D2D Recovery ausreichend um Bank - Trojaner zu beseitigen?

Elli2808 · 12.10.2011, 09:04

Hallo

also ich habe mir leider einen Trojaner eingefangen, der auf mein Konto via Online Banking zugreifen wollte. Nun habe ich bereits im Internet recherchiert und bin zu dem Schluss gekommen das ich Vista neu aufsetzten sollte um sicher zu gehen, dass ich ihn auch wirklich los bin. Von normalem Suchsystem ist er nicht gefunden worden (Avira).
Habe GMER durchlaufen lassen, der hat sehr viele infizierte Prozesse gefunden, aber nicht den Trojaner selbst.
Nun meine Hauptfrage - wenn ich Windows Vista über die Recovery Partition auf meinem Laptop zurücksetzte, ist das ausreichend um den Trojaner loszuwerden? Soweit ich das verstanden habe, setzt das Recovery mein System ja nur auf den Ausgangszustand zurück oder?

Vielen Dank für jede Hilfe.

markusg · 12.10.2011, 09:30

hi, ich möchte mir nur mal nen kurzen überblick über das system verschaffen, da du ja sicher daten sichern willst wie fotos etc, sollte da kein fehler gemacht werden.
danach berate ich dich gern weiter, wie das system neu aufzusetzen und abzusichern ist, falls du das möchtest.

otl:
Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden)

Doppelklick auf die
OTL.exe

Vista und Win7 User mit Rechtsklick "als Administrator starten"
Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal
Output
Unter Extra Registry, wähle bitte Use SafeList
Klicke nun auf Run Scan
links oben
Wenn der Scan beendet wurde werden 2 Logfiles erstellt
Poste die Logfiles hier in den Thread.

Elli2808 · 12.10.2011, 14:06

Erstmal vielen Dank für die schnelle Antwort.

Meine Daten, wie Bilder etc. hab ich bereits auf einer externen Festplatte gesichert, bin jetz nur noch dabei meine Programme soweit es möglich ist, zu sichern.

Ich habe den Scan durchlaufen lassen, OTL Logfiles wie folgt:
OTL EXTRAS Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 12.10.2011 14:07:23 - Run 2
OTL by OldTimer - Version 3.2.29.1     Folder = D:\Downloads
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19088)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,50 Gb Total Physical Memory | 2,36 Gb Available Physical Memory | 67,55% Memory free
7,23 Gb Paging File | 5,98 Gb Available in Paging File | 82,70% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 43,95 Gb Total Space | 3,32 Gb Free Space | 7,55% Space Free | Partition Type: NTFS
Drive D: | 246,33 Gb Total Space | 42,14 Gb Free Space | 17,11% Space Free | Partition Type: NTFS
 
Computer Name: ELLI-PC | User Name: Elli | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L"
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UacDisableNotify" = 0
"InternetSettingsDisableNotify" = 0
"AutoUpdateDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{351C1796-8713-4A70-9D13-082595581FA7}" = lport=37674 | protocol=6 | dir=in | name=oovoo tcp port 37674 | 
"{4CDA7F2A-CC44-45CF-979D-DCD000F90DF9}" = lport=443 | protocol=6 | dir=in | name=oovoo tcp port 443 | 
"{5F84055C-4DCA-42DF-87E4-31746831BF9E}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{71683D54-4150-426B-BE1B-795A297BCF44}" = lport=37675 | protocol=17 | dir=in | name=oovoo udp port 37675 | 
"{8BDFB017-EB74-45F2-9CE5-44EBF3CEF47C}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | 
"{8CA4E821-B8B5-4FE4-B7DA-D9A5CACD61E5}" = lport=443 | protocol=17 | dir=in | name=oovoo udp port 443 | 
"{B036CA5C-0B64-4A63-A2BE-BFB31BB2811B}" = lport=37674 | protocol=17 | dir=in | name=oovoo udp port 37674 | 
"{C0416975-0DA3-4A03-B294-3EDBF474189D}" = lport=2869 | protocol=6 | dir=in | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02B69561-448B-4FD3-B7D2-7B5FD197CE9C}" = protocol=17 | dir=in | app=c:\program files\firaxis games\sid meier's civilization 4\civilization4.exe | 
"{03FDEAA7-86DA-46E7-A0A0-87D76A3FABD0}" = protocol=6 | dir=in | app=d:\program files\firaxis\firaxis games\sid meier's civilization iv colonization\colonization.exe | 
"{079DFBA2-6CD6-4001-BBE6-FC279140A84E}" = protocol=6 | dir=in | app=d:\program files\firaxis\firaxis games\sid meier's civilization 4\civilization4.exe | 
"{0E960ACC-7FD5-477A-8708-637D3C963C46}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{1537E996-9B6D-47D5-BC65-B8377026C734}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe | 
"{1A66279F-8A9E-4B9F-BE29-1FBA7C1FC3ED}" = protocol=6 | dir=in | app=d:\program files\firaxis\firaxis games\sid meier's civilization 4\beyond the sword\civ4beyondsword_pitboss.exe | 
"{1B042189-AE85-423D-9AF7-5B5EF2007202}" = protocol=17 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsasvr.exe | 
"{20F713E9-FC66-4D4E-837F-E9C2658AC5B8}" = protocol=17 | dir=in | app=d:\program files\firaxis\firaxis games\sid meier's civilization 4\civilization4.exe | 
"{223DCD4E-35A9-4A33-8345-7DAF574B5C75}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{2261E47A-1AFE-4CB1-8B78-D3023F6F075E}" = protocol=17 | dir=in | app=d:\program files\firaxis\firaxis games\sid meier's civilization 4\beyond the sword\civ4beyondsword_pitboss.exe | 
"{2722E283-F553-45F7-B7C9-B485A5C17ACC}" = protocol=17 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsvsvr.exe | 
"{3C6D048D-1E8C-4F80-88CB-5BB73FBF1FDB}" = protocol=6 | dir=in | app=c:\program files\firaxis games\sid meier's civilization 4\beyond the sword\civ4beyondsword_pitboss.exe | 
"{3F4276BF-7626-4DDD-AB55-DF0A9E0B66F3}" = protocol=6 | dir=in | app=c:\program files\firaxis games\sid meier's civilization 4\beyond the sword\civ4beyondsword.exe | 
"{40FC2AC8-490B-48DF-B276-54647AE499AF}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
"{48E5E3F6-9161-42ED-BBED-76EEEB599074}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version5\teamviewer_service.exe | 
"{4EC17E2C-2DD5-45A6-97DF-3AB9F153EFF5}" = protocol=17 | dir=in | app=c:\program files\firaxis games\sid meier's civilization 4\beyond the sword\civ4beyondsword_pitboss.exe | 
"{52DECC77-F6EF-4298-8E26-9A1772B07CBC}" = protocol=6 | dir=in | app=c:\program files\firaxis games\sid meier's civilization 4\civilization4.exe | 
"{543EFC9F-7EB9-45DF-BA32-3F59FCC55330}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version5\teamviewer.exe | 
"{5C2AA84D-BA6E-4E71-99B9-D161932B68EC}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{5D983795-DDA8-44B3-8D20-1BD8C1D77FCD}" = protocol=6 | dir=in | app=c:\program files\avira\antivir desktop\avcenter.exe | 
"{61278C35-EF7D-4C1E-B6A2-FCE5C0EDBAC9}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version5\teamviewer.exe | 
"{635D2CB2-8A62-44E4-9D81-492DB9CAB689}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
"{71C81B3F-A2A7-49BF-A52A-0C4DF37C6898}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version5\teamviewer_service.exe | 
"{72CE9B84-F9D7-4613-A6DE-A11234B81640}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe | 
"{77456A14-1A2B-4470-AA6E-711DF010DEC9}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{7FFF6FF6-CD39-4464-BFC1-46F637116CA9}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{89176B4F-78DF-4512-A3A4-245BE1FEFE0E}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{93EC63A0-4A62-414F-B002-9BCE873E2BB3}" = dir=in | app=c:\program files\cyberlink\powerdirector express\pdx.exe | 
"{AC365C79-4F40-4E06-9559-AEA53644D985}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe | 
"{ACF20239-93AA-4282-BC94-A0187471B312}" = protocol=17 | dir=in | app=d:\program files\firaxis\firaxis games\sid meier's civilization iv colonization\colonization.exe | 
"{B3F35912-A48A-4DEF-AF4B-C8C9EB6233DE}" = protocol=17 | dir=in | app=d:\program files\civilization v\steam\steam.exe | 
"{B4728589-DD7A-4A67-863E-865A0A1F6FD2}" = protocol=17 | dir=in | app=c:\program files\avira\antivir desktop\avcenter.exe | 
"{B6A17AD2-28AF-4DC2-9E2C-5C831D8528C2}" = protocol=17 | dir=in | app=c:\program files\firaxis games\sid meier's civilization 4\beyond the sword\civ4beyondsword.exe | 
"{B75FA790-468C-4B05-A6A2-6AF8FB510D29}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{CE7D8548-7FAE-4A2B-B7DA-FE7FE799A913}" = protocol=6 | dir=in | app=d:\program files\civilization v\steam\steam.exe | 
"{CFE46ABE-A558-4282-905D-7174D9ACE36D}" = protocol=17 | dir=in | app=d:\program files\firaxis\firaxis games\sid meier's civilization 4\beyond the sword\civ4beyondsword.exe | 
"{D907E364-F350-4B27-8C30-1775D1151A37}" = protocol=6 | dir=in | app=d:\program files\firaxis\firaxis games\sid meier's civilization 4\beyond the sword\civ4beyondsword.exe | 
"{DBBB9013-EFB9-4550-9B76-58225E271726}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe | 
"{E36753E8-64C9-470C-B59E-1C16685BDFBA}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{F45C37A8-B25C-4C3C-BC11-992DF67F3DF0}" = protocol=6 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsvsvr.exe | 
"{F5CC5C23-2886-487D-913F-8556BFA8AAA1}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe | 
"{F838E0E1-55FA-4BD8-8D3B-28685F554A89}" = protocol=6 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsasvr.exe | 
"TCP Query User{341D3EFB-B8CD-4550-9EF8-CCCDA1C7ECBA}D:\games\motogp urt 3\motogp.exe" = protocol=6 | dir=in | app=d:\games\motogp urt 3\motogp.exe | 
"TCP Query User{3CA5A057-BF77-44F9-B09A-8F46D2D67625}D:\program files\age of empires ii\age of empires 2\empires2.exe" = protocol=6 | dir=in | app=d:\program files\age of empires ii\age of empires 2\empires2.exe | 
"TCP Query User{466DEFA7-C0B2-4CA9-8F9F-91757C9CAC03}C:\program files\oovoo\oovoo.exe" = protocol=6 | dir=in | app=c:\program files\oovoo\oovoo.exe | 
"TCP Query User{4A69A4D8-2C05-46D6-B9B3-68D7AA1FEF1D}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe | 
"TCP Query User{52BBBF54-E512-471F-9345-89C13D6F6959}C:\program files\thq\motogp urt 3\motogp.exe" = protocol=6 | dir=in | app=c:\program files\thq\motogp urt 3\motogp.exe | 
"TCP Query User{60CD3F3A-2E06-4775-905B-50FFA3F5A139}D:\program files\age of empires ii\age of empires 2\age2_x1.exe" = protocol=6 | dir=in | app=d:\program files\age of empires ii\age of empires 2\age2_x1.exe | 
"TCP Query User{A983DA42-CE75-45C1-AD2E-55411DF58139}C:\program files\tvants\tvants.exe" = protocol=6 | dir=in | app=c:\program files\tvants\tvants.exe | 
"TCP Query User{BBD720E8-DFD8-4892-952F-D9E337A28CDA}C:\program files\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe | 
"UDP Query User{0735D16C-9E5B-46EA-B3B9-C4180D57D04A}C:\program files\oovoo\oovoo.exe" = protocol=17 | dir=in | app=c:\program files\oovoo\oovoo.exe | 
"UDP Query User{2F722933-1D38-4122-BAC4-567293689CB2}D:\program files\age of empires ii\age of empires 2\empires2.exe" = protocol=17 | dir=in | app=d:\program files\age of empires ii\age of empires 2\empires2.exe | 
"UDP Query User{37409E9B-DFE1-4F97-BFD4-CFB25D028594}D:\program files\age of empires ii\age of empires 2\age2_x1.exe" = protocol=17 | dir=in | app=d:\program files\age of empires ii\age of empires 2\age2_x1.exe | 
"UDP Query User{3BFEB365-3439-4E91-BF4D-2C59096A06C4}C:\program files\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe | 
"UDP Query User{5211669A-7784-49A6-94AA-398D6CD93359}D:\games\motogp urt 3\motogp.exe" = protocol=17 | dir=in | app=d:\games\motogp urt 3\motogp.exe | 
"UDP Query User{BC8CDAE9-DC2B-4AD4-B352-917995B781A0}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe | 
"UDP Query User{FB588F2F-A1AD-49A5-BC82-8681E6090367}C:\program files\thq\motogp urt 3\motogp.exe" = protocol=17 | dir=in | app=c:\program files\thq\motogp urt 3\motogp.exe | 
"UDP Query User{FE66513F-3BA7-4BE6-A1E6-D444939C0799}C:\program files\tvants\tvants.exe" = protocol=17 | dir=in | app=c:\program files\tvants\tvants.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01501EBA-EC35-4F9F-8889-3BE346E5DA13}" = MSXML4 Parser
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{07690F1C-04B1-4060-9691-6748ED1826B9}" = MSI Software Install
"{0CB9668D-F979-4F31-B8B8-67FE90F929F8}" = Bonjour
"{0D2E9DCB-9938-475E-B4DD-8851738852FF}" = AIO_Scan
"{14D4ED84-6A9A-45A0-96F6-1753768C3CB5}" = ESSPCD
"{1746EA69-DCB6-4408-B5A5-E75F55439CDF}" = Scan
"{179C56A4-F57F-4561-8BBF-F911D26EB435}" = WebReg
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1C01CA5C-82F9-4936-E3B4-51C94E5B05BB}" = CCC Help Italian
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{224AB0E8-53FC-3C03-8697-3480F5843F53}" = Catalyst Control Center Graphics Light
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20
"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Driver Installation Program
"{2892E1B7-E24D-4CCB-B8A7-B63D4B66F89F}" = BurnRecovery
"{2D03B6F8-DF36-4980-B7B6-5B93D5BA3A8F}" = essvatgt
"{2FFE93F0-BB72-4E52-8761-354D1AAA9387}" = Sony Ericsson PC Suite 6.007.00
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{32E4F0D2-C135-475E-A841-1D59A0D22989}" = Sid Meier's Civilization 4 - Beyond the Sword
"{342323C8-0C8B-A95A-66FD-75BAB09B7A14}" = ccc-utility
"{3A29CC30-8E1A-430C-8E5B-A52CA2F3F9DA}" = Die Gilde 2 Venedig Patch 3.5
"{3D9892BB-A751-4E48-ADC8-E4289956CE1D}" = QuickTime
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go 5.0
"{40C03514-89C3-41BA-0090-3B440256DB87}" = The Sims 2
"{41A3D48B-3AD5-1163-1A4C-E6B68FDA3D44}" = CCC Help Spanish
"{421357F2-B574-5D98-DE61-70AB2AD9DA0E}" = Catalyst Control Center Localization German
"{42938595-0D83-404D-9F73-F8177FDD531A}" = ESScore
"{4377F918-E6C9-4ECA-A7F5-754B310B7ED8}" = Sid Meier's Civilization 4
"{4537EA4B-F603-4181-89FB-2953FC695AB1}" = netbrdg
"{49F2B650-2D7B-4F59-B33D-346F63776BD3}" = DocProc
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CF3F2A3-AE07-A3BD-D3F7-3F6C32BB764C}" = Skins
"{5316DFC9-CE99-4458-9AB3-E8726EDE0210}" = skin0001
"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync
"{59F6A514-9813-47A3-948C-8A155460CC2A}" = RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01
"{5E6D6161-5509-4f55-9372-1E01792F843A}" = F300_Help
"{605A4E39-613C-4A12-B56F-DEFBE6757237}" = SHASTA
"{643EAE81-920C-4931-9F0B-4B343B225CA6}" = ESSBrwr
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{67D3F1A0-A1F2-49b7-B9EE-011277B170CD}" = HPProductAssistant
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7A7DC702-DEDE-42A8-8722-B3BA724D546F}" = Fax
"{7AB3A249-FB81-416B-917A-A2A10E74C503}" = iTunes
"{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}" = Windows Live Anmelde-Assistent
"{850C7BD3-9F3F-46AD-9396-E7985B38C55E}" = Windows Live Fotogalerie
"{85991ED2-010C-4930-96FA-52F43C2CE98A}" = Apple Mobile Device Support
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{8943CE61-53BD-475E-90E1-A580869E98A2}" = staticcr
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A502E38-29C9-49FA-BCFA-D727CA062589}" = ESSTOOLS
"{8C6027FD-53DC-446D-BB75-CACD7028A134}" = HP Update
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{8E92D746-CD9F-4B90-9668-42B74C14F765}" = ESSini
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0015-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0015-040C-0000-0000000FF1CE}" = Microsoft Office Access MUI (French) 2007
"{90120000-0015-040C-0000-0000000FF1CE}_PROHYBRIDR_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0015-0410-0000-0000000FF1CE}" = Microsoft Office Access MUI (Italian) 2007
"{90120000-0015-0410-0000-0000000FF1CE}_PROHYBRIDR_{71CCE0F1-A3B4-49C9-A328-1DABE845E0C4}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0015-0C0A-0000-0000000FF1CE}" = Microsoft Office Access MUI (Spanish) 2007
"{90120000-0015-0C0A-0000-0000000FF1CE}_PROHYBRIDR_{91A7F72A-3273-4C1E-8BE0-BC9DD0D9345C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-040C-0000-0000000FF1CE}" = Microsoft Office Excel MUI (French) 2007
"{90120000-0016-040C-0000-0000000FF1CE}_PROHYBRIDR_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0410-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Italian) 2007
"{90120000-0016-0410-0000-0000000FF1CE}_PROHYBRIDR_{71CCE0F1-A3B4-49C9-A328-1DABE845E0C4}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0C0A-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Spanish) 2007
"{90120000-0016-0C0A-0000-0000000FF1CE}_PROHYBRIDR_{91A7F72A-3273-4C1E-8BE0-BC9DD0D9345C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-040C-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (French) 2007
"{90120000-0018-040C-0000-0000000FF1CE}_PROHYBRIDR_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0410-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Italian) 2007
"{90120000-0018-0410-0000-0000000FF1CE}_PROHYBRIDR_{71CCE0F1-A3B4-49C9-A328-1DABE845E0C4}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0C0A-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Spanish) 2007
"{90120000-0018-0C0A-0000-0000000FF1CE}_PROHYBRIDR_{91A7F72A-3273-4C1E-8BE0-BC9DD0D9345C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-040C-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (French) 2007
"{90120000-0019-040C-0000-0000000FF1CE}_PROHYBRIDR_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0410-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Italian) 2007
"{90120000-0019-0410-0000-0000000FF1CE}_PROHYBRIDR_{71CCE0F1-A3B4-49C9-A328-1DABE845E0C4}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0C0A-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Spanish) 2007
"{90120000-0019-0C0A-0000-0000000FF1CE}_PROHYBRIDR_{91A7F72A-3273-4C1E-8BE0-BC9DD0D9345C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-040C-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (French) 2007
"{90120000-001A-040C-0000-0000000FF1CE}_PROHYBRIDR_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0410-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Italian) 2007
"{90120000-001A-0410-0000-0000000FF1CE}_PROHYBRIDR_{71CCE0F1-A3B4-49C9-A328-1DABE845E0C4}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0C0A-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Spanish) 2007
"{90120000-001A-0C0A-0000-0000000FF1CE}_PROHYBRIDR_{91A7F72A-3273-4C1E-8BE0-BC9DD0D9345C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-040C-0000-0000000FF1CE}" = Microsoft Office Word MUI (French) 2007
"{90120000-001B-040C-0000-0000000FF1CE}_PROHYBRIDR_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0410-0000-0000000FF1CE}" = Microsoft Office Word MUI (Italian) 2007
"{90120000-001B-0410-0000-0000000FF1CE}_PROHYBRIDR_{71CCE0F1-A3B4-49C9-A328-1DABE845E0C4}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0C0A-0000-0000000FF1CE}" = Microsoft Office Word MUI (Spanish) 2007
"{90120000-001B-0C0A-0000-0000000FF1CE}_PROHYBRIDR_{91A7F72A-3273-4C1E-8BE0-BC9DD0D9345C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0401-0000-0000000FF1CE}" = Microsoft Office Proof (Arabic) 2007
"{90120000-001F-0401-0000-0000000FF1CE}_PROHYBRIDR_{14809F99-C601-4D4A-9391-F1E8FAA964C5}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0403-0000-0000000FF1CE}" = Microsoft Office Proof (Catalan) 2007
"{90120000-001F-0403-0000-0000000FF1CE}_PROHYBRIDR_{4B47C31E-46B0-462B-BEE4-DC383B6A1F2A}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}_PROHYBRIDR_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}_PROHYBRIDR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}_PROHYBRIDR_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0413-0000-0000000FF1CE}" = Microsoft Office Proof (Dutch) 2007
"{90120000-001F-0413-0000-0000000FF1CE}_PROHYBRIDR_{D66D5A44-E480-4BA4-B4F2-C554F6B30EBB}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0416-0000-0000000FF1CE}" = Microsoft Office Proof (Portuguese (Brazil)) 2007
"{90120000-001F-0416-0000-0000000FF1CE}_PROHYBRIDR_{75EBE365-7FC5-4720-A7D3-804BF550D1BC}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-042D-0000-0000000FF1CE}" = Microsoft Office Proof (Basque) 2007
"{90120000-001F-0456-0000-0000000FF1CE}" = Microsoft Office Proof (Galician) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROHYBRIDR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-002C-040C-0000-0000000FF1CE}" = Microsoft Office Proofing (French) 2007
"{90120000-002C-0410-0000-0000000FF1CE}" = Microsoft Office Proofing (Italian) 2007
"{90120000-002C-0C0A-0000-0000000FF1CE}" = Microsoft Office Proofing (Spanish) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}_PROHYBRIDR_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_PROHYBRIDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-040C-0000-0000000FF1CE}" = Microsoft Office Shared MUI (French) 2007
"{90120000-006E-040C-0000-0000000FF1CE}_PROHYBRIDR_{B165D3C2-40AE-4D39-86F7-E5C87C4264C0}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0410-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Italian) 2007
"{90120000-006E-0410-0000-0000000FF1CE}_PROHYBRIDR_{0A75DA12-55CB-4DE5-8B6A-74D97847204E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0C0A-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Spanish) 2007
"{90120000-006E-0C0A-0000-0000000FF1CE}_PROHYBRIDR_{6113C11D-BACA-4D8E-8002-03C8D06FD5E6}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00B2-0409-0000-0000000FF1CE}" = Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_PROHYBRIDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{91517631-A9F3-4B7C-B482-43E0068FD55A}" = ESSgui
"{91E079B2-88D3-A140-334C-8CB7B97C55E6}" = ccc-core-static
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95120000-0122-0407-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{95D08F4E-DFC2-4ce3-ACB7-8C8E206217E9}" = MarketResearch
"{96B51C0B-D3BE-4DF3-959C-28B22C10CFBB}" = Vodafone Mobile Connect Lite
"{978C25EE-5777-46e4-8988-732C297CBDBD}" = Status
"{98766509-A0E1-3F1E-7E78-36EC5778576F}" = Catalyst Control Center Localization French
"{999D43F4-9709-4887-9B1A-83EBB15A8370}" = VPRINTOL
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B1FD9CE-0776-4f0b-A6F5-C6AB7B650CDF}" = Destinations
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D53C8E7-A4B6-1344-805F-D1752174A60B}" = Catalyst Control Center Graphics Full Existing
"{9FBAA1F1-1562-4A8A-A395-5479988AD064}" = Catalyst Control Center Localization Italian
"{A36CD345-625C-4d6c-B3E2-76E1248CB451}" = SolutionCenter
"{A3B7C670-4A1E-4EE2-950E-C875BC1965D0}" = Copy
"{A3BE3F1E-2472-4211-8735-E8239BE49D9F}" = Ulead Burn.Now 4.5
"{A7496F46-78AE-4DB2-BCF5-95F210FA6F96}" = Windows Live Movie Maker
"{A8CF5C37-8EC5-4C33-BB4A-87F468B77D45}" = Age of Empires III
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{ABD5D431-7FAA-A5B1-9EE0-3AC9930FEACC}" = Catalyst Control Center Graphics Previews Vista
"{AC76BA86-7AD7-1033-7B44-A83000000003}" = Adobe Reader 8.3.0
"{AE1FA02D-E6A4-4EA0-8E58-6483CAC016DD}" = ESSCDBK
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{AF7E85DC-317C-47F5-810E-B82EE093A612}" = Samsung New PC Studio USB Driver Installer
"{B162D0A6-9A1D-4B7C-91A5-88FB48113C45}" = OfotoXMI
"{B2D328BE-45AD-4D92-96F9-2151490A203E}" = Apple Application Support
"{B3FED300-806C-11E0-A0D0-B8AC6F97B88E}" = Google Earth
"{B4B44FE7-41FF-4DAD-8C0A-E406DDA72992}" = CCScore
"{B5DD0F28-0167-4F1E-A114-06AB8DC82D81}" = Die Gilde 2 Venedig
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Click to Call with Skype
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer
"{B90450DF-E781-46FD-B1F1-0C86DA40E443}" = PIF DESIGNER
"{BE77A81F-B315-4666-9BF3-AE70C0ADB057}" = BufferChm
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{C716522C-3731-4667-8579-40B098294500}" = Toolbox
"{C916D86C-AB76-49c7-B0E4-A946E0FD9BC2}" = HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba
"{CFBCE791-2D53-4FCE-B3FB-D6E01F4112E8}" = Sid Meier's Civilization 4
"{D1504C77-1B19-4AF0-8DEC-946666123B55}" = CrazyTalk Cam Suite
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D2CBA327-41C4-7B83-F9E0-30D95128A76C}" = Catalyst Control Center Localization Spanish
"{D2FB0471-03CC-81D4-C732-64F9C188B86B}" = CCC Help English
"{D32470A1-B10C-4059-BA53-CF0486F68EBC}" = Kodak EasyShare Software
"{D36DD326-7280-11D8-97C8-000129760CBE}" = PhotoNow!
"{D5A9B7C0-8751-11D8-9D75-000129760D75}" = MediaShow
"{DB02F716-6275-42E9-B8D2-83BA2BF5100B}" = SFR
"{DE895051-4980-8BC5-F1B7-4EEC10382C24}" = Catalyst Control Center Core Implementation
"{E06F04B9-45E6-4AC0-8083-85F7515F40F7}" = UnloadSupport
"{E09575B2-498D-4C8B-A9D2-623F78574F29}" = AIO_CDB_Software
"{E30BBC39-DD97-05C8-3977-B364481AE469}" = CCC Help German
"{E7112940-5F8E-4918-B9FE-251F2F8DC81F}" = AIO_CDB_ProductContext
"{EA37CE02-3E46-F65C-3373-B443D0E60845}" = CCC Help French
"{EB21A812-671B-4D08-B974-2A347F0D8F70}" = HP Photosmart Essential
"{ED9C5D25-55DF-48D8-9328-2AC0D75DE5D8}" = System Control Manager
"{EDE721EC-870A-11D8-9D75-000129760D75}" = PowerDirector Express
"{EF36A836-BF89-4A4F-B079-057B0C68C1E0}" = Sid Meier's Civilization IV Colonization
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F1568757-E564-4cb5-8980-9333119A4384}" = F300
"{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer
"{F4A2E7CC-60CA-4AFA-B67F-AD5E58173C3F}" = SKINXSDK
"{F6AC5364-2FB7-437a-811A-D645F22AA6AC}" = F300Trb
"{F7529650-B9DB-481B-0089-A2AC3C2821C1}" = Die Sims 2: Nightlife
"{F9593CFB-D836-49BC-BFF1-0E669A411D9F}" = WIRELESS
"{FCDB1C92-03C6-4C76-8625-371224256091}" = ESSPDock
"{FD4DB092-2343-D351-8A1F-807E397E05EC}" = ATI Catalyst Install Manager
"{FF075778-6E50-47ed-991D-3B07FD4E3250}" = TrayApp
"{FF17BCC9-A612-B804-F4CA-4426BC596FBC}" = Catalyst Control Center Graphics Full New
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Age of Mythology 1.0" = Age of Mythology
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Avenue Flo1.0.1.276" = Avenue Flo
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"AVMFBox" = AVM FRITZ!Box Dokumentation
"CCleaner" = CCleaner
"CdCoverCreator" = CdCoverCreator 2.5.3
"Digital Editions" = Adobe Digital Editions
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Filzip 3.0.6.93_is1" = Filzip 3.06
"Google Chrome" = Google Chrome
"HP Imaging Device Functions" = HP Imaging Device Functions 8.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center 8.0
"HPExtendedCapabilities" = HP Customer Participation Program 8.0
"HPOCR" = HP OCR Software 8.0
"InstallShield_{A3BE3F1E-2472-4211-8735-E8239BE49D9F}" = Ulead Burn.Now 4.5 SE
"InstallShield_{A8CF5C37-8EC5-4C33-BB4A-87F468B77D45}" = Age of Empires III
"InstallShield_{AF7E85DC-317C-47F5-810E-B82EE093A612}" = Samsung New PC Studio USB Driver Installer
"InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 7.0.1 (x86 de)" = Mozilla Firefox 7.0.1 (x86 de)
"MPE" = MyPhoneExplorer
"OpenAL" = OpenAL
"PROHYBRIDR" = 2007 Microsoft Office system
"RealPlayer 6.0" = RealPlayer
"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"SecureW2 EAP Suite" = SecureW2 EAP Suite 1.1.3 for Windows
"TeamViewer 5" = TeamViewer 5
"VLC media player" = VLC media player 1.1.10
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
"World Riddles Animals 1.00" = World Riddles Animals 1.00
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 12.10.2011 02:48:47 | Computer Name = Elli-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 12.10.2011 02:49:52 | Computer Name = Elli-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 12.10.2011 04:08:45 | Computer Name = Elli-PC | Source = EventSystem | ID = 4621
Description = 
 
Error - 12.10.2011 07:46:17 | Computer Name = Elli-PC | Source = VMCService | ID = 0
Description = conflictManagerTypeValue
 
Error - 12.10.2011 07:46:36 | Computer Name = Elli-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 12.10.2011 07:46:36 | Computer Name = Elli-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 12.10.2011 07:47:35 | Computer Name = Elli-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 12.10.2011 07:52:48 | Computer Name = Elli-PC | Source = Application Hang | ID = 1002
Description = Programm OTL.exe, Version 3.2.29.1 arbeitet nicht mehr mit Windows
 zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
 für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
 zu suchen.  Prozess-ID: 1048  Anfangszeit: 01cc88d508310510  Zeitpunkt der Beendigung:
 4
 
Error - 12.10.2011 08:04:25 | Computer Name = Elli-PC | Source = Application Hang | ID = 1002
Description = Programm OTL.exe, Version 3.2.29.1 arbeitet nicht mehr mit Windows
 zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
 für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
 zu suchen.  Prozess-ID: cc  Anfangszeit: 01cc88d57daa1c00  Zeitpunkt der Beendigung: 
5
 
Error - 12.10.2011 08:06:47 | Computer Name = Elli-PC | Source = Application Hang | ID = 1002
Description = Programm OTL.exe, Version 3.2.29.1 arbeitet nicht mehr mit Windows
 zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
 für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
 zu suchen.  Prozess-ID: ba4  Anfangszeit: 01cc88d72dad33c0  Zeitpunkt der Beendigung:
 17
 
[ OSession Events ]
Error - 08.02.2010 09:18:01 | Computer Name = Elli-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application 
Version: 12.0.6500.5000, Microsoft Office Version: 12.0.6215.1000. This session 
lasted 9358 seconds with 1740 seconds of active time.  This session ended with a
 crash.
 
Error - 08.02.2010 11:39:28 | Computer Name = Elli-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application 
Version: 12.0.6500.5000, Microsoft Office Version: 12.0.6215.1000. This session 
lasted 8391 seconds with 1620 seconds of active time.  This session ended with a
 crash.
 
[ System Events ]
Error - 11.10.2011 15:59:31 | Computer Name = Elli-PC | Source = HTTP | ID = 15016
Description = 
 
Error - 11.10.2011 16:00:24 | Computer Name = Elli-PC | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description = 
 
Error - 11.10.2011 16:14:28 | Computer Name = Elli-PC | Source = DCOM | ID = 10010
Description = 
 
Error - 11.10.2011 16:14:39 | Computer Name = Elli-PC | Source = Microsoft-Windows-LanguagePackSetup | ID = 1000
Description = 
 
Error - 11.10.2011 16:14:39 | Computer Name = Elli-PC | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description = 
 
Error - 12.10.2011 02:48:20 | Computer Name = Elli-PC | Source = HTTP | ID = 15016
Description = 
 
Error - 12.10.2011 02:49:13 | Computer Name = Elli-PC | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description = 
 
Error - 12.10.2011 04:08:44 | Computer Name = Elli-PC | Source = DCOM | ID = 10010
Description = 
 
Error - 12.10.2011 07:46:02 | Computer Name = Elli-PC | Source = HTTP | ID = 15016
Description = 
 
Error - 12.10.2011 07:47:46 | Computer Name = Elli-PC | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description = 
 
 
< End of report >

--- --- ---

Elli2808 · 12.10.2011, 14:21

OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 12.10.2011 14:07:23 - Run 2
OTL by OldTimer - Version 3.2.29.1     Folder = D:\Downloads
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19088)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,50 Gb Total Physical Memory | 2,36 Gb Available Physical Memory | 67,55% Memory free
7,23 Gb Paging File | 5,98 Gb Available in Paging File | 82,70% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 43,95 Gb Total Space | 3,32 Gb Free Space | 7,55% Space Free | Partition Type: NTFS
Drive D: | 246,33 Gb Total Space | 42,14 Gb Free Space | 17,11% Space Free | Partition Type: NTFS
 
Computer Name: ELLI-PC | User Name: Elli | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - D:\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe (Vodafone)
PRC - C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe ()
PRC - C:\Windows\System32\FsUsbExService.Exe (Teruten)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Program Files\System Control Manager\MGSysCtrl.exe (MSI)
PRC - C:\Program Files\System Control Manager\edd.exe ()
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
PRC - C:\Windows\System32\agrsmsvc.exe (Agere Systems)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\0a1195c6b5fab213527364c9e8b26ef0\System.Web.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\1ba19f8efcff8ad7f972aa38ab9a15f5\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\cfb60f99da570cc494e27e0e8ee747e2\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\381fb23cb39e1a61e13b8770eb9800ba\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\f1aa2385c0109f3059e0e6ba8b58ff68\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9dff86a62a525ec8dc827fe9f50298b7\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\0309936a8e1672d39b9cf14463ce69f9\mscorlib.ni.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Wizard\2.0.2861.39845__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Wizard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.2861.40070__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Wizard\2.0.2861.40046__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Wizard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.2861.39803__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.2861.39858__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.2861.40038__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.2861.40004__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.2861.39837__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.2861.39955__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.2861.39824__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Dashboard\2.0.2861.40012__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Dashboard\2.0.2861.40069__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.2861.40076__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Grid.HydraVision.Dashboard\2.0.2861.40095__90ba9c70f846762e\CLI.Aspect.Grid.HydraVision.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.2861.40018__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.2861.39817__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Runtime\2.0.2861.40011__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime\2.0.2861.40069__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.HydraVision.Runtime\2.0.2861.40095__90ba9c70f846762e\CLI.Caste.HydraVision.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.HydraVision.Shared\2.0.2861.40094__90ba9c70f846762e\CLI.Caste.HydraVision.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.HydraVision.Dashboard\2.0.2861.40094__90ba9c70f846762e\CLI.Caste.HydraVision.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Dashboard\2.0.2861.40040__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Dashboard\2.0.2861.39963__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Dashboard\2.0.2861.39872__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Dashboard\2.0.2861.39956__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Dashboard\2.0.2861.39825__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Wizard\2.0.2861.40030__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Wizard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Dashboard\2.0.2861.39997__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Dashboard\2.0.2861.39949__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Wizard\2.0.2861.39878__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Wizard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.2861.39865__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Dashboard\2.0.2861.39977__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Runtime\2.0.2861.39963__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Runtime\2.0.2861.39955__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Runtime\2.0.2861.39878__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Runtime\2.0.2861.39962__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Runtime\2.0.2861.39977__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Runtime\2.0.2861.39996__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.2820.26388__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.2820.26372__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Foundation\2.0.2820.26370__90ba9c70f846762e\CLI.Foundation.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.2820.26387__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Shared\2.0.2820.26385__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.2820.26396__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\LOG.Foundation\2.0.2820.26369__90ba9c70f846762e\LOG.Foundation.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.2820.26409__90ba9c70f846762e\CLI.Foundation.XManifest.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Shared\2.0.2820.26383__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.2820.26370__90ba9c70f846762e\NEWAEM.Foundation.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Shared\2.0.2820.26395__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Shared\2.0.2820.26386__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\DEM.OS.I0602\2.0.2820.26382__90ba9c70f846762e\DEM.OS.I0602.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.2820.26375__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.2820.26374__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.2820.26371__90ba9c70f846762e\CLI.Component.Client.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.2820.26383__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.2820.26371__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.2820.26371__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\MOM.Foundation\2.0.2820.26375__90ba9c70f846762e\MOM.Foundation.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\DEM.OS\2.0.2820.26381__90ba9c70f846762e\DEM.OS.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0706\2.0.2743.23304__90ba9c70f846762e\DEM.Graphics.I0706.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\DEM.Graphics\2.0.2820.26382__90ba9c70f846762e\DEM.Graphics.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.2820.26374__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.2820.26383__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.2820.26382__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.2820.26385__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AEM.Plugin.EEU.Shared\2.0.2820.26376__90ba9c70f846762e\AEM.Plugin.EEU.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.2820.26386__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Shared\2.0.2820.26385__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Shared\2.0.2820.26385__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.2820.26387__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.2861.40086__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.2820.26375__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Shared\2.0.2820.26382__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.2820.26377__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AEM.Foundation\2.0.2820.26370__90ba9c70f846762e\AEM.Foundation.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\ACE.Graphics.DisplaysManager.Shared\2.0.2573.17685__90ba9c70f846762e\ACE.Graphics.DisplaysManager.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\APM.Foundation\2.0.2820.26375__90ba9c70f846762e\APM.Foundation.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AEM.Server.Shared\2.0.2820.26372__90ba9c70f846762e\AEM.Server.Shared.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\LOCALIZATION.Foundation.Implementation\2.0.2861.40096__90ba9c70f846762e\LOCALIZATION.Foundation.Implementation.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Systemtray.resources\2.0.2861.40053_de_90ba9c70f846762e\CLI.Component.Systemtray.resources.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.2861.39832__90ba9c70f846762e\CLI.Component.Wizard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.2861.40053__90ba9c70f846762e\CLI.Component.Systemtray.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\MOM.Implementation\2.0.2861.40061__90ba9c70f846762e\MOM.Implementation.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.2861.39795__90ba9c70f846762e\CLI.Component.Runtime.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.2861.40060__90ba9c70f846762e\LOG.Foundation.Implementation.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.2820.26371__90ba9c70f846762e\CLI.Foundation.Private.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.2820.26374__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.2820.26371__90ba9c70f846762e\LOG.Foundation.Private.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.2820.26394__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.2820.26376__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\LOCALIZATION.Foundation.Private\2.0.2820.26371__90ba9c70f846762e\LOCALIZATION.Foundation.Private.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Extension.EEU\2.0.2861.39795__90ba9c70f846762e\CLI.Component.Runtime.Extension.EEU.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.2861.39811__90ba9c70f846762e\CLI.Component.Dashboard.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\ATIDEMOS\2.0.2861.39795__90ba9c70f846762e\ATIDEMOS.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\APM.Server\2.0.2861.39793__90ba9c70f846762e\APM.Server.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\AEM.Server\2.0.2861.39794__90ba9c70f846762e\AEM.Server.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.2820.26374__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CCC.Implementation\2.0.2861.40061__90ba9c70f846762e\CCC.Implementation.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.2820.26376__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.2820.26388__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.dll ()
MOD - C:\Windows\System32\atitmmxx.dll ()
MOD - C:\Windows\System32\MGHwCtrl.dll ()
MOD - C:\Program Files\System Control Manager\MGKBHook.dll ()
MOD - C:\Program Files\System Control Manager\CmSuppX.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (de_serv) --  File not found
SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (TeamViewer5) -- C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (VMCService) -- C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe (Vodafone)
SRV - (OMSI download service) -- C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe ()
SRV - (FsUsbExService) -- C:\Windows\System32\FsUsbExService.Exe (Teruten)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV - (NishService) -- C:\Program Files\System Control Manager\edd.exe ()
SRV - (TOSHIBA Bluetooth Service) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
SRV - (AgereModemAudio) -- C:\Windows\System32\agrsmsvc.exe (Agere Systems)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (ZTEusbnet) -- C:\Windows\System32\drivers\ZTEusbnet.sys (ZTE Corporation)
DRV - (ZTEusbvoice) -- C:\Windows\System32\drivers\zteusbvoice.sys (ZTE Incorporated)
DRV - (ZTEusbser6k) -- C:\Windows\System32\drivers\ZTEusbser6k.sys (ZTE Incorporated)
DRV - (ZTEusbnmea) -- C:\Windows\System32\drivers\ZTEusbnmea.sys (ZTE Incorporated)
DRV - (ZTEusbmdm6k) -- C:\Windows\System32\drivers\ZTEusbmdm6k.sys (ZTE Incorporated)
DRV - (massfilter) -- C:\Windows\System32\drivers\massfilter.sys (ZTE Incorporated)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avgio) -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (FsUsbExDisk) -- C:\Windows\System32\FsUsbExDisk.Sys ()
DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys ()
DRV - (s0016unic) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM) -- C:\Windows\System32\drivers\s0016unic.sys (MCCI Corporation)
DRV - (s0016nd5) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS) -- C:\Windows\System32\drivers\s0016nd5.sys (MCCI Corporation)
DRV - (s0016mdfl) -- C:\Windows\System32\drivers\s0016mdfl.sys (MCCI Corporation)
DRV - (s0016mdm) -- C:\Windows\System32\drivers\s0016mdm.sys (MCCI Corporation)
DRV - (s0016mgmt) Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM) -- C:\Windows\System32\drivers\s0016mgmt.sys (MCCI Corporation)
DRV - (s0016obex) -- C:\Windows\System32\drivers\s0016obex.sys (MCCI Corporation)
DRV - (s0016bus) Sony Ericsson Device 0016 driver (WDM) -- C:\Windows\System32\drivers\s0016bus.sys (MCCI Corporation)
DRV - (AtiPcie) ATI PCI Express (3GIO) -- C:\Windows\system32\DRIVERS\AtiPcie.sys (ATI Technologies Inc.)
DRV - (sscdmdm) -- C:\Windows\System32\drivers\sscdmdm.sys (MCCI Corporation)
DRV - (sscdmdfl) -- C:\Windows\System32\drivers\sscdmdfl.sys (MCCI Corporation)
DRV - (sscdbus) SAMSUNG USB Composite Device driver (WDM) -- C:\Windows\System32\drivers\sscdbus.sys (MCCI Corporation)
DRV - (seehcri) -- C:\Windows\System32\drivers\seehcri.sys (Sony Ericsson Mobile Communications)
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation                                            )
DRV - (RTHDMIAzAudService) -- C:\Windows\System32\drivers\RtHDMIV.sys (Realtek Semiconductor Corp.)
DRV - (rismxdp) -- C:\Windows\System32\drivers\rixdptsk.sys (REDC)
DRV - (ReallusionVirtualAudio) -- C:\Windows\System32\drivers\RLVrtAuCbl.sys ()
DRV - (Tosrfhid) -- C:\Windows\System32\drivers\Tosrfhid.sys (TOSHIBA Corporation.)
DRV - (Tosrfusb) -- C:\Windows\System32\drivers\tosrfusb.sys (TOSHIBA CORPORATION)
DRV - (rimmptsk) -- C:\Windows\System32\drivers\rimmptsk.sys (REDC)
DRV - (tosrfbd) -- C:\Windows\System32\drivers\tosrfbd.sys (TOSHIBA CORPORATION)
DRV - (rimsptsk) -- C:\Windows\System32\drivers\rimsptsk.sys (REDC)
DRV - (TosRfSnd) -- C:\Windows\System32\drivers\TosRfSnd.sys (TOSHIBA Corporation)
DRV - (MGHwCtrl) -- C:\Windows\System32\drivers\MGHwCtrl.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)
DRV - (tosrfbnp) -- C:\Windows\System32\drivers\tosrfbnp.sys (TOSHIBA Corporation)
DRV - (tosporte) -- C:\Windows\System32\drivers\tosporte.sys (TOSHIBA Corporation)
DRV - (Tosrfcom) -- C:\Windows\System32\drivers\tosrfcom.sys (TOSHIBA Corporation)
DRV - (tosrfnds) -- C:\Windows\System32\drivers\tosrfnds.sys (TOSHIBA Corporation.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.msi.com.tw
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.msi.com.tw
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://vshare.toolbarhome.com/?hp=df
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Web Search..."
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://web.de/"
FF - prefs.js..extensions.enabledItems: smarterwiki@wikiatic.com:3.1.2
FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.5.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {F34B9130-C471-4085-9AA2-F40F0D118621}:1.9.1
FF - prefs.js..keyword.URL: "hxxp://vshare.toolbarhome.com/search.aspx?srch=ku&q="
FF - prefs.js..network.proxy.type: 4
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: D:\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/npmozax:  File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/npracplug;version=1.0.0.0: C:\Program Files\Real\RealArcade\Plugins\Mozilla\npracplug.dll (RealNetworks)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.69: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@zylom.com/ZylomGamesPlayer: C:\Users\Elli\AppData\Roaming\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll (Zylom)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.10.02 05:09:53 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.06.16 08:55:00 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{F34B9130-C471-4085-9AA2-F40F0D118621}: C:\Users\Elli\AppData\Local\{F34B9130-C471-4085-9AA2-F40F0D118621} [2011.06.24 17:52:13 | 000,000,000 | ---D | M]
 
[2008.08.07 11:44:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Elli\AppData\Roaming\mozilla\Extensions
[2011.10.01 10:49:02 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Elli\AppData\Roaming\mozilla\Firefox\Profiles\l26iucgo.default\extensions
[2009.08.01 02:41:27 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Elli\AppData\Roaming\mozilla\Firefox\Profiles\l26iucgo.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.03.15 21:51:22 | 000,001,583 | ---- | M] () -- C:\Users\Elli\AppData\Roaming\Mozilla\Firefox\Profiles\l26iucgo.default\searchplugins\web-search.xml
[2011.08.23 21:10:43 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2011.08.23 21:10:44 | 000,000,000 | ---D | M] (Click to call with Skype) -- C:\Program Files\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2010.07.10 18:55:40 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2011.06.24 17:52:13 | 000,000,000 | ---D | M] (XULRunner) -- C:\USERS\ELLI\APPDATA\LOCAL\{F34B9130-C471-4085-9AA2-F40F0D118621}
() (No name found) -- C:\USERS\ELLI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L26IUCGO.DEFAULT\EXTENSIONS\PERSONAS@CHRISTOPHER.BEARD.XPI
() (No name found) -- C:\USERS\ELLI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L26IUCGO.DEFAULT\EXTENSIONS\SMARTERWIKI@WIKIATIC.COM.XPI
[2011.10.02 05:09:52 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010.07.10 18:55:20 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2005.04.27 22:10:49 | 000,102,400 | ---- | M] (RealNetworks) -- C:\Program Files\mozilla firefox\plugins\npracplug.dll
[2011.10.02 05:09:49 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.10.02 05:09:49 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011.10.02 05:09:49 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.10.02 05:09:49 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.10.02 05:09:49 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.10.02 05:09:49 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No CLSID value found.
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [MGSysCtrl] C:\Program Files\System Control Manager\MGSysCtrl.exe (MSI)
O4 - HKLM..\Run: [NPSStartup]  File not found
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [4Y3Y0C3AXG6CZY7EFZMEZFAXLZQOD] C:\serverg.Bin\873D3F8ACB5.exe (Radialpoint Inc.)
O4 - HKCU..\Run: [Rkofatupekamos] rundll32.exe  File not found
O4 - HKLM..\RunOnceEx: []  File not found
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 83.169.186.33 83.169.186.97
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0EFC965F-5242-4A4E-A798-2A981FA90052}: DhcpNameServer = 139.7.30.125 139.7.30.126
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E090DBE9-8F7F-4640-9FF1-A435097A9A16}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FB7AF5B4-1F3C-47C1-8CF1-7D2D70869946}: DhcpNameServer = 83.169.186.33 83.169.186.97
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: D:\Meine Daten\Bilder\Bikes\Kawasaki-Ninja-ZX-6R-2009-01.jpg
O24 - Desktop BackupWallPaper: D:\Meine Daten\Bilder\Bikes\Kawasaki-Ninja-ZX-6R-2009-01.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2010.08.03 12:20:55 | 000,000,057 | RHS- | M] () - C:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2010.08.03 12:20:55 | 000,000,057 | RHS- | M] () - D:\autorun.inf -- [ NTFS ]
O33 - MountPoints2\{07b062af-cda2-11df-b81f-00a0c6000000}\Shell - "" = AutoRun
O33 - MountPoints2\{07b062af-cda2-11df-b81f-00a0c6000000}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{1778b4ae-5a4f-11de-bb07-001d9258f9f8}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RUNdLl32.ExE  .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
O33 - MountPoints2\{34df8403-ea63-11dd-9adb-001d9258f9f8}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
O33 - MountPoints2\{b9e13fd7-f568-11de-9212-001d9258f9f8}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL USEr.ExE
O33 - MountPoints2\{b9e13fdd-f568-11de-9212-001d9258f9f8}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL User.eXE
O33 - MountPoints2\H\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RUNdLl32.ExE  .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.10.09 14:47:41 | 000,000,000 | ---D | C] -- C:\Users\Elli\AppData\Roaming\KodakCredentialStore
[2011.09.23 12:10:36 | 000,000,000 | ---D | C] -- C:\Users\Elli\AppData\Local\KodakGallery
[2011.09.23 12:09:35 | 000,000,000 | ---D | C] -- C:\Users\Elli\AppData\Roaming\Skinux
[2011.09.23 11:54:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kodak
[2011.09.23 11:54:12 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Kodak
[2011.09.23 11:52:28 | 000,000,000 | ---D | C] -- C:\Program Files\Kodak
[2011.09.23 11:48:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Kodak
[2009.09.30 13:27:48 | 000,148,736 | ---- | C] (Avanquest Software) -- C:\ProgramData\hpeEF3E.dll
[2008.08.07 14:51:45 | 000,774,144 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\RngInterstitial.dll
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.10.12 13:53:00 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.10.12 13:46:20 | 000,001,090 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.10.12 13:46:04 | 000,003,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.10.12 13:46:04 | 000,003,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.10.12 13:45:57 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.10.12 13:45:52 | 3757,432,832 | -HS- | M] () -- C:\hiberfil.sys
[2011.10.11 20:48:22 | 000,087,040 | ---- | M] () -- C:\Users\Elli\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.10.11 19:38:35 | 000,667,792 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.10.11 19:38:35 | 000,628,486 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.10.11 19:38:35 | 000,143,632 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.10.11 19:38:35 | 000,117,988 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.09.26 16:24:36 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2011.09.23 12:33:54 | 000,034,816 | R--- | M] () -- C:\Users\Public\Documents\ESBK.mb
[2011.09.23 12:33:54 | 000,014,336 | R--- | M] () -- C:\Users\Public\Documents\ESBK.mbb
[2011.09.19 17:42:20 | 000,001,174 | ---- | M] () -- C:\Users\Elli\Desktop\Civ4BeyondSword.lnk
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.09.23 12:10:09 | 000,034,816 | R--- | C] () -- C:\Users\Public\Documents\ESBK.mb
[2011.09.23 12:10:09 | 000,014,336 | R--- | C] () -- C:\Users\Public\Documents\ESBK.mbb
[2011.09.19 17:42:20 | 000,001,174 | ---- | C] () -- C:\Users\Elli\Desktop\Civ4BeyondSword.lnk
[2011.06.24 17:52:14 | 000,000,120 | ---- | C] () -- C:\Users\Elli\AppData\Local\Erirew.dat
[2011.06.24 17:52:14 | 000,000,000 | ---- | C] () -- C:\Users\Elli\AppData\Local\Oyujazohit.bin
[2009.12.28 18:30:59 | 000,164,254 | ---- | C] () -- C:\Windows\hpoins19.dat
[2009.12.28 18:30:22 | 000,026,952 | ---- | C] () -- C:\Windows\hpomdl19.dat
[2009.12.07 00:23:07 | 000,110,592 | ---- | C] () -- C:\Windows\System32\FsUsbExDevice.Dll
[2009.12.07 00:23:07 | 000,036,608 | ---- | C] () -- C:\Windows\System32\FsUsbExDisk.Sys
[2009.11.29 12:11:27 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2009.10.15 19:17:10 | 000,130,520 | R--- | C] () -- C:\ProgramData\DeviceManager.xml.rc4
[2009.09.03 13:37:36 | 000,004,240 | ---- | C] () -- C:\Windows\System32\outdated.dat
[2009.04.05 13:56:50 | 000,011,770 | ---- | C] () -- C:\Users\Elli\AppData\Roaming\elli.xml
[2009.04.05 13:50:42 | 000,000,755 | ---- | C] () -- C:\Users\Elli\AppData\Roaming\users.xml
[2009.01.18 10:30:30 | 000,111,932 | ---- | C] () -- C:\Windows\System32\EPPICPrinterDB.dat
[2009.01.18 10:30:30 | 000,001,146 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_DU.dat
[2009.01.18 10:30:30 | 000,001,136 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_ES.dat
[2009.01.18 10:30:30 | 000,001,120 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_IT.dat
[2009.01.18 10:30:30 | 000,001,107 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_GE.dat
[2009.01.18 10:30:30 | 000,001,104 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_EN.dat
[2009.01.18 10:30:30 | 000,000,097 | ---- | C] () -- C:\Windows\System32\PICSDK.ini
[2009.01.18 10:30:29 | 000,031,053 | ---- | C] () -- C:\Windows\System32\EPPICPattern131.dat
[2009.01.18 10:30:29 | 000,027,417 | ---- | C] () -- C:\Windows\System32\EPPICPattern121.dat
[2009.01.18 10:30:29 | 000,026,154 | ---- | C] () -- C:\Windows\System32\EPPICPattern1.dat
[2009.01.18 10:30:29 | 000,024,903 | ---- | C] () -- C:\Windows\System32\EPPICPattern3.dat
[2009.01.18 10:30:29 | 000,021,390 | ---- | C] () -- C:\Windows\System32\EPPICPattern5.dat
[2009.01.18 10:30:29 | 000,020,148 | ---- | C] () -- C:\Windows\System32\EPPICPattern2.dat
[2009.01.18 10:30:29 | 000,011,811 | ---- | C] () -- C:\Windows\System32\EPPICPattern4.dat
[2009.01.18 10:30:29 | 000,004,943 | ---- | C] () -- C:\Windows\System32\EPPICPattern6.dat
[2009.01.18 10:30:29 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_PT.dat
[2009.01.18 10:30:29 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_BP.dat
[2009.01.18 10:30:29 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_FR.dat
[2009.01.18 10:30:29 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_CF.dat
[2009.01.18 10:23:42 | 000,000,025 | ---- | C] () -- C:\Windows\CDE CX3900EC.ini
[2009.01.14 21:26:35 | 000,260,531 | ---- | C] () -- C:\Windows\pdfcvt.dat
[2008.11.30 06:29:53 | 000,000,025 | ---- | C] () -- C:\Windows\cdplayer.ini
[2008.11.16 03:41:03 | 000,000,680 | ---- | C] () -- C:\Users\Elli\AppData\Local\d3d9caps.dat
[2008.10.21 06:51:39 | 000,000,048 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2008.10.02 03:37:18 | 000,000,092 | ---- | C] () -- C:\Users\Elli\AppData\Local\fusioncache.dat
[2008.09.16 02:14:24 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll
[2008.09.16 02:11:10 | 000,012,288 | ---- | C] () -- C:\Windows\System32\DivXWMPExtType.dll
[2008.08.22 11:08:10 | 000,106,605 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2008.08.22 11:08:10 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008.08.21 14:11:59 | 000,000,526 | ---- | C] () -- C:\Windows\eReg.dat
[2008.08.07 11:59:45 | 000,087,040 | ---- | C] () -- C:\Users\Elli\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.08.06 18:28:48 | 000,031,616 | ---- | C] () -- C:\Windows\System32\drivers\RLVrtAuCbl.sys
[2008.06.12 01:06:29 | 000,110,592 | ---- | C] () -- C:\Windows\System32\MGHwCtrl.dll
[2008.06.12 01:06:29 | 000,032,768 | ---- | C] () -- C:\Windows\System32\MGFPCtrl.dll
[2008.06.12 01:05:45 | 000,000,000 | ---- | C] () -- C:\Windows\tosOBEX.INI
[2008.06.12 00:52:20 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll
[2008.06.12 00:38:50 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2008.06.12 00:29:55 | 003,107,788 | ---- | C] () -- C:\Windows\System32\atiumdva.dat
[2008.03.05 04:38:24 | 000,667,792 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2008.03.05 04:38:24 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2008.03.05 04:38:24 | 000,143,632 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2008.03.05 04:38:24 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2007.11.01 17:09:00 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2007.10.25 18:26:10 | 000,005,632 | ---- | C] () -- C:\Windows\System32\drivers\StarOpen.sys
[2007.07.16 04:37:38 | 000,154,206 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2006.12.05 22:05:06 | 000,114,688 | ---- | C] () -- C:\Windows\System32\TosBtAcc.dll
[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:47:37 | 000,376,056 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:33:01 | 000,628,486 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,117,988 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2005.12.15 06:17:00 | 000,159,744 | ---- | C] () -- C:\Windows\System32\EPSPTDV.DLL
[2005.07.23 06:30:20 | 000,065,536 | ---- | C] () -- C:\Windows\System32\TosCommAPI.dll
 
========== LOP Check ==========
 
[2009.07.03 15:11:47 | 000,000,000 | -HSD | M] -- C:\Users\Elli\AppData\Roaming\.#
[2010.05.12 17:19:50 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\1morebee
[2010.06.30 17:53:25 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\A Gypsy's Tale - The Tower of Secrets
[2010.11.04 14:30:11 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Absolutist
[2010.10.31 17:18:51 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Aerohills
[2011.04.01 15:10:20 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Alawar
[2010.08.25 23:34:05 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\AlderGames
[2011.03.24 12:46:20 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\AlphaKimori1
[2011.03.24 12:00:47 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\AlphaKimori2
[2010.04.26 23:22:37 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Artogon
[2010.09.19 01:28:30 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Big Fish Games
[2010.01.06 19:07:29 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\blg
[2011.03.01 13:51:00 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Blue Tea Games
[2009.10.26 00:27:58 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Boolat Games
[2010.04.25 17:06:31 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Boomzap
[2010.03.08 01:24:28 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\BrokenHearts
[2011.02.05 19:36:47 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Cosmonaut Games
[2010.03.22 19:54:27 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\CupcakeCafe
[2008.11.16 03:38:46 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\DAEMON Tools
[2010.06.04 12:00:00 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\DarkParablesBriarRoseSE_BFG
[2009.12.21 23:05:08 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Dekovir
[2011.03.29 14:34:56 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\DGform
[2011.02.13 22:48:17 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\DivoGames
[2010.03.14 15:28:05 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Dragon Altar Games
[2010.10.13 18:49:22 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Dreamscape_Saves
[2011.04.11 21:51:28 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\DreamWoods2ScreenShot
[2011.04.26 16:57:59 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\EleFun Games
[2009.12.27 14:09:13 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\ElementalsTheMagicKey
[2011.05.20 15:41:33 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Elephant Games
[2010.12.07 00:33:18 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Ellashope_Saves
[2010.02.09 23:11:02 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Enchanted Katya
[2010.01.30 16:32:53 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Enki Games
[2010.01.06 01:24:51 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Enlightenus
[2010.08.21 12:38:10 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Enlightenus2SE_BFG
[2010.08.22 02:35:54 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Enlightenus2_BFG
[2009.01.18 12:05:48 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\EPSON
[2009.10.29 22:48:12 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\ERS G-Studio
[2011.06.04 15:33:44 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\ERS Game Studios
[2011.04.11 21:29:36 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\FairyTale
[2011.04.12 17:46:59 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Farm Mania 2.1
[2009.10.19 12:09:23 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\FashionCrazeDe
[2011.09.07 11:30:07 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\FFSJ
[2010.02.17 20:13:35 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Flood Light Games
[2011.01.02 14:53:09 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Floodlight Games
[2010.03.17 14:39:35 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Friday's games
[2008.09.05 08:15:48 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\FRITZ!
[2010.05.01 13:37:24 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Fuzzy Games
[2010.05.08 14:11:09 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Game Mill Entertainment
[2009.10.25 23:27:36 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\gamehouse
[2009.12.12 12:19:31 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\GameInvest
[2010.08.09 23:08:07 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Gamelab
[2010.07.02 12:14:29 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Gamers Digital
[2010.03.08 21:04:18 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\GetRightToGo
[2011.02.28 17:21:43 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Ghost Ship Studios
[2010.08.20 17:27:37 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Gogii
[2009.12.18 00:34:17 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\GraveyardShift
[2010.05.01 14:56:20 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Green Clover Games
[2010.02.15 14:04:06 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\HdO Adventure
[2010.07.11 14:13:14 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\IBAGroup
[2010.06.16 20:47:04 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Image Zone Express
[2011.06.02 19:22:48 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\InImages
[2009.12.24 13:49:34 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\IronCode
[2011.06.27 16:43:07 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Islands
[2011.06.29 12:51:54 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Islands2
[2010.01.28 20:27:39 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Jane s Hotel  Family Hero
[2010.12.03 13:06:41 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Jane s Hotel 3
[2009.11.07 00:51:33 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Janes_Realty
[2010.10.25 17:13:03 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Jetdogs Studios
[2010.04.26 15:29:16 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\JoyBits
[2010.03.27 12:42:33 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Ladia Group
[2010.05.01 12:46:01 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\LaJangada
[2010.06.27 13:16:15 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Lazy Turtle Games
[2010.08.10 09:26:22 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Little Worlds Online
[2009.12.22 19:36:17 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\MA
[2010.07.15 13:41:09 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Magic3
[2011.05.12 16:39:16 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Manifesto Games
[2010.02.17 15:03:15 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\MastersOfMystery2
[2011.03.05 15:43:25 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Meridian93
[2010.10.06 11:14:17 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Merscom
[2010.06.13 13:49:33 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\My Games
[2009.09.30 16:56:43 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\MyPhoneExplorer
[2011.06.06 17:07:30 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\NevoSoft
[2011.02.07 18:08:35 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Nevosoft-Breeze
[2010.01.27 12:07:37 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Oberon Games
[2010.03.05 14:35:35 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Orneon
[2011.05.11 12:35:48 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Otom
[2011.07.08 16:05:02 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\PathToSuccess
[2011.04.30 17:21:53 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Ph03nixNewMedia
[2011.04.12 14:55:29 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\PlayFirst
[2009.12.23 02:49:20 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Princess Isabella
[2010.06.16 20:47:04 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Printer Info Cache
[2011.06.09 20:01:30 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Private Moon Studios
[2010.06.15 21:59:01 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\ProtectDisc
[2010.09.01 12:36:21 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Rabbit's Magic Adventures
[2011.03.05 14:44:20 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\RenPy
[2010.03.22 20:32:30 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Roaming
[2011.09.03 19:47:14 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Rovio
[2010.10.23 14:02:30 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Sahmon Games
[2009.12.07 00:22:47 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Samsung
[2009.12.15 14:18:59 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Sanna
[2010.08.30 16:15:00 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\SevenSails
[2010.03.21 12:45:14 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\ShinyTales
[2011.09.23 12:09:35 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Skinux
[2010.08.25 12:25:22 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Sky Bros
[2011.01.03 16:23:41 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Spark Plug Games
[2010.08.31 18:11:11 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Specialbit
[2010.11.02 14:45:44 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Spooky Runes
[2010.10.07 20:23:04 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\TeamViewer
[2009.09.30 00:09:10 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Teleca
[2009.03.13 10:22:33 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\temp
[2011.06.07 14:22:24 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Teyon
[2010.10.26 18:14:59 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Thinstall
[2008.10.28 11:01:33 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Ulead Systems
[2010.05.31 18:43:56 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\V-Games
[2010.01.19 19:35:07 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\VampireSaga
[2010.10.01 23:33:17 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Vodafone
[2011.05.11 12:36:11 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Watui
[2008.08.26 13:30:52 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\WEBDE
[2011.06.15 17:49:47 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\WendigoStudios
[2011.05.16 13:37:02 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\World-Loom
[2011.04.18 15:20:26 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\YoudaGames
[2009.12.13 20:53:09 | 000,000,000 | ---D | M] -- C:\Users\Elli\AppData\Roaming\Zylom
[2011.10.12 10:08:49 | 000,032,510 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 99 bytes -> C:\ProgramData\TEMP:49EB0FDC
@Alternate Data Stream - 97 bytes -> C:\ProgramData\TEMP:95198126
@Alternate Data Stream - 97 bytes -> C:\ProgramData\TEMP:1ECED34B
@Alternate Data Stream - 96 bytes -> C:\ProgramData\TEMP:B2CD146E
@Alternate Data Stream - 96 bytes -> C:\ProgramData\TEMP:AABCC5A7
@Alternate Data Stream - 96 bytes -> C:\ProgramData\TEMP:AAA14AF9
@Alternate Data Stream - 96 bytes -> C:\ProgramData\TEMP:3D5B1D7A
@Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:C07A6A6B
@Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:55BB2521
@Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:52E3B819
@Alternate Data Stream - 229 bytes -> C:\ProgramData\TEMP:8FF81EB0
@Alternate Data Stream - 214 bytes -> C:\ProgramData\TEMP:E2CFA9CD
@Alternate Data Stream - 177 bytes -> C:\ProgramData\TEMP:7D6D7474
@Alternate Data Stream - 165 bytes -> C:\ProgramData\TEMP:07557E0B
@Alternate Data Stream - 148 bytes -> C:\ProgramData\TEMP:D6A4A911
@Alternate Data Stream - 148 bytes -> C:\ProgramData\TEMP:BFE54417
@Alternate Data Stream - 148 bytes -> C:\ProgramData\TEMP:1AFC2166
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:FB647F34
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:D390A6A7
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:178093AE
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:10F6E97E
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:46CBC45C
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:ED9B661E
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:CEE4A457
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:ADFAD95A
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:AC73CDCE
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:3D186293
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:10CFA7D4
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:089CBF08
@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:6FD3C973
@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:22741C1F
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:CAF8DAC8
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:B722BCE5
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:B64F7263
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:73461BFA
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:2DD32145
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:EAEE7554
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:1B8AA588
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:01070CA7
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:F78CC2A2
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:F5FC5DCE
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:D882BE37
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:88AE8AB0
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:6AF67671
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:0E8117B1
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:08E5EE32
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:01690B01
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:AE2EA3C2
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:3A7527E8
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:0BCD6B91
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:71B89F61
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:5C4A588B
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:4F28299B
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:3A0561F3
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:149327FE
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:0EC7A545
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:CF1334B0
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:87452B14
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:834DD57E
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:63B94956
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:47A24D4B
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:3B07E6F4
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:C43C957E
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:BACB6B6C
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:A18121AD
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:9026FFAC
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:88A44CC1
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:79875988
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:F84B8DB5
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:E9900C74
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:A59DD4AD
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:9E76E7F3
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:9D6EAEC3
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:8DD20B4A
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:8BFA0030
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:80F63EC3
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:696F7DA7
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:6017A808
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:35629AE6
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:F8F070C2
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:D0D17155
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:AFB24B00
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:9A8F071F
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:91A12471
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:78739EC9
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:1B3549F2
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:EA701346
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:C10635F6
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:BE6DC701
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:A6D6E537
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:8B4B9596
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:700B9342
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:18BFD8F8
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:F81E7082
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:F5B99CA4
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:CCB49694
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:BBF60A29
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:55E1514E
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:55C54F7C
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:4B1195DD
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:0E684AC9
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:FED25C29
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:47C57855
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:FF7D915E
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:EC7C9796
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:EA10407C
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:DE47A3DA
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:ADAD2FFE
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:AD727397
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:93B0BB6F
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:93226FE3
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:896E1EFF
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:7BF749CA
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:61AF2B29
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:26FBC1F9
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:19474103
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:C9B27A06
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:C4A88D6B
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:B3196E8D
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:A819A132
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:A7DA2BCD
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:7A0EFE63
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:4F96D8E6
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:04BB186B
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:F14D1F80
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:DD04902E
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:D01ACC06
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:9DF07E8F
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:9BFB769D
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:981456CB
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:969C0C96
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:80EA2EA3
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:6E11933F
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:0DFE2AE1
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:AC0528D9
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:A26AFC00
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:9B285B76
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:996104FC
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:90865A6D
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:870649A4
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:751D6870
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:5335CE76
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:45F3AD49
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:3B812EE0
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:36A39835
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:33384BC0
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:315B4A13
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:2E3F04BC
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:1A5207FA
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:06C34166
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:FC8FFA4E
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:F2DC4B0B
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:E7C9DAAE
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:DDEB08FD
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:D88D995C
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:CFDE7852
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:92FE8A60
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:490BCC52
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:48977386
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:F67AAFC5
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:EC0279DC
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:E1D818F7
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:DDF112BD
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:C5DC2B0C
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:4A966CC2
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:2ADF9928
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:206470A5
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:11EFE63D
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:F7370879
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:D8D58038
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:CB16385F
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:B6285236
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:A1023D41
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:7CEDF9F3
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:5C6EBC69
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:5B307FD4
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:2495D97A
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:072F1F69
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:D354012D
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:D0757AAB
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:C35B4B19
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:B1E64E47
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:957E9765
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:852F2262
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:7D7536E0
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:6247E766
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:1DEE6B65
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:073139EC
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:EC0A74A1
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:DC21D414
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:C8207070
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:BDF08FAF
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:75A76CD8
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:598E0FFA
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:57EE48CA
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:EA1919C7
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:D9771F40
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:BC1F7CAE
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:B845F669
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:A5584049
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:A3B8F70C
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:A31B5E9B
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:961B84C5
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:62525FE7
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:5ED7E575
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:4A2862FF
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:4363DE71
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:3C9B05C4
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:3571475C
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:2871B698
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:25BB767E
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:059167AF
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:FEEEFFAD
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:DCA79AB3
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:CB0FEE2B
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:BD9F7E4E
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:A4E7D25F
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:76A59E49
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:5EF1AD34
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:4673E9EA
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:A441D13F
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:7EC01D6D
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:7B52659E
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:425759C6
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:1E86ADD2
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:EA7D76BE
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:DA7655EA
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:B8384DB6
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:B4980368
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:7FCB9D0D
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:7547DA5B
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:6BD304B9
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:51F17BB8
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:35C78DCC
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:2EC5D66C
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:B093E177
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:8DF68137
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:663B62CA
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:5C826C73
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:471AD3D0
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:46A2F27B
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:3D36932D
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:3B75B877
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:275AA066
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:062AF572
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:D8F9D810
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:8BCF4DE2
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:70E897B5
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:6C5EC3CD
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:483AC68A
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:3C282BEA
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:3118E26B
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:097FF903
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:EE7AAC75
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:9AA05701
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:569CEE83
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:52E1DB1D
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:4A1628E5
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:385E2CFD
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:F35AE645
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:EF794BCD
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:E99D1D3C
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:D2793A03
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:C86B29EB
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:A6346EE9
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:9491C9C7
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:81653DC8
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:5E9B629B
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:05F547A9
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:D4D056EC
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:B5038DF9
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:A3251D01
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:A0A7408F
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:961B4D58
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:74091520
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:701B92FB
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:59846E5E
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:57176330
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:2BC498A4
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:12EA4DC9
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:0D278FB5
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:07241935
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:FBE81670
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:E3CEEC4C
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:AF54CFFD
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:A688EF17
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:A00BCDEF
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:945FE29C
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:90108DD7
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:6BF0805F
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:3E06C78F
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:2F1D743F
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:260575F1
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:109734F6
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:0C5AF2AA
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:00AA4B31
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:FDCAE7B5
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:F1F936DF
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:E411AA0D
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:CC7738DB
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:AEBC40EC
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:9D03192E
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:8F827F9E
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:71112705
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:5197985B
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:4FE30352
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:1CB96B16
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:102394C6
@Alternate Data Stream - 111 bytes -> C:\ProgramData\TEMP:8140CB50
@Alternate Data Stream - 111 bytes -> C:\ProgramData\TEMP:7AF9CAEB
@Alternate Data Stream - 111 bytes -> C:\ProgramData\TEMP:3BAD65EA
@Alternate Data Stream - 111 bytes -> C:\ProgramData\TEMP:1A4BF204
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:F2AF86D9
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:C9FD258B
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:4E6B8D68
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:3C5ABDC7
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:12D2EB9C
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:E51234A9
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:7A0FEE87
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:6E97B83A
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:63F8EC77
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:331B76C7
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:2E49FF93
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:24FECE50
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:D708EEF9
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:BDCD8531
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:AA60673F
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:5A8F8A0C
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:554C6431
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:50636E35
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:EC5EFA15
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:BDCD0530
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:97C4F81F
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:6710EF08
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:667565EE
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:561B1D2B
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:164FA86E
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:08D8BB20
@Alternate Data Stream - 106 bytes -> C:\ProgramData\TEMP:5BC73C48
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:E41267F2
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:9E3E060F
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:848CC150
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:80B291A7
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:603FD11D
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:124B94C0
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:0F0A5896
@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:BFAD7A5D
@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:5D351BC6
@Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:71FA8B7F
@Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:53DF59D1
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:FF9C44FE
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:E4FCDFD9
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:E2B84483
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:D48500F8
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:D0668210
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:B6DD2C7E
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:918B7566
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:8CCDAB14
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:8247A199
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:81A3F151
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:F44D3C53
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:E44D7155
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:E32966C0
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:D994162E
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:CF61CE5A
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:B2735F9E
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:78E0DF72
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:78DEA3A4
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:614F17D3
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:4AD2C54D
@Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:C22674B6
@Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:A724744F
@Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:8BA6C9F8
@Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:27D1368B

< End of report >

--- --- ---

markusg · 12.10.2011, 14:51

hiho
ich sehe schon einiges woran du in zukunft unbedingt denken musst um nen sicheres system zu bekommen, aber vorher will ich noch malware einsammeln, zur analyse.

achtung!
dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.

• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

:OTL
O4 - HKCU..\Run: [4Y3Y0C3AXG6CZY7EFZMEZFAXLZQOD] C:\serverg.Bin\873D3F8ACB5.exe (Radialpoint Inc.)
:Files
C:\serverg.Bin

:Commands
[purity]
[EMPTYFLASH]
[resethosts]
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.

öffne computer, öffne C: dann _OTL
dort rechtsklick auf moved files
wähle zu moved files.rar oder zip hinzufügen.
folge dem link, und lade das archiv im upload channel hoch
http://www.trojaner-board.de/54791-a...ner-board.html

Elli2808 · 12.10.2011, 16:52

Oh okay, bin für jede Hilfe für ein sicheres System dankbar. Hatte sowieso vor mir zumindest demnächst Kaspersky zu holen, nun war es leider schon zu spät.

Ich habe noch eine kleine Zwischenfrage bevor ich die gewünschten Aktionen bei OTL ausführen kann. Hatte nebenbei mal Malwarebytes durchlaufen lassen, ohne große Hoffnung das er was findet. Nun ist das Programm doch fündig geworden, 4 Funde um genau zu sein. Könnten die das bereits sein?

Hier mal das Ergebnis:

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 7929

Windows 6.0.6001 Service Pack 1
Internet Explorer 8.0.6001.19088

12.10.2011 17:49:06
mbam-log-2011-10-12 (17-49-02).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 406265
Laufzeit: 1 Stunde(n), 55 Minute(n), 59 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 1
Infizierte Dateien: 2

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4Y3Y0C3AXG6CZY7EFZMEZFAXLZQOD (Trojan.Agent) -> Value: 4Y3Y0C3AXG6CZY7EFZMEZFAXLZQOD -> No action taken.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
c:\Recycle.Bin (Trojan.Spyeyes) -> No action taken.

Infizierte Dateien:
c:\serverg.Bin\873d3f8acb5.exe (Trojan.Agent) -> No action taken.
c:\Recycle.Bin\9ee3fdfc0a2bb52 (Trojan.Spyeyes) -> No action taken.

markusg · 12.10.2011, 17:15

ja das waren sie.
ok dann können wir mit dem neu aufsetzen beginnen.
ich werde dir auch ein av vorschlagen, aber nicht kaspersky, ein, mein meiner meinung nach, besseres :-)
ok, du sagst ja, alle daten sind gesichert.

Elli2808 · 12.10.2011, 17:32

Okay also erstmal wollt ich fragen, ob es denn jetzt noch nötig ist die Recovery zu nutzen, denn Malwarebytes hat den Trojaner ja entfernt. Oder ist es einfach sicherer doch neu aufzusetzen?

Dann hatte ich mich noch gefragt, zwecks Datensicherung, wie es mit allen Treibern aussieht. Sind die in der Recovery vorhanden? Also ist da keine extra Sicherung vonnöten?

Andere Fragen werden sicherlich aufkommen, wenn ich die Liste durchgehe, aber dazu später.

markusg · 12.10.2011, 17:58

hi,
ich würde trotzdem neu aufsetzen ist sicherer.
die treiber sind in der recovery enthalten, bzw gibts auch was über windows updates und falls nötig können wir nachträglich nach neuen versionen suchen.

Elli2808 · 12.10.2011, 19:11

Hey nun stellt sich mir ein ganz unerwartetes Problem, ich kann die Recovery Partition nicht finden. Eigentlich sollte sie mit F3 beim Start nutzbar sein, jedoch passiert garnicht. Auf F11 kann ich nur normal oder vom Laufwerk booten sowie eine dritte Option, bei der der Laptop aber auch nur ganz normal startet.
Habe auch im Bios gesucht, aber nichts von Recovery gefunden.

markusg · 12.10.2011, 19:18

wenn du das logo des herstellers siehst, klappts da mit
Alt+F10
die recovery zu starten?

Elli2808 · 12.10.2011, 19:23

Nein habe ich auch ausprobiert. Bin eigentlich inzwischen fast alle F-Tasten durchgegangen, nichts passiert.

markusg · 12.10.2011, 19:52

wie ist die genaue gerätebezeichnung? wurdest du am anfang mal aufgefordert recovery dvds zu erstellen?
und hast das hoffendlich gemacht?

Elli2808 · 12.10.2011, 20:07

MSI EX610 heißt das Notebook. Und nein ich bin nicht dazu aufgefordert worden, habe aber ein Programm auf dem Laptop mit dem ich eine erstellen kann. Aber ich dachte das wäre nicht nötig, da ich es ja eigentlich von der Partition aus starten kann... In der Anleitung zum Brennen der Recovery Disk steht auch das dann, wenn ich die gebrannt habe, die "F3 Schnelltasten Wiederherstellung von der Festplatte nicht mehr benutzt werden kann." Ich hoffe, ich habe jetzt keinen Fehler gemacht, weil ich nicht gleich nach dem Kauf die DVD erstellt habe?

markusg · 12.10.2011, 20:11

hmm kannst du denn die dvd jetzt noch erstellen?
bzw vllt war ja ne dvd im lieferumfang dabei?

D2D Recovery ausreichend um Bank - Trojaner zu beseitigen?

Log-Analyse und Auswertung: D2D Recovery ausreichend um Bank - Trojaner zu beseitigen?