Hallo,

ich hatte leider das nervige Vista Home Security 2012 auf meinem PC. Es hat sich als zvb.exe unter dem Namen Microsoft Hybrid Library getarnt. Ich hab mich in Google schlau gemacht und es soweit geschafft, dass es nicht mehr auftaucht. Genauer habe ich folgende Programme benutzt:
PCTools Nuke
Spybot Search&Destroy
Avira Antivir
Malwarebytes AntiMalware

Jetzt bin ich mir nicht sicher, ob das reicht. Ich habe an verschiedenen Stellen gelesen, dass es nach der Reinigungsaktion noch Dateien geben könnte, die evtl. gefährlich werden könnten.
Kann ich das überprüfen und die Dateien restlos entfernen?

Ich habe versucht ein Log mit GMER zu machen, leider stürtzte das Programm immer ab. "Gmer funktioniert nicht mehr - Es wird nach einer Lösung gesucht"

Hier meine Logs mit OTL:

OTL logfile created on: 17.01.2012 18:24:57 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\Felix\Downloads
Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,25 Gb Total Physical Memory | 1,94 Gb Available Physical Memory | 59,69% Memory free
6,69 Gb Paging File | 5,50 Gb Available in Paging File | 82,18% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 244,14 Gb Total Space | 72,29 Gb Free Space | 29,61% Space Free | Partition Type: NTFS
Drive D: | 507,35 Gb Total Space | 418,36 Gb Free Space | 82,46% Space Free | Partition Type: NTFS
Drive E: | 634,77 Gb Total Space | 129,57 Gb Free Space | 20,41% Space Free | Partition Type: NTFS
Drive F: | 465,75 Gb Total Space | 88,87 Gb Free Space | 19,08% Space Free | Partition Type: NTFS
Drive N: | 246,00 Gb Total Space | 15,77 Gb Free Space | 6,41% Space Free | Partition Type: NTFS
 
Computer Name: FELIX-PC | User Name: Felix | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.01.17 18:16:43 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Felix\Downloads\OTL.exe
PRC - [2012.01.07 11:04:46 | 000,061,088 | ---- | M] (F-Secure Corporation) -- C:\Programme\F-Secure\ORSP Client\fsorsp.exe
PRC - [2012.01.07 11:04:18 | 000,488,104 | ---- | M] (F-Secure Corporation) -- C:\Programme\F-Secure\Anti-Virus\fsav32.exe
PRC - [2012.01.07 11:03:14 | 001,008,296 | ---- | M] (F-Secure Corporation) -- C:\Programme\F-Secure\Anti-Virus\fssm32.exe
PRC - [2012.01.07 11:03:14 | 000,512,680 | ---- | M] (F-Secure Corporation) -- C:\Programme\F-Secure\Anti-Virus\fsgk32.exe
PRC - [2012.01.06 17:52:32 | 000,529,064 | ---- | M] (F-Secure Corporation) -- C:\Programme\F-Secure\FWES\program\fsdfwd.exe
PRC - [2012.01.06 17:52:25 | 000,221,864 | ---- | M] (F-Secure Corporation) -- C:\Programme\F-Secure\Anti-Virus\fsgk32st.exe
PRC - [2012.01.06 17:52:23 | 000,201,384 | ---- | M] (F-Secure Corporation) -- C:\Programme\F-Secure\Common\FSM32.EXE
PRC - [2012.01.06 17:52:23 | 000,189,096 | ---- | M] (F-Secure Corporation) -- C:\Programme\F-Secure\Common\FSMA32.EXE
PRC - [2012.01.06 17:52:23 | 000,090,792 | ---- | M] (F-Secure Corporation) -- C:\Programme\F-Secure\Common\FSHDLL32.EXE
PRC - [2011.10.07 12:15:42 | 000,453,400 | ---- | M] (Logitech, Inc.) -- C:\Programme\Logitech\SetPointG\SetPointII.exe
PRC - [2011.10.07 10:40:42 | 001,387,288 | ---- | M] (Logitech, Inc.) -- C:\Programme\Logitech\SetPointP\SetPoint.exe
PRC - [2011.10.05 15:45:56 | 000,130,976 | ---- | M] (Safer-Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy 2\SDHookSvc.exe
PRC - [2011.10.05 15:45:42 | 000,169,624 | ---- | M] (Safer-Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy 2\SDWSCSvc.exe
PRC - [2011.10.05 15:45:40 | 000,955,816 | ---- | M] (Safer-Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy 2\SDUpdSvc.exe
PRC - [2011.10.05 15:45:38 | 000,892,336 | ---- | M] (Safer-Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy 2\SDFSSvc.exe
PRC - [2011.09.27 20:05:24 | 000,149,784 | ---- | M] (Logitech, Inc.) -- C:\Programme\Common Files\LogiShrd\KHAL3\KHALMNPR.exe
PRC - [2011.08.19 08:26:50 | 000,450,848 | ---- | M] (Logitech Inc.) -- C:\Programme\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe
PRC - [2009.11.12 13:48:56 | 000,071,096 | ---- | M] () -- C:\Programme\CDBurnerXP\NMSAccessU.exe
PRC - [2009.08.18 10:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
PRC - [2009.08.18 10:29:22 | 000,183,152 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
PRC - [2009.04.11 07:28:15 | 000,117,248 | ---- | M] () -- \\?\C:\Windows\System32\wbem\WMIADAP.EXE
PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2007.09.02 13:58:52 | 000,495,616 | ---- | M] () -- C:\Programme\RocketDock\RocketDock.exe
PRC - [2007.02.06 10:50:08 | 004,374,528 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.01.06 17:52:40 | 000,086,016 | ---- | M] () -- C:\Programme\F-Secure\FSGUI\strres.eng
MOD - [2012.01.06 17:52:38 | 000,553,640 | ---- | M] () -- C:\Programme\F-Secure\FSGUI\gres.dll
MOD - [2012.01.06 17:52:34 | 000,045,056 | ---- | M] () -- C:\Programme\F-Secure\FSGUI\fsavures.eng
MOD - [2012.01.06 17:52:33 | 000,443,048 | ---- | M] () -- C:\Programme\F-Secure\FSGUI\about.dll
MOD - [2012.01.06 17:52:33 | 000,143,360 | ---- | M] () -- C:\Programme\F-Secure\FSGUI\flyerres.eng
MOD - [2012.01.06 17:52:33 | 000,090,792 | ---- | M] () -- C:\Programme\F-Secure\FSGUI\aboutres.dll
MOD - [2012.01.06 17:52:26 | 000,001,536 | ---- | M] () -- C:\Programme\F-Secure\FSPC\fspcfsm.eng
MOD - [2011.12.23 20:54:16 | 000,077,824 | ---- | M] () -- C:\Programme\MediaMonkey\DeskPlayer.dll
MOD - [2011.10.07 10:41:16 | 000,879,896 | ---- | M] () -- C:\Programme\Logitech\SetPointP\Macros\MacroCore.dll
MOD - [2007.09.02 13:58:52 | 000,495,616 | ---- | M] () -- C:\Programme\RocketDock\RocketDock.exe
MOD - [2007.09.02 13:57:36 | 000,069,632 | ---- | M] () -- C:\Programme\RocketDock\RocketDock.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] --  -- (AcronisOSSReinstallSvc)
SRV - [2012.01.07 11:04:46 | 000,061,088 | ---- | M] (F-Secure Corporation) [On_Demand | Running] -- C:\Program Files\F-Secure\ORSP Client\fsorsp.exe -- (FSORSPClient)
SRV - [2012.01.06 17:52:32 | 000,529,064 | ---- | M] (F-Secure Corporation) [On_Demand | Running] -- C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe -- (FSDFWD)
SRV - [2012.01.06 17:52:25 | 000,221,864 | ---- | M] (F-Secure Corporation) [Auto | Running] -- C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe -- (F-Secure Gatekeeper Handler Starter)
SRV - [2012.01.06 17:52:23 | 000,189,096 | ---- | M] (F-Secure Corporation) [Auto | Running] -- C:\Program Files\F-Secure\Common\FSMA32.EXE -- (FSMA)
SRV - [2012.01.04 18:09:34 | 003,746,576 | ---- | M] (Trend Micro Inc.) [On_Demand | Stopped] -- C:\Program Files\Trend Micro SafeSync\hrfscore.exe -- (OnlineStorageService)
SRV - [2011.10.27 10:34:30 | 000,718,384 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2011.10.05 15:45:56 | 000,130,976 | ---- | M] (Safer-Networking Ltd.) [Auto | Running] -- C:\Programme\Spybot - Search & Destroy 2\SDHookSvc.exe -- (SDHookService)
SRV - [2011.10.05 15:45:42 | 000,169,624 | ---- | M] (Safer-Networking Ltd.) [Auto | Running] -- C:\Programme\Spybot - Search & Destroy 2\SDWSCSvc.exe -- (SDWSCService)
SRV - [2011.10.05 15:45:40 | 000,955,816 | ---- | M] (Safer-Networking Ltd.) [Auto | Running] -- C:\Programme\Spybot - Search & Destroy 2\SDUpdSvc.exe -- (SDUpdateService)
SRV - [2011.10.05 15:45:38 | 000,892,336 | ---- | M] (Safer-Networking Ltd.) [Auto | Running] -- C:\Programme\Spybot - Search & Destroy 2\SDFSSvc.exe -- (SDScannerService)
SRV - [2011.09.27 20:03:28 | 000,295,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\LogiShrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2011.08.19 08:26:50 | 000,450,848 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Programme\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe -- (UMVPFSrv)
SRV - [2011.05.22 11:14:18 | 000,403,240 | ---- | M] (Valve Corporation) [Disabled | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011.02.08 12:12:43 | 000,288,112 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe -- (Adobe Version Cue CS4)
SRV - [2010.09.14 11:23:26 | 000,435,008 | ---- | M] (TuneUp Software) [Disabled | Stopped] -- C:\Programme\TuneUp Utilities 2010\TuneUpDefragService.exe -- (TuneUp.Defrag)
SRV - [2010.08.26 13:43:20 | 001,051,968 | ---- | M] (TuneUp Software) [Disabled | Stopped] -- C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)
SRV - [2010.08.26 13:40:24 | 000,030,016 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\System32\uxtuneup.dll -- (UxTuneUp)
SRV - [2010.02.02 22:28:21 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2009.11.12 13:48:56 | 000,071,096 | ---- | M] () [Auto | Running] -- C:\Programme\CDBurnerXP\NMSAccessU.exe -- (NMSAccessU)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2012.01.07 11:06:55 | 000,042,672 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\system32\Drivers\fsbts.sys -- (fsbts)
DRV - [2012.01.07 11:03:55 | 000,148,632 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Programme\F-Secure\Anti-Virus\minifilter\fsgk.sys -- (F-Secure Gatekeeper)
DRV - [2012.01.06 17:52:50 | 000,072,520 | ---- | M] (F-Secure Corporation) [Kernel | System | Running] -- C:\Programme\F-Secure\HIPS\drivers\fshs.sys -- (F-Secure HIPS)
DRV - [2012.01.06 17:52:42 | 000,037,832 | ---- | M] (F-Secure Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\fses.sys -- (FSES)
DRV - [2012.01.06 17:52:32 | 000,072,840 | ---- | M] (F-Secure Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\fsdfw.sys -- (FSFW)
DRV - [2012.01.06 17:52:25 | 000,014,504 | ---- | M] () [Kernel | System | Running] -- C:\Programme\F-Secure\Anti-Virus\minifilter\fsvista.sys -- (fsvista)
DRV - [2011.09.15 13:54:06 | 000,084,512 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\vsflt58.sys -- (vidsflt58) Acronis Disk Storage Filter (58)
DRV - [2011.09.15 13:53:56 | 000,076,768 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\fltsrv.sys -- (fltsrv)
DRV - [2011.09.09 12:10:16 | 000,031,848 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rrnetcap.sys -- (RRNetCapMP)
DRV - [2011.09.09 12:10:16 | 000,031,848 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rrnetcap.sys -- (RRNetCap)
DRV - [2011.09.02 07:31:28 | 000,039,192 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2011.09.02 07:31:20 | 000,041,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2011.08.19 08:26:50 | 004,334,624 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvuvc.sys -- (LVUVC) Logitech Webcam C100(UVC)
DRV - [2011.08.17 13:03:58 | 000,137,472 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nmwcdnsu.sys -- (nmwcdnsu)
DRV - [2011.08.17 12:56:32 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2011.08.17 12:56:30 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2011.08.17 12:56:26 | 000,023,168 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2011.08.17 12:56:22 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2011.06.07 13:44:16 | 000,026,112 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tap0901.sys -- (tap0901)
DRV - [2010.03.18 10:02:32 | 000,028,624 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LUsbFilt.sys -- (LUsbFilt)
DRV - [2010.03.04 19:40:20 | 000,911,680 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\tdrpm258.sys -- (tdrpman258) Acronis Try&Decide and Restore Points filter (build 258)
DRV - [2010.02.16 11:44:26 | 000,037,920 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tbhsd.sys -- (tbhsd)
DRV - [2010.02.04 15:07:54 | 000,278,728 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2010.02.04 15:07:51 | 000,025,416 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2010.01.20 16:53:06 | 000,014,216 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\epmntdrv.sys -- (epmntdrv)
DRV - [2010.01.20 16:53:04 | 000,008,456 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\EuGdiDrv.sys -- (EuGdiDrv)
DRV - [2010.01.12 12:03:34 | 011,586,280 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2009.12.02 12:20:54 | 000,123,784 | ---- | M] (CHENGDU YIWO Tech Development Co., Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\EuDisk.sys -- (EuDisk)
DRV - [2009.11.12 13:48:56 | 000,007,168 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\StarOpen.sys -- (StarOpen)
DRV - [2009.10.14 07:24:44 | 000,010,064 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Stopped] -- C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv)
DRV - [2008.08.26 10:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008.01.21 03:23:46 | 000,016,896 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV - [2006.10.18 14:44:48 | 000,007,680 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ASACPI.sys -- (MTsensor)
DRV - [2006.01.19 02:01:00 | 000,017,280 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ctpdusb.sys -- (Jukebox3)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 08 6B 5A EA CD 14 CC 01  [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 127.0.0.1:8080
 
========== FireFox ==========
 
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://de.ask.com/?l=dis&o=102875&gct=hp"
FF - prefs.js..extensions.enabledItems: fastdial@telega.phpnet.us:3.4
FF - prefs.js..extensions.enabledItems: {ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}:1.4.2b
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6
FF - prefs.js..extensions.enabledItems: {FBF6D7FB-F305-4445-BB3D-FEF66579A033}:5.0.1
FF - prefs.js..extensions.enabledItems: {20cc25e2-48c9-45e1-9a1f-1ccc1882b81b}:1.9
FF - prefs.js..extensions.enabledItems: {1A2D0EC4-75F5-4c91-89C4-3656F6E44B68}:0.4.6
FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.4.51
FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.6.2
FF - prefs.js..extensions.enabledItems: {9AA46F4F-4DC7-4c06-97AF-5035170633FE}:22.1.11089.229
FF - prefs.js..extensions.enabledItems: {184AA5E6-741D-464a-820E-94B3ABC2F3B4}:1.0
FF - prefs.js..network.proxy.http: "218.19.119.99"
FF - prefs.js..network.proxy.http_port: 8080
FF - prefs.js..network.proxy.no_proxies_on: "127.0.0.1"
FF - prefs.js..network.proxy.socks: "127.0.0.1"
FF - prefs.js..network.proxy.socks_port: 9050
FF - prefs.js..network.proxy.socks_remote_dns: true
FF - prefs.js..network.proxy.type: 4
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@garmin.com/GpsControl: C:\Program Files\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Acrobat: C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\Felix\AppData\Roaming\5015
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\litmus-ff@f-secure.com: C:\Program Files\F-Secure\NRS\litmus-ff@f-secure.com [2012.01.07 11:04:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.12.30 20:36:36 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.01.12 17:10:52 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011.09.17 09:55:31 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2012.01.12 17:10:52 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\Felix\AppData\Roaming\5015
 
[2010.04.02 17:38:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Felix\AppData\Roaming\mozilla\Extensions
[2010.04.02 17:38:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Felix\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.01.12 14:20:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Felix\AppData\Roaming\mozilla\Firefox\Profiles\8jo8r1xj.default\extensions
[2011.01.02 11:29:05 | 000,000,000 | ---D | M] (Image Zoom) -- C:\Users\Felix\AppData\Roaming\mozilla\Firefox\Profiles\8jo8r1xj.default\extensions\{1A2D0EC4-75F5-4c91-89C4-3656F6E44B68}
[2010.12.10 16:04:48 | 000,000,000 | ---D | M] ("Facebook PhotoZoom") -- C:\Users\Felix\AppData\Roaming\mozilla\Firefox\Profiles\8jo8r1xj.default\extensions\{20cc25e2-48c9-45e1-9a1f-1ccc1882b81b}
[2011.12.20 23:04:06 | 000,000,000 | ---D | M] (FoxyProxy Standard) -- C:\Users\Felix\AppData\Roaming\mozilla\Firefox\Profiles\8jo8r1xj.default\extensions\foxyproxy@eric.h.jung
[2011.11.17 19:25:44 | 000,002,333 | ---- | M] () -- C:\Users\Felix\AppData\Roaming\Mozilla\Firefox\Profiles\8jo8r1xj.default\searchplugins\askcom.xml
[2011.02.15 10:33:46 | 000,001,729 | ---- | M] () -- C:\Users\Felix\AppData\Roaming\Mozilla\Firefox\Profiles\8jo8r1xj.default\searchplugins\linguee-de-en.xml
[2011.11.10 17:46:46 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.04.27 22:51:17 | 000,000,000 | ---D | M] (G Data WebFilter) -- C:\Programme\Mozilla Firefox\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170633FE}
[2011.07.17 19:42:47 | 000,000,000 | ---D | M] (Anti-Banner) -- C:\Programme\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak2
[2011.07.17 19:42:35 | 000,000,000 | ---D | M] (Modul zur Link-Untersuchung) -- C:\Programme\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak2
() (No name found) -- C:\USERS\FELIX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JO8R1XJ.DEFAULT\EXTENSIONS\{64161300-E22B-11DB-8314-0800200C9A66}.XPI
() (No name found) -- C:\USERS\FELIX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JO8R1XJ.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2011.12.30 20:36:36 | 000,121,816 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.10.02 14:50:40 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.10.02 14:50:40 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011.10.02 14:50:40 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.10.02 14:50:40 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.10.02 14:50:40 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.10.02 14:50:40 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Browsing Protection Class) - {C6867EB7-8350-4856-877F-93CF8AE3DC9C} - C:\Programme\F-Secure\NRS\iescript\baselitmus.dll (F-Secure Corporation)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Browsing Protection Toolbar) - {265EEE8E-3228-44D3-AEA5-F7FDF5860049} - C:\Programme\F-Secure\NRS\iescript\baselitmus.dll (F-Secure Corporation)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4 - HKLM..\Run: [F-Secure Manager] C:\Program Files\F-Secure\Common\FSM32.EXE (F-Secure Corporation)
O4 - HKLM..\Run: [F-Secure TNB] C:\Program Files\F-Secure\FSGUI\TNBUtil.exe (F-Secure Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: []  File not found
O4 - HKCU..\Run: [RocketDock] C:\Program Files\RocketDock\RocketDock.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWelcomeScreen = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoInternetOpenWith = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 01 00 00 00  [binary data]
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = Schimek.local
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DD69F594-5775-432C-B142-9B61D11EEE4C}: DhcpNameServer = 192.168.0.1
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\SDWinLogon: DllName - (SDWinLogon.dll) -  File not found
O24 - Desktop WallPaper: C:\Users\Felix\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Felix\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKCU\...exe [@ = exefile] -- Reg Error: Key error. File not found
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {1D6CC2FC-A438-0372-8A6D-914CF56896E6} - Themes Setup
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6A2C34F6-583C-6157-7A60-AD44A983836A} - 
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {A8D647C8-65AC-409F-B7B2-3C0FEE1A32F2} - C:\Program Files\PixiePack Codec Pack\InstallerHelper.exe
ActiveX: {C787FC1C-CC35-FF95-CAF2-0FA15721EEB3} - Microsoft Windows Media Player
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs: UxTuneUp - C:\Windows\System32\uxtuneup.dll (TuneUp Software)
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - State: "services" - 2
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.01.17 16:11:36 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Roaming\Malwarebytes
[2012.01.17 16:11:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.01.17 16:11:28 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.01.17 16:11:28 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.01.17 09:11:42 | 000,000,000 | ---D | C] -- C:\Program Files\PC Tools
[2012.01.17 09:07:38 | 000,185,560 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\PCTSD.sys
[2012.01.17 09:07:37 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\PC Tools
[2012.01.16 18:11:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2012.01.16 18:10:32 | 000,015,224 | ---- | C] (Safer Networking Limited) -- C:\Windows\System32\sdnclean.exe
[2012.01.16 18:10:29 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy 2
[2012.01.16 18:08:34 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2012.01.16 18:08:32 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Tools
[2012.01.16 18:08:31 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Roaming\TestApp
[2012.01.15 00:58:56 | 000,000,000 | ---D | C] -- C:\Users\Felix\Documents\Nokia Suite
[2012.01.15 00:34:32 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Roaming\F-Secure
[2012.01.14 20:15:58 | 000,000,000 | R--D | C] -- C:\Users\Felix\SafeSync
[2012.01.14 20:15:58 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Local\Trend Micro
[2012.01.14 20:15:40 | 000,000,000 | ---D | C] -- C:\ProgramData\boost_interprocess
[2012.01.14 20:14:23 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro SafeSync
[2012.01.14 20:14:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Trend Micro
[2012.01.14 20:07:51 | 000,000,000 | ---D | C] -- C:\Users\Felix\.thinupload
[2012.01.11 15:55:24 | 000,000,000 | ---D | C] -- C:\Users\Felix\Documents\GreenlineOberstufeCD
[2012.01.06 17:54:03 | 000,037,832 | ---- | C] (F-Secure Corporation) -- C:\Windows\System32\drivers\fses.sys
[2012.01.06 17:53:48 | 000,072,840 | ---- | C] (F-Secure Corporation) -- C:\Windows\System32\drivers\fsdfw.sys
[2012.01.03 18:23:01 | 000,000,000 | ---D | C] -- C:\Program Files\Seagate
[2012.01.03 18:14:19 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard
[2012.01.02 20:28:31 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Roaming\Jumping Bytes
[2012.01.02 20:28:17 | 000,000,000 | ---D | C] -- C:\Program Files\PureSync
[2012.01.02 20:28:17 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Jumping Bytes
[2011.12.29 21:25:13 | 000,000,000 | ---D | C] -- C:\Users\Felix\Documents\Discotel
[2011.12.29 21:21:31 | 000,000,000 | ---D | C] -- C:\Users\Felix\Documents\2011_10_28_Web.deClub
[2011.12.26 20:07:18 | 000,000,000 | ---D | C] -- C:\Program Files\HMA! Pro VPN
[2011.12.23 12:06:05 | 000,000,000 | ---D | C] -- C:\Program Files\ShellfireVPN
[2011.12.22 15:19:13 | 000,000,000 | ---D | C] -- C:\ProgramData\MediaMonkey
[2011.12.22 15:19:10 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Roaming\MediaMonkey
[2011.12.22 12:51:04 | 000,000,000 | ---D | C] -- C:\Users\Felix\AppData\Local\Audible
[2011.12.22 12:35:27 | 000,000,000 | ---D | C] -- C:\Users\Felix\Documents\Audible
[2011.12.22 12:35:26 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Audible
[2011.12.22 12:35:26 | 000,000,000 | ---D | C] -- C:\Program Files\Audible
[2011.12.19 21:05:20 | 000,000,000 | ---D | C] -- C:\Program Files\AutoHotkey
[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.01.17 18:27:06 | 000,681,060 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.01.17 18:27:06 | 000,641,790 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.01.17 18:27:06 | 000,148,942 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.01.17 18:27:06 | 000,123,130 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.01.17 18:22:52 | 000,354,570 | ---- | M] () -- C:\Users\Felix\Documents\Fehlermeldung Desktop.jpg
[2012.01.17 18:21:26 | 000,140,815 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2012.01.17 18:21:26 | 000,140,815 | ---- | M] () -- C:\ProgramData\nvModes.001
[2012.01.17 18:20:15 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.01.17 18:19:26 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.01.17 18:19:26 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.01.17 18:19:22 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.01.17 18:19:20 | 3488,735,232 | -HS- | M] () -- C:\hiberfil.sys
[2012.01.17 18:16:51 | 000,000,020 | ---- | M] () -- C:\Users\Felix\defogger_reenable
[2012.01.17 18:03:00 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.01.17 09:09:49 | 002,236,606 | ---- | M] () -- C:\Windows\System32\drivers\Cat.DB
[2012.01.16 18:10:42 | 000,000,318 | ---- | M] () -- C:\Windows\tasks\Scan the system (Spybot - Search & Destroy).job
[2012.01.16 18:10:42 | 000,000,310 | ---- | M] () -- C:\Windows\tasks\Refresh immunization (Spybot - Search & Destroy).job
[2012.01.16 18:10:42 | 000,000,310 | ---- | M] () -- C:\Windows\tasks\Check for updates (Spybot - Search & Destroy).job
[2012.01.16 18:10:36 | 000,001,964 | ---- | M] () -- C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
[2012.01.16 17:56:06 | 000,106,496 | ---- | M] () -- C:\Users\Felix\Desktop\nuke.exe
[2012.01.16 17:31:25 | 002,191,368 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.01.15 12:21:27 | 000,007,779 | ---- | M] () -- C:\ProgramData\2be2b9a
[2012.01.14 20:27:34 | 000,002,709 | ---- | M] () -- C:\Users\Public\Desktop\ACDSee Pro 3.lnk
[2012.01.14 20:15:40 | 000,001,902 | ---- | M] () -- C:\Users\Public\Desktop\Trend Micro SafeSync-Dateien.lnk
[2012.01.11 19:38:07 | 000,956,680 | ---- | M] () -- C:\Users\Felix\Documents\BFF-Einladungsflyer_2011_.pdf
[2012.01.10 16:17:42 | 000,023,577 | ---- | M] () -- C:\Users\Felix\Documents\DB BAHN - Stuttgart - Oberstdorf.pdf
[2012.01.07 11:06:55 | 000,042,672 | ---- | M] () -- C:\Windows\System32\drivers\fsbts.sys
[2012.01.07 01:41:43 | 000,000,016 | ---- | M] () -- C:\Windows\System32\PCProxyOff.ini
[2012.01.07 01:01:40 | 000,000,068 | ---- | M] () -- C:\Windows\MyProg.ini
[2012.01.06 18:17:56 | 000,001,818 | ---- | M] () -- C:\Users\Public\Desktop\lexiCan 4 starten.lnk
[2012.01.06 17:52:42 | 000,037,832 | ---- | M] (F-Secure Corporation) -- C:\Windows\System32\drivers\fses.sys
[2012.01.06 17:52:32 | 000,072,840 | ---- | M] (F-Secure Corporation) -- C:\Windows\System32\drivers\fsdfw.sys
[2012.01.04 22:30:46 | 000,187,677 | ---- | M] () -- C:\Users\Felix\Documents\WAV-Beiträge 2012.pdf
[2012.01.04 19:30:08 | 000,027,719 | ---- | M] () -- C:\Users\Felix\Documents\HTPC.odt
[2012.01.04 19:24:58 | 000,053,742 | ---- | M] () -- C:\Users\Felix\Documents\HTPC_Alternate.pdf
[2012.01.04 12:00:28 | 000,002,457 | ---- | M] () -- C:\Users\Public\Desktop\TubeBox! starten.lnk
[2012.01.02 20:28:18 | 000,000,846 | ---- | M] () -- C:\Users\Public\Desktop\PureSync.lnk
[2011.12.30 11:35:10 | 000,155,671 | ---- | M] () -- C:\Users\Felix\Documents\2011-12-30_Flat_Kündigung.jpg
[2011.12.29 16:45:41 | 000,001,939 | ---- | M] () -- C:\Users\Public\Documents\HMA VPN.ahk
[2011.12.26 20:05:52 | 003,434,266 | ---- | M] () -- C:\Users\Public\Documents\HMA-Pro-VPN-2.6.9-install.exe
[2011.12.26 19:54:01 | 000,221,745 | ---- | M] () -- C:\Users\Felix\Documents\HMA VPN.jpg
[2011.12.26 19:51:56 | 000,001,204 | ---- | M] () -- C:\Users\Public\Documents\KSKLB 2.ahk
[2011.12.22 13:09:52 | 000,001,158 | ---- | M] () -- C:\Users\Felix\Desktop\SciLors GrooveDownloader - Verknüpfung.lnk
[2011.12.19 21:54:42 | 000,000,784 | ---- | M] () -- C:\Users\Felix\Desktop\OperaTor - Verknüpfung.lnk
[2011.12.19 21:04:54 | 002,047,357 | ---- | M] () -- C:\Users\Public\Documents\AutoHotkey104805_Install.exe
[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.01.17 18:22:52 | 000,354,570 | ---- | C] () -- C:\Users\Felix\Documents\Fehlermeldung Desktop.jpg
[2012.01.17 18:16:32 | 000,000,020 | ---- | C] () -- C:\Users\Felix\defogger_reenable
[2012.01.17 09:07:51 | 002,236,606 | ---- | C] () -- C:\Windows\System32\drivers\Cat.DB
[2012.01.17 09:02:47 | 3488,735,232 | -HS- | C] () -- C:\hiberfil.sys
[2012.01.16 18:10:42 | 000,000,318 | ---- | C] () -- C:\Windows\tasks\Scan the system (Spybot - Search & Destroy).job
[2012.01.16 18:10:42 | 000,000,310 | ---- | C] () -- C:\Windows\tasks\Refresh immunization (Spybot - Search & Destroy).job
[2012.01.16 18:10:42 | 000,000,310 | ---- | C] () -- C:\Windows\tasks\Check for updates (Spybot - Search & Destroy).job
[2012.01.16 18:10:36 | 000,001,964 | ---- | C] () -- C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
[2012.01.16 17:59:42 | 000,106,496 | ---- | C] () -- C:\Users\Felix\Desktop\nuke.exe
[2012.01.15 12:06:14 | 000,007,779 | ---- | C] () -- C:\ProgramData\2be2b9a
[2012.01.14 20:14:31 | 000,001,902 | ---- | C] () -- C:\Users\Public\Desktop\Trend Micro SafeSync-Dateien.lnk
[2012.01.12 16:51:54 | 000,000,946 | ---- | C] () -- C:\Users\Felix\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Trillian.lnk
[2012.01.11 19:38:07 | 000,956,680 | ---- | C] () -- C:\Users\Felix\Documents\BFF-Einladungsflyer_2011_.pdf
[2012.01.10 16:17:42 | 000,023,577 | ---- | C] () -- C:\Users\Felix\Documents\DB BAHN - Stuttgart - Oberstdorf.pdf
[2012.01.07 00:10:30 | 000,000,068 | ---- | C] () -- C:\Windows\MyProg.ini
[2012.01.06 17:54:36 | 000,042,672 | ---- | C] () -- C:\Windows\System32\drivers\fsbts.sys
[2012.01.04 22:30:46 | 000,187,677 | ---- | C] () -- C:\Users\Felix\Documents\WAV-Beiträge 2012.pdf
[2012.01.04 19:30:06 | 000,027,719 | ---- | C] () -- C:\Users\Felix\Documents\HTPC.odt
[2012.01.04 19:24:58 | 000,053,742 | ---- | C] () -- C:\Users\Felix\Documents\HTPC_Alternate.pdf
[2012.01.02 20:28:18 | 000,000,846 | ---- | C] () -- C:\Users\Public\Desktop\PureSync.lnk
[2011.12.30 11:35:10 | 000,155,671 | ---- | C] () -- C:\Users\Felix\Documents\2011-12-30_Flat_Kündigung.jpg
[2011.12.26 20:23:38 | 000,001,939 | ---- | C] () -- C:\Users\Public\Documents\HMA VPN.ahk
[2011.12.26 20:05:52 | 003,434,266 | ---- | C] () -- C:\Users\Public\Documents\HMA-Pro-VPN-2.6.9-install.exe
[2011.12.26 19:54:01 | 000,221,745 | ---- | C] () -- C:\Users\Felix\Documents\HMA VPN.jpg
[2011.12.22 13:09:52 | 000,001,158 | ---- | C] () -- C:\Users\Felix\Desktop\SciLors GrooveDownloader - Verknüpfung.lnk
[2011.12.19 21:54:42 | 000,000,784 | ---- | C] () -- C:\Users\Felix\Desktop\OperaTor - Verknüpfung.lnk
[2011.12.19 21:14:59 | 000,001,204 | ---- | C] () -- C:\Users\Public\Documents\KSKLB 2.ahk
[2011.12.19 21:04:54 | 002,047,357 | ---- | C] () -- C:\Users\Public\Documents\AutoHotkey104805_Install.exe
[2011.12.06 22:11:13 | 000,000,016 | ---- | C] () -- C:\Windows\System32\PCProxyOff.ini
[2011.12.06 22:11:02 | 000,073,728 | ---- | C] () -- C:\Windows\System32\VistaInfo32.dll
[2011.11.23 16:13:14 | 000,019,472 | ---- | C] () -- C:\Windows\prodsett_copy.ini
[2011.10.18 17:03:35 | 000,000,439 | ---- | C] () -- C:\Windows\CDPlayer.ini
[2011.09.28 17:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2011.08.19 08:26:20 | 010,898,456 | ---- | C] () -- C:\Windows\System32\LogiDPP.dll
[2011.08.19 08:26:20 | 000,336,408 | ---- | C] () -- C:\Windows\System32\DevManagerCore.dll
[2011.08.19 08:26:20 | 000,104,472 | ---- | C] () -- C:\Windows\System32\LogiDPPApp.exe
[2011.08.12 11:20:14 | 000,015,896 | ---- | C] () -- C:\Windows\System32\drivers\iKeyLFT2.dll
[2011.08.08 18:18:50 | 000,000,115 | ---- | C] () -- C:\Windows\Podcasts.INI
[2011.07.26 05:48:54 | 000,028,418 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini
[2011.04.27 23:04:40 | 000,297,405 | ---- | C] () -- C:\Windows\System32\sig.bin
[2011.02.21 19:07:20 | 000,000,000 | ---- | C] () -- C:\Windows\ViewNX.INI
[2011.02.07 18:18:19 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Printer Icons
[2011.02.07 18:18:19 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLdw.DAT
[2011.02.07 18:18:19 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Receipts
[2011.02.07 18:08:38 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Pop Kit
[2011.02.07 18:08:38 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLdu.DAT
[2011.02.07 18:08:38 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Profiles
[2011.01.04 10:38:16 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
[2010.10.12 08:50:47 | 000,000,530 | ---- | C] () -- C:\Windows\System32\tx14_ic.ini
[2010.03.13 09:35:26 | 000,007,168 | ---- | C] () -- C:\Windows\System32\drivers\StarOpen.sys
[2010.03.06 01:00:17 | 000,028,672 | ---- | C] () -- C:\Windows\System32\PdeSrvps.dll
[2010.03.06 01:00:16 | 000,149,504 | ---- | C] () -- C:\Windows\UNWISE.EXE
[2010.03.06 01:00:16 | 000,006,067 | ---- | C] () -- C:\Windows\UNWISE.INI
[2010.02.04 17:03:00 | 001,692,288 | ---- | C] () -- C:\Windows\System32\BootMan.exe
[2010.02.04 17:03:00 | 000,086,408 | ---- | C] () -- C:\Windows\System32\setupempdrv03.exe
[2010.02.04 17:03:00 | 000,014,848 | ---- | C] () -- C:\Windows\System32\EuEpmGdi.dll
[2010.02.04 17:03:00 | 000,014,216 | ---- | C] () -- C:\Windows\System32\epmntdrv.sys
[2010.02.04 17:03:00 | 000,008,456 | ---- | C] () -- C:\Windows\System32\EuGdiDrv.sys
[2010.02.04 15:07:54 | 000,278,728 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2010.02.04 15:07:51 | 000,025,416 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2010.02.03 17:30:44 | 000,012,096 | ---- | C] () -- C:\Windows\System32\drivers\AsInsHelp64.sys
[2010.02.03 17:30:44 | 000,010,304 | ---- | C] () -- C:\Windows\System32\drivers\AsInsHelp32.sys
[2010.02.03 17:23:33 | 000,024,576 | R--- | C] () -- C:\Windows\System32\AsIO.dll
[2010.02.03 17:23:32 | 000,012,664 | ---- | C] () -- C:\Windows\System32\drivers\AsIO.sys
[2010.02.03 17:20:32 | 000,014,963 | ---- | C] () -- C:\Windows\Ascd_log.ini
[2010.02.03 16:52:39 | 000,007,680 | ---- | C] () -- C:\Windows\System32\drivers\ASACPI.sys
[2010.02.03 16:52:38 | 000,014,925 | ---- | C] () -- C:\Windows\Ascd_tmp.ini
[2010.02.03 12:06:20 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2010.02.03 12:06:20 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2010.02.03 12:05:24 | 000,062,976 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2010.01.31 14:47:45 | 000,004,614 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2010.01.31 13:48:25 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2010.01.31 12:59:03 | 000,140,815 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2010.01.31 12:59:03 | 000,140,815 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009.12.16 12:02:10 | 000,000,530 | ---- | C] () -- C:\Windows\System32\tx151ic.ini
[2009.11.25 13:40:50 | 000,085,504 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2008.01.21 09:31:48 | 000,681,060 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2008.01.21 09:31:48 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2008.01.21 09:31:48 | 000,148,942 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2008.01.21 09:31:48 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.11.02 13:56:48 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 13:47:43 | 002,191,368 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 11:33:01 | 000,641,790 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 11:33:01 | 000,123,130 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.10.11 04:33:58 | 000,010,288 | ---- | C] () -- C:\Windows\System32\drivers\ASUSHWIO.SYS
[1996.04.03 20:33:26 | 000,005,248 | ---- | C] () -- C:\Windows\System32\giveio.sys
 
========== LOP Check ==========
 
[2011.05.12 21:33:54 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\ACD Systems
[2011.03.19 16:21:37 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Acronis
[2011.09.15 13:40:53 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\ASCOMP Software
[2011.01.06 17:12:49 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Atari
[2010.03.13 09:35:43 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Canneverbe Limited
[2010.02.22 21:15:57 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\DAEMON Tools Lite
[2012.01.15 00:34:32 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\F-Secure
[2011.11.18 23:48:16 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\FileZilla
[2010.02.26 22:45:43 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\FreeCommander
[2011.06.10 20:19:31 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\GARMIN
[2011.02.19 12:26:12 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\gtk-2.0
[2011.11.22 23:19:38 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Jens Lorek
[2012.01.02 20:28:31 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Jumping Bytes
[2012.01.15 02:10:45 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\KeePass
[2011.02.19 12:49:11 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\keepnote
[2011.11.15 17:43:17 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\lexiCan
[2011.11.15 17:34:03 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\lexiCan 4
[2012.01.17 18:17:42 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\MediaMonkey
[2011.02.21 18:38:38 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Nikon
[2011.03.22 22:08:26 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Nokia
[2011.03.22 22:08:27 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Nokia Ovi Suite
[2010.02.23 22:33:57 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\OpenOffice.org
[2011.12.15 17:23:57 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Opera
[2010.08.23 17:38:36 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\PC Suite
[2010.07.25 15:50:33 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\PeerNetworking
[2010.08.25 18:24:22 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Red Kawa
[2012.01.17 15:47:21 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\TeraCopy
[2012.01.16 18:08:31 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\TestApp
[2010.04.20 16:18:53 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Thunderbird
[2012.01.15 00:59:36 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Trillian
[2010.06.25 17:16:48 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\TS3Client
[2010.07.19 19:48:49 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\TubeBox
[2010.02.19 15:00:02 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\TuneUp Software
[2012.01.07 01:18:55 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\uTorrent
[2011.06.08 17:48:01 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\xmldm
[2012.01.16 18:10:42 | 000,000,310 | ---- | M] () -- C:\Windows\Tasks\Check for updates (Spybot - Search & Destroy).job
[2012.01.16 18:10:42 | 000,000,310 | ---- | M] () -- C:\Windows\Tasks\Refresh immunization (Spybot - Search & Destroy).job
[2012.01.16 18:10:42 | 000,000,318 | ---- | M] () -- C:\Windows\Tasks\Scan the system (Spybot - Search & Destroy).job
[2012.01.17 18:18:09 | 000,032,562 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2010.05.19 14:17:12 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2010.02.04 17:46:42 | 000,000,000 | -HSD | M] -- C:\Boot
[2011.07.26 21:31:34 | 000,000,000 | RHSD | M] -- C:\bootwiz
[2006.11.02 14:02:24 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2010.01.31 12:35:54 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2010.02.03 17:07:18 | 000,000,000 | ---D | M] -- C:\Intel
[2010.02.19 16:53:19 | 000,000,000 | ---D | M] -- C:\My Music
[2010.02.19 14:21:23 | 000,000,000 | ---D | M] -- C:\NVIDIA
[2012.01.17 16:11:28 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.01.17 16:11:29 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2010.01.31 12:35:54 | 000,000,000 | -HSD | M] -- C:\Programme
[2011.04.16 16:07:04 | 000,000,000 | ---D | M] -- C:\Spiele
[2012.01.17 18:27:23 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011.06.01 19:52:12 | 000,000,000 | R--D | M] -- C:\Users
[2012.01.17 15:49:29 | 000,000,000 | ---D | M] -- C:\Windows
[2011.10.04 16:29:39 | 000,000,000 | RHSD | M] -- C:\Winmend~Folder~Hidden
[2011.04.30 00:04:11 | 000,000,000 | ---D | M] -- C:\xmldm
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.manifest /3 >
 
 
< MD5 for: AFD.SYS  >
[2011.04.21 14:58:27 | 000,273,408 | ---- | M] (Microsoft Corporation) MD5=3911B972B55FEA0478476B2E777B29FA -- C:\Windows\System32\drivers\afd.sys
[2011.04.21 14:58:27 | 000,273,408 | ---- | M] (Microsoft Corporation) MD5=3911B972B55FEA0478476B2E777B29FA -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.18457_none_d99fb42e5bb59d9b\afd.sys
[2011.04.21 14:16:42 | 000,273,408 | ---- | M] (Microsoft Corporation) MD5=48EB99503533C27AC6135648E5474457 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.18639_none_d7d0e0cc5e7d461c\afd.sys
[2011.04.21 14:28:53 | 000,273,920 | ---- | M] (Microsoft Corporation) MD5=70EE0FC7A0F384DBD929A01384AEEB4B -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.22629_none_da4bc33774b91967\afd.sys
[2008.01.21 03:24:43 | 000,273,920 | ---- | M] (Microsoft Corporation) MD5=763E172A55177E478CB419F88FD0BA03 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.18000_none_d7e842925e6d1f50\afd.sys
[2009.04.11 05:47:03 | 000,273,920 | ---- | M] (Microsoft Corporation) MD5=A201207363AA900ABF1A388468688570 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.18005_none_d9d3bb9e5b8eea9c\afd.sys
[2011.04.21 14:12:21 | 000,273,920 | ---- | M] (Microsoft Corporation) MD5=C8AF25017CECB75906A571AC70D2D306 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.22905_none_d876efff77862705\afd.sys
 
< MD5 for: EXPLORER.EXE  >
[2011.10.05 15:46:38 | 003,167,656 | ---- | M] (Safer-Networking Ltd.) MD5=0AB68BFCE1579A61C36B79CAAFDCE992 -- C:\Program Files\Spybot - Search & Destroy 2\explorer.exe
[2008.10.29 07:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008.10.30 04:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2008.10.28 03:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2008.01.21 03:24:50 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
 
< MD5 for: REGEDIT.EXE  >
[2008.01.21 03:25:18 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\regedit.exe
[2008.01.21 03:25:18 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6001.18000_none_f42eb564dbd8a697\regedit.exe
 
< MD5 for: USERINIT.EXE  >
[2008.01.21 03:25:16 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.21 03:25:16 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2008.01.21 03:24:09 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.21 03:24:09 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2011.12.24 17:50:20 | 000,182,856 | ---- | M] () MD5=B382935AB01B27D0E14F267DBF288896 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008.01.21 03:25:17 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2012-01-12 13:29:45
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 153 bytes -> C:\ProgramData\TEMP:DFC5A2B2
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:430C6D84

< End of report >
         

Extras:

OTL Extras logfile created on: 17.01.2012 18:24:57 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\Felix\Downloads
Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,25 Gb Total Physical Memory | 1,94 Gb Available Physical Memory | 59,69% Memory free
6,69 Gb Paging File | 5,50 Gb Available in Paging File | 82,18% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 244,14 Gb Total Space | 72,29 Gb Free Space | 29,61% Space Free | Partition Type: NTFS
Drive D: | 507,35 Gb Total Space | 418,36 Gb Free Space | 82,46% Space Free | Partition Type: NTFS
Drive E: | 634,77 Gb Total Space | 129,57 Gb Free Space | 20,41% Space Free | Partition Type: NTFS
Drive F: | 465,75 Gb Total Space | 88,87 Gb Free Space | 19,08% Space Free | Partition Type: NTFS
Drive N: | 246,00 Gb Total Space | 15,77 Gb Free Space | 6,41% Space Free | Partition Type: NTFS
 
Computer Name: FELIX-PC | User Name: Felix | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = Opera.HTML] -- C:\Program Files\Operator\Opera\Opera.exe (Opera Software)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.exe [@ = exefile] -- Reg Error: Key error. File not found
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [ACDSee Pro 3.Manage] -- "C:\Program Files\ACD Systems\ACDSee Pro\3.0\ACDSeeQVPro3.exe" "%1" (ACD Systems International Inc.)
Directory [Browse with FastStone] -- "C:\Program Files\FastStone Image Viewer\FSViewer.exe" "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [MediaMonkey.1Play] -- "C:\Program Files\MediaMonkey\MediaMonkey.exe" "%1" (Ventis Media Inc.)
Directory [MediaMonkey.2PlayNext] -- "C:\Program Files\MediaMonkey\MediaMonkey.exe" /NEXT "%1" (Ventis Media Inc.)
Directory [MediaMonkey.3Enqueue] -- "C:\Program Files\MediaMonkey\MediaMonkey.exe" /ADD "%1" (Ventis Media Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D 2 Tray Icon -- (Safer-Networking Ltd.)
"C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Enabled:Spybot-S&D 2 Scanner Service -- (Safer-Networking Ltd.)
"C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater -- (Safer-Networking Ltd.)
"C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service -- (Safer-Networking Ltd.)
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1C0ACD6A-C1F6-4BF6-96EB-B2A535A1654F}" = lport=51001 | protocol=6 | dir=in | name=adobe version cue cs4 server | 
"{232EE63D-A617-4497-B058-3B264E044C1B}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{2E275276-B3D3-4800-A939-48383F57B364}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{2FFED07C-5A0B-407C-AA7E-8A231A253C43}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{321CFE53-F971-4C29-9012-4A9F5B7AA7EA}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{35143A49-4CCD-4962-90C8-7E633471A0FD}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{389B69ED-76CE-4EF8-A8C3-9BB47CCC5EAB}" = lport=445 | protocol=6 | dir=in | app=system | 
"{3FF8210D-F486-4FCE-846D-A1AB1AE23614}" = lport=137 | protocol=17 | dir=in | app=system | 
"{40E990BD-C011-4173-8AE9-4CE4729B45E9}" = rport=445 | protocol=6 | dir=out | app=system | 
"{46A5CBC0-13BB-4098-821C-593266C344BD}" = lport=51000 | protocol=6 | dir=in | name=adobe version cue cs4 server | 
"{4B7541A6-328D-4322-8184-6CE8DF311C1E}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{74DEB213-7399-4856-887F-968E8BDC000A}" = rport=137 | protocol=17 | dir=out | app=system | 
"{81015EB2-BDE3-4041-82C6-8DC9E9245DF9}" = rport=138 | protocol=17 | dir=out | app=system | 
"{8252C436-453F-4D7A-8FDE-AB0B99C9E6ED}" = lport=138 | protocol=17 | dir=in | app=system | 
"{865832EE-E598-48D7-8CA4-A3B8769D4985}" = rport=139 | protocol=6 | dir=out | app=system | 
"{915038C3-AF9C-4715-9AF9-88F951124FEE}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{A726AA3A-351A-4BCE-9F64-6D473B302D43}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{C039FAEB-13D5-4FA8-B862-917BFB04D32B}" = lport=3704 | protocol=6 | dir=in | name=adobe version cue cs4 server | 
"{C0D5721E-B725-454E-BC95-66F3DA94D7B0}" = lport=3703 | protocol=6 | dir=in | name=adobe version cue cs4 server | 
"{C6C303F0-162C-4D25-8192-1A924CB9D895}" = lport=rpc | protocol=6 | dir=in | app=c:\program files\sisoftware\sisoftware sandra lite 2010.sp3\wnt500x86\rpcsandrasrv.exe | 
"{CF621E22-5191-47EB-AB10-5CCC8516C5DF}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{D0A694E1-49D6-4B4C-A7B1-9AEE3E016684}" = lport=rpc | protocol=6 | dir=in | app=c:\program files\sisoftware\sisoftware sandra lite 2010.sp3\wnt500x86\rpcsandrasrv.exe | 
"{F63E79F9-7472-4D9B-A22C-B098CE682FFB}" = lport=5353 | protocol=6 | dir=in | name=adobe csi cs4 | 
"{F6F2EE40-061B-49C5-B8C6-5CAE9885B512}" = lport=139 | protocol=6 | dir=in | app=system | 
"{FDFA99A7-5A61-495D-9A17-50329AABFB90}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04889BD3-B357-4963-BA7F-BEA8C6A35A76}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{0A81793D-C4F0-42F4-B702-74A46EE825BE}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\total war shogun 2 demo\shogun2.exe | 
"{0DD1715E-F176-4E19-B1C7-FC5643BEE4B4}" = protocol=6 | dir=in | app=c:\program files\empire interactive\flatout ultimate carnage\fouc.exe | 
"{1140516E-5873-4CDB-82A4-DD0CC18ADE3E}" = protocol=6 | dir=in | app=c:\program files\operator\opera\opera.exe | 
"{11E7DD34-717B-4496-A9DE-D593C68F7C4B}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{13ADE5AB-12CC-4DDA-9779-F4ECD038A37E}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\alien swarm\srcds.exe | 
"{1B669C0A-DEE3-4040-A773-E0D9CDED60CC}" = protocol=6 | dir=in | app=c:\users\felix\downloads\operator\opera\opera.exe | 
"{1E4A0303-BBDE-46AE-8210-833C85401E89}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{263EFD7D-6FF9-476F-802F-F42CE668CFD2}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\call of duty modern warfare 2\iw4mp.exe | 
"{2C4A8EB2-4CC4-4113-82FD-2A6C75225384}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{41A14FA9-ABEF-480E-8848-50524CCDBFBC}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{447AF2A1-7191-432B-8FAF-30CF5C574E9E}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\alien swarm\srcds.exe | 
"{45894EA2-D9B7-467B-A8C1-78B3D7B921A2}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{4862F5D6-6A30-4448-98DC-1DFB1622CF17}" = protocol=1 | dir=in | app=c:\program files\sisoftware\sisoftware sandra lite 2010.sp3\wnt500x86\rpcsandrasrv.exe | 
"{53C09EFA-3BE2-439D-8FF6-E595D217FD76}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{53FDEC77-3B28-4894-A410-8086E2F395EF}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe | 
"{5B8D9797-BDC8-4B9A-82F3-834D2AFB3FF7}" = protocol=17 | dir=in | app=c:\program files\operator\opera\opera.exe | 
"{5E55227C-B0A2-4B33-AABF-FC94EFC6AF18}" = protocol=6 | dir=in | app=c:\program files\common files\adobe\adobe version cue cs4\server\bin\versioncuecs4.exe | 
"{5F887659-369D-4F24-AF53-4784E786A7C1}" = protocol=17 | dir=in | app=c:\program files\common files\adobe\adobe version cue cs4\server\bin\versioncuecs4.exe | 
"{63F2ECC0-C51B-4DA6-B9F3-CFA73936495E}" = protocol=17 | dir=in | app=c:\program files\empire interactive\flatout ultimate carnage\fouc.exe | 
"{6A93952C-A489-4AD2-B1DD-D8BDA837430C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{79F1CC09-BEFF-4029-91A0-23B65E982C07}" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe | 
"{7F83E2E5-6D31-4DE7-B35D-BE5B7255C576}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\alien swarm\swarm.exe | 
"{80350780-ABD8-4D14-92BF-0BC8FD595A86}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{8EAB6DBC-BF60-4876-A6FB-F9257325A43B}" = protocol=1 | dir=in | app=c:\program files\sisoftware\sisoftware sandra lite 2010.sp3\wnt500x86\rpcsandrasrv.exe | 
"{8F5C397F-C130-4C16-B366-3E4956ECFC6B}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe | 
"{91384C3E-F4CD-42AB-997D-FEF929A1777D}" = dir=in | app=c:\program files\skype\plugin manager\skypepm.exe | 
"{98F8E27C-E72D-4CA8-83CB-939F59F2E0DA}" = protocol=6 | dir=in | app=c:\program files\common files\adobe\cs4servicemanager\cs4servicemanager.exe | 
"{A10DA155-C98C-4053-BCEE-53F2448722E6}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe | 
"{A1D80779-B995-4B75-BF11-BAD4D23238A2}" = protocol=17 | dir=in | app=c:\program files\common files\adobe\cs4servicemanager\cs4servicemanager.exe | 
"{AA3BA12C-B78E-4387-9F47-1FD1A7CF4513}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\call of duty modern warfare 2\iw4mp.exe | 
"{B2594B29-3CCF-4248-B5A3-0B07F89966B8}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{C6855F89-9C7E-494C-A9C5-D760F5FED2A2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{D5F54618-453F-4A25-A1FD-928FA8C6649D}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{D7C7F6F1-2694-4FF5-B03C-B31029CA44D0}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{DE38A8E8-55E9-4B30-B153-3487442367AC}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\total war shogun 2 demo\shogun2.exe | 
"{DEB7BB20-2B35-48F0-88BA-DCF7A05232E1}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{E5DA577B-517A-49F1-A780-9332DFFC7CED}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe | 
"{ECAABE41-7797-4418-B759-22E432E5CCB7}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{F0D5D8A6-75F4-47CF-9B5B-E2F820489A00}" = protocol=17 | dir=in | app=c:\users\felix\downloads\operator\opera\opera.exe | 
"{F8D69F62-8FF9-446C-926D-522E957B9F17}" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe | 
"{FE11E65A-58B4-442B-BBE2-3EC7749F3B88}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\alien swarm\swarm.exe | 
"TCP Query User{65E90909-A863-4E3F-B923-A5667E1CE475}C:\program files\opera\opera.exe" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe | 
"TCP Query User{6CE3BDDE-629F-46F5-B1A7-736257499847}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
"TCP Query User{95382624-51A2-4CD2-B770-7DD09A5BAD8D}C:\program files\operator\opera\opera.exe" = protocol=6 | dir=in | app=c:\program files\operator\opera\opera.exe | 
"TCP Query User{97CFFE87-62BB-4412-9493-A2D48A2B76C1}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
"TCP Query User{9A4ACCF0-FE82-4C43-B7B4-32918DBA0D36}C:\program files\operator\opera\opera.exe" = protocol=6 | dir=in | app=c:\program files\operator\opera\opera.exe | 
"TCP Query User{E1714352-6089-4A4D-916F-4E82B45FA0DD}C:\program files\opera\opera.exe" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe | 
"TCP Query User{EDFF1906-1E20-4163-BC26-35631CA74659}C:\program files\mediamonkey\mediamonkey.exe" = protocol=6 | dir=in | app=c:\program files\mediamonkey\mediamonkey.exe | 
"UDP Query User{6346CEB3-3661-4E46-8736-6C56E0D71B4A}C:\program files\mediamonkey\mediamonkey.exe" = protocol=17 | dir=in | app=c:\program files\mediamonkey\mediamonkey.exe | 
"UDP Query User{763E1037-3FF2-4B73-AEE7-C21C1E47D6E8}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
"UDP Query User{9F5848CB-0B70-4629-9744-B14CE6C04C8C}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
"UDP Query User{AAAAFC19-D82F-40D2-BC6F-9406FAE4D7A6}C:\program files\operator\opera\opera.exe" = protocol=17 | dir=in | app=c:\program files\operator\opera\opera.exe | 
"UDP Query User{AAF05C2A-8134-479C-AAE7-2C43370222F0}C:\program files\operator\opera\opera.exe" = protocol=17 | dir=in | app=c:\program files\operator\opera\opera.exe | 
"UDP Query User{BC9E1EF5-FD7D-4D9E-B067-5A9A2D1CCC5F}C:\program files\opera\opera.exe" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe | 
"UDP Query User{CE2D17C5-9E9A-4061-8F91-6EDE5DAE1308}C:\program files\opera\opera.exe" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{054EFA56-2AC1-48F4-A883-0AB89874B972}" = Adobe Extension Manager CS4
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant
"{08610298-29AE-445B-B37D-EFBE05802967}" = LWS Pictures And Video
"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler
"{098A2A49-7CF3-4F08-A38D-FB879117152A}" = Adobe Color NA Extra Settings CS4
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0D6013AB-A0C7-41DC-973C-E93129C9A29F}" = Adobe Color JA Extra Settings CS4
"{0DC0E85F-36E4-463B-B3EA-4CD8ED2222A1}" = Adobe Color EU Recommended Settings CS4
"{0DD140D3-9563-481E-AA75-BA457CBDAEF2}" = PC Inspector File Recovery
"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
"{138A4072-9E64-46BD-B5F9-DB2BB395391F}" = LWS VideoEffects
"{153F529B-694F-44D7-8C90-E9036281B3E9}" = PureSync
"{15634701-BACE-4449-8B25-1567DA8C9FD3}" = CameraHelperMsi
"{15BF7AAF-846C-4A6D-80E1-5D1FC7FB461B}" = Adobe SGM CS4
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{1651216E-E7AD-4250-92A1-FB8ED61391C9}" = LWS Help_main
"{16E16F01-2E2D-4248-A42F-76261C147B6C}" = Adobe Drive CS4
"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
"{174A3B31-4C43-43DD-866F-73C9DB887B48}" = LWS Twitter
"{1B280FAF-AE10-4E31-A41A-DB3917D651DC}" = ACDSee Pro 3
"{1B7C06E1-4888-47A6-992A-0990B9683486}" = Adobe Version Cue CS4 Server
"{1DCA3EAA-6EB5-4563-A970-EA14D75037BA}" = Adobe InDesign CS4
"{1E04CB54-AF4E-4AC3-B4B7-C0A160BE57F1}" = Adobe InDesign CS4 Icon Handler
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{21DF0294-6B9D-4741-AB6F-B2ABFBD2387E}" = LWS YouTube Plugin
"{24EE4523-711A-4BD1-95EA-F73A8A6950D3}" = Audials TV
"{24F5BFDD-18E0-41F6-8A68-A22C742FC4A1}" = TubeBox!
"{25140000-0052-0407-0000-0000000FF1CE}" = Microsoft Visio Viewer 2010 (Beta)
"{2624B969-7135-4EB1-B0F6-2D8C397B45F7}_is1" = Media Player Classic - Home Cinema v1.5.2.3456
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 16
"{26D0933F-950E-4875-811F-3FB342F9E14C}" = AudialsOne
"{2BAF2B96-7560-48B4-87D4-10178DDBE217}" = Adobe InDesign CS4 Application Feature Set Files (Roman)
"{2E5052A2-8E3D-4229-A5EB-2465B260D917}" = Audials
"{30C8AA56-4088-426F-91D1-0EDFD3A25678}" = Adobe Dreamweaver CS4
"{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}" = PDF Settings CS4
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3A6829EF-0791-4FDD-9382-C690DD0821B9}" = Adobe Flash Player 10 ActiveX
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}" = Adobe Color - Photoshop Specific CS4
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{3D654496-9C3D-4565-858C-3E551ECDA4E2}" = Virtual Cable Tester
"{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}" = Adobe WinSoft Linguistics Plugin
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{428FDF9F-E010-4C4C-A8BB-156960AFCA1C}" = Adobe Fireworks CS4
"{43509E18-076E-40FE-AF38-CA5ED400A5A9}" = Pixel Bender Toolkit
"{47C6F987-685A-41AE-B092-E75B277AEE39}" = Adobe Flash CS4 Extension - Flash Lite STI others
"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension
"{4A52555C-032A-4083-BDD9-6A85ABFB39A8}" = Adobe SING CS4
"{55EB7967-5BB1-4EA2-8AFF-B2F9E487E553}" = PC Connectivity Solution
"{587178E7-B1DF-494E-9838-FA4DD36E873C}" = ASUSUpdate
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5CF1F472-846B-44E8-9750-A2112DA32CB6}" = MemoMaster 4
"{5E0D2061-86AB-4B83-A671-A0BF3FF1537B}_is1" = Vokabel Trainer 5
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{60DB5894-B5A1-4B62-B0F3-669A22C0EE5D}" = Adobe Dynamiclink Support
"{63C24A08-70F3-4C8E-B9FB-9F21A903801D}" = Adobe Color Video Profiles CS CS4
"{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}" = Adobe Photoshop CS4 Support
"{651B1863-7EEF-4C6F-AC77-614C6A1CC807}" = FastPictureViewer 1.6 (32-bit)
"{65F9E1F3-A2C1-4AA9-9F33-A3AEB0255F0E}" = Garmin USB Drivers
"{67F0E67A-8E93-4C2C-B29D-47C48262738A}" = Adobe Device Central CS4
"{68243FF8-83CA-466B-B2B8-9F99DA5479C4}" = AdobeColorCommonSetCMYK
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6CF27348-9B8F-439D-9C50-923F435B0B44}" = lexiCan 4.0
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6F76EC3C-34B1-436E-97FB-48C58D7BEDCD}" = LWS Gallery
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71E66D3F-A009-44AB-8784-75E2819BA4BA}" = LWS Motion Detection
"{7223945A-F037-4AE1-92F9-BA8304F0E21A}" = TubeBox!
"{7C3108A4-350C-4D49-8121-360B4C0061B6}_is1" = Fast Empty Folder Finder
"{7CC7BDD5-6F10-4724-96A1-EAC7D9F2831C}" = Adobe InDesign CS4 Common Base Files
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{7EE873AF-46BB-4B5D-BA6F-CFE4B0566E22}" = TuneUp Utilities Language Pack (de-DE)
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}" = Microsoft Games for Windows - LIVE Redistributable
"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4
"{83C8FA3C-F4EA-46C4-8392-D3CE353738D6}" = LWS Launcher
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{87441A59-5E64-4096-A170-14EFE67200C3}" = Picture Control Utility
"{87532CAB-7932-4F84-8937-823337622807}" = Adobe Illustrator CS4
"{8937D274-C281-42E4-8CDB-A0B2DF979189}" = LWS Webcam Software
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8D1E61D1-1395-4E97-997F-D002DB3A5074}" = OpenOffice.org 3.2
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90850407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Word Viewer 2003
"{931AB7EA-3656-4BB7-864D-022B09E3DD67}" = Adobe Linguistics CS4
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{95140000-00AF-0407-0000-0000000FF1CE}" = Microsoft PowerPoint Viewer
"{98613C99-1399-416C-A07C-1EE1C585D872}" = SeaTools for Windows
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9DAEA76B-E50F-4272-A595-0124E826553D}" = LWS WLM Plugin
"{A128921B-D03F-4BFB-8141-C365AA48D660}" = Adobe Setup
"{A2433A63-5F5D-40E5-B529-9123C2B3E734}" = Anno 1701
"{A2881E09-38DB-4F79-9135-00FDA01768A7}" = Adobe Creative Suite 4 Design Premium
"{A78C31B1-317F-48A7-9D53-244B9660BF08}" = AI Gear2
"{A89768CF-CD21-44FD-A723-16D5A8557415}" = NEF Codec
"{A8D647C8-65AC-409F-B7B2-3C0FEE1A32F2}" = PixiePack Codec Pack
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AC76BA86-1033-F400-7760-000000000004}" = Adobe Acrobat 9 Pro - English, Français, Deutsch
"{AC76BA86-1033-F400-7760-000000000004}_950" = Adobe Acrobat 9.5.0 - CPSID_83708
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{AF88496B-4BBA-4922-97E9-2582D3A28358}" = Nokia Connectivity Cable Driver
"{B1EE1CC5-6CED-4801-BFFF-8454F21A245A}" = Garmin Communicator Plugin
"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect
"{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1" = Spybot - Search & Destroy 2
"{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494}" = Adobe Photoshop CS4
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Plus Web Player
"{B9F4561A-924D-4510-A85A-BB0960C338CB}" = Adobe Asset Services CS4
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{BD3374D3-C2E6-42B7-A80B-E850B6886246}" = Adobe Flash CS4 STI-other
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{C7C82ED1-E5AD-48CF-8B92-38DD9B49610C}" = Garmin TOPO Deutschland 2010
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}" = Nikon Message Center
"{D3397488-6A10-4972-A4B5-1CA41FBDB25A}" = Opera 11.60
"{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}" = TuneUp Utilities
"{D40EB009-0499-459c-A8AF-C9C110766215}" = Logitech Webcam-Software
"{D944236D-7992-41D6-8257-930B5832F1CC}" = Creative Zen Micro
"{DB24A9E5-A068-43DD-88D0-B51BED3C0B99}" = Nokia Suite
"{DEB90B8E-0DCB-48CE-B90E-8842A2BD643E}" = Adobe Media Encoder CS4
"{E3B64CC5-C011-40C0-92BC-7316CD5E5688}" = Microsoft_VC100_CRT_SP1_x86
"{E503B4BF-F7BB-3D5F-8BC8-F694B1CFF942}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218
"{E9757890-7EC5-46C8-99AB-B00F07B6525C}" = Nikon Transfer
"{EED027B7-0DB6-404B-8F45-6DFEE34A0441}" = LWS Video Mask Maker
"{F007CBCE-D714-4C0B-8CE9-9B0D78116468}" = ViewNX
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F6E99614-F042-4459-82B7-8B38B2601356}" = Adobe Flash CS4
"{F7338FA3-DAB5-49B2-900D-0AFB5760C166}" = PC Probe II
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}" = Adobe Fonts All
"{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR
"{FF167195-9EE4-46C0-8CD7-FBA3457E88AB}" = LWS Facebook
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"49CF605F02C7954F4E139D18828DE298CD59217C" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (06/03/2009 2.3.0.0)
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"7-Zip" = 7-Zip 4.65
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe_55230b0b70661df0f212e88f0b655f7" = Adobe Creative Suite 4 Design Premium
"Album Art Downloader XUI" = Album Art Downloader XUI 0.43
"Anti-Twin 2011-01-03 18.28.52" = Anti-Twin (Installation 03.01.2011)
"AutoHotkey" = AutoHotkey 1.0.48.05
"BackUp Maker_is1" = BackUp Maker v6.3
"Creative Jukebox Driver" = Creative Jukebox Driver
"Creative Removable Disk Manager" = Creative Removable Disk Manager
"EASEUS Partition Master Home Edition_is1" = EASEUS Partition Master 5.0.1 Home Edition
"FastStone Image Viewer" = FastStone Image Viewer 4.1
"ffdshow_is1" = ffdshow [rev 3154] [2009-12-09]
"FileZilla Client" = FileZilla Client 3.5.2
"FlatOut Ultimate Carnage" = FlatOut Ultimate Carnage
"FreeCommander_is1" = FreeCommander 2009.02b
"F-Secure Product 444" = F-Secure Internet Security 2011
"HFRS_is1" = Trend Micro SafeSync
"JDownloader" = JDownloader
"KeePass Password Safe_is1" = KeePass Password Safe 1.17
"KeePassPasswordSafe2_is1" = KeePass Password Safe 2.16
"KeepNote_is1" = KeepNote 0.6.8
"lexiCan 4.0 4.0.1" = lexiCan 4.0
"lvdrivers_12.10" = Logitech Webcam Software-Treiberpaket
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.60.0.1800
"MediaMonkey_is1" = MediaMonkey 4.0
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Mozilla Firefox 9.0.1 (x86 de)" = Mozilla Firefox 9.0.1 (x86 de)
"Mozilla Thunderbird (8.0)" = Mozilla Thunderbird (8.0)
"Nokia Suite" = Nokia Suite
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"Opera 11.60.1185" = Opera 11.60
"phase-6" = phase-6 2.1.1.1a
"PixelRuler_is1" = PixelRuler v8.0.0.0
"PureSync" = PureSync 3.5.0
"QuicktimeAlt_is1" = QuickTime Alternative 3.2.2
"RocketDock_is1" = RocketDock 1.3.5
"SP6" = Logitech SetPoint 6.32
"Steam App 10180" = Call of Duty: Modern Warfare 2
"Steam App 10190" = Call of Duty: Modern Warfare 2 - Multiplayer
"Steam App 34350" = Total War: SHOGUN 2 Demo
"Steam App 630" = Alien Swarm
"SysInfo" = Creative-Systeminformationen
"TeraCopy_is1" = TeraCopy 2.12
"Transcribe!_is1" = Transcribe! 7.31
"Trillian" = Trillian
"TuneUp Utilities" = TuneUp Utilities
"uTorrent" = µTorrent
"XMind" = XMind
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Battle for Wesnoth 1.8.3" = Battle for Wesnoth 1.8.3
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >
         

Ich hoffe ihr könnt mir helfen.
LG

Genauer habe ich folgende Programme benutzt:
PCTools Nuke
Spybot Search&Destroy
Avira Antivir
Malwarebytes AntiMalware

Wo sind die Logs dazu? Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

 hier steht das Log
         

hier die Logs die ich noch finden konnte:

Spybot Search&Destroy:

Search results from Spybot - Search & Destroy

16.01.2012 18:23:01
Scan took 00:09:56.

Statcounter: [SBI $7F76510F] Tracking cookie (Internet Explorer (User): Felix) (Browser: Cookie, nothing done)
  

Right Media: [SBI $7F76510F] Tracking cookie (Internet Explorer (User): Felix) (Browser: Cookie, nothing done)
  

MediaPlex: [SBI $7F76510F] Tracking cookie (Internet Explorer (User): Felix) (Browser: Cookie, nothing done)
  

Tradedoubler: [SBI $7F76510F] Tracking cookie (Internet Explorer (User): Felix) (Browser: Cookie, nothing done)
  

CasaleMedia: [SBI $7F76510F] Tracking cookie (Internet Explorer (User): Felix) (Browser: Cookie, nothing done)
  

DoubleClick: [SBI $7F76510F] Tracking cookie (Internet Explorer (User): Felix) (Browser: Cookie, nothing done)
  

WebTrends live: [SBI $7F76510F] Tracking cookie (Internet Explorer (User): Felix) (Browser: Cookie, nothing done)
  

MediaPlex: [SBI $7F76510F] Tracking cookie (Internet Explorer (User): Felix) (Browser: Cookie, nothing done)
  

DoubleClick: [SBI $7F76510F] Tracking cookie (Firefox: Felix (default)) (Browser: Cookie, nothing done)
  

Tradedoubler: [SBI $7F76510F] Tracking cookie (Firefox: Felix (default)) (Browser: Cookie, nothing done)
  

Tradedoubler: [SBI $7F76510F] Tracking cookie (Firefox: Felix (default)) (Browser: Cookie, nothing done)
  

WebTrends live: [SBI $7F76510F] Tracking cookie (Firefox: Felix (default)) (Browser: Cookie, nothing done)
  

Statcounter: [SBI $7F76510F] Tracking cookie (Firefox: Felix (default)) (Browser: Cookie, nothing done)
  

Log: [SBI $7F76510F]  Activity: ntbtlog.txt (File, nothing done)
  C:\Windows\ntbtlog.txt
  Properties.size=573356
  Properties.md5=7617C75781053BC95D353FF3848111F5
  Properties.filedate=1326734580
  Properties.filedatetext=2012-01-16 18:23:00

Log: [SBI $7F76510F]  Install: comsetup.log (File, nothing done)
  C:\Windows\comsetup.log
  Properties.size=493
  Properties.md5=8E6678D52E0A844C69F171E4C0E7D8CD
  Properties.filedate=1264940474
  Properties.filedatetext=2010-01-31 13:21:14

Log: [SBI $7F76510F]  Install: Directx.log (File, nothing done)
  C:\Windows\Directx.log
  Properties.size=231931
  Properties.md5=1CF554BE81405F70A67DBEB1CF596E8F
  Properties.filedate=1308778938
  Properties.filedatetext=2011-06-22 22:42:18

Log: [SBI $7F76510F]  Install: setupact.log (File, nothing done)
  C:\Windows\setupact.log
  Properties.size=137009
  Properties.md5=58978226F19128B6EB0A00FF2A972078
  Properties.filedate=1324553930
  Properties.filedatetext=2011-12-22 12:38:50

Log: [SBI $7F76510F]  Install: setupapi.log (File, nothing done)
  C:\Windows\setupapi.log
  Properties.size=94
  Properties.md5=7DCF473391ED652447DF2C62BE835551
  Properties.filedate=1162471676
  Properties.filedatetext=2006-11-02 13:47:56

Log: [SBI $7F76510F]  Install: DtcInstall.log (File, nothing done)
  C:\Windows\DtcInstall.log
  Properties.size=3257
  Properties.md5=87999EBF6A2F2294B825612F94C7E54F
  Properties.filedate=1264937230
  Properties.filedatetext=2010-01-31 12:27:10

Log: [SBI $7F76510F]  Shutdown: System32\wbem\logs\wmiprov.log (File, nothing done)
  C:\Windows\System32\wbem\logs\wmiprov.log
  Properties.size=8064
  Properties.md5=3B1109B4AAB74B245083A8F6FC0DA1E3
  Properties.filedate=1326733795
  Properties.filedatetext=2012-01-16 18:09:54

7-Zip: [SBI $B0066D4E] Compressed archives history (Registry Key, nothing done)
  HKEY_USERS\.DEFAULT\Software\7-ZIP\Compression\ArcHistory

7-Zip: [SBI $B0066D4E] Compressed archives history (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1138322658-3541545370-464644935-1001\Software\7-ZIP\Compression\ArcHistory

7-Zip: [SBI $B0066D4E] Compressed archives history (Registry Key, nothing done)
  HKEY_USERS\S-1-5-18\Software\7-ZIP\Compression\ArcHistory

7-Zip: [SBI $0D2606FE] Extracted archives history (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1138322658-3541545370-464644935-1001\Software\7-ZIP\Extraction\PathHistory

7-Zip: [SBI $12C3A52C] Folder history (Registry Value, nothing done)
  HKEY_USERS\S-1-5-21-1138322658-3541545370-464644935-1001\Software\7-ZIP\FM\FolderHistory

7-Zip: [SBI $3D5692BD] Last used folder (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1138322658-3541545370-464644935-1001\Software\7-ZIP\FM\PanelPath0

Gabest Media Player Classic: [SBI $E81D76E1] Last captured file (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1138322658-3541545370-464644935-1001\Software\Gabest\Media Player Classic\Capture\FileName

Gabest Media Player Classic: [SBI $A8B11633] Recent file list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1138322658-3541545370-464644935-1001\Software\Gabest\Media Player Classic\Recent File List

Internet Explorer: [SBI $1E8157BE] Typed URL list (Registry Key, nothing done)
  HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\TypedURLs

Internet Explorer: [SBI $1E8157BE] Typed URL list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1138322658-3541545370-464644935-1001\Software\Microsoft\Internet Explorer\TypedURLs

Internet Explorer: [SBI $1E8157BE] Typed URL list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\TypedURLs

Internet Explorer: [SBI $FF589D0C] Download directory (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1138322658-3541545370-464644935-1001\Software\Microsoft\Internet Explorer\Download Directory

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
  HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
  HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
  HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1138322658-3541545370-464644935-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
  HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

MS Management Console: [SBI $ECD50EAD] Recent command list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1138322658-3541545370-464644935-1001\Software\Microsoft\Microsoft Management Console\Recent File List

MS Media Player: [SBI $E48560B4] Recent file list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1138322658-3541545370-464644935-1001\Software\Microsoft\MediaPlayer\Player\RecentFileList

MS Media Player: [SBI $5C51E349] Client ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1138322658-3541545370-464644935-1001\Software\Microsoft\MediaPlayer\Player\Settings\Client ID

MS Direct3D: [SBI $7FB7B83F] Most recent application (Registry Change, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
  HKEY_USERS\.DEFAULT\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1138322658-3541545370-464644935-1001\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-18\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS DirectDraw: [SBI $EB49D5AF] Most recent application (Registry Change, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication\Name

MS DirectInput: [SBI $9A063C91] Most recent application (Registry Change, nothing done)
  HKEY_USERS\.DEFAULT\Software\Microsoft\DirectInput\MostRecentApplication\Name

MS DirectInput: [SBI $9A063C91] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1138322658-3541545370-464644935-1001\Software\Microsoft\DirectInput\MostRecentApplication\Name

MS DirectInput: [SBI $9A063C91] Most recent application (Registry Change, nothing done)
  HKEY_USERS\S-1-5-18\Software\Microsoft\DirectInput\MostRecentApplication\Name

MS DirectInput: [SBI $7B184199] Most recent application ID (Registry Change, nothing done)
  HKEY_USERS\.DEFAULT\Software\Microsoft\DirectInput\MostRecentApplication\Id

MS DirectInput: [SBI $7B184199] Most recent application ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1138322658-3541545370-464644935-1001\Software\Microsoft\DirectInput\MostRecentApplication\Id

MS DirectInput: [SBI $7B184199] Most recent application ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-18\Software\Microsoft\DirectInput\MostRecentApplication\Id

MS Office 11.0: [SBI $53EEAC4B] Last opened-from-web file (Registry Value, nothing done)
  HKEY_USERS\S-1-5-21-1138322658-3541545370-464644935-1001\Software\Microsoft\Office\11.0\Common\Internet\UseRWHlinkNavigation

MS Paint: [SBI $07867C39] Recent file list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1138322658-3541545370-464644935-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List

MS Regedit: [SBI $C3B62FC1] Recent open key (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1138322658-3541545370-464644935-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit\LastKey

MS Wordpad: [SBI $4C02334D] Recent file list (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1138322658-3541545370-464644935-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List

Windows.OpenWith: [SBI $787DC1A1] Open with list - .001 extension (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1138322658-3541545370-464644935-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.001\OpenWithList

Windows.OpenWith: [SBI $82C6CF83] Open with list - .AA extension (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1138322658-3541545370-464644935-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AA\OpenWithList

Windows.OpenWith: [SBI $F6D91293] Open with list - .AI extension (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1138322658-3541545370-464644935-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AI\OpenWithList

Windows.OpenWith: [SBI $F7204896] Open with list - .AVI extension (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1138322658-3541545370-464644935-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AVI\OpenWithList

Windows.OpenWith: [SBI $A1C94E79] Open with list - .BMP extension (Registry Key, nothing done)
  HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BMP\OpenWithList

Windows.OpenWith: [SBI $A1C94E79] Open with list - .BMP extension (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1138322658-3541545370-464644935-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BMP\OpenWithList

Windows.OpenWith: [SBI $A1C94E79] Open with list - .BMP extension (Registry Key, nothing done)
  HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BMP\OpenWithList

Windows.OpenWith: [SBI $B6B2B96E] Open with list - .CHM extension (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1138322658-3541545370-464644935-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CHM\OpenWithList

Windows.OpenWith: [SBI $7E93AD81] Open with list - .CSS extension (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1138322658-3541545370-464644935-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CSS\OpenWithList

Windows Explorer: [SBI $8390E60B] Network map history (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1138322658-3541545370-464644935-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Map Network Drive MRU

Windows Explorer: [SBI $7308A845] Run history (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1138322658-3541545370-464644935-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

Windows Explorer: [SBI $2026AFB6] User Assistant history IE (Registry Key, nothing done)
  HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count

Windows Explorer: [SBI $2026AFB6] User Assistant history IE (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1138322658-3541545370-464644935-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count

Windows Explorer: [SBI $2026AFB6] User Assistant history IE (Registry Key, nothing done)
  HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count

Windows Explorer: [SBI $6107D172] User Assistant history files (Registry Key, nothing done)
  HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count

Windows Explorer: [SBI $6107D172] User Assistant history files (Registry Key, nothing done)
  HKEY_USERS\S-1-5-21-1138322658-3541545370-464644935-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count

Windows Explorer: [SBI $6107D172] User Assistant history files (Registry Key, nothing done)
  HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count

Windows Media SDK: [SBI $37AAEDE6] Computer name (Registry Change, nothing done)
  HKEY_USERS\.DEFAULT\Software\Microsoft\Windows Media\WMSDK\General\ComputerName

Windows Media SDK: [SBI $37AAEDE6] Computer name (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1138322658-3541545370-464644935-1001\Software\Microsoft\Windows Media\WMSDK\General\ComputerName

Windows Media SDK: [SBI $37AAEDE6] Computer name (Registry Change, nothing done)
  HKEY_USERS\S-1-5-18\Software\Microsoft\Windows Media\WMSDK\General\ComputerName

Windows Media SDK: [SBI $CAA58B6E] Unique ID (Registry Change, nothing done)
  HKEY_USERS\.DEFAULT\Software\Microsoft\Windows Media\WMSDK\General\UniqueID

Windows Media SDK: [SBI $CAA58B6E] Unique ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-21-1138322658-3541545370-464644935-1001\Software\Microsoft\Windows Media\WMSDK\General\UniqueID

Windows Media SDK: [SBI $CAA58B6E] Unique ID (Registry Change, nothing done)
  HKEY_USERS\S-1-5-18\Software\Microsoft\Windows Media\WMSDK\General\UniqueID

Windows Media SDK: [SBI $BACCD0DA] Volume serial number (Registry Value, nothing done)
  HKEY_USERS\.DEFAULT\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber

Windows Media SDK: [SBI $BACCD0DA] Volume serial number (Registry Value, nothing done)
  HKEY_USERS\S-1-5-21-1138322658-3541545370-464644935-1001\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber

Windows Media SDK: [SBI $BACCD0DA] Volume serial number (Registry Value, nothing done)
  HKEY_USERS\S-1-5-18\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber

Cookie: [SBI $49804B54] Browser: Cookie (233) (Browser: Cookie, nothing done)
  

Cache: [SBI $49804B54] Browser: Cache (2003) (Browser: Cache, nothing done)
  

History: [SBI $49804B54] Browser: History (575) (Browser: History, nothing done)
  

History: [SBI $49804B54] Browser: History (1000) (Browser: History, nothing done)
  

Cookie: [SBI $49804B54] Browser: Cookie (1895) (Browser: Cookie, nothing done)
  

Cookie: [SBI $49804B54] Browser: Cookie (3) (Browser: Cookie, nothing done)
  


--- Spybot - Search & Destroy version: 2.0.6.131  DLL (build: 20111005) ---

2011-10-05 blindman.exe (2.0.6.151)
2011-10-05 explorer.exe (2.0.6.170)
2003-04-18 ntrights.exe
2011-10-05 SDBootCD.exe (2.0.6.108)
2011-10-05 SDCleaner.exe (2.0.6.106)
2011-10-05 SDDelFile.exe (2.0.6.94)
2011-10-05 SDFiles.exe (2.0.6.127)
2011-10-05 SDFSSvc.exe (2.0.6.196)
2011-10-05 SDHookHelper.exe (2.0.6.1)
2011-10-05 SDHookInst32.exe (2.0.6.1)
2011-10-05 SDHookSvc.exe (2.0.6.1)
2011-10-05 SDImmunize.exe (2.0.6.125)
2011-10-05 SDLogReport.exe (2.0.6.104)
2011-10-05 SDMain.exe (2.0.6.92)
2011-10-05 SDPhoneScan.exe (2.0.6.27)
2011-10-05 SDPrepPos.exe (2.0.6.10)
2011-10-05 SDQuarantine.exe (2.0.6.102)
2011-10-05 SDRootAlyzer.exe (2.0.6.114)
2011-10-05 SDScan.exe (2.0.6.170)
2011-10-05 SDSettings.exe (2.0.6.112)
2011-10-05 SDShred.exe (2.0.6.104)
2011-10-05 SDSysRepair.exe (2.0.6.101)
2011-10-05 SDTools.exe (2.0.6.141)
2011-10-05 SDTray.exe (2.0.6.122)
2011-10-05 SDUpdate.exe (2.0.6.84)
2011-10-05 SDUpdSvc.exe (2.0.6.76)
2011-10-05 SDWelcome.exe (2.0.6.119)
2011-10-05 SDWSCSvc.exe (2.0.6.1)
2012-01-16 unins000.exe (51.52.0.0)
1999-12-02 xcacls.exe
2007-04-02 aports.dll (2.1.0.0)
2006-03-03 borlndmm.dll (10.0.2288.42451)
2010-09-06 DelZip190.dll (1.9.0.87)
2009-10-01 pcrelib.dll
2011-10-05 SDAdvancedCheckLibrary.dll (2.0.6.98)
2011-10-05 SDDialogs.dll (2.0.6.13)
2011-10-05 SDECon32.dll (2.0.6.113)
2011-10-05 SDEvents.dll (2.0.6.2)
2011-10-05 SDHelper.dll (2.0.6.88)
2011-10-05 SDHook32.dll (2.0.6.1)
2011-10-05 SDImmunizeLibrary.dll (2.0.6.1)
2011-10-05 sdinsTasks.dll (1.0.0.10)
2011-10-05 SDLists.dll (2.0.6.4)
2011-10-05 SDResources.dll (2.0.6.1)
2011-10-05 SDScanLibrary.dll (2.0.6.131)
2011-10-05 SDWinLogon.dll (2.0.6.0)
2011-04-20 sqlite3.dll
2011-10-05 Tools.dll (2.0.6.36)
2011-10-05 UninsSrv.dll (1.0.0.0)
2011-03-18 Includes\Adware.sbi (*)
2011-05-09 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2010-12-14 Includes\Dialer.sbi (*)
2011-03-08 Includes\DialerC.sbi (*)
2011-02-24 Includes\HeavyDuty.sbi (*)
2011-03-29 Includes\Hijackers.sbi (*)
2011-03-29 Includes\HijackersC.sbi (*)
2010-09-15 Includes\iPhone.sbi (*)
2010-12-14 Includes\Keyloggers.sbi (*)
2011-03-08 Includes\KeyloggersC.sbi (*)
2011-04-05 Includes\Malware.sbi (*)
2011-05-09 Includes\MalwareC.sbi (*)
2011-02-24 Includes\PUPS.sbi (*)
2011-03-15 Includes\PUPSC.sbi (*)
2011-02-24 Includes\Security.sbi (*)
2011-05-03 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2011-02-24 Includes\Spyware.sbi (*)
2011-05-10 Includes\SpywareC.sbi (*)
2010-03-08 Includes\Tracks.uti (*)
2010-12-28 Includes\Trojans.sbi (*)
2011-05-11 Includes\TrojansC-02.sbi (*)
2011-05-11 Includes\TrojansC-03.sbi (*)
2011-05-11 Includes\TrojansC-04.sbi (*)
2011-05-11 Includes\TrojansC-05.sbi (*)
2011-05-11 Includes\TrojansC.sbi (*)
         

Malwarebytes Anti-Malware :

Malwarebytes Anti-Malware 1.60.0.1800
www.malwarebytes.org

Datenbank Version: v2012.01.17.02

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Felix :: FELIX-PC [Administrator]

17.01.2012 16:16:30
mbam-log-2012-01-17 (16-16-30).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 538885
Laufzeit: 1 Stunde(n), 38 Minute(n), 47 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 1
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|Userinit (Hijack.UserInit) -> Bösartig: (C:\Windows\system32\userinit.exe,C:\Users\Felix\AppData\Roaming\appconf32.exe,C:\Users\Felix\AppData\Roaming\appconf32.exe,) Gut: (userinit.exe) -> Erfolgreich ersetzt und in Quarantäne gestellt.

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\Spiele\RollerCoaster Tycoon 3\Erweiterungen\Neue\stuk71_hangar51\stuk71_Hangar51.exe (Adware.Onlinegames) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Gast\Downloads\MediaMonkey.Gold.v3.2.0.1294.Multilingual.Incl.Keymaker-CORE\MediaMonkey.Gold.v3.2.0.1294.Multilingual.Incl.Keymaker-CORE\keygen.exe.vir (Trojan.Dropper.PGen) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
         

Sollte ich wegen der Schadsoftware noch was tun? Bis jetzt ist mir nichts mehr aufgefallen.

LG Felix

C:\Users\Gast\Downloads\MediaMonkey.Gold.v3.2.0.1294.Multilingual.Incl.Keymaker-CORE

Siehe auch => http://www.trojaner-board.de/95393-c...-software.html

Falls wir Hinweise auf illegal erworbene Software finden, werden wir den Support ohne jegliche Diskussion beenden.

Cracks/Keygens sind zu 99,9% gefährliche Schädlinge, mit denen man nicht spaßen sollte. Ausserdem sind diese illegal und wir unterstützen die Verwendung von geklauter Software nicht. Somit beschränkt sich der Support auf Anleitung zur kompletten Neuinstallation!!

Dass illegale Cracks und Keygens im Wesentlichen dazu dienen, Malware zu verbreiten ist kein Geheimnis und muss jedem klar sein!


In Zukunft Finger weg von: Softonic, Registry-Bereinigern und illegalem Zeugs Cracks/Keygens/Serials