computer Name = ****-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung ICQ.exe, Version 6.5.0.1042, Zeitstempel 0x49aa6a1d,
 fehlerhaftes Modul Flash9f.ocx, Version 9.0.124.0, Zeitstempel 0x47e8643e, Ausnahmecode
 0xc0000005, Fehleroffset 0x000fa5d4,  Prozess-ID 0x10c8, Anwendungsstartzeit 01ca7667d33826c2.
 
Error - 06.12.2009 11:16:38 | Computer Name = ****-PC | Source = Microsoft Office 11 | ID =

2000
Description =
 
Error - 07.12.2009 03:12:09 | Computer Name = ****-PC | Source = WerSvc | ID = 5007
Description =
 
Error - 07.12.2009 07:32:48 | Computer Name = ****-PC | Source = Application Hang | ID = 1002
Description = Programm OUTLOOK.EXE, Version 11.0.5510.0 arbeitet nicht mehr mit
Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über
 das Problem zu suchen.  Prozess-ID: 1784  Anfangszeit: 01ca770bea15e88c  Zeitpunkt der
 Beendigung: 469
 
Error - 07.12.2009 08:35:43 | Computer Name = ****-PC | Source = Microsoft Office 11 | ID =

2001
Description =
 
Error - 07.12.2009 11:25:19 | Computer Name = ****-PC | Source = Application Hang | ID = 1002
Description = Programm OUTLOOK.EXE, Version 11.0.5510.0 arbeitet nicht mehr mit
Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über
 das Problem zu suchen.  Prozess-ID: 1674  Anfangszeit: 01ca7739c9fb494c  Zeitpunkt der
 Beendigung: 13
 
Error - 08.12.2009 03:58:52 | Computer Name = ****-PC | Source = WerSvc | ID = 5007
Description =
 
Error - 08.12.2009 05:43:07 | Computer Name = ****-PC | Source = Application Hang | ID = 1002
Description = Programm OUTLOOK.EXE, Version 11.0.5510.0 arbeitet nicht mehr mit
Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über
 das Problem zu suchen.  Prozess-ID: df0  Anfangszeit: 01ca77e399d727cc  Zeitpunkt der
 Beendigung: 505
 
Error - 08.12.2009 14:10:58 | Computer Name = ****-PC | Source = WerSvc | ID = 5007
Description =
 
Error - 08.12.2009 14:55:01 | Computer Name = ****-PC | Source = Application Hang | ID = 1002
Description = Programm OUTLOOK.EXE, Version 11.0.5510.0 arbeitet nicht mehr mit
Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über
 das Problem zu suchen.  Prozess-ID: 14c8  Anfangszeit: 01ca783108295eab  Zeitpunkt der
 Beendigung: 442
 
[ OSession Events ]
Error - 26.02.2009 06:18:20 | Computer Name = ****-PC | Source = Microsoft Office 12 Sessions |

ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 7720
 seconds with 5280 seconds of active time.  This session ended with a crash.
 
Error - 03.10.2009 13:02:57 | Computer Name = ****-PC | Source = Microsoft Office 12 Sessions |

ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 36
 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error - 09.10.2009 08:45:24 | Computer Name = ****-PC | Source = Microsoft Office 12 Sessions |

ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 1934
 seconds with 1860 seconds of active time.  This session ended with a crash.
 
Error - 29.05.2010 15:23:53 | Computer Name = ****-PC | Source = Microsoft Office 12 Sessions |

ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 19582
 seconds with 13440 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 14.08.2010 11:15:53 | Computer Name = ****-PC | Source = DCOM | ID = 10010
Description =
 
Error - 14.08.2010 11:20:04 | Computer Name = ****-PC | Source = Service Control Manager | ID =

7000
Description =
 
Error - 14.08.2010 13:04:35 | Computer Name = ****-PC | Source = Microsoft-Windows-

WindowsUpdateClient | ID = 20
Description =
 
Error - 14.08.2010 14:02:37 | Computer Name = ****-PC | Source = DCOM | ID = 10010
Description =
 
Error - 14.08.2010 14:04:30 | Computer Name = ****-PC | Source = DCOM | ID = 10010
Description =
 
Error - 14.08.2010 14:08:44 | Computer Name = ****-PC | Source = Service Control Manager | ID =

7000
Description =
 
Error - 14.08.2010 14:57:46 | Computer Name = ****-PC | Source = DCOM | ID = 10010
Description =
 
Error - 15.08.2010 03:58:05 | Computer Name = ****-PC | Source = Service Control Manager | ID =

7000
Description =
 
Error - 15.08.2010 04:35:42 | Computer Name = ****-PC | Source = DCOM | ID = 10010
Description =
 
Error - 15.08.2010 04:38:19 | Computer Name = ****-PC | Source = Service Control Manager | ID =

7000
Description =
 
 
< End of report >


Grüße
SG

markusg 15.08.2010 10:55
avira

avira 10 so instalieren bzw. dann konfigurieren. wenn du die konfiguration übernommen hast, update das programm.
klicke dann auf "lokaler schutz" "lokale laufwerke" eventuelle funde in quarantäne, log posten.

sxhor 15.08.2010 13:37
Sers,
Vollständiger Suchlauf ist durch, hier das Ergebnis:


Code:

Avira AntiVir Personal
Erstellungsdatum der Reportdatei: Sonntag, 15. August 2010  12:54

Es wird nach 1867270 Virenstämmen gesucht.

Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer  : Avira AntiVir Personal - FREE Antivirus
Seriennummer  : 0000149996-ADJIE-0000001
Plattform      : Windows Vista
Windowsversion : (Service Pack 2)  [6.0.6002]
Boot Modus    : Normal gebootet
Benutzername  : ****
Computername  : ****-PC

Versionsinformationen:
BUILD.DAT      : 10.0.0.561          Bytes  18.03.2010 15:35:00
AVSCAN.EXE    : 10.0.2.3      433832 Bytes  07.03.2010 15:57:03
AVSCAN.DLL    : 10.0.2.0      55144 Bytes  15.02.2010 14:03:11
LUKE.DLL      : 10.0.2.3      104296 Bytes  07.03.2010 16:32:59
LUKERES.DLL    : 10.0.0.0      13672 Bytes  14.01.2010 09:59:47
VBASE000.VDF  : 7.10.0.0    19875328 Bytes  06.11.2009 06:35:52
VBASE001.VDF  : 7.10.1.0    1372672 Bytes  19.11.2009 08:17:25
VBASE002.VDF  : 7.10.3.1    3143680 Bytes  20.01.2010 08:38:42
VBASE003.VDF  : 7.10.3.75    996864 Bytes  26.01.2010 08:37:15
VBASE004.VDF  : 7.10.4.203  1579008 Bytes  05.03.2010 16:03:33
VBASE005.VDF  : 7.10.4.204      2048 Bytes  05.03.2010 09:29:03
VBASE006.VDF  : 7.10.4.205      2048 Bytes  05.03.2010 09:29:03
VBASE007.VDF  : 7.10.4.206      2048 Bytes  05.03.2010 09:29:03
VBASE008.VDF  : 7.10.4.207      2048 Bytes  05.03.2010 09:29:03
VBASE009.VDF  : 7.10.4.208      2048 Bytes  05.03.2010 09:29:03
VBASE010.VDF  : 7.10.4.209      2048 Bytes  05.03.2010 09:29:03
VBASE011.VDF  : 7.10.4.210      2048 Bytes  05.03.2010 09:29:03
VBASE012.VDF  : 7.10.4.211      2048 Bytes  05.03.2010 09:29:03
VBASE013.VDF  : 7.10.4.242    153088 Bytes  08.03.2010 13:43:21
VBASE014.VDF  : 7.10.5.17      99328 Bytes  10.03.2010 13:24:21
VBASE015.VDF  : 7.10.5.44    107008 Bytes  11.03.2010 15:41:40
VBASE016.VDF  : 7.10.5.69      92672 Bytes  12.03.2010 07:25:53
VBASE017.VDF  : 7.10.5.91    119808 Bytes  15.03.2010 07:39:58
VBASE018.VDF  : 7.10.5.121    112640 Bytes  18.03.2010 11:01:24
VBASE019.VDF  : 7.10.5.122      2048 Bytes  18.03.2010 11:01:24
VBASE020.VDF  : 7.10.5.123      2048 Bytes  18.03.2010 11:01:24
VBASE021.VDF  : 7.10.5.124      2048 Bytes  18.03.2010 11:01:24
VBASE022.VDF  : 7.10.5.125      2048 Bytes  18.03.2010 11:01:24
VBASE023.VDF  : 7.10.5.126      2048 Bytes  18.03.2010 11:01:24
VBASE024.VDF  : 7.10.5.127      2048 Bytes  18.03.2010 11:01:24
VBASE025.VDF  : 7.10.5.128      2048 Bytes  18.03.2010 11:01:24
VBASE026.VDF  : 7.10.5.129      2048 Bytes  18.03.2010 11:01:24
VBASE027.VDF  : 7.10.5.130      2048 Bytes  18.03.2010 11:01:24
VBASE028.VDF  : 7.10.5.131      2048 Bytes  18.03.2010 11:01:24
VBASE029.VDF  : 7.10.5.132      2048 Bytes  18.03.2010 11:01:24
VBASE030.VDF  : 7.10.5.133      2048 Bytes  18.03.2010 11:01:25
VBASE031.VDF  : 7.10.5.134    16384 Bytes  18.03.2010 11:01:25
Engineversion  : 8.2.1.194
AEVDF.DLL      : 8.1.1.3      106868 Bytes  13.02.2010 10:16:21
AESCRIPT.DLL  : 8.1.3.18    1024378 Bytes  17.03.2010 09:09:47
AESCN.DLL      : 8.1.5.0      127347 Bytes  25.02.2010 16:38:41
AESBX.DLL      : 8.1.2.1      254323 Bytes  17.03.2010 09:09:47
AERDL.DLL      : 8.1.4.3      541043 Bytes  17.03.2010 09:09:47
AEPACK.DLL    : 8.2.1.0      426356 Bytes  02.03.2010 13:01:39
AEOFFICE.DLL  : 8.1.0.41      201083 Bytes  17.03.2010 09:09:46
AEHEUR.DLL    : 8.1.1.13    2470262 Bytes  17.03.2010 09:09:46
AEHELP.DLL    : 8.1.10.2      237941 Bytes  17.03.2010 09:09:46
AEGEN.DLL      : 8.1.2.2      373107 Bytes  17.03.2010 09:09:45
AEEMU.DLL      : 8.1.1.0      393587 Bytes  10.11.2009 07:04:22
AECORE.DLL    : 8.1.12.3      188789 Bytes  17.03.2010 09:09:45
AEBB.DLL      : 8.1.0.3        53618 Bytes  10.09.2009 10:15:06
AVWINLL.DLL    : 10.0.0.0      19304 Bytes  14.01.2010 09:59:10
AVPREF.DLL    : 10.0.0.0      44904 Bytes  14.01.2010 09:59:07
AVREP.DLL      : 10.0.0.8      62209 Bytes  18.02.2010 14:47:40
AVREG.DLL      : 10.0.1.2      52072 Bytes  29.01.2010 09:47:36
AVSCPLR.DLL    : 10.0.2.3      83304 Bytes  07.03.2010 16:02:25
AVARKT.DLL    : 10.0.0.13    227176 Bytes  07.03.2010 15:48:35
AVEVTLOG.DLL  : 10.0.0.8      203112 Bytes  26.01.2010 07:53:25
SQLITE3.DLL    : 3.6.19.0      355688 Bytes  28.01.2010 10:57:53
AVSMTP.DLL    : 10.0.0.17      63848 Bytes  16.03.2010 13:38:54
NETNT.DLL      : 10.0.0.0      11624 Bytes  19.02.2010 12:40:55
RCIMAGE.DLL    : 10.0.0.26    2550120 Bytes  28.01.2010 11:10:08
RCTEXT.DLL    : 10.0.46.0      98664 Bytes  05.03.2010 08:09:35

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Lokale Laufwerke
Konfigurationsdatei...................: C:\program files\avira\antivir desktop\alldrives.avp
Protokollierung.......................: niedrig
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:, E:,
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Intelligente Dateiauswahl
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: hoch
Abweichende Gefahrenkategorien........: +PCK,+PFS,+SPR,

Beginn des Suchlaufs: Sonntag, 15. August 2010  12:54

Der Suchlauf nach versteckten Objekten wird begonnen.
c:\acer\empowering technology\erecovery\mbrwrwin.exe
c:\Acer\Empowering Technology\eRecovery\MBRwrWin.exe
    [HINWEIS]  Der Prozess ist nicht sichtbar.

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'avscan.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'conime.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'MPAPI3s.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'NclIrSrv.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'CCC.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'sidebar.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'BrMfcmon.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'unsecapp.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'brccMCtl.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'RtkBtMnt.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'ehmsas.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'phonostarTimer.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'PCSuite.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'PcSync2.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'ehtray.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'sidebar.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'CNMNSUT.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'fpassist.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'BrMfcWnd.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'pptd40nt.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmdc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'eDSLoader.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'MOM.EXE' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'PDVDServ.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'RtHDVCpl.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'IAAnotif.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'MSASCui.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'mobsync.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '1' Modul(e) wurden durchsucht

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
    [INFO]      Es wurde kein Virus gefunden!
   

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
    [INFO]      Es wurde kein Virus gefunden!
   
Bootsektor 'D:\'
    [INFO]      Es wurde kein Virus gefunden!
   

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '420' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\' <ACER>
Beginne mit der Suche in 'D:\' <DATA>
Beginne mit der Suche in 'E:\' <Disk>


Ende des Suchlaufs: Sonntag, 15. August 2010  14:30
Benötigte Zeit:  1:35:36 Stunde(n)

Der Suchlauf wurde vollständig durchgeführt.

  34151 Verzeichnisse wurden überprüft
 1057804 Dateien wurden geprüft
      0 Viren bzw. unerwünschte Programme wurden gefunden
      0 Dateien wurden als verdächtig eingestuft
      0 Dateien wurden gelöscht
      0 Viren bzw. unerwünschte Programme wurden repariert
      0 Dateien wurden in die Quarantäne verschoben
      0 Dateien wurden umbenannt
      0 Dateien konnten nicht durchsucht werden
 1057804 Dateien ohne Befall
  9517 Archive wurden durchsucht
      0 Warnungen
      0 Hinweise
 133694 Objekte wurden beim Rootkitscan durchsucht
      1 Versteckte Objekte wurden gefunden


Grüße
SG

markusg 15.08.2010 13:40
du hast kein update gemacht, bitte nachholen.
Integritätsprüfung von Systemdateien
ist nicht aktiev, bitte einschalten, dann erneut über lokaler schutz, lokale laufwerke scannen und log posten.

sxhor 15.08.2010 16:52
Hallo,
Updates durchgeführt, Suchlauf durchgeführt, Items in Quarantäne geworfen.

Hier der Log:

Code:

Avira AntiVir Personal
Erstellungsdatum der Reportdatei: Sonntag, 15. August 2010  14:47

Es wird nach 2715134 Virenstämmen gesucht.

Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer  : Avira AntiVir Personal - FREE Antivirus
Seriennummer  : 0000149996-ADJIE-0000001
Plattform      : Windows Vista
Windowsversion : (Service Pack 2)  [6.0.6002]
Boot Modus    : Normal gebootet
Benutzername  : ****
Computername  : ****-PC

Versionsinformationen:
BUILD.DAT      : 10.0.0.567    32097 Bytes  19.04.2010 15:50:00
AVSCAN.EXE    : 10.0.3.0      433832 Bytes  15.08.2010 12:45:07
AVSCAN.DLL    : 10.0.3.0      56168 Bytes  15.08.2010 12:45:07
LUKE.DLL      : 10.0.2.3      104296 Bytes  07.03.2010 16:32:59
LUKERES.DLL    : 10.0.0.0      13672 Bytes  14.01.2010 09:59:47
VBASE000.VDF  : 7.10.0.0    19875328 Bytes  06.11.2009 06:35:52
VBASE001.VDF  : 7.10.1.0    1372672 Bytes  19.11.2009 08:17:25
VBASE002.VDF  : 7.10.3.1    3143680 Bytes  20.01.2010 08:38:42
VBASE003.VDF  : 7.10.3.75    996864 Bytes  26.01.2010 08:37:15
VBASE004.VDF  : 7.10.4.203  1579008 Bytes  05.03.2010 16:03:33
VBASE005.VDF  : 7.10.6.82    2494464 Bytes  15.04.2010 12:45:03
VBASE006.VDF  : 7.10.7.218  2294784 Bytes  02.06.2010 12:45:03
VBASE007.VDF  : 7.10.9.165  4840960 Bytes  23.07.2010 12:45:05
VBASE008.VDF  : 7.10.9.166      2048 Bytes  23.07.2010 12:45:05
VBASE009.VDF  : 7.10.9.167      2048 Bytes  23.07.2010 12:45:05
VBASE010.VDF  : 7.10.9.168      2048 Bytes  23.07.2010 12:45:05
VBASE011.VDF  : 7.10.9.169      2048 Bytes  23.07.2010 12:45:05
VBASE012.VDF  : 7.10.9.170      2048 Bytes  23.07.2010 12:45:05
VBASE013.VDF  : 7.10.9.198    157696 Bytes  26.07.2010 12:45:05
VBASE014.VDF  : 7.10.9.255    997888 Bytes  29.07.2010 12:45:05
VBASE015.VDF  : 7.10.10.28    139264 Bytes  02.08.2010 12:45:05
VBASE016.VDF  : 7.10.10.52    127488 Bytes  03.08.2010 12:45:05
VBASE017.VDF  : 7.10.10.84    137728 Bytes  06.08.2010 12:45:05
VBASE018.VDF  : 7.10.10.107  176640 Bytes  09.08.2010 12:45:05
VBASE019.VDF  : 7.10.10.130  132608 Bytes  10.08.2010 12:45:06
VBASE020.VDF  : 7.10.10.158  131072 Bytes  12.08.2010 12:45:06
VBASE021.VDF  : 7.10.10.159    2048 Bytes  12.08.2010 12:45:06
VBASE022.VDF  : 7.10.10.160    2048 Bytes  12.08.2010 12:45:06
VBASE023.VDF  : 7.10.10.161    2048 Bytes  12.08.2010 12:45:06
VBASE024.VDF  : 7.10.10.162    2048 Bytes  12.08.2010 12:45:06
VBASE025.VDF  : 7.10.10.163    2048 Bytes  12.08.2010 12:45:06
VBASE026.VDF  : 7.10.10.164    2048 Bytes  12.08.2010 12:45:06
VBASE027.VDF  : 7.10.10.165    2048 Bytes  12.08.2010 12:45:06
VBASE028.VDF  : 7.10.10.166    2048 Bytes  12.08.2010 12:45:06
VBASE029.VDF  : 7.10.10.167    2048 Bytes  12.08.2010 12:45:06
VBASE030.VDF  : 7.10.10.168    2048 Bytes  12.08.2010 12:45:06
VBASE031.VDF  : 7.10.10.182    49664 Bytes  13.08.2010 12:45:06
Engineversion  : 8.2.4.34 
AEVDF.DLL      : 8.1.2.1      106868 Bytes  15.08.2010 12:45:07
AESCRIPT.DLL  : 8.1.3.42    1364347 Bytes  15.08.2010 12:45:07
AESCN.DLL      : 8.1.6.1      127347 Bytes  15.08.2010 12:45:07
AESBX.DLL      : 8.1.3.1      254324 Bytes  15.08.2010 12:45:07
AERDL.DLL      : 8.1.8.2      614772 Bytes  15.08.2010 12:45:07
AEPACK.DLL    : 8.2.3.5      471412 Bytes  15.08.2010 12:45:07
AEOFFICE.DLL  : 8.1.1.8      201081 Bytes  15.08.2010 12:45:07
AEHEUR.DLL    : 8.1.2.11    2834805 Bytes  15.08.2010 12:45:07
AEHELP.DLL    : 8.1.13.2      242039 Bytes  15.08.2010 12:45:06
AEGEN.DLL      : 8.1.3.19      393587 Bytes  15.08.2010 12:45:06
AEEMU.DLL      : 8.1.2.0      393588 Bytes  15.08.2010 12:45:06
AECORE.DLL    : 8.1.16.2      192887 Bytes  15.08.2010 12:45:06
AEBB.DLL      : 8.1.1.0        53618 Bytes  15.08.2010 12:45:06
AVWINLL.DLL    : 10.0.0.0      19304 Bytes  14.01.2010 09:59:10
AVPREF.DLL    : 10.0.0.0      44904 Bytes  14.01.2010 09:59:07
AVREP.DLL      : 10.0.0.8      62209 Bytes  18.02.2010 14:47:40
AVREG.DLL      : 10.0.3.0      53096 Bytes  15.08.2010 12:45:07
AVSCPLR.DLL    : 10.0.3.0      83816 Bytes  15.08.2010 12:45:07
AVARKT.DLL    : 10.0.0.14    227176 Bytes  15.08.2010 12:45:07
AVEVTLOG.DLL  : 10.0.0.8      203112 Bytes  26.01.2010 07:53:25
SQLITE3.DLL    : 3.6.19.0      355688 Bytes  28.01.2010 10:57:53
AVSMTP.DLL    : 10.0.0.17      63848 Bytes  16.03.2010 13:38:54
NETNT.DLL      : 10.0.0.0      11624 Bytes  19.02.2010 12:40:55
RCIMAGE.DLL    : 10.0.0.26    2550120 Bytes  28.01.2010 11:10:08
RCTEXT.DLL    : 10.0.53.0      98152 Bytes  15.08.2010 12:45:02

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Lokale Laufwerke
Konfigurationsdatei...................: C:\Program Files\Avira\AntiVir Desktop\alldrives.avp
Protokollierung.......................: niedrig
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:, E:,
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: ein
Datei Suchmodus.......................: Intelligente Dateiauswahl
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: hoch
Abweichende Gefahrenkategorien........: +PCK,+PFS,+SPR,

Beginn des Suchlaufs: Sonntag, 15. August 2010  14:47

Der Suchlauf nach versteckten Objekten wird begonnen.
c:\acer\empowering technology\erecovery\mbrwrwin.exe
c:\Acer\Empowering Technology\eRecovery\MBRwrWin.exe
    [HINWEIS]  Der Prozess ist nicht sichtbar.

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'vssvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'conime.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'MPAPI3s.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'NclRSSrv.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'NclIrSrv.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'NclUSBSrv.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'ServiceLayer.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'CCC.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'sidebar.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'BrMfcmon.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'unsecapp.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'brccMCtl.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'RtkBtMnt.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'ehmsas.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'phonostarTimer.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'PCSuite.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'PcSync2.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'ehtray.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'sidebar.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'CNMNSUT.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'fpassist.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'BrMfcWnd.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'pptd40nt.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmdc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'LManager.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'eDSLoader.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'MOM.EXE' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'PDVDServ.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'SynTPEnh.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'unsecapp.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'ePowerSvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'capuserv.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'eRecoveryService.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'xaudio.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'RegSrvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'MobilityService.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'LSSrvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'Iaantmon.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'EvtEng.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'eNet Service.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'RtHDVCpl.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'IAAnotif.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'MSASCui.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'eLockServ.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'eDSService.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'mobsync.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLANExt.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'Ati2evxx.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'SLsvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'Ati2evxx.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '1' Modul(e) wurden durchsucht

Untersuchung der Systemdateien wird begonnen:
Signiert -> 'C:\Windows\system32\svchost.exe'
Signiert -> 'C:\Windows\system32\winlogon.exe'
Signiert -> 'C:\Windows\explorer.exe'
Signiert -> 'C:\Windows\system32\smss.exe'
Signiert -> 'C:\Windows\system32\wininet.DLL'
Signiert -> 'C:\Windows\system32\wsock32.DLL'
Signiert -> 'C:\Windows\system32\ws2_32.DLL'
Signiert -> 'C:\Windows\system32\services.exe'
Signiert -> 'C:\Windows\system32\lsass.exe'
Signiert -> 'C:\Windows\system32\csrss.exe'
Signiert -> 'C:\Windows\system32\drivers\kbdclass.sys'
Signiert -> 'C:\Windows\system32\spoolsv.exe'
Signiert -> 'C:\Windows\system32\alg.exe'
Signiert -> 'C:\Windows\system32\wuauclt.exe'
Signiert -> 'C:\Windows\system32\advapi32.DLL'
Signiert -> 'C:\Windows\system32\user32.DLL'
Signiert -> 'C:\Windows\system32\gdi32.DLL'
Signiert -> 'C:\Windows\system32\kernel32.DLL'
Signiert -> 'C:\Windows\system32\ntdll.DLL'
Signiert -> 'C:\Windows\system32\ntoskrnl.exe'
Signiert -> 'C:\Windows\system32\ctfmon.exe'
Die Systemdateien wurden durchsucht ('21' Dateien)

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
    [INFO]      Es wurde kein Virus gefunden!

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
    [INFO]      Es wurde kein Virus gefunden!
Bootsektor 'D:\'
    [INFO]      Es wurde kein Virus gefunden!

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '532' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\' <ACER>
C:\Users\****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18\10b94bd2-5a5ed983
[0] Archivtyp: ZIP
  [FUND]      Enthält Erkennungsmuster des Java-Virus JAVA/Agent.M.2
--> dev/s/DyesyasZ.class
  [FUND]      Enthält Erkennungsmuster des Java-Virus JAVA/Agent.M.2
--> dev/s/LoaderX.class
  [FUND]      Enthält Erkennungsmuster des Java-Virus JAVA/Agent.M.1
C:\Users\****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42\6486b32a-5810f754
[0] Archivtyp: ZIP
  [FUND]      Enthält Erkennungsmuster des Java-Virus JAVA/Agent.a
--> Keyworq.class
  [FUND]      Enthält Erkennungsmuster des Java-Virus JAVA/Agent.a
Beginne mit der Suche in 'D:\' <DATA>
Beginne mit der Suche in 'E:\' <Disk>

Beginne mit der Desinfektion:
C:\Users\****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42\6486b32a-5810f754
    [FUND]      Enthält Erkennungsmuster des Java-Virus JAVA/Agent.a
    [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4907a846.qua'

verschoben!
C:\Users\****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18\10b94bd2-5a5ed983
    [FUND]      Enthält Erkennungsmuster des Java-Virus JAVA/Agent.M.1
    [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '51fa87e5.qua'

verschoben!


Ende des Suchlaufs: Sonntag, 15. August 2010  17:50
Benötigte Zeit:  1:31:28 Stunde(n)

Der Suchlauf wurde vollständig durchgeführt.

  34523 Verzeichnisse wurden überprüft
 1133544 Dateien wurden geprüft
      3 Viren bzw. unerwünschte Programme wurden gefunden
      0 Dateien wurden als verdächtig eingestuft
      0 Dateien wurden gelöscht
      0 Viren bzw. unerwünschte Programme wurden repariert
      2 Dateien wurden in die Quarantäne verschoben
      0 Dateien wurden umbenannt
      0 Dateien konnten nicht durchsucht werden
 1133541 Dateien ohne Befall
  9954 Archive wurden durchsucht
      0 Warnungen
      2 Hinweise
 134179 Objekte wurden beim Rootkitscan durchsucht
      1 Versteckte Objekte wurden gefunden

Grüße und Danke!!!
SG

markusg 15.08.2010 17:07
ok abschließend den eset online scan
Free ESET Online Antivirus Scanner
ergebniss posten.

sxhor 15.08.2010 19:15
Hallo,
hier das ESET-Ergebnis:

C:\nicimail\Posteingang.dbx Win32/TrojanDropper.Agent.AGE trojan unable to clean

Soll ich den betreffenden File löschen?

Grüße
SG

markusg 15.08.2010 19:27
nein das ist in deinem mailprogramm, mal unnötige mails löschen, papierkorb leeren, ordner komprimieren.

sxhor 15.08.2010 20:08
Hey,
denke das sind alte Mails aus nem Outlook-Express-Archiv. Sie verwendet momentan Microsoft Outlook. Ist der Rechner damit clean? Ich werde sie fragen, ob sie auf die alte SIcherung verzichten kann. Nur um sicher zu gehen.


Wäre eine Infektion mit aktuellen Updates verhindert worden oder kann sowas trotzdem durch kino.to passieren? Ich werds dann so weitergeben.

Gibt es sonst noch was?

Vielen Dank nochmals für die Hilfe!


Grüße
SG

markusg 15.08.2010 20:12
ja sicher, kino.to ist illegal, wer dann auch noch sicherheitslücken auf dem pc hat ist selbst schuld, sorry...
1. solltest du nur noch als eingeschrenkter nutzer arbeiten , das admin konto ist nur für instalationen gedacht.
klicke start, tippe unter suchen (ausführen) systemsteuerung. wähle dort Benutzerkonten hinzufügen/entfernen.
wähle "neues konto erstellen"
Wähle standard benutzer.

die konten sollten mit einem passwort geschützt werden.
dazu auf konto endern klicken und passwörter vergeben.
Die folgenden konfigurationen als admin ausführen:
2. dep aktivieren:
dep für alle prozesse:
Datenausführungsverhinderung (DEP)
• "Datenausführungsverhinderung für alle Programme und Dienste mit Ausnahme der ausgewählten einschalten:".
wenn es zu problemen kommen sollte, kann man die betroffenen prozesse aus der Überwachung entfernen.

3. konfiguriere avira 10, wie in meiner signatur beschrieben.
4. als browser den firefox nutzen:
Webbrowser Firefox | Schneller, sicherer & anpassbar | Mozilla Europe
5. als adon noscript, es werden dadurch alle scripts (java) zb blockiert, du kannst diese dann frei geben, in dem du auf der seite, die freigegeben werden
soll, nen rechtsklick machst, noscript wählst, und temporär alle berectigungen aufheben wählst, somit werden sie für den besuch aufgehoben, oder alle beschrenkungen
aufheben, somit wird die seite freigegeben. das kann man natürlich wieder rückgängig machen.
http://filepony.de/download-noscript//
6.

adblock+ um werbung zu blockieren:
http://filepony.de/download-adblock_firefox//
hier gibt es noch filterlisten:
Adblock Plus: Bekannte Filterlisten für Adblock Plus
hier würde ich 2 oder 3 deutsche filter auswählen.

unter sonstiges die malware blocklist.
7.
um das surfen sicherer zu machen, würde ich sandboxie empfehlen.
Download:
Sandboxie Download
anleitung:
drop.io
(als pdf)
wenn du mit dem programm gut auskommst, ist ne lizenz zu empfehlen.
1. es gibt dann noch ein paar mehr funktionen.
2. kommt nach nem monat die anzeige, dass das programm freeware ist, die verschwindet erst nach ner zeit, find ich n bissel nerfig.
3. ist die lizenz lebenslang gültig, kostenpunkt rund 25 €, und du kannst sie auf allen pcs in deinem haushalt einsetzen.
ab sofort also nur noch in der sanbox surfen bitte.
8. autorun für usb deaktivieren:
über diesen weg werden sehr häufig schaddateien verbreitet, schalte die funktion also ab.
Tipparchiv - Autorun/Autoplay gezielt für Laufwerkstypen oder -buchstaben abschalten - WinTotal.de
9. um deine software aktuell zu halten, instaliere secunia.
http://www.trojaner-board.de/83959-s...ector-psi.html
und file hippo update checker:
FileHippo.com Update Checker - FileHippo.com
10.
regelmäßige Backups des systems sind sehr wichtig, du weist nie, ob deine festplatte mal kaputt geht.
Acronis True Image 2010 - Festplatten-Backup-Software, Datei-Backup und Disk Imaging, Wiederherstellung von Anwendungseinstellungen, Backup von Musik, Videos, Fotos und Outlook-Mails
außerdem kannst du, bei neuerlichem malware befall das system zurücksetzen.
Das Backup sollte möglichst auf eine externe festplatte etc emacht werden, nicht auf die selbe, wo sich die zu sichernden daten befinden.
Von sehr wichtigen Daten könnte man noch eine zusätzliche Sicherung auf dvds/cds erstellen, dazu könnte man auch wiederbeschreibbare verwenden (rws) falls die sammlung mal erneuert werden soll.

sxhor 15.08.2010 21:28
Okay, danke für die Tipps. Dieses Forum ist echt klasse, ich werds weiterempfehlen!


Grüße
SG


Alle Zeitangaben in WEZ +1. Es ist jetzt 09:53 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131