Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Meldung: Windows wird in weniger als einer Minute..., AntiVir-Fund: JAVA/ClassLoader.BO (https://www.trojaner-board.de/91454-meldung-windows-weniger-minute-antivir-fund-java-classloader-bo.html)

Gar 04.10.2010 19:15
Meldung: Windows wird in weniger als einer Minute..., AntiVir-Fund: JAVA/ClassLoader.BO
 
Vor einer Woche kam die Meldung "Windows wird in weniger als einer Minute herutergefahren" das erste mal, danach startete der PC neu. Kurz darauf bekam ich auch einen Virenfund bei AntiVir.

Die Datei 'C:\Users\***\AppData\Local\Temp\0.8988801972047661.exe'
enthielt einen Virus oder unerwünschtes Programm 'TR/Riner.YF' [trojan].
Durchgeführte Aktion(en):Die Datei wurde gelöscht.

Und:

Die Datei 'C:\Users\***\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14\5029cd0e-59147293'
enthielt einen Virus oder unerwünschtes Programm 'JAVA/ClassLoader.BO' [virus].
Durchgeführte Aktion(en):
Die Datei wurde gelöscht.

Außer dem Neustart von Windows startet Firefox sehr langsam, und stürzt ständig ab( "Programm reagiert nicht" ).

Nach einem Scan mit AntiVir machte ich noch einen mit
Malwarebytes.
LOG:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4690

Windows 6.0.6002 Service Pack 2
Internet Explorer 7.0.6002.18005

25.09.2010 15:36:43
mbam-log-2010-09-25 (15-36-43).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 512760
Laufzeit: 1 Stunde(n), 56 Minute(n), 6 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 2
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 2

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{055fd26d-3a88-4e15-963d-dc8493744b1d} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{055fd26d-3a88-4e15-963d-dc8493744b1d} (Trojan.BHO) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Program Files\Werkkzeug1\kkino1.exe (Malware.Packer.Krunchy) -> Quarantined and deleted successfully.
C:\Program Files\ICQToolbar\toolbaru.dll (Trojan.BHO) -> Quarantined and deleted successfully.

Nach dem Löschen der Funde tritt das Problem weiterhin auf, alle weiteren Scans sind jedoch negativ.
ich habe verschiedene Einträge bereits gelesen (z.B. der von User Eldrick, weil sein Problem scheinbar sehr ähnlich war.) seitdem habe ich einen weiterern Scan mit SUPERAntiSpiware gemacht, bei dem das hier gefunden wurde:

Trojan.Agent/Gen-FakeAlert[Local]
C:\PROGRAM FILES\MONTE CRISTO\CITY LIFE\DATA\_FILESYSTEMPACKER.EXE


Trojan.Agent/CDesc[Generic]
C:\PROGRAM FILES\SONY\PLAYSTATION STORE\NPAAC_WIN.DLL
C:\PROGRAM FILES\SONY\PLAYSTATION STORE\NPCOMMERCE2LIB.DLL


Die weiteren Scans waren jedoch wieder negativ, die Probleme treten weiterhin auf.
Ich habe außerdem Java geupdated.

Ich weiß wirklich nicht, was ich noch weiteres machen soll.

Swisstreasure 04.10.2010 21:29
:hallo:


Eine Bereinigung ist mitunter mit viel Arbeit für Dich verbunden.
  • Bitte arbeite alle Schritte der Reihe nach ab.
  • Lese die Anleitungen sorgfältig. Sollte es Probleme geben, bitte stoppen und hier so gut es geht beschreiben.
  • Nur Scanns durchführen zu denen Du von einem Helfer aufgefordert wirst.
  • Bitte kein Crossposting ( posten in mehreren Foren).
  • Installiere oder Deinstalliere während der Bereinigung keine Software ausser Du wurdest dazu aufgefordert.
  • Lese Dir die Anleitung zuerst vollständig durch. Sollte etwas unklar sein, frage bevor Du beginnst.
  • Poste die Logfiles direkt in deinen Thread. Nicht anhängen ausser ich fordere Dich dazu auf. Erschwert mir nämlich das auswerten.
Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der Schnellere und immer der sicherste Weg.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist.

Vista und Win7 User
Alle Tools mit Rechtsklick "als Administrator ausführen" starten.

Schritt 1

CustomScan mit OTL


Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%systemroot%\system32\*.wt
%systemroot%\system32\*.ruy
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
%systemroot%\system32\ws2help.dll /md5
/md5start
explorer.exe
winlogon.exe
wininit.exe
/md5stop
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
Schritt 2

Rootkit-Suche mit Gmer

Was sind Rootkits?


Wichtig: Bei jedem Rootkit-Scans soll/en:
  • Deaktiviere zunächst nach dieser Anleitung evtl. vorhandene CD-Emulatoren wie Alcohol, Daemon-Tools oder ähnliche.
  • Alle anderen Programme gegen Viren, Spyware, usw. deaktiviert sein,
  • keine Verbindung zu einem Netzwerk/Internet bestehen (WLAN nicht vergessen),
  • nichts am Rechner getan werden,
  • nach jedem Scan der Rechner neu gestartet werden.
  • Nicht vergessen, nach dem Rootkit-Scan die Security-Programme wieder einzuschalten!
Lade Dir Gmer von dieser Seite herunter

(auf den Button Download EXE drücken) und das Programm auf dem Desktop speichern.
  • Alle anderen Programme sollen geschlossen sein.
  • Starte gmer.exe (hat einen willkürlichen Programm-Namen).
  • Vista-User mit Rechtsklick und als Administrator starten.
  • Gmer startet automatisch einen ersten Scan.
  • Sollte sich ein Fenster mit folgender Warnung öffnen:
    Code:
    WARNING !!!
    GMER has found system modification, which might have been caused by ROOTKIT activity.
    Do you want to fully scan your system?
  • Unbedingt auf "No" klicken,
    in dem Fall über den Save-Button das bisherige Resultat auf dem Desktop als gmer_first.log speichern.

    .
  • Falls das nicht der Fall war, wähle nun den Reiter "Rootkit/Malware",
  • Hake an: System, Sections, Devices, Modules, Processes, Threads, Libraries, Services, Registry und Files.
  • Wichtig: "Show all" darf nicht angehakt sein!
  • Starte den Scan durch Drücken des Buttons "Scan".
    Mache nichts am Computer während der Scan läuft (unten links wird angezeigt, was gerade gescannt wird).
  • Wenn der Scan fertig ist, bleibt die Zeile leer.
    Kllicke auf "Save" und speichere das Logfile als gmer.log auf dem Desktop.
    Mit "Ok" wird Gmer beendet.
Antiviren-Programm und sonstige Scanner wieder einschalten, bevor Du ins Netz gehst!

Nun das Logfile in Code-Tags posten.

Gar 05.10.2010 16:01
OTL:OTL Logfile:
Code:
OTL logfile created on: 05.10.2010 14:30:28 - Run 1
OTL by OldTimer - Version 3.2.14.1    Folder = C:\Users\***\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 62,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 80,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 229,13 Gb Total Space | 25,93 Gb Free Space | 11,32% Space Free | Partition Type: NTFS
Drive D: | 228,82 Gb Total Space | 34,07 Gb Free Space | 14,89% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive J: | 1397,26 Gb Total Space | 1087,35 Gb Free Space | 77,82% Space Free | Partition Type: NTFS
 
Computer Name: ***S-PC
Current User Name: ***
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan
 
========== Processes (SafeList) ==========
 
PRC - [2010.10.05 14:25:41 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
PRC - [2010.10.01 15:53:54 | 002,424,560 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
PRC - [2010.09.17 17:32:09 | 000,014,808 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\plugin-container.exe
PRC - [2010.09.17 17:32:08 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010.08.13 12:58:56 | 000,144,672 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010.06.28 13:01:30 | 002,435,592 | ---- | M] (Check Point Software Technologies LTD) -- C:\Windows\System32\ZoneLabs\vsmon.exe
PRC - [2010.06.28 12:59:52 | 001,043,968 | ---- | M] (Check Point Software Technologies LTD) -- C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
PRC - [2010.04.20 16:27:09 | 000,267,432 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2010.03.02 11:28:23 | 000,282,792 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.02.24 10:28:01 | 000,135,336 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2010.01.14 22:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009.08.18 11:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
PRC - [2009.08.18 11:29:22 | 000,183,152 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
PRC - [2009.04.11 08:28:15 | 000,244,224 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wisptis.exe
PRC - [2009.04.11 08:28:06 | 000,304,128 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.01.19 09:33:12 | 000,198,656 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2010.10.05 14:25:41 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
MOD - [2009.04.11 08:28:24 | 000,380,416 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll
MOD - [2009.04.11 08:21:38 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll
MOD - [2008.01.19 09:33:00 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msscript.ocx
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] -- c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (LiveUpdate Notice Ex)
SRV - File not found [Auto | Stopped] -- c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (CLTNetCnService)
SRV - [2010.08.13 12:58:56 | 000,144,672 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2010.08.13 09:13:32 | 000,066,112 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_Helper_3004.dll -- (nosGetPlusHelper) getPlus(R)
SRV - [2010.06.28 13:01:30 | 002,435,592 | ---- | M] (Check Point Software Technologies LTD) [Auto | Running] -- C:\Windows\System32\ZoneLabs\vsmon.exe -- (vsmon)
SRV - [2010.04.20 16:27:09 | 000,267,432 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2010.03.29 08:53:22 | 000,068,000 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus(R)
SRV - [2010.03.18 13:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.24 10:28:01 | 000,135,336 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010.01.03 18:07:48 | 000,246,520 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)
SRV - [2009.12.27 15:54:44 | 003,792,896 | ---- | M] (Moonware Studios) [Disabled | Stopped] -- D:\Programme2\webcam 7\wService.exe -- (w7Svc)
SRV - [2009.09.25 03:27:04 | 000,793,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache)
SRV - [2009.08.18 11:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2008.06.05 13:22:50 | 001,811,456 | ---- | M] (Buhl Data Service GmbH) [Disabled | Stopped] -- C:\Program Files\Sceneo\AbsolutTV\Services\PVR\pvrservice.exe -- (srvcPVR)
SRV - [2008.01.29 17:38:32 | 000,583,048 | ---- | M] (Symantec Corporation) [Disabled | Stopped] -- C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe -- (LiveUpdate Notice Service)
SRV - [2008.01.19 09:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.09.26 10:53:56 | 002,999,664 | ---- | M] (Symantec Corporation) [Disabled | Stopped] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_2.EXE -- (LiveUpdate)
SRV - [2007.09.26 10:53:56 | 000,554,352 | ---- | M] (Symantec Corporation) [Disabled | Stopped] -- C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe -- (Automatisches LiveUpdate - Scheduler)
SRV - [2007.09.07 20:16:18 | 001,373,480 | ---- | M] (Wacom Technology, Corp.) [Disabled | Stopped] -- C:\Windows\System32\Pen_Tablet.exe -- (TabletServicePen)
SRV - [2007.04.04 18:54:08 | 000,266,343 | ---- | M] (CyberLink) [Disabled | Stopped] -- C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe -- (Acer HomeMedia Connect Service)
SRV - [2007.02.07 00:04:26 | 000,457,512 | ---- | M] (HiTRSUT) [Disabled | Stopped] -- C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe -- (eDataSecurity Service)
SRV - [2007.01.31 18:18:42 | 000,053,248 | ---- | M] (Acer Inc.) [Disabled | Stopped] -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe -- (eRecoveryService)
SRV - [2006.12.29 17:51:56 | 000,028,672 | ---- | M] () [Disabled | Stopped] -- C:\Acer\Empowering Technology\ePerformance\MemCheck.exe -- (AcerMemUsageCheckService)
SRV - [2006.12.14 17:00:00 | 000,544,768 | ---- | M] (Magix AG) [Disabled | Stopped] -- C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe -- (UPnPService)
SRV - [2005.11.17 16:18:52 | 001,527,900 | ---- | M] (MAGIX®) [Disabled | Stopped] -- C:\MAGIX\Common\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vsdatant.win7.sys -- (vsdatant7)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\EagleNT.sys -- (EagleNT)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2010.05.15 16:30:46 | 000,457,304 | ---- | M] (Check Point Software Technologies LTD) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\vsdatant.sys -- (Vsdatant)
DRV - [2010.05.10 20:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010.04.03 22:55:32 | 011,573,800 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2010.03.01 10:05:19 | 000,124,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2010.02.17 20:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2010.02.16 14:24:01 | 000,060,936 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009.09.11 21:38:19 | 000,025,280 | ---- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\hamachi.sys -- (hamachi)
DRV - [2009.05.11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.04.11 06:45:24 | 000,113,664 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rmcast.sys -- (RMCAST) RMCAST (Pgm)
DRV - [2009.03.27 14:23:12 | 000,023,064 | ---- | M] (Screaming Bee LLC) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ScreamingBAudio.sys -- (SCREAMINGBDRIVER)
DRV - [2009.02.13 11:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2008.04.25 18:38:49 | 000,101,376 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\ACEDRV07.sys -- (ACEDRV07)
DRV - [2008.01.14 12:06:32 | 000,021,632 | ---- | M] (ManyCam LLC.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ManyCam.sys -- (ManyCam)
DRV - [2007.08.31 15:24:26 | 000,039,408 | ---- | M] (Cyberlink Corp.) [Kernel | Auto | Running] -- C:\Program Files\Acer Arcade Live\Acer PlayMovie\000.fcl -- ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796})
DRV - [2007.07.18 21:32:40 | 001,841,312 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2007.06.14 14:41:00 | 000,466,048 | ---- | M] (LITEON) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Ltn_stk7070P.sys -- (Ltn_stk7070P)
DRV - [2007.06.13 19:30:20 | 000,013,440 | ---- | M] (LITEON) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Ltn_stkrc.sys -- (Ltn_stkrc)
DRV - [2007.05.07 00:55:51 | 000,006,144 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NTIDrvr.sys -- (NTIDrvr)
DRV - [2007.03.14 16:04:28 | 002,427,392 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2007.02.16 21:12:36 | 000,011,312 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\wacommousefilter.sys -- (wacommousefilter)
DRV - [2007.02.16 20:30:12 | 000,012,848 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\wacomvhid.sys -- (wacomvhid)
DRV - [2007.02.16 02:11:28 | 000,011,440 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\WacomVKHid.sys -- (WacomVKHid)
DRV - [2007.02.07 00:04:54 | 000,016,680 | ---- | M] (HiTRUST) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\PSDNServ.sys -- (PSDNServ)
DRV - [2007.02.07 00:04:50 | 000,060,712 | ---- | M] (HiTRUST) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\psdvdisk.sys -- (psdvdisk)
DRV - [2007.02.07 00:04:48 | 000,020,264 | ---- | M] (HiTRUST) [File_System | Boot | Running] -- C:\Windows\system32\DRIVERS\psdfilter.sys -- (PSDFilter)
DRV - [2006.12.07 18:12:02 | 000,076,584 | ---- | M] () [Kernel | Auto | Running] -- C:\Acer\Empowering Technology\eRecovery\int15.sys -- (int15)
DRV - [2006.11.02 11:51:45 | 000,900,712 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)
DRV - [2006.11.02 11:51:38 | 000,420,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)
DRV - [2006.11.02 11:51:34 | 000,316,520 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)
DRV - [2006.11.02 11:51:32 | 000,297,576 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)
DRV - [2006.11.02 11:51:25 | 000,235,112 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)
DRV - [2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)
DRV - [2006.11.02 11:51:00 | 000,147,048 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)
DRV - [2006.11.02 11:50:45 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)
DRV - [2006.11.02 11:50:41 | 000,112,232 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)
DRV - [2006.11.02 11:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)
DRV - [2006.11.02 11:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)
DRV - [2006.11.02 11:50:35 | 000,098,408 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)
DRV - [2006.11.02 11:50:24 | 000,088,680 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid)
DRV - [2006.11.02 11:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)
DRV - [2006.11.02 11:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)
DRV - [2006.11.02 11:50:16 | 000,071,784 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)
DRV - [2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)
DRV - [2006.11.02 11:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)
DRV - [2006.11.02 11:50:10 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)
DRV - [2006.11.02 11:50:10 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2006.11.02 11:50:10 | 000,038,504 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid2.sys -- (SiSRaid2)
DRV - [2006.11.02 11:50:10 | 000,037,480 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)
DRV - [2006.11.02 11:50:09 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc)
DRV - [2006.11.02 11:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)
DRV - [2006.11.02 11:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)
DRV - [2006.11.02 11:50:05 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)
DRV - [2006.11.02 11:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)
DRV - [2006.11.02 11:50:04 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)
DRV - [2006.11.02 11:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)
DRV - [2006.11.02 11:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)
DRV - [2006.11.02 11:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)
DRV - [2006.11.02 11:49:53 | 000,028,776 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas)
DRV - [2006.11.02 11:49:30 | 000,017,512 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide)
DRV - [2006.11.02 11:49:28 | 000,016,488 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)
DRV - [2006.11.02 11:49:20 | 000,014,952 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide)
DRV - [2006.11.02 10:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006.11.02 10:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)
DRV - [2006.11.02 10:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)
DRV - [2006.11.02 10:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)
DRV - [2006.11.02 10:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)
DRV - [2006.11.02 10:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)
DRV - [2006.11.02 09:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)
DRV - [2006.11.02 09:30:56 | 000,194,048 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\yk60x86.sys -- (yukonwlh)
DRV - [2006.11.02 09:30:54 | 000,117,760 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R)
DRV - [2006.10.30 05:22:26 | 000,008,192 | ---- | M] (ATI Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\AtiPcie.sys -- (AtiPcie) ATI PCI Express (3GIO)
DRV - [2004.11.22 16:58:31 | 000,014,342 | ---- | M] (Intellon Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbethmp.sys -- (A_USBETHMP)
DRV - [2004.05.17 11:21:54 | 000,017,280 | ---- | M] (Intellon, Inc.) [Kernel | Auto | Running] -- C:\Windows\system32\plcndis5.sys -- (PLCNDIS5)
DRV - [2002.10.31 13:04:06 | 000,434,368 | ---- | M] (Unknown) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\V2210vid.sys -- (V2210VID)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.intl.acer.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.sweetim.com
IE - HKLM\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKLM\..\URLSearchHook: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Program Files\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Program Files\ZoneAlarm-Sicherheit\tbZone.dll (Conduit Ltd.)
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SEARCH PAGE = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\..\URLSearchHook: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Program Files\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll (SweetIM Technologies Ltd.)
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
IE - HKCU\..\URLSearchHook: {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Program Files\ZoneAlarm-Sicherheit\tbZone.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.sweetim.com/search.asp?src=2&q="
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://taz.de/"
FF - prefs.js..extensions.enabledItems: battlefieldheroespatcher@ea.com:5.0.31.0
FF - prefs.js..extensions.enabledItems: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}:1.0.7
FF - prefs.js..extensions.enabledItems: {e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.2.5
FF - prefs.js..extensions.enabledItems: eafo3fflauncher@ea.com:1.1
FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.2.0
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}:2.7.1.3
FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=2&q="
FF - prefs.js..network.proxy.no_proxies_on: "*.local"
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "hxxp://meine-startseite.computerbild.de/hauptbahnhof/***s Startseite"
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q="
 
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.10.04 17:32:45 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.10.04 17:32:45 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.16\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010.10.04 17:32:45 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.16\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2010.10.04 17:32:45 | 000,000,000 | ---D | M]
 
[2009.05.08 13:23:20 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\mozilla\Extensions
[2008.05.21 21:17:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions\{6334D996-EA3E-4a0e-AA8D-15BA56B37241}
[2010.10.05 13:58:48 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\ze1nkspb.default\extensions
[2009.06.27 12:39:12 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\ze1nkspb.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009.11.20 18:41:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\ze1nkspb.default\extensions\{3e9bb2a7-62ca-4efa-a4e6-f6f6168a652d}
[2009.12.05 22:36:28 | 000,000,000 | ---D | M] (Stylish) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\ze1nkspb.default\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}
[2009.12.17 20:55:11 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\ze1nkspb.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010.09.08 17:03:46 | 000,000,000 | ---D | M] (DVDVideoSoftTB Toolbar) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\ze1nkspb.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2010.09.08 16:58:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\ze1nkspb.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2009.05.18 17:58:34 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus(R))) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\ze1nkspb.default\extensions\{CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}
[2010.04.23 17:29:46 | 000,000,000 | ---D | M] (Torbutton) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\ze1nkspb.default\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}
[2010.01.01 16:29:04 | 000,000,000 | ---D | M] (DVDVideoSoft Toolbar) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\ze1nkspb.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}
[2010.01.04 00:43:47 | 000,000,000 | ---D | M] (SweetIM Toolbar for Firefox) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\ze1nkspb.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
[2010.09.28 20:25:55 | 000,000,000 | ---D | M] (ZoneAlarm-Sicherheit Toolbar) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\ze1nkspb.default\extensions\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}
[2010.08.26 17:15:35 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\ze1nkspb.default\extensions\battlefieldheroespatcher@ea.com
[2010.06.22 18:27:31 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\ze1nkspb.default\extensions\eafo3fflauncher@ea.com
[2010.10.01 18:14:25 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\ze1nkspb.default\extensions\staged-xpis
[2010.08.29 23:17:38 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\ze1nkspb.default\extensions\toolbar@ask.com
[2010.05.26 15:18:50 | 000,002,333 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\FireFox\Profiles\ze1nkspb.default\searchplugins\askcom.xml
[2010.08.27 23:04:54 | 000,000,943 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\FireFox\Profiles\ze1nkspb.default\searchplugins\conduit.xml
[2010.09.29 20:25:29 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\FireFox\Profiles\ze1nkspb.default\searchplugins\icqplugin-1.xml
[2009.08.11 18:42:54 | 000,000,961 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\FireFox\Profiles\ze1nkspb.default\searchplugins\icqplugin-2.xml
[2009.09.13 17:39:22 | 000,000,666 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\FireFox\Profiles\ze1nkspb.default\searchplugins\icqplugin-3.xml
[2009.11.02 21:34:59 | 000,000,961 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\FireFox\Profiles\ze1nkspb.default\searchplugins\icqplugin-4.xml
[2009.11.07 19:51:41 | 000,000,961 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\FireFox\Profiles\ze1nkspb.default\searchplugins\icqplugin-5.xml
[2009.12.17 17:58:07 | 000,000,961 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\FireFox\Profiles\ze1nkspb.default\searchplugins\icqplugin-6.xml
[2008.07.10 14:07:28 | 000,000,944 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\FireFox\Profiles\ze1nkspb.default\searchplugins\icqplugin.xml
[2009.05.21 15:46:36 | 000,001,632 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\FireFox\Profiles\ze1nkspb.default\searchplugins\live-search.xml
[2010.01.04 00:43:35 | 000,003,915 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\FireFox\Profiles\ze1nkspb.default\searchplugins\sweetim.xml
[2010.10.03 22:18:14 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010.01.24 00:04:33 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.09.12 17:38:08 | 000,001,392 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.09.12 17:38:08 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.09.12 17:38:08 | 000,006,805 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.09.12 17:38:08 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.09.12 17:38:08 | 000,001,105 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar1.dll (Google Germany GmbH)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (DVDVideoSoft Toolbar) - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Program Files\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
O2 - BHO: (EpsonToolBandKicker Class) - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O2 - BHO: (SweetIM Toolbar Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O2 - BHO: (ZoneAlarm-Sicherheit Toolbar) - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Program Files\ZoneAlarm-Sicherheit\tbZone.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Germany GmbH)
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (DVDVideoSoft Toolbar) - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Program Files\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKLM\..\Toolbar: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (ZoneAlarm-Sicherheit Toolbar) - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Program Files\ZoneAlarm-Sicherheit\tbZone.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKCU\..\Toolbar\WebBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKCU\..\Toolbar\WebBrowser: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoft Toolbar) - {E9911EC6-1BCC-40B0-9993-E0EEA7F6953F} - C:\Program Files\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKCU\..\Toolbar\WebBrowser: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: [Acer Tour]  File not found
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [eRecoveryService]  File not found
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [Acer Tour Reminder]  File not found
O4 - HKCU..\Run: [PMCRemote]  File not found
O4 - HKCU..\Run: [Res32] C:\Users\***\AppData\Roaming\Adobe\Update\dlgdo.exe ()
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8 - Extra context menu item: Free YouTube Download - C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - Reg Error: Value error. File not found
O9 - Extra Button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\***\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\***\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
Drivers32: aux - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\Windows\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.imaadpcm - C:\Windows\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codec - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lhacm - C:\Windows\System32\lhacm.acm (Microsoft Corporation)
Drivers32: msacm.mkdmp3enc - C:\PROGRA~1\ACERAR~1\ACERVI~1\Kernel\Burner\MKDMP3Enc.ACM File not found
Drivers32: msacm.msadpcm - C:\Windows\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msaudio1 - C:\Windows\System32\msaud32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\Windows\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\Windows\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: msacm.siren - C:\Windows\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\Windows\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.dvsd - C:\Windows\System32\Dvc.dll (Adaptec)
Drivers32: VIDC.I420 - C:\Windows\System32\i420vfw.dll (www.helixcommunity.org)
Drivers32: vidc.iv50 - C:\Windows\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.IYUV - C:\Windows\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.mjpg - C:\Windows\System32\pvmjpg30.dll (Pegasus Imaging Corporation)
Drivers32: VIDC.MP42 - C:\Windows\System32\mpg4c32.dll (Microsoft Corporation)
Drivers32: VIDC.MP43 - C:\Windows\System32\mpg4c32.dll (Microsoft Corporation)
Drivers32: VIDC.MPG4 - C:\Windows\System32\mpg4c32.dll (Microsoft Corporation)
Drivers32: vidc.mrle - C:\Windows\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\Windows\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: VIDC.UYVY - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: vidc.VP60 - C:\Windows\System32\vp6vfw.dll (On2.com)
Drivers32: vidc.VP61 - C:\Windows\System32\vp6vfw.dll (On2.com)
Drivers32: VIDC.VQC6 - C:\Windows\System32\V2210dec.dll ( )
Drivers32: vidc.XVID - C:\Windows\System32\xvidvfw.dll ()
Drivers32: VIDC.YUY2 - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: vidc.yv12 - C:\Windows\System32\yv12vfw.dll (www.helixcommunity.org)
Drivers32: VIDC.YVU9 - C:\Windows\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVYU - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\Windows\System32\msacm32.drv (Microsoft Corporation)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 90 Days ==========
 
[2010.10.05 14:25:37 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
[2010.10.04 18:09:14 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft ATS
[2010.10.04 17:38:51 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\PCF-VLC
[2010.10.04 17:35:22 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2010.10.04 17:35:17 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2010.10.04 17:32:16 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2010.10.04 17:30:48 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2010.10.04 17:30:46 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2010.09.28 20:25:16 | 000,000,000 | ---D | C] -- C:\Program Files\ZoneAlarm-Sicherheit
[2010.09.28 20:24:51 | 000,000,000 | ---D | C] -- C:\Program Files\CheckPoint
[2010.09.28 20:20:58 | 000,046,592 | ---- | C] (Zone Labs Inc.) -- C:\Windows\System32\vsutil_loc0407.dll
[2010.09.28 20:16:49 | 000,000,000 | ---D | C] -- C:\Windows\System32\ZoneLabs
[2010.09.28 20:16:44 | 000,000,000 | ---D | C] -- C:\Program Files\Zone Labs
[2010.09.28 20:14:25 | 000,000,000 | ---D | C] -- C:\ProgramData\CheckPoint
[2010.09.28 20:14:20 | 000,000,000 | ---D | C] -- C:\Windows\Internet Logs
[2010.09.28 15:19:00 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\SUPERAntiSpyware.com
[2010.09.28 15:19:00 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2010.09.28 15:18:55 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2010.09.27 22:30:09 | 000,000,000 | ---D | C] -- C:\Windows\Sun
[2010.09.27 20:16:00 | 000,000,000 | ---D | C] -- C:\Program Files\HiJackThis
[2010.09.26 22:48:33 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2010.09.25 19:08:49 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2010.09.25 13:33:57 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes
[2010.09.25 13:33:49 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.09.25 13:33:48 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.09.25 13:33:48 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010.09.25 13:33:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.09.21 19:35:48 | 000,000,000 | ---D | C] -- C:\Users\***\Documents\Schöningh
[2010.09.17 18:26:49 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\PLAKATE
[2010.09.08 18:55:04 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Philipp Winterberg
[2010.09.08 18:54:55 | 000,000,000 | ---D | C] -- C:\Program Files\RarZilla Free Unrar
[2010.09.08 16:58:45 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.09.06 19:37:25 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\LOGO
[2010.07.10 19:44:59 | 000,000,000 | ---D | C] -- C:\Program Files\DivX
[2010.01.20 17:14:50 | 000,139,264 | ---- | C] ( ) -- C:\Windows\System32\V2210dec.dll
[2007.05.07 01:07:10 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\Interop.Shell32.dll
 
========== Files - Modified Within 90 Days ==========
 
File not found -- C:\Users\***\splinter cell
[2010.10.05 14:29:55 | 005,242,880 | -HS- | M] () -- C:\Users\***\NTUSER.DAT
[2010.10.05 14:25:41 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
[2010.10.05 13:50:16 | 000,000,418 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{1DB327C0-63D8-4FDD-85A5-CD223743BA19}.job
[2010.10.05 13:47:42 | 000,001,052 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job
[2010.10.05 13:45:22 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.10.05 13:45:22 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.10.05 13:45:22 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.10.05 13:45:05 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.10.05 13:44:57 | 3220,692,992 | -HS- | M] () -- C:\hiberfil.sys
[2010.10.05 01:33:21 | 000,524,288 | -HS- | M] () -- C:\Users\***\NTUSER.DAT{152eacd7-c82d-11df-8fc1-001c25273050}.TMContainer00000000000000000001.regtrans-ms
[2010.10.05 01:33:21 | 000,065,536 | -HS- | M] () -- C:\Users\***\NTUSER.DAT{152eacd7-c82d-11df-8fc1-001c25273050}.TM.blf
[2010.10.05 01:33:15 | 003,424,976 | -H-- | M] () -- C:\Users\***\AppData\Local\IconCache.db
[2010.10.04 19:30:17 | 004,063,232 | ---- | M] () -- C:\Windows\ocsetup_install_MicrosoftWindowsPowerShell.etl
[2010.10.04 19:30:17 | 000,196,608 | ---- | M] () -- C:\Windows\ocsetup_cbs_install_MicrosoftWindowsPowerShell.perf
[2010.10.04 19:30:17 | 000,065,536 | ---- | M] () -- C:\Windows\ocsetup_cbs_install_MicrosoftWindowsPowerShell.dpx
[2010.10.04 17:36:07 | 000,001,804 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2010.10.04 17:32:32 | 000,001,690 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2010.10.04 17:19:41 | 000,002,613 | ---- | M] () -- C:\Users\***\Desktop\HiJackThis.lnk
[2010.10.04 00:22:16 | 000,000,680 | RHS- | M] () -- C:\Users\***\ntuser.pol
[2010.10.04 00:06:46 | 000,000,349 | ---- | M] () -- C:\Users\Public\Documents\PCLECHAL.INI
[2010.10.04 00:06:45 | 000,222,208 | ---- | M] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.10.03 17:49:12 | 000,008,592 | ---- | M] () -- C:\Users\***\AppData\Local\d3d9caps.dat
[2010.09.29 23:59:01 | 000,174,324 | ---- | M] () -- C:\Users\***\Desktop\cc_20100929_235655.reg
[2010.09.28 20:31:16 | 000,420,800 | -H-- | M] () -- C:\Windows\System32\drivers\vsconfig.xml
[2010.09.28 20:24:13 | 000,000,835 | ---- | M] () -- C:\Users\***\Desktop\ZoneAlarm Security.lnk
[2010.09.28 20:24:11 | 000,005,977 | ---- | M] () -- C:\Windows\System32\vsconfig.xml
[2010.09.28 15:18:58 | 000,001,764 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010.09.27 23:07:56 | 000,040,375 | ---- | M] () -- C:\Users\***\Desktop\bootkit_remover.rar
[2010.09.27 22:01:21 | 000,001,851 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2010.09.26 22:48:48 | 000,000,768 | ---- | M] () -- C:\Users\***\Desktop\CCleaner.lnk
[2010.09.25 18:58:25 | 000,052,741 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2010.09.25 18:58:25 | 000,052,741 | ---- | M] () -- C:\ProgramData\nvModes.001
[2010.09.25 15:40:13 | 000,142,712 | ---- | M] () -- C:\Users\***\AppData\Local\GDIPFONTCACHEV1.DAT
[2010.09.25 15:38:52 | 000,444,808 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010.09.25 13:33:52 | 000,000,782 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.09.25 01:01:30 | 000,524,288 | -HS- | M] () -- C:\Users\***\NTUSER.DAT{152eacd7-c82d-11df-8fc1-001c25273050}.TMContainer00000000000000000002.regtrans-ms
[2010.09.25 00:42:08 | 000,524,288 | -HS- | M] () -- C:\Users\***\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2010.09.25 00:42:08 | 000,065,536 | -HS- | M] () -- C:\Users\***\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010.09.23 15:38:47 | 000,138,184 | ---- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2010.09.23 15:38:36 | 000,215,016 | ---- | M] () -- C:\Windows\System32\PnkBstrB.xtr
[2010.09.21 22:31:33 | 002,865,280 | ---- | M] () -- C:\Users\***\Desktop\YouTube        - King of the Bongo.mp3
[2010.09.21 15:09:03 | 000,072,792 | ---- | M] () -- C:\Users\***\Desktop\BLFImSickOfIt.jpg
[2010.09.20 21:26:46 | 000,110,691 | ---- | M] () -- C:\Users\***\Desktop\rickshaw2.jpg
[2010.09.20 16:32:50 | 000,001,398 | ---- | M] () -- C:\Users\***\Desktop\DivX Movies.lnk
[2010.09.20 16:31:53 | 000,000,881 | ---- | M] () -- C:\Users\Public\Desktop\DivX Plus Player.lnk
[2010.09.19 02:04:25 | 000,015,402 | ---- | M] () -- C:\Users\***\Desktop\Profil2.jpg
[2010.09.19 01:57:16 | 000,015,869 | ---- | M] () -- C:\Users\***\Desktop\Profil.jpg
[2010.09.18 23:31:36 | 000,169,827 | -H-- | M] () -- C:\Users\***\Desktop\mxfilerelatedcache.mxc2
[2010.09.15 18:21:56 | 001,174,016 | ---- | M] () -- C:\Users\***\Desktop\Aufwärmen.doc
[2010.09.12 22:07:37 | 000,249,693 | ---- | M] () -- C:\Users\***\Desktop\LOGO (2).zip
[2010.09.12 22:06:39 | 000,072,776 | ---- | M] () -- C:\Users\***\Desktop\SV LOGO3.jpg
[2010.09.12 22:02:28 | 000,077,197 | ---- | M] () -- C:\Users\***\Desktop\SV LOGO2.jpg
[2010.09.12 21:58:25 | 000,099,042 | ---- | M] () -- C:\Users\***\Desktop\SV LOGO´1.pdn
[2010.09.12 21:58:08 | 000,072,449 | ---- | M] () -- C:\Users\***\Desktop\SV LOGO.jpg
[2010.09.12 01:54:16 | 000,137,770 | ---- | M] () -- C:\Users\***\Desktop\SV logo.pdn
[2010.09.12 01:49:51 | 000,043,339 | ---- | M] () -- C:\Users\***\Desktop\Logo.2.2.jpg
[2010.09.12 01:49:42 | 000,049,155 | ---- | M] () -- C:\Users\***\Desktop\Logo.2.2.png
[2010.09.12 01:47:56 | 000,049,011 | ---- | M] () -- C:\Users\***\Desktop\Logo.2.png
[2010.09.11 17:52:33 | 000,054,474 | ---- | M] () -- C:\Users\***\Desktop\Logo.2.jpg
[2010.09.11 17:51:53 | 000,043,456 | ---- | M] () -- C:\Users\***\Desktop\logo.2.1.jpg
[2010.09.11 17:45:51 | 000,061,570 | ---- | M] () -- C:\Users\***\Desktop\logo.2.1.png
[2010.09.09 19:33:14 | 000,006,144 | -H-- | M] () -- C:\Users\***\photothumb.db
[2010.09.09 19:33:04 | 000,059,392 | -H-- | M] () -- C:\Users\***\Desktop\photothumb.db
[2010.09.08 18:54:56 | 000,000,864 | ---- | M] () -- C:\Users\Public\Desktop\RarZilla Free Unrar.lnk
[2010.09.08 17:03:17 | 004,972,672 | ---- | M] () -- C:\Users\***\Desktop\Charlie Chaplin-Funny song- Modern Times.mp3
[2010.09.08 16:58:34 | 000,000,996 | ---- | M] () -- C:\Users\***\Desktop\DVDVideoSoft Free Studio.lnk
[2010.09.07 23:29:00 | 000,081,282 | ---- | M] () -- C:\Users\***\Desktop\die chance nutzen.png
[2010.09.06 19:30:49 | 000,168,561 | ---- | M] () -- C:\Users\***\Desktop\Logo.zip
[2010.08.24 20:10:57 | 000,038,400 | ---- | M] () -- C:\Users\***\Desktop\The Unanimous Declaration Of Independence.doc
[2010.07.30 22:12:12 | 000,045,831 | ---- | M] () -- C:\Users\***\Documents\revolution.pdf
[2010.07.10 23:03:29 | 000,017,408 | ---- | M] () -- C:\Users\***\AppData\Local\WebpageIcons.db
[2010.07.10 19:46:05 | 000,000,921 | ---- | M] () -- C:\Users\Public\Desktop\DivX Plus Converter.lnk
 
========== Files Created - No Company Name ==========
 
[2010.10.04 19:29:53 | 000,196,608 | ---- | C] () -- C:\Windows\ocsetup_cbs_install_MicrosoftWindowsPowerShell.perf
[2010.10.04 19:29:53 | 000,065,536 | ---- | C] () -- C:\Windows\ocsetup_cbs_install_MicrosoftWindowsPowerShell.dpx
[2010.10.04 19:29:52 | 004,063,232 | ---- | C] () -- C:\Windows\ocsetup_install_MicrosoftWindowsPowerShell.etl
[2010.10.04 17:36:07 | 000,001,804 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2010.10.04 17:32:32 | 000,001,690 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2010.10.04 00:22:16 | 000,000,680 | RHS- | C] () -- C:\Users\***\ntuser.pol
[2010.10.03 22:39:33 | 3220,692,992 | -HS- | C] () -- C:\hiberfil.sys
[2010.09.29 23:57:16 | 000,174,324 | ---- | C] () -- C:\Users\***\Desktop\cc_20100929_235655.reg
[2010.09.28 20:24:13 | 000,000,835 | ---- | C] () -- C:\Users\***\Desktop\ZoneAlarm Security.lnk
[2010.09.28 20:21:04 | 000,005,977 | ---- | C] () -- C:\Windows\System32\vsconfig.xml
[2010.09.28 20:16:49 | 000,420,800 | -H-- | C] () -- C:\Windows\System32\drivers\vsconfig.xml
[2010.09.28 15:18:58 | 000,001,764 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010.09.27 23:07:53 | 000,040,375 | ---- | C] () -- C:\Users\***\Desktop\bootkit_remover.rar
[2010.09.27 22:00:36 | 000,001,851 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2010.09.27 20:16:02 | 000,002,613 | ---- | C] () -- C:\Users\***\Desktop\HiJackThis.lnk
[2010.09.26 22:48:48 | 000,000,768 | ---- | C] () -- C:\Users\***\Desktop\CCleaner.lnk
[2010.09.25 13:33:52 | 000,000,782 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.09.25 00:43:18 | 000,524,288 | -HS- | C] () -- C:\Users\***\NTUSER.DAT{152eacd7-c82d-11df-8fc1-001c25273050}.TMContainer00000000000000000002.regtrans-ms
[2010.09.25 00:43:18 | 000,524,288 | -HS- | C] () -- C:\Users\***\NTUSER.DAT{152eacd7-c82d-11df-8fc1-001c25273050}.TMContainer00000000000000000001.regtrans-ms
[2010.09.25 00:43:18 | 000,065,536 | -HS- | C] () -- C:\Users\***\NTUSER.DAT{152eacd7-c82d-11df-8fc1-001c25273050}.TM.blf
[2010.09.21 22:26:27 | 002,865,280 | ---- | C] () -- C:\Users\***\Desktop\YouTube        - King of the Bongo.mp3
[2010.09.20 21:26:45 | 000,110,691 | ---- | C] () -- C:\Users\***\Desktop\rickshaw2.jpg
[2010.09.19 02:04:22 | 000,015,402 | ---- | C] () -- C:\Users\***\Desktop\Profil2.jpg
[2010.09.19 01:57:14 | 000,015,869 | ---- | C] () -- C:\Users\***\Desktop\Profil.jpg
[2010.09.15 17:59:42 | 001,174,016 | ---- | C] () -- C:\Users\***\Desktop\Aufwärmen.doc
[2010.09.12 22:07:17 | 000,249,693 | ---- | C] () -- C:\Users\***\Desktop\LOGO (2).zip
[2010.09.12 22:06:21 | 000,072,776 | ---- | C] () -- C:\Users\***\Desktop\SV LOGO3.jpg
[2010.09.12 22:02:24 | 000,077,197 | ---- | C] () -- C:\Users\***\Desktop\SV LOGO2.jpg
[2010.09.12 21:58:23 | 000,099,042 | ---- | C] () -- C:\Users\***\Desktop\SV LOGO´1.pdn
[2010.09.12 21:58:03 | 000,072,449 | ---- | C] () -- C:\Users\***\Desktop\SV LOGO.jpg
[2010.09.12 01:49:49 | 000,043,339 | ---- | C] () -- C:\Users\***\Desktop\Logo.2.2.jpg
[2010.09.12 01:49:40 | 000,049,155 | ---- | C] () -- C:\Users\***\Desktop\Logo.2.2.png
[2010.09.11 17:52:31 | 000,054,474 | ---- | C] () -- C:\Users\***\Desktop\Logo.2.jpg
[2010.09.11 17:51:51 | 000,043,456 | ---- | C] () -- C:\Users\***\Desktop\logo.2.1.jpg
[2010.09.11 17:45:49 | 000,061,570 | ---- | C] () -- C:\Users\***\Desktop\logo.2.1.png
[2010.09.11 17:45:33 | 000,049,011 | ---- | C] () -- C:\Users\***\Desktop\Logo.2.png
[2010.09.08 18:54:56 | 000,000,864 | ---- | C] () -- C:\Users\Public\Desktop\RarZilla Free Unrar.lnk
[2010.09.08 17:02:50 | 004,972,672 | ---- | C] () -- C:\Users\***\Desktop\Charlie Chaplin-Funny song- Modern Times.mp3
[2010.09.08 16:58:34 | 000,000,996 | ---- | C] () -- C:\Users\***\Desktop\DVDVideoSoft Free Studio.lnk
[2010.09.07 23:28:57 | 000,081,282 | ---- | C] () -- C:\Users\***\Desktop\die chance nutzen.png
[2010.09.07 23:10:02 | 000,137,770 | ---- | C] () -- C:\Users\***\Desktop\SV logo.pdn
[2010.09.06 18:54:26 | 000,168,561 | ---- | C] () -- C:\Users\***\Desktop\Logo.zip
[2010.08.24 20:10:57 | 000,038,400 | ---- | C] () -- C:\Users\***\Desktop\The Unanimous Declaration Of Independence.doc
[2010.07.30 22:12:09 | 000,045,831 | ---- | C] () -- C:\Users\***\Documents\revolution.pdf
[2010.07.10 19:46:59 | 000,001,398 | ---- | C] () -- C:\Users\***\Desktop\DivX Movies.lnk
[2010.07.10 19:46:21 | 000,000,881 | ---- | C] () -- C:\Users\Public\Desktop\DivX Plus Player.lnk
[2010.07.10 19:46:05 | 000,000,921 | ---- | C] () -- C:\Users\Public\Desktop\DivX Plus Converter.lnk
[2010.06.19 11:58:58 | 000,052,741 | ---- | C] () -- C:\ProgramData\nvModes.001
[2010.06.19 11:58:45 | 000,052,741 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2010.06.04 20:54:11 | 000,017,408 | ---- | C] () -- C:\Users\***\AppData\Local\WebpageIcons.db
[2010.05.30 21:04:01 | 001,028,096 | ---- | C] () -- C:\Windows\System32\HDX4MediaConverter2.dll
[2010.03.02 00:48:01 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.01.28 23:32:40 | 000,941,784 | ---- | C] () -- C:\Windows\System32\drivers\CAMTHWDM.sys
[2010.01.20 17:14:50 | 000,028,672 | ---- | C] () -- C:\Windows\vqsetup.dll
[2009.10.18 17:43:29 | 000,008,570 | ---- | C] () -- C:\ProgramData\LUUnInstall.LiveUpdate
[2009.09.11 19:08:48 | 000,138,184 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2009.09.11 19:08:47 | 000,139,152 | ---- | C] () -- C:\Users\***\AppData\Roaming\PnkBstrK.sys
[2009.09.03 22:02:45 | 000,045,056 | ---- | C] () -- C:\Windows\System32\lexazdll32.dll
[2009.08.31 13:03:42 | 000,262,144 | ---- | C] () -- C:\Windows\System32\EMRegSys.dll
[2009.08.18 17:24:43 | 000,000,551 | ---- | C] () -- C:\Users\***\AppData\Roaming\AutoGK.ini
[2009.08.07 23:46:10 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.05.19 20:13:39 | 000,000,099 | ---- | C] () -- C:\Windows\galaxy.ini
[2009.05.12 15:51:31 | 000,000,660 | ---- | C] () -- C:\Windows\ODBC.INI
[2009.04.13 01:02:06 | 000,012,437 | ---- | C] () -- C:\Users\***\AppData\Roaming\UserTile.png
[2009.01.25 23:10:48 | 000,179,200 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2009.01.22 17:12:15 | 000,000,093 | ---- | C] () -- C:\Users\***\AppData\Local\fusioncache.dat
[2009.01.09 01:01:22 | 000,629,760 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2008.11.25 16:01:16 | 000,299,008 | ---- | C] () -- C:\Windows\System32\midas.dll
[2008.11.25 16:01:16 | 000,120,320 | ---- | C] () -- C:\Windows\System32\UnzDll.dll
[2008.11.25 15:55:52 | 000,000,043 | ---- | C] () -- C:\Windows\Caligari.ini
[2008.07.04 22:02:52 | 000,000,058 | ---- | C] () -- C:\Windows\nfsc_patch.ini
[2008.06.27 17:38:58 | 000,069,632 | R--- | C] () -- C:\Windows\System32\xmltok.dll
[2008.06.27 17:38:58 | 000,036,864 | R--- | C] () -- C:\Windows\System32\xmlparse.dll
[2008.06.11 20:11:29 | 000,226,302 | ---- | C] () -- C:\Users\***\AppData\Local\Temppenciltemp.png
[2008.06.01 22:07:41 | 000,544,256 | ---- | C] () -- C:\Windows\System32\janGraphics.dll
[2008.05.29 20:36:11 | 000,408,576 | ---- | C] () -- C:\Windows\System32\Smab.dll
[2008.05.29 20:36:10 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2008.05.26 18:51:01 | 000,096,768 | ---- | C] () -- C:\Windows\SlantAdj.dll
[2008.05.26 18:51:01 | 000,000,072 | ---- | C] () -- C:\Windows\System32\epDPE.ini
[2008.05.26 18:50:25 | 000,000,097 | ---- | C] () -- C:\Windows\System32\PICSDK.ini
[2008.05.26 18:47:43 | 000,000,027 | ---- | C] () -- C:\Windows\CDE CX3600FGD.ini
[2008.05.25 21:22:42 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2008.05.22 21:28:50 | 000,029,696 | ---- | C] () -- C:\Windows\System32\asutl8.dll
[2008.05.08 19:56:29 | 000,000,032 | ---- | C] () -- C:\ProgramData\ezsid.dat
[2008.04.19 17:06:46 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll
[2008.04.18 22:25:27 | 000,442,368 | ---- | C] () -- C:\Windows\System32\dvmsg.dll
[2008.04.18 19:08:50 | 000,053,248 | ---- | C] () -- C:\Windows\System32\mgxasio2.dll
[2008.04.18 19:03:27 | 000,007,103 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2008.04.15 21:50:36 | 000,222,208 | ---- | C] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.04.15 21:05:18 | 000,138,752 | ---- | C] () -- C:\Windows\System32\MASE32.DLL
[2008.04.15 21:05:17 | 000,196,096 | ---- | C] () -- C:\Windows\System32\MACD32.DLL
[2008.04.15 21:05:17 | 000,136,192 | ---- | C] () -- C:\Windows\System32\MAMC32.DLL
[2008.04.15 21:05:17 | 000,057,856 | ---- | C] () -- C:\Windows\System32\MASD32.DLL
[2008.04.15 21:05:17 | 000,027,648 | ---- | C] () -- C:\Windows\System32\MA32.DLL
[2008.04.15 19:42:07 | 000,000,044 | ---- | C] () -- C:\Windows\Acer(Normal).ini
[2008.04.15 19:42:07 | 000,000,042 | ---- | C] () -- C:\Windows\Acer(Wide).ini
[2008.04.15 19:22:52 | 000,008,592 | ---- | C] () -- C:\Users\***\AppData\Local\d3d9caps.dat
[2007.05.07 10:41:16 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIBUN4.dll
[2007.05.07 09:22:38 | 000,000,834 | ---- | C] () -- C:\Windows\generic.ini
[2007.05.07 09:22:38 | 000,000,132 | ---- | C] () -- C:\Windows\Alaunch.ini
[2007.05.07 09:22:34 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2007.05.07 01:07:10 | 000,331,776 | ---- | C] () -- C:\Windows\System32\ScrollBarLib.dll
[2007.02.06 23:58:10 | 000,204,800 | ---- | C] () -- C:\Windows\System32\NotesActnMenu.dll
[2007.02.06 23:57:58 | 000,266,240 | ---- | C] () -- C:\Windows\System32\NotesExtmngr.dll
[2007.02.06 23:57:20 | 000,086,016 | ---- | C] () -- C:\Windows\System32\MSNSpook.dll
[2007.02.06 23:56:30 | 000,028,672 | ---- | C] () -- C:\Windows\System32\BatchCrypto.dll
[2007.02.06 23:56:28 | 000,073,728 | ---- | C] () -- C:\Windows\System32\APISlice.dll
[2007.02.06 23:52:08 | 000,063,488 | ---- | C] () -- C:\Windows\System32\ShowErrMsg.dll
[2006.12.25 15:44:48 | 000,022,016 | ---- | C] () -- C:\Windows\System32\MailFormat_U.dll
[2006.12.07 01:57:19 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2005.02.05 21:46:00 | 000,004,608 | ---- | C] () -- C:\Windows\fgexec.dll
[2003.02.20 17:53:42 | 000,005,702 | ---- | C] () -- C:\Windows\System32\OUTLPERF.INI
[2002.10.16 00:54:04 | 000,153,088 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2001.12.26 15:12:30 | 000,065,536 | ---- | C] () -- C:\Windows\System32\multiplex_vcd.dll
[2001.09.03 22:46:38 | 000,110,592 | ---- | C] () -- C:\Windows\System32\Hmpg12.dll
[2001.07.30 15:33:56 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC.dll
[2001.07.23 21:04:36 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC_MMX.dll
 
========== LOP Check ==========
 
[2009.09.12 23:21:57 | 000,000,000 | -HSD | M] -- C:\Users\***\AppData\Roaming\.#
[2008.05.22 21:32:34 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Anvil Studio
[2010.05.30 21:05:15 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Ashampoo
[2009.01.22 16:24:33 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Ashampoo Cover Studio 2009
[2008.08.21 21:05:38 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Blender Foundation
[2008.11.25 16:15:25 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Buhl Data Service
[2009.09.03 22:03:56 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\dtv-lexikon
[2010.09.08 16:58:45 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.05.30 20:54:33 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Engelmann Media
[2008.04.17 23:05:05 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\eSobi
[2009.10.25 18:25:18 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\FontCreator
[2009.12.30 22:36:51 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\gtk-2.0
[2010.10.04 21:47:50 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ICQ
[2008.04.18 18:55:33 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ICQ Toolbar
[2008.06.23 19:16:31 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\InterTrust
[2009.05.19 19:34:29 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Laconic Software
[2009.10.03 15:06:04 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Leadertech
[2008.05.13 21:29:19 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Lionhead Studios
[2009.03.23 22:31:34 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\MAGIX
[2009.02.11 23:25:36 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\MAGIX Fotobuch
[2010.01.21 23:41:38 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ManyCam
[2008.05.21 21:17:19 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Participatory Culture Foundation
[2010.10.04 17:38:51 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\PCF-VLC
[2009.05.10 15:23:25 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\PeerNetworking
[2010.09.08 18:55:04 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Philipp Winterberg
[2009.09.10 16:06:01 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Screaming Bee
[2009.09.03 17:19:30 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Scribus
[2008.05.26 18:58:42 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Smart Panel
[2009.05.11 15:59:11 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Sony
[2009.11.23 17:14:13 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\SPORE
[2008.09.06 15:50:57 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\SPORE Creature Creator
[2008.05.21 21:34:58 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Thunderbird
[2010.02.21 18:58:48 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Tobit
[2008.11.25 16:06:04 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TVcentral-Core
[2010.01.28 23:33:44 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Webcammax
[2010.10.05 01:33:23 | 000,032,510 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2010.10.05 13:50:16 | 000,000,418 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{1DB327C0-63D8-4FDD-85A5-CD223743BA19}.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*.* >
[2007.05.07 01:07:48 | 000,003,380 | ---- | M] () -- C:\-20070507.log
[2006.09.18 23:43:36 | 000,000,024 | ---- | M] () -- C:\autoexec.bat
[2009.04.11 08:36:36 | 000,333,257 | RHS- | M] () -- C:\bootmgr
[2007.05.07 09:23:15 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK
[2006.09.18 23:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys
[2009.11.26 15:45:12 | 000,000,245 | ---- | M] () -- C:\debugInstaller.txt
[2010.10.05 13:44:57 | 3220,692,992 | -HS- | M] () -- C:\hiberfil.sys
[2009.09.03 22:03:20 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2006.11.29 17:35:22 | 000,000,512 | ---- | M] () -- C:\MDR.iss
[2009.09.03 22:03:20 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2010.10.05 13:44:53 | 3534,503,936 | -HS- | M] () -- C:\pagefile.sys
[2008.04.15 19:39:09 | 000,000,471 | ---- | M] () -- C:\RHDSetup.log
[2007.05.07 00:57:06 | 000,000,178 | ---- | M] () -- C:\setup.log
 
< %systemroot%\system32\*.wt >
 
< %systemroot%\system32\*.ruy >
 
< %systemroot%\Fonts\*.com >
[2006.11.02 14:37:12 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006.11.02 14:37:12 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006.11.02 14:37:12 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2010.01.18 16:20:46 | 000,037,665 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont
 
< %systemroot%\Fonts\*.dll >
 
< %systemroot%\Fonts\*.ini >
[2006.09.18 23:37:34 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini
 
< %systemroot%\Fonts\*.ini2 >
 
< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2006.11.02 14:35:48 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2007.04.09 13:23:54 | 000,028,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\mdippr.dll
[2006.10.26 19:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll
 
< %systemroot%\REPAIR\*.bak1 >
 
< %systemroot%\REPAIR\*.ini >
 
< %systemroot%\system32\*.jpg >
 
< %systemroot%\*.scr >
[2006.10.19 10:00:56 | 000,187,392 | ---- | M] () -- C:\Windows\Acer(Normal).scr
[2006.10.19 10:00:56 | 000,187,392 | ---- | M] () -- C:\Windows\Acer(Wide).scr
[2008.07.29 16:06:10 | 002,250,240 | ---- | M] (Laconic Software) -- C:\Windows\Free Fire Screensaver.scr
[2009.07.10 14:10:44 | 000,307,568 | ---- | M] (Microsoft Corporation) -- C:\Windows\WLXPGSS.SCR
 
< %systemroot%\*._sy >
 
< %APPDATA%\Adobe\Update\*.* >
[2010.10.04 17:14:14 | 000,274,944 | ---- | M] () -- C:\Users\***\AppData\Roaming\Adobe\Update\dlgdo.exe
 
< %ALLUSERSPROFILE%\Favorites\*.* >
 
< %APPDATA%\Microsoft\*.* >
 
< %PROGRAMFILES%\*.* >
[2009.03.05 18:54:04 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini
 
< %APPDATA%\Update\*.* >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2009.04.11 08:27:47 | 000,241,128 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rsaenh.dll
[2009.04.11 08:28:23 | 000,228,352 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\SLC.dll
 
< %systemroot%\Tasks\*.job /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006.11.02 12:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\system32\user32.dll /md5 >
[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
 
< %systemroot%\system32\ws2_32.dll /md5 >
[2008.01.19 09:37:09 | 000,179,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\ws2_32.dll
 
< %systemroot%\system32\ws2help.dll /md5 >
[2006.11.02 11:44:30 | 000,004,608 | ---- | M] (Microsoft Corporation) MD5=17C0671BF57057108A6D949510EE42C8 -- C:\Windows\System32\ws2help.dll
 
 
< MD5 for: EXPLORER.EXE  >
[2008.10.29 08:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2008.10.29 08:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008.10.30 05:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2008.04.17 14:52:51 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=6D06CD98D954FE87FB2DB8108793B399 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe
[2008.04.17 14:52:51 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=BD06F0BF753BC704B653C3A50F89D362 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe
[2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
[2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2008.10.28 04:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2006.11.02 11:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe
[2008.01.19 09:33:10 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
 
< MD5 for: WININIT.EXE  >
[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2008.01.19 09:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-10-03 20:52:00
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:0CE7F3C9
< End of report >
--- --- ---

EXTRAS:OTL Logfile:
Code:
OTL Extras logfile created on: 05.10.2010 14:30:28 - Run 1
OTL by OldTimer - Version 3.2.14.1    Folder = C:\Users\***\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 62,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 80,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 229,13 Gb Total Space | 25,93 Gb Free Space | 11,32% Space Free | Partition Type: NTFS
Drive D: | 228,82 Gb Total Space | 34,07 Gb Free Space | 14,89% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive J: | 1397,26 Gb Total Space | 1087,35 Gb Free Space | 77,82% Space Free | Partition Type: NTFS
 
Computer Name: HAUKES-PC
Current User Name: ***
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\WINWORD.EXE" /n /dde (Microsoft Corporation)
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UacDisableNotify" = 1
"InternetSettingsDisableNotify" = 1
"AutoUpdateDisableNotify" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{282C987F-7F6F-4A7F-9794-46C188A34E2D}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{36243253-E19F-4273-9768-2CEE152BCD3B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{44242F98-D4B0-42F4-838B-1AF1620C1B9E}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{59D5121B-FF05-4D6A-9264-EA17017C50F6}" = lport=2869 | protocol=6 | dir=in | app=system |
"{6D5D3221-0FAF-4EAC-8D25-3D11E015CE77}" = rport=2869 | protocol=6 | dir=out | app=system |
"{826BEA83-0DE7-4F81-AC3C-6343B02EA7A8}" = lport=2869 | protocol=6 | dir=in | app=system |
"{8AF2B5EB-4A00-4B02-BA2A-C70599F59A18}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{BF766753-76BD-4F57-937C-1E5D9858E356}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{C7171238-94E1-42F2-A53A-B0BE7847B26B}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{F27B4A21-6B78-4C5F-9E4A-3FE4169E1A23}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04B0A50E-00BF-4AD5-A9EA-7CB04089F089}" = protocol=6 | dir=in | app=d:\programme2\icq6.5\icq.exe |
"{08917A68-9F00-4FD6-BC6E-0811EE62BA55}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{092D9FD4-9315-4860-8C15-35D27762E64E}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{0BC4EAD2-5EDC-47F6-960B-7A6C03357683}" = protocol=6 | dir=in | app=c:\program files\pinnacle\videospin\programs\umi.exe |
"{14474163-F976-4417-A929-6ED79991A1AF}" = dir=in | app=c:\program files\acer arcade live\acer arcade live main page\acer arcade live.exe |
"{1DDFAFDA-E343-4D84-BE4D-F055CE0F0819}" = protocol=17 | dir=in | app=c:\program files\pinnacle\videospin\programs\rm.exe |
"{2347661D-BCF9-431B-96F0-84D03336B41D}" = protocol=6 | dir=in | app=c:\program files\microsoft games\zoo tycoon 2\zt.exe |
"{245EFA32-2FB3-45B4-BBA6-22977DA6B9D7}" = dir=in | app=c:\program files\acer arcade live\slideshow dvd\component\clsldvd.exe |
"{29EB6D01-9FC4-4C73-A719-76098D328167}" = protocol=6 | dir=in | app=c:\program files\icq7.0\aolload.exe |
"{2CAF8F7F-4018-449F-A320-06FCBECA7B92}" = protocol=17 | dir=in | app=c:\program files\icq7.0\icq.exe |
"{3738926D-03BB-40CB-8929-1B84147C4419}" = protocol=17 | dir=in | app=c:\program files\microsoft games\zoo tycoon 2\zt.exe |
"{3E1A7721-81FD-4D6A-9799-5F4CF196492D}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{401DCC44-0472-4D02-AC29-0D37AD80CF29}" = dir=in | app=c:\program files\acer arcade live\acer homemedia connect\homemedia connect.exe |
"{48479F0D-A229-4B88-AE0F-A9F4CAA3866E}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{48B8001C-9F90-4B59-A852-29235EEEE6D6}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{4B4DBD99-71D3-41E7-A293-DBF5364CDD6C}" = protocol=6 | dir=in | app=c:\program files\icq7.0\icq.exe |
"{4F6A9D0A-B2C6-4466-BDA3-A9E8A04CA573}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{513ED057-3824-4927-B104-F713836596E8}" = protocol=6 | dir=in | app=c:\program files\pinnacle\videospin\programs\rm.exe |
"{53946808-0485-4BC6-AF97-9978117E9E44}" = protocol=6 | dir=in | app=d:\programme2\icq6.5\icq.exe |
"{53DBA6AB-B590-462B-99E7-051089082179}" = protocol=6 | dir=in | app=c:\program files\icq7.0\icq.exe |
"{57EF81D5-1F99-4371-B78D-B2199531A19B}" = protocol=17 | dir=in | app=c:\program files\icq7.0\aolload.exe |
"{5AF8FA0D-31B4-4BB3-BB06-7468299131E1}" = dir=in | app=c:\program files\acer arcade live\acer playmovie\playmovie.exe |
"{603E1AC3-1B95-432F-BFFC-923DE68CD193}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{610D4256-FBF6-4239-BD64-20FDFE1F9691}" = dir=in | app=c:\program files\acer arcade live\acer homemedia connect\kernel\dms\clmsserver.exe |
"{613EC548-2ADC-4F36-AB4D-D92E1B7D62BC}" = protocol=6 | dir=in | app=c:\program files\sony\media manager for psp\mediamanager.exe |
"{6307F449-05C4-4738-BF6B-FD7B228A1DEE}" = dir=in | app=c:\program files\acer arcade live\acer dvdivine\dvdivine.exe |
"{668B9D30-8C28-4862-BCE1-8A68B4DE5FB4}" = protocol=17 | dir=in | app=d:\programme2\icq6.5\icq.exe |
"{695E9E79-C11B-49E8-9FD5-18A894522ECB}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{69F69489-C87E-4521-8A5A-80841CC67EE8}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{6BA6BAE5-3888-4DCF-8B65-20605C873AE9}" = protocol=6 | dir=in | app=c:\windows\system32\zonelabs\vsmon.exe |
"{741E8BE9-4852-4E4F-8791-EFA7C8F8E713}" = protocol=17 | dir=in | app=d:\programme2\icq6.5\icq.exe |
"{7BA1B465-7412-4EBA-BF21-D7AF309A0289}" = protocol=17 | dir=in | app=c:\program files\icq7.0\icq.exe |
"{82B856C5-BE0F-43F0-B96B-E77DDDD14844}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{8C4C74ED-D6A7-4AF4-9CDE-7E72B903A9FD}" = protocol=17 | dir=in | app=c:\program files\icq7.0\icq.exe |
"{8EE41AAF-5693-447D-A63C-B8584B9DDA1F}" = protocol=17 | dir=in | app=c:\program files\sony\media manager for psp\mediamanager.exe |
"{903A37DB-784F-464B-943C-203538F2C813}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{9126E073-9C9C-4DEE-9274-DD572F147819}" = dir=in | app=c:\program files\acer arcade live\acer dv magician\component\arawp.exe |
"{95B812B6-B8EC-4E56-AB88-727F45A55771}" = protocol=17 | dir=in | app=d:\programme2\icq6.5\icq.exe |
"{964E3E73-5BF5-4C36-8C24-32C59E7584D1}" = dir=in | app=c:\program files\acer arcade live\acer homemedia\homemedia.exe |
"{9AD356BB-9631-4CDA-A902-E678C0D0F631}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\groove.exe |
"{9B2DE5D0-0D7C-45A5-9E49-A18141B64587}" = dir=in | app=c:\program files\acer arcade live\acer videomagician\videomagician.exe |
"{9F2DD910-5EF3-446A-A2F9-CE06248B10E0}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{AC16DC45-AB0E-4315-A498-D953A24414AE}" = protocol=17 | dir=in | app=c:\program files\pinnacle\videospin\programs\videospin.exe |
"{ACE08E08-E81A-44EA-9A1E-CC6F590CD48E}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 |
"{B1FA972A-E777-4071-AC67-E075667091B5}" = protocol=17 | dir=in | app=c:\program files\pinnacle\videospin\programs\umi.exe |
"{B21EBDD6-A628-48A9-AEE6-78777FBB8614}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{B4006B54-CCDF-4253-9413-949274A89576}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{B599EE23-7780-4793-A7B8-C86D398C1B33}" = dir=in | app=c:\program files\acer arcade live\acer playmovie\pmvservice.exe |
"{BB355F37-060D-4046-BF6A-6772FD3DDECD}" = protocol=17 | dir=in | app=c:\program files\pinnacle\videospin\programs\pmsregisterfile.exe |
"{CED2353B-7772-440B-8F35-7EEF30B1FDB3}" = protocol=6 | dir=in | app=c:\program files\icq7.0\icq.exe |
"{D0A24811-3314-41B6-8922-730F79DDD02D}" = protocol=6 | dir=in | app=c:\program files\pinnacle\videospin\programs\videospin.exe |
"{D2FC5796-A451-4BC3-BE9E-6BA50D4E5EE3}" = protocol=6 | dir=in | app=c:\program files\pinnacle\videospin\programs\pmsregisterfile.exe |
"{E582B88F-1D95-4D09-9841-58E0F617124B}" = protocol=6 | dir=in | app=c:\program files\icq7.0\aolload.exe |
"{EE67895E-F5B7-47CA-BD80-8D6113EF06E1}" = protocol=6 | dir=in | app=d:\programme2\icq6.5\icq.exe |
"{EF096C5B-BB54-4A51-8A4A-17879E1BD68A}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{F0429F00-CC5D-4CB5-A7E2-D7C6DD72D2F0}" = dir=in | app=c:\program files\acer arcade live\acer dv magician\component\dvax2process.exe |
"{F2619CE5-966E-4273-B4DD-7EF841426F2F}" = protocol=17 | dir=in | app=c:\windows\system32\zonelabs\vsmon.exe |
"{F9FA0F5A-23C5-4CB4-9BCD-D087CB1931FF}" = protocol=17 | dir=in | app=c:\program files\icq7.0\aolload.exe |
"TCP Query User{1169FD75-7D6C-4BFA-B19C-A019824C0865}C:\program files\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe |
"TCP Query User{249284C7-5BF8-491F-B682-E83A8B076AF6}C:\program files\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe |
"TCP Query User{2A94DF59-4ACB-45DE-824B-C9F8AD62E750}C:\program files\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"TCP Query User{2AA6FA3F-4E84-4CB1-A853-A65214C37331}C:\program files\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"TCP Query User{2FA6E06F-3880-4B10-BD1F-8B23D6193CFD}D:\programme2\ubisoft\tom clancy's splinter cell chaos theory\system\splintercell3.exe" = protocol=6 | dir=in | app=d:\programme2\ubisoft\tom clancy's splinter cell chaos theory\system\splintercell3.exe |
"TCP Query User{44CDA926-47B8-49E9-9F1F-8F372FB6FF24}D:\users\hauke\documents\stronghold crusader\stronghold crusader\stronghold crusader.exe" = protocol=6 | dir=in | app=d:\users\hauke\documents\stronghold crusader\stronghold crusader\stronghold crusader.exe |
"TCP Query User{4F786191-C063-4B44-A303-15143E27E14B}C:\program files\participatory culture foundation\miro\xulrunner\python\miro_downloader.exe" = protocol=6 | dir=in | app=c:\program files\participatory culture foundation\miro\xulrunner\python\miro_downloader.exe |
"TCP Query User{500F8F9A-1ABB-468B-AAD7-79BF1D1852CE}D:\programme2\ubisoft\tom clancy's splinter cell chaos theory\versus\system\scct_versus_dedicatedserver.exe" = protocol=6 | dir=in | app=d:\programme2\ubisoft\tom clancy's splinter cell chaos theory\versus\system\scct_versus_dedicatedserver.exe |
"TCP Query User{5978676B-3C02-4922-AEF5-BFF83C03615B}K:\operator-3.5\operator\opera\opera.exe" = protocol=6 | dir=in | app=k:\operator-3.5\operator\opera\opera.exe |
"TCP Query User{702B988E-95FF-4C60-97D1-D781AB868D1B}C:\program files\ea sports\fifa online\nfe.exe" = protocol=6 | dir=in | app=c:\program files\ea sports\fifa online\nfe.exe |
"TCP Query User{BDC22EB9-FEFF-495A-B857-C4192F0F15F8}C:\windows\system32\dplaysvr.exe" = protocol=6 | dir=in | app=c:\windows\system32\dplaysvr.exe |
"TCP Query User{C786E74F-BE51-4145-B52F-15C571F1C577}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"TCP Query User{E38739B0-9A15-4A77-86FB-0E1366225B8C}C:\program files\aspyr media, inc\thaw\game\thaw.exe" = protocol=6 | dir=in | app=c:\program files\aspyr media, inc\thaw\game\thaw.exe |
"TCP Query User{F02084AE-59C1-45DA-8A75-0954479CE501}C:\program files\tmnationsforever\tmforever.exe" = protocol=6 | dir=in | app=c:\program files\tmnationsforever\tmforever.exe |
"TCP Query User{F21A8AD2-2A83-4055-85F1-3D1C045E7640}D:\programme2\fifa10.exe" = protocol=6 | dir=in | app=d:\programme2\fifa10.exe |
"UDP Query User{1789791A-FB2D-4F59-AE59-60D40B3E4392}C:\program files\tmnationsforever\tmforever.exe" = protocol=17 | dir=in | app=c:\program files\tmnationsforever\tmforever.exe |
"UDP Query User{46B59A63-9166-42CF-BA79-0745582A7DF3}C:\program files\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"UDP Query User{46D15242-D509-4B3F-A037-8D873834A0F6}C:\program files\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe |
"UDP Query User{64B88066-0FB6-4922-A749-E19B339F0ABA}K:\operator-3.5\operator\opera\opera.exe" = protocol=17 | dir=in | app=k:\operator-3.5\operator\opera\opera.exe |
"UDP Query User{749D1C72-55DF-423A-87B8-C1AB468D9960}D:\programme2\ubisoft\tom clancy's splinter cell chaos theory\versus\system\scct_versus_dedicatedserver.exe" = protocol=17 | dir=in | app=d:\programme2\ubisoft\tom clancy's splinter cell chaos theory\versus\system\scct_versus_dedicatedserver.exe |
"UDP Query User{7CC0A4BA-9FEF-48C2-A623-EA1A44BCC0E2}C:\program files\aspyr media, inc\thaw\game\thaw.exe" = protocol=17 | dir=in | app=c:\program files\aspyr media, inc\thaw\game\thaw.exe |
"UDP Query User{992FECE7-D97A-4E58-ABDC-9BD77A308209}C:\windows\system32\dplaysvr.exe" = protocol=17 | dir=in | app=c:\windows\system32\dplaysvr.exe |
"UDP Query User{994FF1F2-F725-400A-84F3-CD17C09B71B4}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"UDP Query User{A24828E5-29C2-4731-89E2-4041471490E1}C:\program files\ea sports\fifa online\nfe.exe" = protocol=17 | dir=in | app=c:\program files\ea sports\fifa online\nfe.exe |
"UDP Query User{AAD11887-4E90-4D80-86F1-C5753D19A53E}C:\program files\participatory culture foundation\miro\xulrunner\python\miro_downloader.exe" = protocol=17 | dir=in | app=c:\program files\participatory culture foundation\miro\xulrunner\python\miro_downloader.exe |
"UDP Query User{BD4FB4BE-5D93-4A48-BA97-9B9FF4EDB892}C:\program files\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"UDP Query User{C29D7220-4699-4C7D-AC0E-844A7FF2C9E6}D:\users\hauke\documents\stronghold crusader\stronghold crusader\stronghold crusader.exe" = protocol=17 | dir=in | app=d:\users\hauke\documents\stronghold crusader\stronghold crusader\stronghold crusader.exe |
"UDP Query User{C84D02DA-5944-4120-96BD-811E8ED2DBB8}D:\programme2\ubisoft\tom clancy's splinter cell chaos theory\system\splintercell3.exe" = protocol=17 | dir=in | app=d:\programme2\ubisoft\tom clancy's splinter cell chaos theory\system\splintercell3.exe |
"UDP Query User{DCB28C10-AEF2-4C74-A345-562B02352362}C:\program files\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe |
"UDP Query User{F248228B-F5A0-4B9F-951D-8944973CB89D}D:\programme2\fifa10.exe" = protocol=17 | dir=in | app=d:\programme2\fifa10.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{01521746-02A6-4A72-00BD-A285DF6B80C6}" = Die Sims 2: Wilde Campus-Jahre
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0556F885-2415-4666-B53E-33727E46AEA1}" = The Movies(TM)
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID-Anmelde-Assistent
"{084A9731-D05B-4ADA-B4A0-0ADD25FD7152}" = Splinter Cell Pandora Tomorrow
"{090A0EB4-FC4E-4D24-0001-04C3FA6538B1}" = MyTube BigPack Internet Recorder 3 Free
"{0D8A8C0F-79BA-49EE-B9F5-4FB01E864C35}" = Tom Clancy's Splinter Cell 3 - Chaos Theory Demo
"{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}" = PlayStation(R)Store
"{11202615-E557-4ECF-9B86-F59C81E52909}" = FIFA 10
"{11C88EEC-23FC-4181-B6E4-22247E2ABD28}" = Microsoft Expression Web 3
"{132888AE-EF67-41C5-BCA2-7D5D2488AB63}" = Acer HomeMedia Connect
"{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"{15CCBC5D-66A7-4131-8D36-E05F27B0E68F}" = Sibelius Scorch (ActiveX Only)
"{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010 (Beta)
"{20140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010 (Beta)
"{20140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010 (Beta)
"{20140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010 (Beta)
"{20140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010 (Beta)
"{20140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010 (Beta)
"{20140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010 (Beta)
"{20140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010 (Beta)
"{20140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010 (Beta)
"{20140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010 (Beta)
"{20140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010 (Beta)
"{20140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010 (Beta)
"{20140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010 (Beta)
"{20140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010 (Beta)
"{20140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010 (Beta)
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{21C6344A-918B-4D35-ADB6-7614F97B78EA}" = Sony Media Manager for PSP 3.0
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{23B59ED4-C360-11D7-875B-0090CC005647}" = EPSON PRINT Image Framer Tool2.1
"{259C0ABB-A3B2-4D70-008F-BF7EE491B70B}" = Need for Speed™ Carbon
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 18
"{2BA722D1-48D1-406E-9123-8AE5431D63EF}" = Windows Live Fotogalerie
"{2CE5A2E7-3437-4CE7-BCF4-85ED6EEFF9E4}" = iTunes
"{31CF6C0E-51F0-41D2-B088-A6A143C4303C}" = SweetIM Toolbar for Internet Explorer 3.6
"{3293C06B-003F-4027-8380-FFD79E38167D}" = Tony Hawk's American Wasteland
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{41581EF5-45A7-11DA-9D78-000129760D75}" = Acer SlideShow DVD
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{4817189D-1785-4627-A33C-39FD90919300}" = Die Sims™ 2 Haustiere
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4C3EF687-803F-4825-B815-04AE32DDEB41}" = YAVIDO
"{4C73B683-B15D-4B94-AC7A-520B70C4FFE9}" = Sceneo AbsolutTV
"{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}" = Microsoft Works
"{4EDB1CA5-983F-4FC3-A8E3-E34981E05A60}" = Pinnacle VideoSpin
"{5628829F-3318-4DDA-988D-D301832F1611}" = Singles
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{628697C2-7F0E-40D2-8020-A147B3090F60}" = MorphVOX Pro
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{65F5B7AF-3363-11D7-BB6B-00018021113F}" = EPSON PhotoQuicker3.5
"{67ADE9AF-5CD9-4089-8825-55DE4B366799}" = NTI Backup NOW! 4.7
"{67EDD823-135A-4D59-87BD-950616D6E857}" = EPSON Copy Utility 3
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6BDD9CE6-D0A6-478A-BAD3-BA6945E89EB0}" = Die Sims 2: Family Fun - Accessoires
"{6C11D561-620B-47DA-A693-4C597F3CDF40}" = EPSON Smart Panel
"{6E7DD182-9FC6-4651-0095-2E666CC6AF35}" = Die Sims 2
"{6FE3B0CE-37C1-4825-908A-5A84C9B4EC2F}" = EA SPORTS(TM) FIFA Online
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{752E90AC-3F11-4EA3-88EA-96441047EC31}" = Microsoft Expression Web 3 SP1
"{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{78699791-0625-4667-9E70-626A1CCEC94D}" = 3D Canvas
"{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver
"{7B3577F5-1D82-4C9B-008B-69D026FD8BCA}" = Die Sims 2: Open For Business
"{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}" = Text-To-Speech-Runtime
"{7BD0A2D8-4EA0-43C6-BDF8-DDA87B8031C6}" = PIF DESIGNER2.1
"{7CDA2B02-E0A4-4EB5-8533-050D535BA43A}" = Media Converter for Philips
"{7F14F68C-17FA-4F88-B3FD-7F449C1EBF32}" = EPSON Web-To-Page
"{80A97464-A741-44B0-8AD6-0C16B1FEF7F6}" = Norton Security Scan
"{81AB1374-098A-43CB-BE57-31CEB5EB1031}" = Nero 7 Essentials
"{83467AF1-C7D8-4138-0095-AB308887A9FB}" = NBA LIVE 2004
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{87F6C83D-F949-4d14-B5CB-DC8C75F8932D}" = Die Sims™ 2 Freizeit-Spaß
"{888DD888-82BE-4D85-BCB2-2E042CD3E844}" = Tom Clancy's Splinter Cell Chaos Theory
"{88EB38EF-4D2C-436D-ABD3-56B232674062}" = ICQ7
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A6AD979-8170-49ED-8529-14174317B281}" = SA60xx Device Manager
"{8FDC1610-3FB5-4EF2-A0D0-CEDC3A525A25}" = DIE SIEDLER - Das Erbe der Könige
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{91120407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
"{94389919-B0AA-4882-9BE8-9F0B004ECA35}" = Acer Tour
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9527A496-5DF9-412A-ADC7-168BA5379CA6}" = Microsoft Flight Simulator X
"{97C0EA4A-1A0B-4C53-ACEB-49984DA79C90}" = Google Earth
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C48DCA4-00C2-449C-88D8-B1EE1692B44F}" = Safari
"{9DF0196F-B6B8-4C3A-8790-DE42AA530101}" = SPORE™
"{A174402A-2EE6-4B86-A930-7BC85A9933BD}" = Tom Clancy's Splinter Cell
"{A450831D-25F6-4F42-9662-D000B25E0D82}" = Acer PlayMovie
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A863F2EF-443D-429C-9DCD-9234BEB8142A}" = Scrapland
"{A919AABD-61FA-4E16-0000-26966C3D2481}" = GameJack 6
"{AA4BF92B-2AAF-11DA-9D78-000129760D75}" = Acer HomeMedia
"{AB6097D9-D722-4987-BD9E-A076E2848EE2}" = Acer Empowering Technology
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.4 - Deutsch
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AEBBFC67-7A03-4DF3-9E71-BA5C9EB4FBEF}" = MobileMe Control Panel
"{AEEAE013-92F1-4515-B278-139F1A692A36}" = Acer eDataSecurity Management
"{B145EC69-66F5-11D8-9D75-000129760D75}" = Acer DVDivine
"{B246C325-1C49-4572-8665-7691EFE1D06B}" = MGI VideoWave 4
"{BC4CA8FA-41D2-4B81-8680-E9B7573D6500}" = PlayStation(R)Network Downloader
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = Die Sims™ 3
"{C06A7DAC-1708-417C-B694-28C84DFE2DF9}" = The Movies(TM) Stunts & Spezialeffekte
"{C07F8D75-7A8D-400E-A8F9-A3F396B49BB1}" = SPORE™ Süß & Schrecklich Ergänzungs-Pack
"{C7340571-7773-4A8C-9EBC-4E4243B38C76}" = Microsoft XML Parser
"{C9DC3EE4-7A92-F473-510D-48A5EAD52845}" = ATI Catalyst Install Manager
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCA1EEA3-555E-4D05-AC46-4B49C6C5D887}" = Apple Mobile Device Support
"{CCD90636-D97D-4130-A44A-3AD4E63B9220}" = OpenOffice.org 2.4
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe  1.4.142.1
"{CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}" = getPlus(R) for Adobe
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D462BF9E-0C35-4705-BF9B-3DF9F3816643}" = Acer ePerformance Management
"{D92F1880-822A-41CA-0090-451FBB89BF4C}" = FIFA Fussball-Weltmeisterschaft 2006 (TM)
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}" = LiveUpdate Notice (Symantec Corporation)
"{DBEA1034-5882-4A88-8033-81C4EF0CFA29}" = Google Toolbar for Internet Explorer
"{DF6F459C-8B89-4F88-B63F-A2E136BB6B79}" = SweetIM for Messenger 2.8
"{DFEF49D9-FC95-4301-99B9-2FB91C6ABA06}" = Die Sims™ 2 Vier Jahreszeiten
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E37AC1FF-03EE-4AE3-0001-E55B0BCCABE0}" = MyTube BigPack 3 CHIP-Edition
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{EBAE381B-60A6-4863-AA9F-FCAB755BC9E5}" = ScanToWeb
"{EFBDC2B0-FAA8-4B78-8DE1-AEBE7958FA37}" = Acer Arcade Live Main Page
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F0E2B312-D7FD-4349-A9B6-E90B36DB1BD0}" = Paint.NET v3.5.5
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F38ADCA4-AF7C-4C73-9021-6F1EA15D15EA}" = Pinnacle TVCenter Pro
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F6EFFB76-4A07-11DA-9D78-000129760D75}" = Acer DV Magician
"{F722E488-A5B5-47ff-AA9B-4DE6CE7914CA}" = Windows 7 Upgrade Advisor
"{F7529650-B9DB-481B-0089-A2AC3C2821C1}" = Die Sims 2: Nightlife
"{F79A208D-D929-11D9-9D77-000129760D75}" = Acer VideoMagician
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{FA54AFB1-5745-4389-B8C1-9F7509672ED1}" = iPhone-Konfigurationsprogramm
"{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"82A44D22-9452-49FB-00FB-CEC7DCAF7E23" = EA SPORTS online 2004
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Acrobat 5.0" = Adobe Acrobat 5.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player
"Alien Arena 2008_is1" = Alien Arena 2008 7.21
"All Out Race" = All Out Race
"Ashampoo ClipFisher_is1" = Ashampoo ClipFisher1.21
"Ashampoo Cover Studio 2009_is1" = Ashampoo Cover Studio 2009
"AsUninst.exe" = Anvil Studio
"ATI Uninstaller" = ATI Uninstaller
"AutoGK" = Auto Gordian Knot 2.55
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"AviSynth" = AviSynth 2.5
"Beneton Movie GIF_is1" = Beneton Movie GIF 1.1.2
"Blender" = Blender (remove only)
"CAM-IN SUITE III" = CAM-IN SUITE III
"CCleaner" = CCleaner
"Cities of Earth 3D Screensaver_is1" = Cities of Earth 3D Screensaver v. 2.1
"City Life" = City Life
"DivX Setup.divx.com" = DivX-Setup
"dlanconf" = devolo dLAN-Konfigurationsassistent
"doPDF 6  printer_is1" = doPDF 6.3  printer
"dslmon" = devolo Informer
"dtvlexikon2006_is1" = dtv-Lexikon 1.0
"DVDVideoSoft Toolbar" = DVDVideoSoft Toolbar
"easyclean" = devolo EasyClean
"easyshare" = devolo EasyShare
"Einsteiger-Sprachkurs Spanisch" = Einsteiger-Sprachkurs Spanisch
"EPSON Printer and Utilities" = EPSON-Drucker-Software
"ESCX3600 Referenzhandbuch" = ESCX3600 Referenzhandbuch
"ESCX3600 Softwarehandbuch" = ESCX3600 Softwarehandbuch
"Fiesta Online" = Fiesta Online 1.01.000
"Firebird SQL Server D" = Firebird SQL Server - MAGIX Edition
"FLV Player" = FLV Player 2.0, build 24
"FontCreator6_is1" = High-Logic FontCreator 6.0
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.2
"Free Fire Screensaver" = Free Fire Screensaver
"Free Studio_is1" = Free Studio version 4.8
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.2
"Freedom Force vs The 3rd Reich" = Freedom Force vs The 3rd Reich (remove only)
"Google Updater" = Google Updater
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"ICQToolbar" = ICQ Toolbar
"InstallShield_{0556F885-2415-4666-B53E-33727E46AEA1}" = The Movies(TM) Stunts & Spezialeffekte
"InstallShield_{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"InstallShield_{9527A496-5DF9-412A-ADC7-168BA5379CA6}" = Microsoft Flight Simulator X
"LiveUpdate" = LiveUpdate 3.2 (Symantec Corporation)
"MAGIX 3D Maker D" = MAGIX 3D Maker (embeded)
"MAGIX Foto Manager 2006 D" = MAGIX Foto Manager 2006 (D)
"MAGIX Foto Manager 8 D" = MAGIX Foto Manager 8 6.0.1.457 (D)
"MAGIX Fotobuch" = MAGIX Fotobuch 3.6
"MAGIX Music Maker 2007 D" = MAGIX Music Maker 2007 (D)
"MAGIX Music Maker Basic Edition UK" = MAGIX Music Maker Basic Edition 12.1.0.3 (UK)
"MAGIX Music Maker for MySpace D" = MAGIX Music Maker for MySpace 15.0.1.8 (D)
"MAGIX Music Maker Rock Edition D" = MAGIX Music Maker Rock Edition 4.0.0.13 (D)
"MAGIX Music Manager 2006 D" = MAGIX Music Manager 2006 (D)
"MAGIX Online Druck Service D" = MAGIX Online Druck Service 3.4.3.0 (D)
"MAGIX Screenshare D" = MAGIX Screenshare 4.3.6.1987 (D)
"MAGIX Video deluxe 15 Plus D" = MAGIX Video deluxe 15 Plus 8.0.0.62 (D)
"MAGIX Xtreme Foto Designer 6 D" = MAGIX Xtreme Foto Designer 6 6.0.25.0 (D)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"ManyCam" = ManyCam 2.4 (remove only)
"maxdome - Online Videothek_is1" = maxdome - Online Videothek Version 3.1.0
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Miro" = Miro
"Mozilla Firefox (3.6.10)" = Mozilla Firefox (3.6.10)
"Mozilla Thunderbird (2.0.0.16)" = Mozilla Thunderbird (2.0.0.16)
"Mufin MusicFinder Base D" = Mufin MusicFinder Base 1.0.1.229 (D)
"myGamersCam" = myGamersCam 1.0
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"Pen Tablet Driver" = Stifttablett
"PhotoScape" = PhotoScape
"PSP Video 9" = PSP Video 9 2.25
"PunkBusterSvc" = PunkBuster Services
"RalliSport Challenge 1.0" = Microsoft RalliSport Challenge
"RarZilla Free Unrar" = RarZilla Free Unrar
"Recover My Files_is1" = Recover My Files
"Recuva" = Recuva (remove only)
"Schmaili_is1" = Schmaili 9.0
"Scribus 1.3.5" = Scribus 1.3.5.1
"SimPE_is1" = SimPE 0.58b (alpha)
"SUPER ©" = SUPER © Version 2010.bld.37 (Jan 2, 2010)
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"TmNationsForever_is1" = TmNationsForever
"Tomb Raider: Legend" = Tomb Raider: Legend 1.2
"Tunatic" = Tunatic
"Uninstall_is1" = Uninstall 1.0.0.1
"V2210" = DigitalCam Pro
"VitualDub" = VitualDub
"VLC media player" = VideoLAN VLC media player 0.8.6f
"VobSub" = VobSub v2.23 (Remove Only)
"VQ2210" = DigitalCam Pro
"Web_3.0.3813.0" = Microsoft Expression Web 3
"webcam 7" = webcam 7
"WinGimp-2.0_is1" = GIMP 2.6.7
"WinLiveSuite_Wave3" = Windows Live Essentials
"XviD MPEG4 Video Codec" = XviD MPEG4 Video Codec (remove only)
"Yahoo! Companion" = Yahoo! Toolbar
"Zattoo" = Zattoo 3.1.1 Beta
"Zattoo4" = Zattoo4 4.0.5
"ZDFmediathek_is1" = ZDFmediathek Version 1.4.0
"ZoneAlarm" = ZoneAlarm
"ZoneAlarm-Sicherheit Toolbar" = ZoneAlarm-Sicherheit Toolbar
"Zoo Tycoon 2" = Zoo Tycoon 2
"Zulu" = Zulu DJ Software
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{8DC910CD-8EE3-4ffc-A4EB-9B02701059C4}" = Battlefield Heroes
"Move Media Player" = Move Media Player
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 04.10.2010 17:26:23 | Computer Name = ***s-PC | Source = Bonjour Service | ID = 100
Description = 388: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
 vom Remotehost geschlossen.)
 
Error - 04.10.2010 17:26:23 | Computer Name = ***s-PC | Source = Bonjour Service | ID = 100
Description = 392: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
 vom Remotehost geschlossen.)
 
Error - 04.10.2010 17:26:23 | Computer Name = ***s-PC | Source = Bonjour Service | ID = 100
Description = 396: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
 vom Remotehost geschlossen.)
 
Error - 04.10.2010 17:26:23 | Computer Name = ***s-PC | Source = Bonjour Service | ID = 100
Description = 400: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
 vom Remotehost geschlossen.)
 
Error - 04.10.2010 17:26:23 | Computer Name = ***s-PC | Source = Application Hang | ID = 1002
Description = Programm iTunes.exe, Version 10.0.1.22 arbeitet nicht mehr mit Windows
 zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
 für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
 zu suchen.  Prozess-ID: 6d4  Anfangszeit: 01cb63fe5beadaea  Zeitpunkt der Beendigung:
 28
 
Error - 04.10.2010 17:58:50 | Computer Name = ***s-PC | Source = Bonjour Service | ID = 100
Description = 400: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
 vom Remotehost geschlossen.)
 
Error - 04.10.2010 19:27:48 | Computer Name = ***s-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 04.10.2010 19:27:48 | Computer Name = ***s-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 1554565
 
Error - 04.10.2010 19:27:48 | Computer Name = ***s-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 1554565
 
Error - 05.10.2010 08:28:50 | Computer Name = ***s-PC | Source = Application Hang | ID = 1002
Description = Programm OTL.exe, Version 0.0.0.0 arbeitet nicht mehr mit Windows
zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
 für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
 zu suchen.  Prozess-ID: 1308  Anfangszeit: 01cb6488710cd7e7  Zeitpunkt der Beendigung:
 4
 
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >
--- --- ---

Gar 05.10.2010 16:03
Code:
GMER 1.0.15.15281 - hxxp://www.gmer.net
Rootkit scan 2010-10-05 16:33:19
Windows 6.0.6002 Service Pack 2
Running: 84dv22nv.exe; Driver: C:\Users\***\AppData\Local\Temp\kxlyrpoc.sys


---- System - GMER 1.0.15 ----

SSDT    \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwAlpcConnectPort [0xA113E570]
SSDT    \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwAlpcCreatePort [0xA113EE46]
SSDT    \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwConnectPort [0xA113DFC6]
SSDT    \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwCreateFile [0xA1137884]
SSDT    \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwCreateKey [0xA1158FA8]
SSDT    \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwCreatePort [0xA113EAD0]
SSDT    \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwCreateWaitablePort [0xA113EC2E]
SSDT    \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwDeleteFile [0xA11385B4]
SSDT    \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwDeleteKey [0xA115AA50]
SSDT    \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwDeleteValueKey [0xA115A346]
SSDT    \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwLoadKey [0xA115B41A]
SSDT    \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwLoadKey2 [0xA115B658]
SSDT    \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwLoadKeyEx [0xA115BB0A]
SSDT    \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwOpenFile [0xA113816C]
SSDT    \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwRenameKey [0xA115C4E0]
SSDT    \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwReplaceKey [0xA115BDD4]
SSDT    \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwRequestWaitReplyPort [0xA113DB5E]
SSDT    \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwRestoreKey [0xA115CF40]
SSDT    \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwSetInformationFile [0xA11389BE]
SSDT    \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwSetSecurityObject [0xA115CA68]
SSDT    \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwSetValueKey [0xA1159A6A]
SSDT    \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS                                                                  ZwTerminateProcess [0x91B96620]

---- Kernel code sections - GMER 1.0.15 ----

.text    ntkrnlpa.exe!KeSetEvent + 13D                                                                                      822C08A0 8 Bytes  [70, E5, 13, A1, 46, EE, 13, ...] {JO 0xffffffffffffffe7; ADC ESP, [ECX-0x5eec11ba]}
.text    ntkrnlpa.exe!KeSetEvent + 1C1                                                                                      822C0924 4 Bytes  [C6, DF, 13, A1]
.text    ntkrnlpa.exe!KeSetEvent + 1D9                                                                                      822C093C 4 Bytes  [84, 78, 13, A1]
.text    ntkrnlpa.exe!KeSetEvent + 1E9                                                                                      822C094C 4 Bytes  [A8, 8F, 15, A1]
.text    ntkrnlpa.exe!KeSetEvent + 205                                                                                      822C0968 4 Bytes  JMP 58BFA113
.text    ...                                                                                                               
.text    C:\Windows\system32\drivers\ACEDRV07.sys                                                                            section is writeable [0x92328000, 0x328BA, 0xE8000020]
.pklstb  C:\Windows\system32\drivers\ACEDRV07.sys                                                                            entry point in ".pklstb" section [0x9236C000]
.relo2  C:\Windows\system32\drivers\ACEDRV07.sys                                                                            unknown last section [0x92388000, 0x8E, 0x42000040]
        C:\Program Files\Acer Arcade Live\Acer PlayMovie\000.fcl                                                            entry point in "" section [0xA7D16000]
.clc    C:\Program Files\Acer Arcade Live\Acer PlayMovie\000.fcl                                                            unknown last section [0xA7D17000, 0x1000, 0x00000000]

---- User code sections - GMER 1.0.15 ----

.text    C:\Windows\explorer.exe[4036] ntdll.dll!NtCreateThread                                                              77C444F4 5 Bytes  CALL 00870000
.text    C:\Windows\explorer.exe[4036] ntdll.dll!NtProtectVirtualMemory                                                      77C44D34 5 Bytes  CALL 00850000
.text    C:\Windows\explorer.exe[4036] ntdll.dll!NtCreateUserProcess                                                        77C45804 5 Bytes  CALL 00890000
.text    C:\Windows\explorer.exe[4036] kernel32.dll!ExitProcess                                                              779A41D8 5 Bytes  CALL 008C0000

---- Registry - GMER 1.0.15 ----

Reg      HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Media Center\Service\Scheduler@Heartbeat                            0x07 0xE7 0xEA 0xAE ...
Reg      HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32                                 
Reg      HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel                    Apartment
Reg      HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@                                  C:\Windows\system32\OLE32.DLL
Reg      HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b  0xC8 0x28 0x51 0xAF ...
Reg      HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32                                 
Reg      HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel                    Apartment
Reg      HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@                                  C:\Windows\system32\OLE32.DLL
Reg      HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b  0x6A 0x9C 0xD6 0x61 ...
Reg      HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32                                 
Reg      HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel                    Apartment
Reg      HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@                                  C:\Windows\system32\OLE32.DLL
Reg      HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016  0xFF 0x7C 0x85 0xE0 ...
Reg      HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32                                 
Reg      HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel                    Apartment
Reg      HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@                                  C:\Windows\system32\OLE32.DLL
Reg      HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48  0x86 0x8C 0x21 0x01 ...
Reg      HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32                                 
Reg      HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel                    Apartment
Reg      HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@                                  C:\Windows\system32\OLE32.DLL
Reg      HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472  0xF5 0x1D 0x4D 0x73 ...
Reg      HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32                                 
Reg      HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel                    Apartment
Reg      HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@                                  C:\Windows\system32\OLE32.DLL
Reg      HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d  0xB0 0x18 0xED 0xA7 ...
Reg      HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32                                 
Reg      HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel                    Apartment
Reg      HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@                                  C:\Windows\system32\OLE32.DLL
Reg      HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b  0x31 0x77 0xE1 0xBA ...
Reg      HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32                                 
Reg      HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel                    Apartment
Reg      HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@                                  C:\Windows\system32\OLE32.DLL
Reg      HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d  0x01 0x3A 0x48 0xFC ...
Reg      HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32                                 
Reg      HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel                    Apartment
Reg      HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@                                  C:\Windows\system32\OLE32.DLL
Reg      HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3  0xF6 0x0F 0x4E 0x58 ...
Reg      HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32                                 
Reg      HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel                    Apartment
Reg      HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@                                  C:\Windows\system32\OLE32.DLL
Reg      HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b  0xB1 0xCD 0x45 0x5A ...
Reg      HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32                                 
Reg      HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel                    Apartment
Reg      HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@                                  C:\Windows\system32\OLE32.DLL
Reg      HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6  0xF8 0x31 0x0F 0xA9 ...
Reg      HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32                                 
Reg      HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel                    Apartment
Reg      HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@                                  C:\Windows\system32\OLE32.DLL
Reg      HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2  0xFA 0xEA 0x66 0x7F ...

---- EOF - GMER 1.0.15 ----
Nachdem ich gmer beendet hatte wurde windows nach einem bluescreen automatisch heruntergefahren.

Swisstreasure 05.10.2010 17:08
Schritt 1

Programme deinstallieren

Da einige Programme und Anti-Spy-Programme uns u. U. bei der Bereinigung behindern (z. B. durch ständig laufende Hintergrundwächter), unnötig oder schädlich sind oder einfach nicht mehr gebraucht werden, bitte ich darum, die folgenden Programme über Systemsteuerung => Software komplett zu deinstallieren. Vorallem Ask muss weg. Die anderen Toolbars solltest Du Dir gut überlegen ob Du die wirklich brauchst. Wenn nicht dann weg damit:

Code:
Ask.com
Ask Toolbar
Google Toolbar for Internet Explorer
DVDVideoSoft Toolbar
Yahoo! Toolbar
ICQToolbar
ZoneAlarm-Sicherheit Toolbar
Berichte mir, falls sich ein Programm nicht deinstallieren lässt. Nach Beendigung der Bereinigung können wir schauen, welche davon Du wieder installieren kannst/sollest.

Schritt 2

Fixen mit OTL
  • Starte die OTL.exe.
  • Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
  • Kopiere folgendes Skript:
    WICHTIG: Deine Zensur xxxx hier im Script bitte durch dne richtigen Pfad ersetzen.
Code:
:OTL
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
[2010.08.29 23:17:38 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\ze1nkspb.default\extensions\toolbar@ask.com
[2010.05.26 15:18:50 | 000,002,333 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\FireFox\Profiles\ze1nkspb.default\searchplugins\askcom.xml
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [Acer Tour]  File not found
O4 - HKCU..\Run: [Acer Tour Reminder]  File not found
O4 - HKCU..\Run: [PMCRemote]  File not found
O4 - HKCU..\Run: [Res32] C:\Users\***\AppData\Roaming\Adobe\Update\dlgdo.exe ()
[2010.10.04 17:14:14 | 000,274,944 | ---- | M] () -- C:\Users\***\AppData\Roaming\Adobe\Update\dlgdo.exe
:Commands
[purity]
[emptytemp]

Schritt 3

ESET Online Scanner
Bitte während der Online-Scans evtl. vorhandene externe Festplatten einschalten! Bitte während der Scans alle Hintergrundwächter (Anti-Virus-Programm, Firewall, Skriptblocking und ähnliches) abstellen und nicht vergessen, alles hinterher wieder einzuschalten.
  • Anmerkung für Vista und Win7 User: Bitte den Browser unbedingt als Administrator starten.
  • Dein Anti-Virus-Programm während des Scans deaktivieren.

    Button http://img695.imageshack.us/img695/1599/eset1l.jpg (<< klick) drücken.
    • Firefox-User:
      Bitte esetsmartinstaller_enu.exe downloaden.Das Firefox-Addon auf dem Desktop speichern und dann installieren.
    • IE-User:
      müssen das Installieren eines ActiveX Elements erlauben.
  • Setze den einen Hacken bei Yes, i accept the Terms of Use.
  • Drücke den http://img707.imageshack.us/img707/687/starteg.jpg Button.
  • Warte bis die Komponenten herunter geladen wurden.
  • Setze einen Haken bei "Scan archives".
  • Gehe sicher das bei Remove Found Threads kein Hacken gesetzt ist.
  • http://img707.imageshack.us/img707/687/starteg.jpg drücken.
  • Die Signaturen werden herunter geladen.Der Scan beginnt automatisch.
Wenn der Scan beendet wurde
  • Klicke Finish.
  • Browser schließen.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt suchen und mit Deinem Editor öffnen.
  • Logfile hier posten.

Gar 05.10.2010 20:01
1

Code:
All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{00000000-6E41-4FD3-8538-502F5495E5FC} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}\ not found.
File C:\Program Files\Ask.com\GenericAskToolbar.dll not found.
Prefs.js: "Ask.com" removed from browser.search.defaultengine
Prefs.js: "Ask.com" removed from browser.search.order.1
Folder C:\Users\Hauke\AppData\Roaming\mozilla\Firefox\Profiles\ze1nkspb.default\extensions\toolbar@ask.com\ not found.
C:\Users\Hauke\AppData\Roaming\Mozilla\FireFox\Profiles\ze1nkspb.default\searchplugins\askcom.xml moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Program Files\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Program Files\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Program Files\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Acer Tour deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Acer Tour Reminder deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\PMCRemote deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Res32 deleted successfully.
File C:\UsersHauke\AppData\Roaming\Adobe\Update\dlgdo.exe not found.
C:\Users\Hauke\AppData\Roaming\Adobe\Update\dlgdo.exe moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Hauke
->Temp folder emptied: 8564388 bytes
->Temporary Internet Files folder emptied: 39473295 bytes
->Java cache emptied: 2676559 bytes
->FireFox cache emptied: 49301563 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 11068 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2082554 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 97,00 mb
 
 
OTL by OldTimer - Version 3.2.14.1 log created on 10052010_204945

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Gar 06.10.2010 12:20
2

Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=47ff51b0a9257f459176dac5eabe05ca
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-10-05 08:06:59
# local_time=2010-10-05 10:06:59 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=1797 16775165 100 100 356308 61205719 92706 0
# compatibility_mode=5892 16776573 100 100 20666 123838283 0 0
# compatibility_mode=8192 67108863 100 0 325 325 0 0
# compatibility_mode=9217 16777214 75 59 607304 8582785 0 0
# scanned=201085
# found=0
# cleaned=0
# scan_time=3664
ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=53251
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=47ff51b0a9257f459176dac5eabe05ca
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-10-05 11:57:10
# local_time=2010-10-06 01:57:10 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=1797 16775165 100 100 360021 61209432 96419 0
# compatibility_mode=5892 16776573 100 100 24379 123841996 0 0
# compatibility_mode=8192 67108863 100 0 4038 4038 0 0
# compatibility_mode=9217 16777214 75 59 611017 8586498 0 0
# scanned=453017
# found=0
# cleaned=0
# scan_time=13761

Swisstreasure 06.10.2010 16:36
Schritt 1

Temp File Cleaner

Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop.
Schließe nun alle offenen Programme und trenne Dich von dem Internet.
Doppelklick auf die TFC.exe
Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen.

Schritt 2

Erneuter Systemscan mit OTL
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles in Code-Tags hier in den Thread.

Gar 06.10.2010 17:31
Hier die beiden Logfiles. Danke soweit schonmal:)

Code:
OTL logfile created on: 06.10.2010 18:21:30 - Run 2
OTL by OldTimer - Version 3.2.14.1    Folder = C:\Users\Hauke\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 69,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 85,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 229,13 Gb Total Space | 20,06 Gb Free Space | 8,76% Space Free | Partition Type: NTFS
Drive D: | 228,82 Gb Total Space | 33,77 Gb Free Space | 14,76% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive J: | 1397,26 Gb Total Space | 1087,31 Gb Free Space | 77,82% Space Free | Partition Type: NTFS
 
Computer Name: HAUKES-PC
Current User Name: Hauke
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Hauke\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
PRC - C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation)
PRC - C:\Windows\System32\wisptis.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
PRC - C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe (Microsoft Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Hauke\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (LiveUpdate Notice Ex) -- c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe File not found
SRV - (CLTNetCnService) -- c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe File not found
SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (nosGetPlusHelper) getPlus(R) -- C:\Program Files\NOS\bin\getPlus_Helper_3004.dll (NOS Microsystems Ltd.)
SRV - (vsmon) -- C:\Windows\System32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (getPlusHelper) getPlus(R) -- C:\Program Files\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.)
SRV - (WPFFontCache_v0400) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (w7Svc) -- D:\Programme2\webcam 7\wService.exe (Moonware Studios)
SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (wlidsvc) -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
SRV - (srvcPVR) -- C:\Program Files\Sceneo\AbsolutTV\Services\PVR\pvrservice.exe (Buhl Data Service GmbH)
SRV - (LiveUpdate Notice Service) -- C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (LiveUpdate) -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_2.EXE (Symantec Corporation)
SRV - (Automatisches LiveUpdate - Scheduler) -- C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (Symantec Corporation)
SRV - (TabletServicePen) -- C:\Windows\System32\Pen_Tablet.exe (Wacom Technology, Corp.)
SRV - (Acer HomeMedia Connect Service) -- C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe (CyberLink)
SRV - (eDataSecurity Service) -- C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe (HiTRSUT)
SRV - (eRecoveryService) -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe (Acer Inc.)
SRV - (AcerMemUsageCheckService) -- C:\Acer\Empowering Technology\ePerformance\MemCheck.exe ()
SRV - (UPnPService) -- C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe (Magix AG)
SRV - (FirebirdServerMAGIXInstance) -- C:\MAGIX\Common\Database\bin\fbserver.exe (MAGIX®)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (vsdatant7) -- C:\Windows\System32\drivers\vsdatant.win7.sys File not found
DRV - (NwlnkFwd) -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (EagleNT) -- C:\Windows\System32\drivers\EagleNT.sys File not found
DRV - (blbdrive) -- C:\Windows\System32\drivers\blbdrive.sys File not found
DRV - (Vsdatant) -- C:\Windows\System32\drivers\vsdatant.sys (Check Point Software Technologies LTD)
DRV - (SASKUTIL) -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (SASDIFSV) -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (hamachi) -- C:\Windows\System32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (RMCAST) RMCAST (Pgm) -- C:\Windows\System32\drivers\rmcast.sys (Microsoft Corporation)
DRV - (SCREAMINGBDRIVER) -- C:\Windows\System32\drivers\ScreamingBAudio.sys (Screaming Bee LLC)
DRV - (avgio) -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (ACEDRV07) -- C:\Windows\System32\drivers\ACEDRV07.sys (Protect Software GmbH)
DRV - (ManyCam) -- C:\Windows\System32\drivers\ManyCam.sys (ManyCam LLC.)
DRV - ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796}) -- C:\Program Files\Acer Arcade Live\Acer PlayMovie\000.fcl (Cyberlink Corp.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (Ltn_stk7070P) -- C:\Windows\System32\drivers\Ltn_stk7070P.sys (LITEON)
DRV - (Ltn_stkrc) -- C:\Windows\System32\drivers\Ltn_stkrc.sys (LITEON)
DRV - (NTIDrvr) -- C:\Windows\System32\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (wacommousefilter) -- C:\Windows\System32\drivers\wacommousefilter.sys (Wacom Technology)
DRV - (wacomvhid) -- C:\Windows\System32\drivers\wacomvhid.sys (Wacom Technology)
DRV - (WacomVKHid) -- C:\Windows\System32\drivers\WacomVKHid.sys (Wacom Technology)
DRV - (PSDNServ) -- C:\Windows\system32\drivers\PSDNServ.sys (HiTRUST)
DRV - (psdvdisk) -- C:\Windows\system32\drivers\psdvdisk.sys (HiTRUST)
DRV - (PSDFilter) -- C:\Windows\system32\DRIVERS\psdfilter.sys (HiTRUST)
DRV - (int15) -- C:\Acer\Empowering Technology\eRecovery\int15.sys ()
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) -- C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (yukonwlh) -- C:\Windows\System32\drivers\yk60x86.sys (Marvell)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (AtiPcie) ATI PCI Express (3GIO) -- C:\Windows\system32\DRIVERS\AtiPcie.sys (ATI Technologies Inc.)
DRV - (A_USBETHMP) -- C:\Windows\System32\drivers\usbethmp.sys (Intellon Corporation)
DRV - (PLCNDIS5) -- C:\Windows\system32\plcndis5.sys (Intellon, Inc.)
DRV - (V2210VID) -- C:\Windows\System32\drivers\V2210vid.sys (Unknown)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.intl.acer.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.sweetim.com
IE - HKLM\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - Reg Error: Key error. File not found
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SEARCH PAGE = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll (SweetIM Technologies Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: ""
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.sweetim.com/search.asp?src=2&q="
FF - prefs.js..browser.search.order.1: ""
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://taz.de/"
FF - prefs.js..extensions.enabledItems: battlefieldheroespatcher@ea.com:5.0.31.0
FF - prefs.js..extensions.enabledItems: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}:1.0.7
FF - prefs.js..extensions.enabledItems: {e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.2.5
FF - prefs.js..extensions.enabledItems: eafo3fflauncher@ea.com:1.1
FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.2.0
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}:2.7.1.3
FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=2&q="
FF - prefs.js..network.proxy.no_proxies_on: "*.local"
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "hxxp://meine-startseite.computerbild.de/hauptbahnhof/Haukes Startseite"
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q="
 
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.10.04 17:32:45 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.10.04 17:32:45 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.16\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010.10.04 17:32:45 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.16\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2010.10.04 17:32:45 | 000,000,000 | ---D | M]
 
[2009.05.08 13:23:20 | 000,000,000 | ---D | M] -- C:\Users\Hauke\AppData\Roaming\mozilla\Extensions
[2008.05.21 21:17:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Hauke\AppData\Roaming\mozilla\Extensions\{6334D996-EA3E-4a0e-AA8D-15BA56B37241}
[2010.10.06 15:30:39 | 000,000,000 | ---D | M] -- C:\Users\Hauke\AppData\Roaming\mozilla\Firefox\Profiles\ze1nkspb.default\extensions
[2010.10.06 15:30:18 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Hauke\AppData\Roaming\mozilla\Firefox\Profiles\ze1nkspb.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009.11.20 18:41:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Hauke\AppData\Roaming\mozilla\Firefox\Profiles\ze1nkspb.default\extensions\{3e9bb2a7-62ca-4efa-a4e6-f6f6168a652d}
[2009.12.05 22:36:28 | 000,000,000 | ---D | M] (Stylish) -- C:\Users\Hauke\AppData\Roaming\mozilla\Firefox\Profiles\ze1nkspb.default\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}
[2010.09.08 17:03:46 | 000,000,000 | ---D | M] (DVDVideoSoftTB Toolbar) -- C:\Users\Hauke\AppData\Roaming\mozilla\Firefox\Profiles\ze1nkspb.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2010.09.08 16:58:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Hauke\AppData\Roaming\mozilla\Firefox\Profiles\ze1nkspb.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2009.05.18 17:58:34 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus(R))) -- C:\Users\Hauke\AppData\Roaming\mozilla\Firefox\Profiles\ze1nkspb.default\extensions\{CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}
[2010.04.23 17:29:46 | 000,000,000 | ---D | M] (Torbutton) -- C:\Users\Hauke\AppData\Roaming\mozilla\Firefox\Profiles\ze1nkspb.default\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}
[2010.01.01 16:29:04 | 000,000,000 | ---D | M] (DVDVideoSoft Toolbar) -- C:\Users\Hauke\AppData\Roaming\mozilla\Firefox\Profiles\ze1nkspb.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}
[2010.01.04 00:43:47 | 000,000,000 | ---D | M] (SweetIM Toolbar for Firefox) -- C:\Users\Hauke\AppData\Roaming\mozilla\Firefox\Profiles\ze1nkspb.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
[2010.09.28 20:25:55 | 000,000,000 | ---D | M] (ZoneAlarm-Sicherheit Toolbar) -- C:\Users\Hauke\AppData\Roaming\mozilla\Firefox\Profiles\ze1nkspb.default\extensions\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}
[2010.08.26 17:15:35 | 000,000,000 | ---D | M] -- C:\Users\Hauke\AppData\Roaming\mozilla\Firefox\Profiles\ze1nkspb.default\extensions\battlefieldheroespatcher@ea.com
[2010.06.22 18:27:31 | 000,000,000 | ---D | M] -- C:\Users\Hauke\AppData\Roaming\mozilla\Firefox\Profiles\ze1nkspb.default\extensions\eafo3fflauncher@ea.com
[2010.10.06 15:30:19 | 000,000,000 | ---D | M] -- C:\Users\Hauke\AppData\Roaming\mozilla\Firefox\Profiles\ze1nkspb.default\extensions\staged-xpis
[2010.08.27 23:04:54 | 000,000,943 | ---- | M] () -- C:\Users\Hauke\AppData\Roaming\Mozilla\FireFox\Profiles\ze1nkspb.default\searchplugins\conduit.xml
[2010.09.29 20:25:29 | 000,000,950 | ---- | M] () -- C:\Users\Hauke\AppData\Roaming\Mozilla\FireFox\Profiles\ze1nkspb.default\searchplugins\icqplugin-1.xml
[2009.08.11 18:42:54 | 000,000,961 | ---- | M] () -- C:\Users\Hauke\AppData\Roaming\Mozilla\FireFox\Profiles\ze1nkspb.default\searchplugins\icqplugin-2.xml
[2009.09.13 17:39:22 | 000,000,666 | ---- | M] () -- C:\Users\Hauke\AppData\Roaming\Mozilla\FireFox\Profiles\ze1nkspb.default\searchplugins\icqplugin-3.xml
[2009.11.02 21:34:59 | 000,000,961 | ---- | M] () -- C:\Users\Hauke\AppData\Roaming\Mozilla\FireFox\Profiles\ze1nkspb.default\searchplugins\icqplugin-4.xml
[2009.11.07 19:51:41 | 000,000,961 | ---- | M] () -- C:\Users\Hauke\AppData\Roaming\Mozilla\FireFox\Profiles\ze1nkspb.default\searchplugins\icqplugin-5.xml
[2009.12.17 17:58:07 | 000,000,961 | ---- | M] () -- C:\Users\Hauke\AppData\Roaming\Mozilla\FireFox\Profiles\ze1nkspb.default\searchplugins\icqplugin-6.xml
[2008.07.10 14:07:28 | 000,000,944 | ---- | M] () -- C:\Users\Hauke\AppData\Roaming\Mozilla\FireFox\Profiles\ze1nkspb.default\searchplugins\icqplugin.xml
[2009.05.21 15:46:36 | 000,001,632 | ---- | M] () -- C:\Users\Hauke\AppData\Roaming\Mozilla\FireFox\Profiles\ze1nkspb.default\searchplugins\live-search.xml
[2010.01.04 00:43:35 | 000,003,915 | ---- | M] () -- C:\Users\Hauke\AppData\Roaming\Mozilla\FireFox\Profiles\ze1nkspb.default\searchplugins\sweetim.xml
[2010.10.03 22:18:14 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010.01.24 00:04:33 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.09.12 17:38:08 | 000,001,392 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.09.12 17:38:08 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.09.12 17:38:08 | 000,006,805 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.09.12 17:38:08 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.09.12 17:38:08 | 000,001,105 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O2 - BHO: (EpsonToolBandKicker Class) - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O2 - BHO: (SweetIM Toolbar Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKLM\..\Toolbar: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKLM\..\Toolbar: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKCU\..\Toolbar\WebBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKCU\..\Toolbar\WebBrowser: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKCU\..\Toolbar\WebBrowser: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [eRecoveryService]  File not found
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8 - Extra context menu item: Free YouTube Download - C:\Users\Hauke\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Hauke\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - Reg Error: Value error. File not found
O9 - Extra Button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Hauke\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Hauke\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.10.06 17:54:37 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Users\Hauke\Desktop\TFC.exe
[2010.10.05 21:00:30 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2010.10.05 20:49:45 | 000,000,000 | ---D | C] -- C:\_OTL
[2010.10.05 14:25:37 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Users\Hauke\Desktop\OTL.exe
[2010.10.04 18:09:14 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft ATS
[2010.10.04 17:38:51 | 000,000,000 | ---D | C] -- C:\Users\Hauke\AppData\Roaming\PCF-VLC
[2010.10.04 17:35:22 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2010.10.04 17:35:17 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2010.10.04 17:32:16 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2010.10.04 17:30:48 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2010.09.29 17:02:22 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
[2010.09.28 20:24:51 | 000,000,000 | ---D | C] -- C:\Program Files\CheckPoint
[2010.09.28 20:20:58 | 000,046,592 | ---- | C] (Zone Labs Inc.) -- C:\Windows\System32\vsutil_loc0407.dll
[2010.09.28 20:20:41 | 000,058,368 | ---- | C] (Check Point Software Technologies LTD) -- C:\Windows\System32\vsregexp.dll
[2010.09.28 20:19:41 | 000,221,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\netio.sys
[2010.09.28 20:18:49 | 000,103,936 | ---- | C] (Check Point Software Technologies LTD) -- C:\Windows\System32\zlcommdb.dll
[2010.09.28 20:18:49 | 000,069,120 | ---- | C] (Check Point Software Technologies LTD) -- C:\Windows\System32\zlcomm.dll
[2010.09.28 20:18:09 | 000,043,008 | ---- | C] (Check Point Software Technologies LTD) -- C:\Windows\System32\vswmi.dll
[2010.09.28 20:17:54 | 001,238,528 | ---- | C] (Check Point Software Technologies LTD) -- C:\Windows\System32\zpeng25.dll
[2010.09.28 20:17:51 | 000,110,080 | ---- | C] (Check Point Software Technologies LTD) -- C:\Windows\System32\vsxml.dll
[2010.09.28 20:17:39 | 000,302,592 | ---- | C] (Check Point Software Technologies LTD) -- C:\Windows\System32\vspubapi.dll
[2010.09.28 20:17:38 | 000,107,520 | ---- | C] (Check Point Software Technologies LTD) -- C:\Windows\System32\vsmonapi.dll
[2010.09.28 20:17:31 | 000,112,128 | ---- | C] (Check Point Software Technologies LTD) -- C:\Windows\System32\vsdata.dll
[2010.09.28 20:16:49 | 000,457,304 | ---- | C] (Check Point Software Technologies LTD) -- C:\Windows\System32\drivers\vsdatant.sys
[2010.09.28 20:16:49 | 000,000,000 | ---D | C] -- C:\Windows\System32\ZoneLabs
[2010.09.28 20:16:44 | 000,000,000 | ---D | C] -- C:\Program Files\Zone Labs
[2010.09.28 20:14:25 | 000,000,000 | ---D | C] -- C:\ProgramData\CheckPoint
[2010.09.28 20:14:20 | 000,000,000 | ---D | C] -- C:\Windows\Internet Logs
[2010.09.28 20:14:10 | 000,228,864 | ---- | C] (Check Point Software Technologies LTD) -- C:\Windows\System32\vsinit.dll
[2010.09.28 20:14:09 | 000,713,728 | ---- | C] (Check Point Software Technologies LTD) -- C:\Windows\System32\vsutil.dll
[2010.09.28 15:19:00 | 000,000,000 | ---D | C] -- C:\Users\Hauke\AppData\Roaming\SUPERAntiSpyware.com
[2010.09.28 15:19:00 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2010.09.28 15:18:55 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2010.09.27 22:30:09 | 000,000,000 | ---D | C] -- C:\Windows\Sun
[2010.09.27 20:16:00 | 000,000,000 | ---D | C] -- C:\Program Files\HiJackThis
[2010.09.26 22:48:33 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2010.09.25 19:08:49 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2010.09.25 13:33:57 | 000,000,000 | ---D | C] -- C:\Users\Hauke\AppData\Roaming\Malwarebytes
[2010.09.25 13:33:49 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.09.25 13:33:48 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.09.25 13:33:48 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010.09.25 13:33:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.09.21 19:35:48 | 000,000,000 | ---D | C] -- C:\Users\Hauke\Documents\Schöningh
[2010.09.17 18:26:49 | 000,000,000 | ---D | C] -- C:\Users\Hauke\Desktop\PLAKATE
[2010.09.15 17:10:36 | 000,317,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MP4SDECD.DLL
[2010.09.08 18:55:04 | 000,000,000 | ---D | C] -- C:\Users\Hauke\AppData\Roaming\Philipp Winterberg
[2010.09.08 18:54:55 | 000,000,000 | ---D | C] -- C:\Program Files\RarZilla Free Unrar
[2010.09.08 16:58:45 | 000,000,000 | ---D | C] -- C:\Users\Hauke\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.09.08 11:17:46 | 000,094,208 | ---- | C] (Apple Inc.) -- C:\Windows\System32\QuickTimeVR.qtx
[2010.09.08 11:17:46 | 000,069,632 | ---- | C] (Apple Inc.) -- C:\Windows\System32\QuickTime.qts
[2010.09.06 19:37:25 | 000,000,000 | ---D | C] -- C:\Users\Hauke\Desktop\LOGO
[2010.01.20 17:14:50 | 000,139,264 | ---- | C] ( ) -- C:\Windows\System32\V2210dec.dll
[2007.05.07 01:07:10 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\Interop.Shell32.dll
 
========== Files - Modified Within 30 Days ==========
 
File not found -- C:\Users\Hauke\splinter cell
[2010.10.06 18:20:41 | 005,242,880 | -HS- | M] () -- C:\Users\Hauke\NTUSER.DAT
[2010.10.06 18:01:22 | 000,001,052 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job
[2010.10.06 17:58:56 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.10.06 17:58:54 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.10.06 17:58:53 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.10.06 17:58:39 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.10.06 17:58:37 | 3220,692,992 | -HS- | M] () -- C:\hiberfil.sys
[2010.10.06 17:57:53 | 000,524,288 | -HS- | M] () -- C:\Users\Hauke\NTUSER.DAT{152eacd7-c82d-11df-8fc1-001c25273050}.TMContainer00000000000000000001.regtrans-ms
[2010.10.06 17:57:53 | 000,065,536 | -HS- | M] () -- C:\Users\Hauke\NTUSER.DAT{152eacd7-c82d-11df-8fc1-001c25273050}.TM.blf
[2010.10.06 17:57:51 | 004,025,612 | -H-- | M] () -- C:\Users\Hauke\AppData\Local\IconCache.db
[2010.10.06 17:54:38 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Users\Hauke\Desktop\TFC.exe
[2010.10.06 16:45:05 | 000,000,418 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{1DB327C0-63D8-4FDD-85A5-CD223743BA19}.job
[2010.10.06 13:19:13 | 000,224,256 | ---- | M] () -- C:\Users\Hauke\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.10.05 20:57:05 | 002,672,312 | ---- | M] () -- C:\Users\Hauke\Desktop\esetsmartinstaller_enu.exe
[2010.10.05 16:34:55 | 781,024,650 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2010.10.05 15:23:50 | 000,293,376 | ---- | M] () -- C:\Users\Hauke\Desktop\84dv22nv.exe
[2010.10.05 15:17:21 | 000,000,000 | ---- | M] () -- C:\Users\Hauke\defogger_reenable
[2010.10.05 15:16:12 | 000,050,477 | ---- | M] () -- C:\Users\Hauke\Desktop\Defogger.exe
[2010.10.05 14:25:41 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\Hauke\Desktop\OTL.exe
[2010.10.04 19:30:17 | 004,063,232 | ---- | M] () -- C:\Windows\ocsetup_install_MicrosoftWindowsPowerShell.etl
[2010.10.04 19:30:17 | 000,196,608 | ---- | M] () -- C:\Windows\ocsetup_cbs_install_MicrosoftWindowsPowerShell.perf
[2010.10.04 19:30:17 | 000,065,536 | ---- | M] () -- C:\Windows\ocsetup_cbs_install_MicrosoftWindowsPowerShell.dpx
[2010.10.04 17:36:07 | 000,001,804 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2010.10.04 17:32:32 | 000,001,690 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2010.10.04 17:19:41 | 000,002,613 | ---- | M] () -- C:\Users\Hauke\Desktop\HiJackThis.lnk
[2010.10.04 00:22:16 | 000,000,680 | RHS- | M] () -- C:\Users\Hauke\ntuser.pol
[2010.10.04 00:06:46 | 000,000,349 | ---- | M] () -- C:\Users\Public\Documents\PCLECHAL.INI
[2010.10.03 17:49:12 | 000,008,592 | ---- | M] () -- C:\Users\Hauke\AppData\Local\d3d9caps.dat
[2010.09.29 23:59:01 | 000,174,324 | ---- | M] () -- C:\Users\Hauke\Desktop\cc_20100929_235655.reg
[2010.09.28 20:31:16 | 000,420,800 | -H-- | M] () -- C:\Windows\System32\drivers\vsconfig.xml
[2010.09.28 20:24:13 | 000,000,835 | ---- | M] () -- C:\Users\Hauke\Desktop\ZoneAlarm Security.lnk
[2010.09.28 20:24:11 | 000,005,977 | ---- | M] () -- C:\Windows\System32\vsconfig.xml
[2010.09.28 15:18:58 | 000,001,764 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010.09.27 23:07:56 | 000,040,375 | ---- | M] () -- C:\Users\Hauke\Desktop\bootkit_remover.rar
[2010.09.27 22:01:21 | 000,001,851 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2010.09.26 22:48:48 | 000,000,768 | ---- | M] () -- C:\Users\Hauke\Desktop\CCleaner.lnk
[2010.09.25 18:58:25 | 000,052,741 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2010.09.25 18:58:25 | 000,052,741 | ---- | M] () -- C:\ProgramData\nvModes.001
[2010.09.25 15:40:13 | 000,142,712 | ---- | M] () -- C:\Users\Hauke\AppData\Local\GDIPFONTCACHEV1.DAT
[2010.09.25 15:38:52 | 000,444,808 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010.09.25 13:33:52 | 000,000,782 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.09.25 01:01:30 | 000,524,288 | -HS- | M] () -- C:\Users\Hauke\NTUSER.DAT{152eacd7-c82d-11df-8fc1-001c25273050}.TMContainer00000000000000000002.regtrans-ms
[2010.09.25 00:42:08 | 000,524,288 | -HS- | M] () -- C:\Users\Hauke\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2010.09.25 00:42:08 | 000,065,536 | -HS- | M] () -- C:\Users\Hauke\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010.09.23 15:38:47 | 000,138,184 | ---- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2010.09.23 15:38:36 | 000,215,016 | ---- | M] () -- C:\Windows\System32\PnkBstrB.xtr
[2010.09.21 22:31:33 | 002,865,280 | ---- | M] () -- C:\Users\Hauke\Desktop\YouTube        - King of the Bongo.mp3
[2010.09.21 15:09:03 | 000,072,792 | ---- | M] () -- C:\Users\Hauke\Desktop\BLFImSickOfIt.jpg
[2010.09.20 21:26:46 | 000,110,691 | ---- | M] () -- C:\Users\Hauke\Desktop\rickshaw2.jpg
[2010.09.20 16:32:50 | 000,001,398 | ---- | M] () -- C:\Users\Hauke\Desktop\DivX Movies.lnk
[2010.09.20 16:31:53 | 000,000,881 | ---- | M] () -- C:\Users\Public\Desktop\DivX Plus Player.lnk
[2010.09.19 02:04:25 | 000,015,402 | ---- | M] () -- C:\Users\Hauke\Desktop\Profil2.jpg
[2010.09.19 01:57:16 | 000,015,869 | ---- | M] () -- C:\Users\Hauke\Desktop\Profil.jpg
[2010.09.18 23:31:36 | 000,169,827 | -H-- | M] () -- C:\Users\Hauke\Desktop\mxfilerelatedcache.mxc2
[2010.09.15 18:21:56 | 001,174,016 | ---- | M] () -- C:\Users\Hauke\Desktop\Aufwärmen.doc
[2010.09.12 22:07:37 | 000,249,693 | ---- | M] () -- C:\Users\Hauke\Desktop\LOGO (2).zip
[2010.09.12 22:06:39 | 000,072,776 | ---- | M] () -- C:\Users\Hauke\Desktop\SV LOGO3.jpg
[2010.09.12 22:02:28 | 000,077,197 | ---- | M] () -- C:\Users\Hauke\Desktop\SV LOGO2.jpg
[2010.09.12 21:58:25 | 000,099,042 | ---- | M] () -- C:\Users\Hauke\Desktop\SV LOGO´1.pdn
[2010.09.12 21:58:08 | 000,072,449 | ---- | M] () -- C:\Users\Hauke\Desktop\SV LOGO.jpg
[2010.09.12 01:54:16 | 000,137,770 | ---- | M] () -- C:\Users\Hauke\Desktop\SV logo.pdn
[2010.09.12 01:49:51 | 000,043,339 | ---- | M] () -- C:\Users\Hauke\Desktop\Logo.2.2.jpg
[2010.09.12 01:49:42 | 000,049,155 | ---- | M] () -- C:\Users\Hauke\Desktop\Logo.2.2.png
[2010.09.12 01:47:56 | 000,049,011 | ---- | M] () -- C:\Users\Hauke\Desktop\Logo.2.png
[2010.09.11 17:52:33 | 000,054,474 | ---- | M] () -- C:\Users\Hauke\Desktop\Logo.2.jpg
[2010.09.11 17:51:53 | 000,043,456 | ---- | M] () -- C:\Users\Hauke\Desktop\logo.2.1.jpg
[2010.09.11 17:45:51 | 000,061,570 | ---- | M] () -- C:\Users\Hauke\Desktop\logo.2.1.png
[2010.09.09 19:33:14 | 000,006,144 | -H-- | M] () -- C:\Users\Hauke\photothumb.db
[2010.09.09 19:33:04 | 000,059,392 | -H-- | M] () -- C:\Users\Hauke\Desktop\photothumb.db
[2010.09.08 18:54:56 | 000,000,864 | ---- | M] () -- C:\Users\Public\Desktop\RarZilla Free Unrar.lnk
[2010.09.08 17:03:17 | 004,972,672 | ---- | M] () -- C:\Users\Hauke\Desktop\Charlie Chaplin-Funny song- Modern Times.mp3
[2010.09.08 16:58:34 | 000,000,996 | ---- | M] () -- C:\Users\Hauke\Desktop\DVDVideoSoft Free Studio.lnk
[2010.09.08 11:17:46 | 000,094,208 | ---- | M] (Apple Inc.) -- C:\Windows\System32\QuickTimeVR.qtx
[2010.09.08 11:17:46 | 000,069,632 | ---- | M] (Apple Inc.) -- C:\Windows\System32\QuickTime.qts
[2010.09.07 23:29:00 | 000,081,282 | ---- | M] () -- C:\Users\Hauke\Desktop\die chance nutzen.png
[2010.09.06 19:30:49 | 000,168,561 | ---- | M] () -- C:\Users\Hauke\Desktop\Logo.zip
 
========== Files Created - No Company Name ==========
 
[2010.10.05 20:56:57 | 002,672,312 | ---- | C] () -- C:\Users\Hauke\Desktop\esetsmartinstaller_enu.exe
[2010.10.05 16:34:55 | 781,024,650 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2010.10.05 15:23:47 | 000,293,376 | ---- | C] () -- C:\Users\Hauke\Desktop\84dv22nv.exe
[2010.10.05 15:17:21 | 000,000,000 | ---- | C] () -- C:\Users\Hauke\defogger_reenable
[2010.10.05 15:16:10 | 000,050,477 | ---- | C] () -- C:\Users\Hauke\Desktop\Defogger.exe
[2010.10.04 19:29:53 | 000,196,608 | ---- | C] () -- C:\Windows\ocsetup_cbs_install_MicrosoftWindowsPowerShell.perf
[2010.10.04 19:29:53 | 000,065,536 | ---- | C] () -- C:\Windows\ocsetup_cbs_install_MicrosoftWindowsPowerShell.dpx
[2010.10.04 19:29:52 | 004,063,232 | ---- | C] () -- C:\Windows\ocsetup_install_MicrosoftWindowsPowerShell.etl
[2010.10.04 17:36:07 | 000,001,804 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2010.10.04 17:32:32 | 000,001,690 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2010.10.04 00:22:16 | 000,000,680 | RHS- | C] () -- C:\Users\Hauke\ntuser.pol
[2010.10.03 22:39:33 | 3220,692,992 | -HS- | C] () -- C:\hiberfil.sys
[2010.09.29 23:57:16 | 000,174,324 | ---- | C] () -- C:\Users\Hauke\Desktop\cc_20100929_235655.reg
[2010.09.28 20:24:13 | 000,000,835 | ---- | C] () -- C:\Users\Hauke\Desktop\ZoneAlarm Security.lnk
[2010.09.28 20:21:04 | 000,005,977 | ---- | C] () -- C:\Windows\System32\vsconfig.xml
[2010.09.28 20:16:49 | 000,420,800 | -H-- | C] () -- C:\Windows\System32\drivers\vsconfig.xml
[2010.09.28 15:18:58 | 000,001,764 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010.09.27 23:07:53 | 000,040,375 | ---- | C] () -- C:\Users\Hauke\Desktop\bootkit_remover.rar
[2010.09.27 22:00:36 | 000,001,851 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2010.09.27 20:16:02 | 000,002,613 | ---- | C] () -- C:\Users\Hauke\Desktop\HiJackThis.lnk
[2010.09.26 22:48:48 | 000,000,768 | ---- | C] () -- C:\Users\Hauke\Desktop\CCleaner.lnk
[2010.09.25 13:33:52 | 000,000,782 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.09.25 00:43:18 | 000,524,288 | -HS- | C] () -- C:\Users\Hauke\NTUSER.DAT{152eacd7-c82d-11df-8fc1-001c25273050}.TMContainer00000000000000000002.regtrans-ms
[2010.09.25 00:43:18 | 000,524,288 | -HS- | C] () -- C:\Users\Hauke\NTUSER.DAT{152eacd7-c82d-11df-8fc1-001c25273050}.TMContainer00000000000000000001.regtrans-ms
[2010.09.25 00:43:18 | 000,065,536 | -HS- | C] () -- C:\Users\Hauke\NTUSER.DAT{152eacd7-c82d-11df-8fc1-001c25273050}.TM.blf
[2010.09.21 22:26:27 | 002,865,280 | ---- | C] () -- C:\Users\Hauke\Desktop\YouTube        - King of the Bongo.mp3
[2010.09.20 21:26:45 | 000,110,691 | ---- | C] () -- C:\Users\Hauke\Desktop\rickshaw2.jpg
[2010.09.19 02:04:22 | 000,015,402 | ---- | C] () -- C:\Users\Hauke\Desktop\Profil2.jpg
[2010.09.19 01:57:14 | 000,015,869 | ---- | C] () -- C:\Users\Hauke\Desktop\Profil.jpg
[2010.09.15 17:59:42 | 001,174,016 | ---- | C] () -- C:\Users\Hauke\Desktop\Aufwärmen.doc
[2010.09.12 22:07:17 | 000,249,693 | ---- | C] () -- C:\Users\Hauke\Desktop\LOGO (2).zip
[2010.09.12 22:06:21 | 000,072,776 | ---- | C] () -- C:\Users\Hauke\Desktop\SV LOGO3.jpg
[2010.09.12 22:02:24 | 000,077,197 | ---- | C] () -- C:\Users\Hauke\Desktop\SV LOGO2.jpg
[2010.09.12 21:58:23 | 000,099,042 | ---- | C] () -- C:\Users\Hauke\Desktop\SV LOGO´1.pdn
[2010.09.12 21:58:03 | 000,072,449 | ---- | C] () -- C:\Users\Hauke\Desktop\SV LOGO.jpg
[2010.09.12 01:49:49 | 000,043,339 | ---- | C] () -- C:\Users\Hauke\Desktop\Logo.2.2.jpg
[2010.09.12 01:49:40 | 000,049,155 | ---- | C] () -- C:\Users\Hauke\Desktop\Logo.2.2.png
[2010.09.11 17:52:31 | 000,054,474 | ---- | C] () -- C:\Users\Hauke\Desktop\Logo.2.jpg
[2010.09.11 17:51:51 | 000,043,456 | ---- | C] () -- C:\Users\Hauke\Desktop\logo.2.1.jpg
[2010.09.11 17:45:49 | 000,061,570 | ---- | C] () -- C:\Users\Hauke\Desktop\logo.2.1.png
[2010.09.11 17:45:33 | 000,049,011 | ---- | C] () -- C:\Users\Hauke\Desktop\Logo.2.png
[2010.09.08 18:54:56 | 000,000,864 | ---- | C] () -- C:\Users\Public\Desktop\RarZilla Free Unrar.lnk
[2010.09.08 17:02:50 | 004,972,672 | ---- | C] () -- C:\Users\Hauke\Desktop\Charlie Chaplin-Funny song- Modern Times.mp3
[2010.09.08 16:58:34 | 000,000,996 | ---- | C] () -- C:\Users\Hauke\Desktop\DVDVideoSoft Free Studio.lnk
[2010.09.07 23:28:57 | 000,081,282 | ---- | C] () -- C:\Users\Hauke\Desktop\die chance nutzen.png
[2010.09.07 23:10:02 | 000,137,770 | ---- | C] () -- C:\Users\Hauke\Desktop\SV logo.pdn
[2010.09.06 18:54:26 | 000,168,561 | ---- | C] () -- C:\Users\Hauke\Desktop\Logo.zip
[2010.06.19 11:58:58 | 000,052,741 | ---- | C] () -- C:\ProgramData\nvModes.001
[2010.06.19 11:58:45 | 000,052,741 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2010.06.04 20:54:11 | 000,017,408 | ---- | C] () -- C:\Users\Hauke\AppData\Local\WebpageIcons.db
[2010.05.30 21:04:01 | 001,028,096 | ---- | C] () -- C:\Windows\System32\HDX4MediaConverter2.dll
[2010.03.02 00:48:01 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.01.28 23:32:40 | 000,941,784 | ---- | C] () -- C:\Windows\System32\drivers\CAMTHWDM.sys
[2010.01.20 17:14:50 | 000,028,672 | ---- | C] () -- C:\Windows\vqsetup.dll
[2009.10.18 17:43:29 | 000,008,570 | ---- | C] () -- C:\ProgramData\LUUnInstall.LiveUpdate
[2009.09.11 19:08:48 | 000,138,184 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2009.09.11 19:08:47 | 000,139,152 | ---- | C] () -- C:\Users\Hauke\AppData\Roaming\PnkBstrK.sys
[2009.09.03 22:02:45 | 000,045,056 | ---- | C] () -- C:\Windows\System32\lexazdll32.dll
[2009.08.31 13:03:42 | 000,262,144 | ---- | C] () -- C:\Windows\System32\EMRegSys.dll
[2009.08.18 17:24:43 | 000,000,551 | ---- | C] () -- C:\Users\Hauke\AppData\Roaming\AutoGK.ini
[2009.08.07 23:46:10 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.05.19 20:13:39 | 000,000,099 | ---- | C] () -- C:\Windows\galaxy.ini
[2009.05.12 15:51:31 | 000,000,660 | ---- | C] () -- C:\Windows\ODBC.INI
[2009.04.13 01:02:06 | 000,012,437 | ---- | C] () -- C:\Users\Hauke\AppData\Roaming\UserTile.png
[2009.01.25 23:10:48 | 000,179,200 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2009.01.22 17:12:15 | 000,000,093 | ---- | C] () -- C:\Users\Hauke\AppData\Local\fusioncache.dat
[2009.01.09 01:01:22 | 000,629,760 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2008.11.25 16:01:16 | 000,299,008 | ---- | C] () -- C:\Windows\System32\midas.dll
[2008.11.25 16:01:16 | 000,120,320 | ---- | C] () -- C:\Windows\System32\UnzDll.dll
[2008.11.25 15:55:52 | 000,000,043 | ---- | C] () -- C:\Windows\Caligari.ini
[2008.07.04 22:02:52 | 000,000,058 | ---- | C] () -- C:\Windows\nfsc_patch.ini
[2008.06.27 17:38:58 | 000,069,632 | R--- | C] () -- C:\Windows\System32\xmltok.dll
[2008.06.27 17:38:58 | 000,036,864 | R--- | C] () -- C:\Windows\System32\xmlparse.dll
[2008.06.11 20:11:29 | 000,226,302 | ---- | C] () -- C:\Users\Hauke\AppData\Local\Temppenciltemp.png
[2008.06.01 22:07:41 | 000,544,256 | ---- | C] () -- C:\Windows\System32\janGraphics.dll
[2008.05.29 20:36:11 | 000,408,576 | ---- | C] () -- C:\Windows\System32\Smab.dll
[2008.05.29 20:36:10 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2008.05.26 18:51:01 | 000,096,768 | ---- | C] () -- C:\Windows\SlantAdj.dll
[2008.05.26 18:51:01 | 000,000,072 | ---- | C] () -- C:\Windows\System32\epDPE.ini
[2008.05.26 18:50:25 | 000,000,097 | ---- | C] () -- C:\Windows\System32\PICSDK.ini
[2008.05.26 18:47:43 | 000,000,027 | ---- | C] () -- C:\Windows\CDE CX3600FGD.ini
[2008.05.25 21:22:42 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2008.05.22 21:28:50 | 000,029,696 | ---- | C] () -- C:\Windows\System32\asutl8.dll
[2008.05.08 19:56:29 | 000,000,032 | ---- | C] () -- C:\ProgramData\ezsid.dat
[2008.04.19 17:06:46 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll
[2008.04.18 22:25:27 | 000,442,368 | ---- | C] () -- C:\Windows\System32\dvmsg.dll
[2008.04.18 19:08:50 | 000,053,248 | ---- | C] () -- C:\Windows\System32\mgxasio2.dll
[2008.04.18 19:03:27 | 000,007,103 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2008.04.15 21:50:36 | 000,224,256 | ---- | C] () -- C:\Users\Hauke\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.04.15 21:05:18 | 000,138,752 | ---- | C] () -- C:\Windows\System32\MASE32.DLL
[2008.04.15 21:05:17 | 000,196,096 | ---- | C] () -- C:\Windows\System32\MACD32.DLL
[2008.04.15 21:05:17 | 000,136,192 | ---- | C] () -- C:\Windows\System32\MAMC32.DLL
[2008.04.15 21:05:17 | 000,057,856 | ---- | C] () -- C:\Windows\System32\MASD32.DLL
[2008.04.15 21:05:17 | 000,027,648 | ---- | C] () -- C:\Windows\System32\MA32.DLL
[2008.04.15 19:42:07 | 000,000,044 | ---- | C] () -- C:\Windows\Acer(Normal).ini
[2008.04.15 19:42:07 | 000,000,042 | ---- | C] () -- C:\Windows\Acer(Wide).ini
[2008.04.15 19:22:52 | 000,008,592 | ---- | C] () -- C:\Users\Hauke\AppData\Local\d3d9caps.dat
[2007.05.07 10:41:16 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIBUN4.dll
[2007.05.07 09:22:38 | 000,000,834 | ---- | C] () -- C:\Windows\generic.ini
[2007.05.07 09:22:38 | 000,000,132 | ---- | C] () -- C:\Windows\Alaunch.ini
[2007.05.07 09:22:34 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2007.05.07 01:07:10 | 000,331,776 | ---- | C] () -- C:\Windows\System32\ScrollBarLib.dll
[2007.02.06 23:58:10 | 000,204,800 | ---- | C] () -- C:\Windows\System32\NotesActnMenu.dll
[2007.02.06 23:57:58 | 000,266,240 | ---- | C] () -- C:\Windows\System32\NotesExtmngr.dll
[2007.02.06 23:57:20 | 000,086,016 | ---- | C] () -- C:\Windows\System32\MSNSpook.dll
[2007.02.06 23:56:30 | 000,028,672 | ---- | C] () -- C:\Windows\System32\BatchCrypto.dll
[2007.02.06 23:56:28 | 000,073,728 | ---- | C] () -- C:\Windows\System32\APISlice.dll
[2007.02.06 23:52:08 | 000,063,488 | ---- | C] () -- C:\Windows\System32\ShowErrMsg.dll
[2006.12.25 15:44:48 | 000,022,016 | ---- | C] () -- C:\Windows\System32\MailFormat_U.dll
[2006.12.07 01:57:19 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2005.02.05 21:46:00 | 000,004,608 | ---- | C] () -- C:\Windows\fgexec.dll
[2003.02.20 17:53:42 | 000,005,702 | ---- | C] () -- C:\Windows\System32\OUTLPERF.INI
[2002.10.16 00:54:04 | 000,153,088 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2001.12.26 15:12:30 | 000,065,536 | ---- | C] () -- C:\Windows\System32\multiplex_vcd.dll
[2001.09.03 22:46:38 | 000,110,592 | ---- | C] () -- C:\Windows\System32\Hmpg12.dll
[2001.07.30 15:33:56 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC.dll
[2001.07.23 21:04:36 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC_MMX.dll
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:0CE7F3C9
< End of report >
Code:
OTL Extras logfile created on: 06.10.2010 18:21:30 - Run 2
OTL by OldTimer - Version 3.2.14.1    Folder = C:\Users\Hauke\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 69,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 85,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 229,13 Gb Total Space | 20,06 Gb Free Space | 8,76% Space Free | Partition Type: NTFS
Drive D: | 228,82 Gb Total Space | 33,77 Gb Free Space | 14,76% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive J: | 1397,26 Gb Total Space | 1087,31 Gb Free Space | 77,82% Space Free | Partition Type: NTFS
 
Computer Name: HAUKES-PC
Current User Name: Hauke
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\WINWORD.EXE" /n /dde (Microsoft Corporation)
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UacDisableNotify" = 1
"InternetSettingsDisableNotify" = 1
"AutoUpdateDisableNotify" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{282C987F-7F6F-4A7F-9794-46C188A34E2D}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{36243253-E19F-4273-9768-2CEE152BCD3B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{44242F98-D4B0-42F4-838B-1AF1620C1B9E}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{59D5121B-FF05-4D6A-9264-EA17017C50F6}" = lport=2869 | protocol=6 | dir=in | app=system |
"{6D5D3221-0FAF-4EAC-8D25-3D11E015CE77}" = rport=2869 | protocol=6 | dir=out | app=system |
"{826BEA83-0DE7-4F81-AC3C-6343B02EA7A8}" = lport=2869 | protocol=6 | dir=in | app=system |
"{8AF2B5EB-4A00-4B02-BA2A-C70599F59A18}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{BF766753-76BD-4F57-937C-1E5D9858E356}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{C7171238-94E1-42F2-A53A-B0BE7847B26B}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{F27B4A21-6B78-4C5F-9E4A-3FE4169E1A23}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04B0A50E-00BF-4AD5-A9EA-7CB04089F089}" = protocol=6 | dir=in | app=d:\programme2\icq6.5\icq.exe |
"{08917A68-9F00-4FD6-BC6E-0811EE62BA55}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{092D9FD4-9315-4860-8C15-35D27762E64E}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{0BC4EAD2-5EDC-47F6-960B-7A6C03357683}" = protocol=6 | dir=in | app=c:\program files\pinnacle\videospin\programs\umi.exe |
"{14474163-F976-4417-A929-6ED79991A1AF}" = dir=in | app=c:\program files\acer arcade live\acer arcade live main page\acer arcade live.exe |
"{1DDFAFDA-E343-4D84-BE4D-F055CE0F0819}" = protocol=17 | dir=in | app=c:\program files\pinnacle\videospin\programs\rm.exe |
"{2347661D-BCF9-431B-96F0-84D03336B41D}" = protocol=6 | dir=in | app=c:\program files\microsoft games\zoo tycoon 2\zt.exe |
"{245EFA32-2FB3-45B4-BBA6-22977DA6B9D7}" = dir=in | app=c:\program files\acer arcade live\slideshow dvd\component\clsldvd.exe |
"{29EB6D01-9FC4-4C73-A719-76098D328167}" = protocol=6 | dir=in | app=c:\program files\icq7.0\aolload.exe |
"{2CAF8F7F-4018-449F-A320-06FCBECA7B92}" = protocol=17 | dir=in | app=c:\program files\icq7.0\icq.exe |
"{3738926D-03BB-40CB-8929-1B84147C4419}" = protocol=17 | dir=in | app=c:\program files\microsoft games\zoo tycoon 2\zt.exe |
"{3E1A7721-81FD-4D6A-9799-5F4CF196492D}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{401DCC44-0472-4D02-AC29-0D37AD80CF29}" = dir=in | app=c:\program files\acer arcade live\acer homemedia connect\homemedia connect.exe |
"{48479F0D-A229-4B88-AE0F-A9F4CAA3866E}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{48B8001C-9F90-4B59-A852-29235EEEE6D6}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{4B4DBD99-71D3-41E7-A293-DBF5364CDD6C}" = protocol=6 | dir=in | app=c:\program files\icq7.0\icq.exe |
"{4F6A9D0A-B2C6-4466-BDA3-A9E8A04CA573}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{513ED057-3824-4927-B104-F713836596E8}" = protocol=6 | dir=in | app=c:\program files\pinnacle\videospin\programs\rm.exe |
"{53946808-0485-4BC6-AF97-9978117E9E44}" = protocol=6 | dir=in | app=d:\programme2\icq6.5\icq.exe |
"{53DBA6AB-B590-462B-99E7-051089082179}" = protocol=6 | dir=in | app=c:\program files\icq7.0\icq.exe |
"{57EF81D5-1F99-4371-B78D-B2199531A19B}" = protocol=17 | dir=in | app=c:\program files\icq7.0\aolload.exe |
"{5AF8FA0D-31B4-4BB3-BB06-7468299131E1}" = dir=in | app=c:\program files\acer arcade live\acer playmovie\playmovie.exe |
"{603E1AC3-1B95-432F-BFFC-923DE68CD193}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{610D4256-FBF6-4239-BD64-20FDFE1F9691}" = dir=in | app=c:\program files\acer arcade live\acer homemedia connect\kernel\dms\clmsserver.exe |
"{613EC548-2ADC-4F36-AB4D-D92E1B7D62BC}" = protocol=6 | dir=in | app=c:\program files\sony\media manager for psp\mediamanager.exe |
"{6307F449-05C4-4738-BF6B-FD7B228A1DEE}" = dir=in | app=c:\program files\acer arcade live\acer dvdivine\dvdivine.exe |
"{668B9D30-8C28-4862-BCE1-8A68B4DE5FB4}" = protocol=17 | dir=in | app=d:\programme2\icq6.5\icq.exe |
"{695E9E79-C11B-49E8-9FD5-18A894522ECB}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{69F69489-C87E-4521-8A5A-80841CC67EE8}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{6BA6BAE5-3888-4DCF-8B65-20605C873AE9}" = protocol=6 | dir=in | app=c:\windows\system32\zonelabs\vsmon.exe |
"{741E8BE9-4852-4E4F-8791-EFA7C8F8E713}" = protocol=17 | dir=in | app=d:\programme2\icq6.5\icq.exe |
"{7BA1B465-7412-4EBA-BF21-D7AF309A0289}" = protocol=17 | dir=in | app=c:\program files\icq7.0\icq.exe |
"{82B856C5-BE0F-43F0-B96B-E77DDDD14844}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{8C4C74ED-D6A7-4AF4-9CDE-7E72B903A9FD}" = protocol=17 | dir=in | app=c:\program files\icq7.0\icq.exe |
"{8EE41AAF-5693-447D-A63C-B8584B9DDA1F}" = protocol=17 | dir=in | app=c:\program files\sony\media manager for psp\mediamanager.exe |
"{903A37DB-784F-464B-943C-203538F2C813}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{9126E073-9C9C-4DEE-9274-DD572F147819}" = dir=in | app=c:\program files\acer arcade live\acer dv magician\component\arawp.exe |
"{95B812B6-B8EC-4E56-AB88-727F45A55771}" = protocol=17 | dir=in | app=d:\programme2\icq6.5\icq.exe |
"{964E3E73-5BF5-4C36-8C24-32C59E7584D1}" = dir=in | app=c:\program files\acer arcade live\acer homemedia\homemedia.exe |
"{9AD356BB-9631-4CDA-A902-E678C0D0F631}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\groove.exe |
"{9B2DE5D0-0D7C-45A5-9E49-A18141B64587}" = dir=in | app=c:\program files\acer arcade live\acer videomagician\videomagician.exe |
"{9F2DD910-5EF3-446A-A2F9-CE06248B10E0}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{AC16DC45-AB0E-4315-A498-D953A24414AE}" = protocol=17 | dir=in | app=c:\program files\pinnacle\videospin\programs\videospin.exe |
"{ACE08E08-E81A-44EA-9A1E-CC6F590CD48E}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 |
"{B1FA972A-E777-4071-AC67-E075667091B5}" = protocol=17 | dir=in | app=c:\program files\pinnacle\videospin\programs\umi.exe |
"{B21EBDD6-A628-48A9-AEE6-78777FBB8614}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{B4006B54-CCDF-4253-9413-949274A89576}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{B599EE23-7780-4793-A7B8-C86D398C1B33}" = dir=in | app=c:\program files\acer arcade live\acer playmovie\pmvservice.exe |
"{BB355F37-060D-4046-BF6A-6772FD3DDECD}" = protocol=17 | dir=in | app=c:\program files\pinnacle\videospin\programs\pmsregisterfile.exe |
"{CED2353B-7772-440B-8F35-7EEF30B1FDB3}" = protocol=6 | dir=in | app=c:\program files\icq7.0\icq.exe |
"{D0A24811-3314-41B6-8922-730F79DDD02D}" = protocol=6 | dir=in | app=c:\program files\pinnacle\videospin\programs\videospin.exe |
"{D2FC5796-A451-4BC3-BE9E-6BA50D4E5EE3}" = protocol=6 | dir=in | app=c:\program files\pinnacle\videospin\programs\pmsregisterfile.exe |
"{E582B88F-1D95-4D09-9841-58E0F617124B}" = protocol=6 | dir=in | app=c:\program files\icq7.0\aolload.exe |
"{EE67895E-F5B7-47CA-BD80-8D6113EF06E1}" = protocol=6 | dir=in | app=d:\programme2\icq6.5\icq.exe |
"{EF096C5B-BB54-4A51-8A4A-17879E1BD68A}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{F0429F00-CC5D-4CB5-A7E2-D7C6DD72D2F0}" = dir=in | app=c:\program files\acer arcade live\acer dv magician\component\dvax2process.exe |
"{F2619CE5-966E-4273-B4DD-7EF841426F2F}" = protocol=17 | dir=in | app=c:\windows\system32\zonelabs\vsmon.exe |
"{F9FA0F5A-23C5-4CB4-9BCD-D087CB1931FF}" = protocol=17 | dir=in | app=c:\program files\icq7.0\aolload.exe |
"TCP Query User{1169FD75-7D6C-4BFA-B19C-A019824C0865}C:\program files\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe |
"TCP Query User{249284C7-5BF8-491F-B682-E83A8B076AF6}C:\program files\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe |
"TCP Query User{2A94DF59-4ACB-45DE-824B-C9F8AD62E750}C:\program files\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"TCP Query User{2AA6FA3F-4E84-4CB1-A853-A65214C37331}C:\program files\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"TCP Query User{2FA6E06F-3880-4B10-BD1F-8B23D6193CFD}D:\programme2\ubisoft\tom clancy's splinter cell chaos theory\system\splintercell3.exe" = protocol=6 | dir=in | app=d:\programme2\ubisoft\tom clancy's splinter cell chaos theory\system\splintercell3.exe |
"TCP Query User{44CDA926-47B8-49E9-9F1F-8F372FB6FF24}D:\users\hauke\documents\stronghold crusader\stronghold crusader\stronghold crusader.exe" = protocol=6 | dir=in | app=d:\users\hauke\documents\stronghold crusader\stronghold crusader\stronghold crusader.exe |
"TCP Query User{4F786191-C063-4B44-A303-15143E27E14B}C:\program files\participatory culture foundation\miro\xulrunner\python\miro_downloader.exe" = protocol=6 | dir=in | app=c:\program files\participatory culture foundation\miro\xulrunner\python\miro_downloader.exe |
"TCP Query User{500F8F9A-1ABB-468B-AAD7-79BF1D1852CE}D:\programme2\ubisoft\tom clancy's splinter cell chaos theory\versus\system\scct_versus_dedicatedserver.exe" = protocol=6 | dir=in | app=d:\programme2\ubisoft\tom clancy's splinter cell chaos theory\versus\system\scct_versus_dedicatedserver.exe |
"TCP Query User{5978676B-3C02-4922-AEF5-BFF83C03615B}K:\operator-3.5\operator\opera\opera.exe" = protocol=6 | dir=in | app=k:\operator-3.5\operator\opera\opera.exe |
"TCP Query User{702B988E-95FF-4C60-97D1-D781AB868D1B}C:\program files\ea sports\fifa online\nfe.exe" = protocol=6 | dir=in | app=c:\program files\ea sports\fifa online\nfe.exe |
"TCP Query User{BDC22EB9-FEFF-495A-B857-C4192F0F15F8}C:\windows\system32\dplaysvr.exe" = protocol=6 | dir=in | app=c:\windows\system32\dplaysvr.exe |
"TCP Query User{C786E74F-BE51-4145-B52F-15C571F1C577}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"TCP Query User{E38739B0-9A15-4A77-86FB-0E1366225B8C}C:\program files\aspyr media, inc\thaw\game\thaw.exe" = protocol=6 | dir=in | app=c:\program files\aspyr media, inc\thaw\game\thaw.exe |
"TCP Query User{F02084AE-59C1-45DA-8A75-0954479CE501}C:\program files\tmnationsforever\tmforever.exe" = protocol=6 | dir=in | app=c:\program files\tmnationsforever\tmforever.exe |
"TCP Query User{F21A8AD2-2A83-4055-85F1-3D1C045E7640}D:\programme2\fifa10.exe" = protocol=6 | dir=in | app=d:\programme2\fifa10.exe |
"UDP Query User{1789791A-FB2D-4F59-AE59-60D40B3E4392}C:\program files\tmnationsforever\tmforever.exe" = protocol=17 | dir=in | app=c:\program files\tmnationsforever\tmforever.exe |
"UDP Query User{46B59A63-9166-42CF-BA79-0745582A7DF3}C:\program files\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"UDP Query User{46D15242-D509-4B3F-A037-8D873834A0F6}C:\program files\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe |
"UDP Query User{64B88066-0FB6-4922-A749-E19B339F0ABA}K:\operator-3.5\operator\opera\opera.exe" = protocol=17 | dir=in | app=k:\operator-3.5\operator\opera\opera.exe |
"UDP Query User{749D1C72-55DF-423A-87B8-C1AB468D9960}D:\programme2\ubisoft\tom clancy's splinter cell chaos theory\versus\system\scct_versus_dedicatedserver.exe" = protocol=17 | dir=in | app=d:\programme2\ubisoft\tom clancy's splinter cell chaos theory\versus\system\scct_versus_dedicatedserver.exe |
"UDP Query User{7CC0A4BA-9FEF-48C2-A623-EA1A44BCC0E2}C:\program files\aspyr media, inc\thaw\game\thaw.exe" = protocol=17 | dir=in | app=c:\program files\aspyr media, inc\thaw\game\thaw.exe |
"UDP Query User{992FECE7-D97A-4E58-ABDC-9BD77A308209}C:\windows\system32\dplaysvr.exe" = protocol=17 | dir=in | app=c:\windows\system32\dplaysvr.exe |
"UDP Query User{994FF1F2-F725-400A-84F3-CD17C09B71B4}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"UDP Query User{A24828E5-29C2-4731-89E2-4041471490E1}C:\program files\ea sports\fifa online\nfe.exe" = protocol=17 | dir=in | app=c:\program files\ea sports\fifa online\nfe.exe |
"UDP Query User{AAD11887-4E90-4D80-86F1-C5753D19A53E}C:\program files\participatory culture foundation\miro\xulrunner\python\miro_downloader.exe" = protocol=17 | dir=in | app=c:\program files\participatory culture foundation\miro\xulrunner\python\miro_downloader.exe |
"UDP Query User{BD4FB4BE-5D93-4A48-BA97-9B9FF4EDB892}C:\program files\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"UDP Query User{C29D7220-4699-4C7D-AC0E-844A7FF2C9E6}D:\users\hauke\documents\stronghold crusader\stronghold crusader\stronghold crusader.exe" = protocol=17 | dir=in | app=d:\users\hauke\documents\stronghold crusader\stronghold crusader\stronghold crusader.exe |
"UDP Query User{C84D02DA-5944-4120-96BD-811E8ED2DBB8}D:\programme2\ubisoft\tom clancy's splinter cell chaos theory\system\splintercell3.exe" = protocol=17 | dir=in | app=d:\programme2\ubisoft\tom clancy's splinter cell chaos theory\system\splintercell3.exe |
"UDP Query User{DCB28C10-AEF2-4C74-A345-562B02352362}C:\program files\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe |
"UDP Query User{F248228B-F5A0-4B9F-951D-8944973CB89D}D:\programme2\fifa10.exe" = protocol=17 | dir=in | app=d:\programme2\fifa10.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{01521746-02A6-4A72-00BD-A285DF6B80C6}" = Die Sims 2: Wilde Campus-Jahre
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0556F885-2415-4666-B53E-33727E46AEA1}" = The Movies(TM)
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID-Anmelde-Assistent
"{084A9731-D05B-4ADA-B4A0-0ADD25FD7152}" = Splinter Cell Pandora Tomorrow
"{090A0EB4-FC4E-4D24-0001-04C3FA6538B1}" = MyTube BigPack Internet Recorder 3 Free
"{0D8A8C0F-79BA-49EE-B9F5-4FB01E864C35}" = Tom Clancy's Splinter Cell 3 - Chaos Theory Demo
"{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}" = PlayStation(R)Store
"{11202615-E557-4ECF-9B86-F59C81E52909}" = FIFA 10
"{11C88EEC-23FC-4181-B6E4-22247E2ABD28}" = Microsoft Expression Web 3
"{132888AE-EF67-41C5-BCA2-7D5D2488AB63}" = Acer HomeMedia Connect
"{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"{15CCBC5D-66A7-4131-8D36-E05F27B0E68F}" = Sibelius Scorch (ActiveX Only)
"{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010 (Beta)
"{20140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010 (Beta)
"{20140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010 (Beta)
"{20140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010 (Beta)
"{20140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010 (Beta)
"{20140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010 (Beta)
"{20140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010 (Beta)
"{20140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010 (Beta)
"{20140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010 (Beta)
"{20140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010 (Beta)
"{20140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010 (Beta)
"{20140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010 (Beta)
"{20140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010 (Beta)
"{20140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010 (Beta)
"{20140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010 (Beta)
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{21C6344A-918B-4D35-ADB6-7614F97B78EA}" = Sony Media Manager for PSP 3.0
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{23B59ED4-C360-11D7-875B-0090CC005647}" = EPSON PRINT Image Framer Tool2.1
"{259C0ABB-A3B2-4D70-008F-BF7EE491B70B}" = Need for Speed™ Carbon
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 18
"{2BA722D1-48D1-406E-9123-8AE5431D63EF}" = Windows Live Fotogalerie
"{2CE5A2E7-3437-4CE7-BCF4-85ED6EEFF9E4}" = iTunes
"{31CF6C0E-51F0-41D2-B088-A6A143C4303C}" = SweetIM Toolbar for Internet Explorer 3.6
"{3293C06B-003F-4027-8380-FFD79E38167D}" = Tony Hawk's American Wasteland
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{41581EF5-45A7-11DA-9D78-000129760D75}" = Acer SlideShow DVD
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{4817189D-1785-4627-A33C-39FD90919300}" = Die Sims™ 2 Haustiere
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4C3EF687-803F-4825-B815-04AE32DDEB41}" = YAVIDO
"{4C73B683-B15D-4B94-AC7A-520B70C4FFE9}" = Sceneo AbsolutTV
"{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}" = Microsoft Works
"{4EDB1CA5-983F-4FC3-A8E3-E34981E05A60}" = Pinnacle VideoSpin
"{5628829F-3318-4DDA-988D-D301832F1611}" = Singles
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{628697C2-7F0E-40D2-8020-A147B3090F60}" = MorphVOX Pro
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{65F5B7AF-3363-11D7-BB6B-00018021113F}" = EPSON PhotoQuicker3.5
"{67ADE9AF-5CD9-4089-8825-55DE4B366799}" = NTI Backup NOW! 4.7
"{67EDD823-135A-4D59-87BD-950616D6E857}" = EPSON Copy Utility 3
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6BDD9CE6-D0A6-478A-BAD3-BA6945E89EB0}" = Die Sims 2: Family Fun - Accessoires
"{6C11D561-620B-47DA-A693-4C597F3CDF40}" = EPSON Smart Panel
"{6E7DD182-9FC6-4651-0095-2E666CC6AF35}" = Die Sims 2
"{6FE3B0CE-37C1-4825-908A-5A84C9B4EC2F}" = EA SPORTS(TM) FIFA Online
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{752E90AC-3F11-4EA3-88EA-96441047EC31}" = Microsoft Expression Web 3 SP1
"{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{78699791-0625-4667-9E70-626A1CCEC94D}" = 3D Canvas
"{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver
"{7B3577F5-1D82-4C9B-008B-69D026FD8BCA}" = Die Sims 2: Open For Business
"{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}" = Text-To-Speech-Runtime
"{7BD0A2D8-4EA0-43C6-BDF8-DDA87B8031C6}" = PIF DESIGNER2.1
"{7CDA2B02-E0A4-4EB5-8533-050D535BA43A}" = Media Converter for Philips
"{7F14F68C-17FA-4F88-B3FD-7F449C1EBF32}" = EPSON Web-To-Page
"{80A97464-A741-44B0-8AD6-0C16B1FEF7F6}" = Norton Security Scan
"{81AB1374-098A-43CB-BE57-31CEB5EB1031}" = Nero 7 Essentials
"{83467AF1-C7D8-4138-0095-AB308887A9FB}" = NBA LIVE 2004
"{87F6C83D-F949-4d14-B5CB-DC8C75F8932D}" = Die Sims™ 2 Freizeit-Spaß
"{888DD888-82BE-4D85-BCB2-2E042CD3E844}" = Tom Clancy's Splinter Cell Chaos Theory
"{88EB38EF-4D2C-436D-ABD3-56B232674062}" = ICQ7
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A6AD979-8170-49ED-8529-14174317B281}" = SA60xx Device Manager
"{8FDC1610-3FB5-4EF2-A0D0-CEDC3A525A25}" = DIE SIEDLER - Das Erbe der Könige
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{91120407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
"{94389919-B0AA-4882-9BE8-9F0B004ECA35}" = Acer Tour
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9527A496-5DF9-412A-ADC7-168BA5379CA6}" = Microsoft Flight Simulator X
"{97C0EA4A-1A0B-4C53-ACEB-49984DA79C90}" = Google Earth
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C48DCA4-00C2-449C-88D8-B1EE1692B44F}" = Safari
"{9DF0196F-B6B8-4C3A-8790-DE42AA530101}" = SPORE™
"{A174402A-2EE6-4B86-A930-7BC85A9933BD}" = Tom Clancy's Splinter Cell
"{A450831D-25F6-4F42-9662-D000B25E0D82}" = Acer PlayMovie
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A863F2EF-443D-429C-9DCD-9234BEB8142A}" = Scrapland
"{A919AABD-61FA-4E16-0000-26966C3D2481}" = GameJack 6
"{AA4BF92B-2AAF-11DA-9D78-000129760D75}" = Acer HomeMedia
"{AB6097D9-D722-4987-BD9E-A076E2848EE2}" = Acer Empowering Technology
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.4 - Deutsch
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AEBBFC67-7A03-4DF3-9E71-BA5C9EB4FBEF}" = MobileMe Control Panel
"{AEEAE013-92F1-4515-B278-139F1A692A36}" = Acer eDataSecurity Management
"{B145EC69-66F5-11D8-9D75-000129760D75}" = Acer DVDivine
"{B246C325-1C49-4572-8665-7691EFE1D06B}" = MGI VideoWave 4
"{BC4CA8FA-41D2-4B81-8680-E9B7573D6500}" = PlayStation(R)Network Downloader
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = Die Sims™ 3
"{C06A7DAC-1708-417C-B694-28C84DFE2DF9}" = The Movies(TM) Stunts & Spezialeffekte
"{C07F8D75-7A8D-400E-A8F9-A3F396B49BB1}" = SPORE™ Süß & Schrecklich Ergänzungs-Pack
"{C7340571-7773-4A8C-9EBC-4E4243B38C76}" = Microsoft XML Parser
"{C9DC3EE4-7A92-F473-510D-48A5EAD52845}" = ATI Catalyst Install Manager
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCA1EEA3-555E-4D05-AC46-4B49C6C5D887}" = Apple Mobile Device Support
"{CCD90636-D97D-4130-A44A-3AD4E63B9220}" = OpenOffice.org 2.4
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe  1.4.142.1
"{CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}" = getPlus(R) for Adobe
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D462BF9E-0C35-4705-BF9B-3DF9F3816643}" = Acer ePerformance Management
"{D92F1880-822A-41CA-0090-451FBB89BF4C}" = FIFA Fussball-Weltmeisterschaft 2006 (TM)
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}" = LiveUpdate Notice (Symantec Corporation)
"{DF6F459C-8B89-4F88-B63F-A2E136BB6B79}" = SweetIM for Messenger 2.8
"{DFEF49D9-FC95-4301-99B9-2FB91C6ABA06}" = Die Sims™ 2 Vier Jahreszeiten
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E37AC1FF-03EE-4AE3-0001-E55B0BCCABE0}" = MyTube BigPack 3 CHIP-Edition
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{EBAE381B-60A6-4863-AA9F-FCAB755BC9E5}" = ScanToWeb
"{EFBDC2B0-FAA8-4B78-8DE1-AEBE7958FA37}" = Acer Arcade Live Main Page
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F0E2B312-D7FD-4349-A9B6-E90B36DB1BD0}" = Paint.NET v3.5.5
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F38ADCA4-AF7C-4C73-9021-6F1EA15D15EA}" = Pinnacle TVCenter Pro
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F6EFFB76-4A07-11DA-9D78-000129760D75}" = Acer DV Magician
"{F722E488-A5B5-47ff-AA9B-4DE6CE7914CA}" = Windows 7 Upgrade Advisor
"{F7529650-B9DB-481B-0089-A2AC3C2821C1}" = Die Sims 2: Nightlife
"{F79A208D-D929-11D9-9D77-000129760D75}" = Acer VideoMagician
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{FA54AFB1-5745-4389-B8C1-9F7509672ED1}" = iPhone-Konfigurationsprogramm
"{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"82A44D22-9452-49FB-00FB-CEC7DCAF7E23" = EA SPORTS online 2004
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Acrobat 5.0" = Adobe Acrobat 5.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player
"Alien Arena 2008_is1" = Alien Arena 2008 7.21
"All Out Race" = All Out Race
"Ashampoo ClipFisher_is1" = Ashampoo ClipFisher1.21
"Ashampoo Cover Studio 2009_is1" = Ashampoo Cover Studio 2009
"AsUninst.exe" = Anvil Studio
"ATI Uninstaller" = ATI Uninstaller
"AutoGK" = Auto Gordian Knot 2.55
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"AviSynth" = AviSynth 2.5
"Beneton Movie GIF_is1" = Beneton Movie GIF 1.1.2
"Blender" = Blender (remove only)
"CAM-IN SUITE III" = CAM-IN SUITE III
"CCleaner" = CCleaner
"Cities of Earth 3D Screensaver_is1" = Cities of Earth 3D Screensaver v. 2.1
"City Life" = City Life
"DivX Setup.divx.com" = DivX-Setup
"dlanconf" = devolo dLAN-Konfigurationsassistent
"doPDF 6  printer_is1" = doPDF 6.3  printer
"dslmon" = devolo Informer
"dtvlexikon2006_is1" = dtv-Lexikon 1.0
"easyclean" = devolo EasyClean
"easyshare" = devolo EasyShare
"Einsteiger-Sprachkurs Spanisch" = Einsteiger-Sprachkurs Spanisch
"EPSON Printer and Utilities" = EPSON-Drucker-Software
"ESCX3600 Referenzhandbuch" = ESCX3600 Referenzhandbuch
"ESCX3600 Softwarehandbuch" = ESCX3600 Softwarehandbuch
"ESET Online Scanner" = ESET Online Scanner v3
"Fiesta Online" = Fiesta Online 1.01.000
"Firebird SQL Server D" = Firebird SQL Server - MAGIX Edition
"FLV Player" = FLV Player 2.0, build 24
"FontCreator6_is1" = High-Logic FontCreator 6.0
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.2
"Free Fire Screensaver" = Free Fire Screensaver
"Free Studio_is1" = Free Studio version 4.8
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.2
"Freedom Force vs The 3rd Reich" = Freedom Force vs The 3rd Reich (remove only)
"Google Updater" = Google Updater
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"InstallShield_{0556F885-2415-4666-B53E-33727E46AEA1}" = The Movies(TM) Stunts & Spezialeffekte
"InstallShield_{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"InstallShield_{9527A496-5DF9-412A-ADC7-168BA5379CA6}" = Microsoft Flight Simulator X
"LiveUpdate" = LiveUpdate 3.2 (Symantec Corporation)
"MAGIX 3D Maker D" = MAGIX 3D Maker (embeded)
"MAGIX Foto Manager 2006 D" = MAGIX Foto Manager 2006 (D)
"MAGIX Foto Manager 8 D" = MAGIX Foto Manager 8 6.0.1.457 (D)
"MAGIX Fotobuch" = MAGIX Fotobuch 3.6
"MAGIX Music Maker 2007 D" = MAGIX Music Maker 2007 (D)
"MAGIX Music Maker Basic Edition UK" = MAGIX Music Maker Basic Edition 12.1.0.3 (UK)
"MAGIX Music Maker for MySpace D" = MAGIX Music Maker for MySpace 15.0.1.8 (D)
"MAGIX Music Maker Rock Edition D" = MAGIX Music Maker Rock Edition 4.0.0.13 (D)
"MAGIX Music Manager 2006 D" = MAGIX Music Manager 2006 (D)
"MAGIX Online Druck Service D" = MAGIX Online Druck Service 3.4.3.0 (D)
"MAGIX Screenshare D" = MAGIX Screenshare 4.3.6.1987 (D)
"MAGIX Video deluxe 15 Plus D" = MAGIX Video deluxe 15 Plus 8.0.0.62 (D)
"MAGIX Xtreme Foto Designer 6 D" = MAGIX Xtreme Foto Designer 6 6.0.25.0 (D)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"ManyCam" = ManyCam 2.4 (remove only)
"maxdome - Online Videothek_is1" = maxdome - Online Videothek Version 3.1.0
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Miro" = Miro
"Mozilla Firefox (3.6.10)" = Mozilla Firefox (3.6.10)
"Mozilla Thunderbird (2.0.0.16)" = Mozilla Thunderbird (2.0.0.16)
"Mufin MusicFinder Base D" = Mufin MusicFinder Base 1.0.1.229 (D)
"myGamersCam" = myGamersCam 1.0
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"Pen Tablet Driver" = Stifttablett
"PhotoScape" = PhotoScape
"PSP Video 9" = PSP Video 9 2.25
"PunkBusterSvc" = PunkBuster Services
"RalliSport Challenge 1.0" = Microsoft RalliSport Challenge
"RarZilla Free Unrar" = RarZilla Free Unrar
"Recover My Files_is1" = Recover My Files
"Recuva" = Recuva (remove only)
"Schmaili_is1" = Schmaili 9.0
"Scribus 1.3.5" = Scribus 1.3.5.1
"SimPE_is1" = SimPE 0.58b (alpha)
"SUPER ©" = SUPER © Version 2010.bld.37 (Jan 2, 2010)
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"TmNationsForever_is1" = TmNationsForever
"Tomb Raider: Legend" = Tomb Raider: Legend 1.2
"Tunatic" = Tunatic
"Uninstall_is1" = Uninstall 1.0.0.1
"V2210" = DigitalCam Pro
"VitualDub" = VitualDub
"VLC media player" = VideoLAN VLC media player 0.8.6f
"VobSub" = VobSub v2.23 (Remove Only)
"VQ2210" = DigitalCam Pro
"Web_3.0.3813.0" = Microsoft Expression Web 3
"webcam 7" = webcam 7
"WinGimp-2.0_is1" = GIMP 2.6.7
"WinLiveSuite_Wave3" = Windows Live Essentials
"XviD MPEG4 Video Codec" = XviD MPEG4 Video Codec (remove only)
"Zattoo" = Zattoo 3.1.1 Beta
"Zattoo4" = Zattoo4 4.0.5
"ZDFmediathek_is1" = ZDFmediathek Version 1.4.0
"ZoneAlarm" = ZoneAlarm
"Zoo Tycoon 2" = Zoo Tycoon 2
"Zulu" = Zulu DJ Software
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{8DC910CD-8EE3-4ffc-A4EB-9B02701059C4}" = Battlefield Heroes
"Move Media Player" = Move Media Player
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 05.10.2010 10:55:23 | Computer Name = Haukes-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung WINWORD.EXE, Version 11.0.8326.0, Zeitstempel
 0x4c1c23b8, fehlerhaftes Modul wininet.dll, Version 7.0.6002.18278, Zeitstempel
 0x4c2a15c0, Ausnahmecode 0xc0000005, Fehleroffset 0x00091838,  Prozess-ID 0x11e8,
 Anwendungsstartzeit 01cb649d4f2429f9.
 
Error - 05.10.2010 10:55:53 | Computer Name = Haukes-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung WINWORD.EXE, Version 11.0.8326.0, Zeitstempel
 0x4c1c23b8, fehlerhaftes Modul wininet.dll, Version 7.0.6002.18278, Zeitstempel
 0x4c2a15c0, Ausnahmecode 0xc0000005, Fehleroffset 0x00091838,  Prozess-ID 0x108c,
 Anwendungsstartzeit 01cb649d6081a8d9.
 
Error - 06.10.2010 02:39:30 | Computer Name = Haukes-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 06.10.2010 02:39:30 | Computer Name = Haukes-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 18211899
 
Error - 06.10.2010 02:39:30 | Computer Name = Haukes-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 18211899
 
Error - 06.10.2010 07:29:36 | Computer Name = Haukes-PC | Source = Bonjour Service | ID = 100
Description = 388: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
 vom Remotehost geschlossen.)
 
Error - 06.10.2010 07:29:36 | Computer Name = Haukes-PC | Source = Bonjour Service | ID = 100
Description = 396: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
 vom Remotehost geschlossen.)
 
Error - 06.10.2010 07:29:36 | Computer Name = Haukes-PC | Source = Bonjour Service | ID = 100
Description = 400: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
 vom Remotehost geschlossen.)
 
Error - 06.10.2010 07:29:36 | Computer Name = Haukes-PC | Source = Bonjour Service | ID = 100
Description = 404: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
 vom Remotehost geschlossen.)
 
Error - 06.10.2010 07:29:36 | Computer Name = Haukes-PC | Source = Bonjour Service | ID = 100
Description = 408: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
 vom Remotehost geschlossen.)
 
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >

Swisstreasure 06.10.2010 17:36
Logfile ist sauber :daumenhoc

Hier noch die letzten paar Schritte zur Säuberung Deines Rechners.

Schritt 1

Systemwiederherstellungpunkte leeren

Windows +E Taste drücken --> Rechtsklick über Laufwerk C --> Eigenschaften --> Bereinigen --> weitere Optionen --> Systemwiederherstellung und Schattenkopien bereinigen.

Schritt 2

Tool CleanUp

Starte bitte die OTL.exe.
Klicke nun auf den Bereinigung Button. Dies wird die meisten Tools und Logfiles entfernen.
Sollte denoch etwas bestehen bleiben, bitte manuell entfernen sowie den Papierkorb leeren.


Schritt 3

Automatische Updates

Sehen wir nach ob die Updates für Windows sich automatisch downloaden. Das ist der beste Weg um all die Sicherheits- Patches und Fixes zu erhalten.

Windows + R Taste drücken. Kopiere nun folgenden Text in die Kommandozeile

RunDll32.exe shell32.dll,Control_RunDLL wscui.cpl

und klicke auf OK.
Stelle sicher das die automatischen Updates aktiviert sind.


Schritt 4

Um Dich für die Zukunft vor weiteren Infizierungen zu schützen empfehle ich Dir noch ein paar Programme.
  • SpywareBlaster
    Ein Tutorial zur Verwendung findest Du Hier

  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
    Hinweis: MBAM ersetzt keine Anti- Viren- Software.

  • Temp File Cleaner
    TFC ist ein wirklich starkes Tool zum entfernen von Temp Dateien vom IE und WIndows, leert den Papierkorb und noch viel mehr.
    Ausserdem hilft es Deinen Computer zu beschleunigen.
    Du kannst Dir TFC ( by OldTimer ) hier downloaden.

  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.

  • Halte Dein System aktuell
    Ich kann gar nicht oft genug betonen, wie wichtig es ist, dass der PC auf dem aktuellsten Stand der Dinge ist.
    Es werden oft genug Sicherheitslücken in Windows eigenen Anwendungen gefunden. Diese "Löcher" gehören entfernt, weil Angreifer diese womöglich nutzen um unauthorisiert auf Dein System zu zugreifen.
    Jeden zweiten Dienstag im Monat ist Update Tag. Besuche bitte dazu die Microsoft Update Seite.

  • Halte Deine Software aktuell
    Der einfachste Weg dafür ist der Secunia Online Software.


Schritt 5

Tipps für sicheres Surfen

Das sind meine Vorschläge.
Verwende einen alternativen Browser statt den IE.
Ich empfehle Mozilla Firefox.

Für Firefox gibt es verschiedenste AddOns um sicher durch das WWW zu kommen.
  • NoScript
    Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.

  • AdblockPlus
    Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
    Es spart ausserdem Downloadkapazität.

  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Gar 06.10.2010 22:17
Vielen Dank für die Hilfe!!! :)
Bis jetzt gab es auch noch keine Meldung mehr, und mein PC läuft so weit wieder einwandfrei!
Hoffe mal, dass das das letzte mal war, dass ich hier Hilfe brauchte, werde euch aber auf jeden fall weiterempfehlen.

Werde jetzt erstmal alle Aktualisierungen machen.

Tschüss!


Alle Zeitangaben in WEZ +1. Es ist jetzt 12:57 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131