Also ich bitte um eine Analyse da mir sämtliche Passwörter geändert wurden.
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:01:41, on 08.02.2012
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16912)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
C:\Windows\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Windows\vVX3000.exe
C:\Windows\Samsung\PanelMgr\SSMMgr.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\CyberLink\PowerDVD10\PDVD10Serv.exe
C:\Program Files\CyberLink\Shared files\brs.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe
C:\Program Files\Steam\Steam.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Windows\System32\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\System32\cmd.exe
C:\Windows\system32\conhost.exe
C:\Users\Rox\AppData\Roaming\Realtek\Realtek.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\MediaMonkey\MediaMonkey.exe
C:\Users\Rox\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Rox\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Rox\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Rox\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Rox\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Rox\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\rundll32.exe
C:\Users\Rox\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Rox\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Rox\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Rox\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Rox\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Rox\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Rox\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Rox\Music\Downloads\HiJackThis204.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: (no name) - {EEE6C35D-6118-11DC-9C72-001320C79847} - (no file)
F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe,C:\Users\Rox\AppData\Roaming\Realtek\Realtek.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [VX3000] C:\Windows\vVX3000.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\SSMMgr.exe /autorun
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [RemoteControl10] "C:\Program Files\CyberLink\PowerDVD10\PDVD10Serv.exe"
O4 - HKLM\..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared files\brs.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
O4 - HKCU\..\Run: [ArchosLink] C:\Program Files\Archos\ArchosLink\ArchosLink.exe /swmin
O4 - HKCU\..\Run: [Google Update] "C:\Users\Rox\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [KPeerNexonEU] C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe
O4 - HKCU\..\Run: [Java Update] C:\Users\Rox\AppData\Local\Temp\\Java_Updater.exe
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ7.4\ICQ.exe" silent loginmode=4
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Wisdom-soft AutoScreenRecorder 3.1 Free] 0
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [HKCU] C:\Users\Rox\AppData\Roaming\install\Adobee.exe
O4 - HKCU\..\Run: [Realtek] C:\Users\Rox\AppData\Roaming\Realtek\Realtek.exe
O4 - Startup: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Abonnieren ArchosLink - file://C:\Program Files\Archos\ArchosLink\\script.js
O8 - Extra context menu item: Free YouTube Download - C:\Users\Rox\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Rox\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Dienst "Bonjour" (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update-Dienst (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: LogMeIn Hamachi Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MySQL55 - Unknown owner - C:\Program.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: TunngleService - Tunngle.net GmbH - C:\Program Files\Tunngle\TnglCtrl.exe

--
End of file - 12188 bytes


Sämtliche Punkte wo mein Name aufgetaucht ist wurde mit "Rox" überschrieben.

hi,
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

• Starte bitte die
  OTL.exe
  .
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Kopiere nun den Inhalt in die
  Textbox.

activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
         

• Schliesse bitte nun alle Programme. (Wichtig)
• Klicke nun bitte auf den Quick Scan Button.
• Kopiere
  nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

OTL EXTRAS Logfile:

OTL Extras logfile created on: 09.02.2012 13:51:47 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\Rox\Desktop
 Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,05 Gb Available Physical Memory | 68,48% Memory free
6,00 Gb Paging File | 4,81 Gb Available in Paging File | 80,25% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 698,63 Gb Total Space | 318,94 Gb Free Space | 45,65% Space Free | Partition Type: NTFS
Drive E: | 232,88 Gb Total Space | 39,27 Gb Free Space | 16,86% Space Free | Partition Type: NTFS
Drive G: | 232,88 Gb Total Space | 63,00 Gb Free Space | 27,05% Space Free | Partition Type: NTFS
 
Computer Name: ROX-PC | User Name: Rox | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [MediaMonkey.1Play] -- "C:\Program Files\MediaMonkey\MediaMonkey.exe" "%1" (Ventis Media Inc.)
Directory [MediaMonkey.2PlayNext] -- "C:\Program Files\MediaMonkey\MediaMonkey.exe" /NEXT "%1" (Ventis Media Inc.)
Directory [MediaMonkey.3Enqueue] -- "C:\Program Files\MediaMonkey\MediaMonkey.exe" /ADD "%1" (Ventis Media Inc.)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~3\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 1
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{03E51094-E59C-11D5-873A-0050DABC2539}" = Tropico: Paradise Island
"{0481A2EA-DA1D-4D10-A7C3-F8237948F6B5}" = Messenger Companion
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{090C73E1-BB48-403D-9DFF-A60FD71FF73A}" = MySQL Connector J
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0CE1A6C0-F3F7-49E6-8F9D-2431F9827441}" = Guitar Hero III
"{14A487F2-1259-4E6C-AE3C-3C888DDBCB60}_is1" = Guitar Pro 6
"{15F02176-0D12-4FAF-B2CD-2767C7781427}" = Google SketchUp 8
"{18A5DFF2-8A95-49F3-873F-743CB5549F3D}" = Canon ScanGear Starter
"{1A2000AF-79DE-47FB-8411-BA22F981917F}" = Tropico 2: Die Pirateninsel
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 27
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{2934DCB0-F8EE-11E0-A4A5-B8AC6F97B88E}" = Google Earth Plug-in
"{2A9F95AB-65A3-432c-8631-B8BC5BF7477A}" = Die Schlacht um Mittelerde™ II
"{3293C06B-003F-4027-8380-FFD79E38167D}" = Tony Hawk's American Wasteland
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{36C97B5B-5593-45B8-B50E-DAD87036BD9D}" = Microsoft LifeCam
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3AB3BCF5-F7EF-4ED2-988F-932953660F93}" = ArchosLink
"{3AEFE723-F44B-4CD0-B8BE-7A4FAC5E5CCB}_is1" = Anomaly Warzone Earth version 1.01
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{528CA916-2209-4779-990A-11D749A49C4A}_is1" = Dead Island PreOrder Edition
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{5ECB3A3C-980B-4D12-9724-25DCB07A1F47}" = iTunes
"{5FD88490-011C-4DF1-B886-F298D955171B}" = MySQL Connector Net 6.3.7
"{6033673D-2530-4587-8AD0-EB059FC263F9}" = Crysis® 2
"{628C3D50-F524-4C49-A958-672CE7953756}" = Der Herr der Ringe® - Die Eroberung™
"{66F9302D-E145-4375-8C84-54DA2339C483}" = MySQL Connector C 6.0.2
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{69EA986B-B172-4FAA-B54D-853BD3A2B264}" = Popcap Game Collection
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6F206B58-E2F7-4A70-ACAC-8E0ABFBC62F6}" = MySQL Connector/ODBC 5.1
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71A88700-6CC4-4DA8-9B2A-1ADB24C6028B}_is1" = Borderlands GotY Edition
"{7223945A-F037-4AE1-92F9-BA8304F0E21A}" = TubeBox!
"{7578ADEA-D65F-4C89-A249-B1C88B6FFC20}" = ICQ7.5
"{76285C16-411A-488A-BCE3-C83CB933D8CF}" = Battlefield 3™
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}" = Text-To-Speech-Runtime
"{7F6D7FD9-648D-4DD9-BB6E-3990C675ECA4}" = NVIDIA PhysX
"{818FB39B-1A57-4F1B-A54D-391C33D6C586}" = Tropico
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A253629-0511-4854-8B4E-46E57E66005C}" = Bonjour
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00B2-0407-0000-0000000FF1CE}" = Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{904CCF62-818D-4675-BC76-D37EB399F917}" = Windows Mobile-Gerätecenter
"{925D9613-EA6A-4DF0-9186-AD968159D1B1}" = Tony Hawk's American Wasteland 1.01 Patch
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9DE1BE03-AFE2-4CDB-BFEB-D06D736CD01A}" = Apple Mobile Device Support
"{A126E617-63F0-4E57-BFA4-7190F5845C39}" = Guitar Hero World Tour
"{A1DB7CFC-1B10-4C49-8ECB-0D8A3A45D3CA}" = LogMeIn Hamachi
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A804B134-F03D-4EFD-9BC0-DCD257AA1B22}" = Hitman Blood Money
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.6
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC76BA86-7AD7-1031-7B44-A92000000001}" = Adobe Reader 9.2 - Deutsch
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.11.0621
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.5.20
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B3BC9DB1-0B0A-48B0-B86B-EA77CAA7F800}" = Microsoft Corporation
"{B48E264C-C8CD-4617-B0BE-46E977BAD694}" = ANNO 2070
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B931FB80-537A-4600-00AD-AC5DEDB6C25B}" = Aufstieg des Hexenkönigs™
"{B9A129AB-CA6B-4CD1-B55C-792722E2B947}" = MySQL Installer
"{BE4BA698-8533-4F77-9559-C7F3F78C0B05}" = Assassin's Creed Brotherhood
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C59C4A56-8560-4E3B-AA5D-BDCED4F110E7}" = MySQL Documents
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{CA9BCD4D-B782-4637-8F1F-F9A328D3C244}" = CanoScan Toolbox Ver4.9
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CD59312B-4D1B-4F98-9689-0E7E99CF3216}" = CASIO fx-ES PLUS Emulator Trial
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D37FE0E3-B1A9-4E41-AB5D-DA62E04D2C42}" = Alpha Protocol
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = CyberLink PowerDVD 10
"{DFFE2B1F-07E0-45A9-8801-CD8514CAA876}" = Prince of Persia T2T
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{E3723A04-A894-4036-A78E-282E18F43C0A}_is1" = Tinypic 3.14
"{E3ABB4CC-1DC5-4430-BC49-D86AB708A9B8}" = MySQL Workbench 5.2 CE
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E929D860-AB8D-4AC0-8B7F-8DB5D65E46D0}" = MySQL Server 5.5
"{F0A209B7-7F85-4BDD-8F1F-B98EEAD9E04B}" = The Witcher 2
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F20C1251-1D0A-4944-B2AE-678581B33B19}" = Neverwinter Nights 2
"{F53503A3-41B3-4327-A5C0-B058AB72B90D}" = MySQL Examples and Samples 5.5
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FC8A7918-D65D-440C-9596-C88185E8DCA4}" = Activision(R)
"{FD753E57-1F44-41E6-B962-E01D76676206}" = MySQL Connector C++ 1.1.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.9
"ASIO4ALL" = ASIO4ALL
"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.12 (Unicode)
"Audacity_is1" = Audacity 1.2.6
"Brink_is1" = Brink
"Call of Duty Black Ops GERMAN Uncut 1.00" = Call of Duty Black Ops GERMAN Uncut 1.00
"Cheat Engine 5.5_is1" = Cheat Engine 5.5
"Collab" = Collab
"Digitale Bibliothek 4" = Digitale Bibliothek 4
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Firebird SQL Server UK" = Firebird SQL Server - MAGIX Edition
"FL Studio 8" = FL Studio 8
"FormatFactory" = FormatFactory 2.20
"Fraps" = Fraps (remove only)
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.7
"Free Studio_is1" = Free Studio version 5.1.7
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.2.718
"Hitman 2: Silent Assassin" = Hitman 2: Silent Assassin
"ICQToolbar" = ICQ Toolbar
"IL Download Manager" = IL Download Manager
"InfraRecorder" = InfraRecorder
"InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = CyberLink PowerDVD 10
"InstallShield_{FC8A7918-D65D-440C-9596-C88185E8DCA4}" = Drum Controller Standard Tuning Kit
"LogMeIn Hamachi" = LogMeIn Hamachi
"MediaMonkey_is1" = MediaMonkey 3.2
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mixxx" = Mixxx 1.7.2
"Morphyre" = Morphyre
"Mozilla Firefox 7.0.1 (x86 de)" = Mozilla Firefox 7.0.1 (x86 de)
"NAVIGON Fresh" = NAVIGON Fresh 3.2.0
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"PhotoScape" = PhotoScape
"PoiZone" = PoiZone
"PunkBusterSvc" = PunkBuster Services
"Robin Hood - Die Legende von Sherwood" = Robin Hood - Die Legende von Sherwood
"Samsung ML-1630 Series" = Samsung ML-1630 Series
"SMAC 2.7" = SMAC 2.7
"Steam App 42680" = Call of Duty: Modern Warfare 3
"Steam App 42690" = Call of Duty: Modern Warfare 3 - Multiplayer
"Steam App 42750" = Call of Duty: Modern Warfare 3 - Dedicated Server
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"Toxic Biohazard" = Toxic Biohazard
"Tunngle beta_is1" = Tunngle beta
"Uninstall_is1" = Uninstall 1.0.0.1
"Universal Document Converter_is1" = Universal Document Converter (Demo)
"VirtualCloneDrive" = VirtualCloneDrive
"VLC media player" = VLC media player 1.0.5
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR
"WinSplit_is1" = WinSplit - Deinstallation
"XMedia Recode" = XMedia Recode 2.1.4.8
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"ArchosLink" = ArchosLink
"Facebook Plug-In" = Facebook Plug-In
"Google Chrome" = Google Chrome
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >
         

--- --- ---
OTL Logfile:
OTL EXTRAS Logfile:

OTL logfile created on: 09.02.2012 13:51:47 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\Rox\Desktop
 Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,05 Gb Available Physical Memory | 68,48% Memory free
6,00 Gb Paging File | 4,81 Gb Available in Paging File | 80,25% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 698,63 Gb Total Space | 318,94 Gb Free Space | 45,65% Space Free | Partition Type: NTFS
Drive E: | 232,88 Gb Total Space | 39,27 Gb Free Space | 16,86% Space Free | Partition Type: NTFS
Drive G: | 232,88 Gb Total Space | 63,00 Gb Free Space | 27,05% Space Free | Partition Type: NTFS
 
Computer Name: ROX-PC | User Name: Rox | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.02.09 13:48:32 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Rox\Desktop\OTL.exe
PRC - [2012.02.08 22:39:27 | 000,481,064 | ---- | M] (Valve Corporation) -- C:\Programme\Common Files\Steam\SteamService.exe
PRC - [2012.02.02 13:22:42 | 001,987,976 | ---- | M] (LogMeIn Inc.) -- C:\Programme\LogMeIn Hamachi\hamachi-2-ui.exe
PRC - [2012.02.02 13:22:40 | 001,373,576 | ---- | M] (LogMeIn Inc.) -- C:\Programme\LogMeIn Hamachi\hamachi-2.exe
PRC - [2012.01.23 19:08:25 | 001,773,568 | -HS- | M] (Realtek) -- C:\Users\Rox\AppData\Roaming\Realtek\Realtek.exe
PRC - [2011.10.15 09:53:00 | 002,253,120 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
PRC - [2011.10.15 09:53:00 | 001,820,480 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\Display\nvtray.exe
PRC - [2011.10.15 09:53:00 | 001,328,960 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\Display\nvxdsync.exe
PRC - [2011.10.15 00:54:40 | 000,381,248 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2011.08.14 17:42:23 | 001,242,448 | ---- | M] (Valve Corporation) -- C:\Programme\Steam\Steam.exe
PRC - [2011.07.13 21:57:18 | 008,155,648 | ---- | M] () -- C:\Programme\Aspyr\Guitar Hero World Tour\bin\mysqld.exe
PRC - [2011.06.09 12:06:06 | 000,507,624 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Common Files\Java\Java Update\jucheck.exe
PRC - [2011.03.28 20:31:16 | 000,193,920 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
PRC - [2011.03.28 20:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
PRC - [2011.02.26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.12.29 11:26:10 | 000,075,048 | ---- | M] (cyberlink) -- C:\Programme\CyberLink\Shared files\brs.exe
PRC - [2010.11.21 10:49:24 | 000,247,608 | ---- | M] () -- C:\Programme\ICQ6Toolbar\ICQ Service.exe
PRC - [2010.02.02 23:08:56 | 000,087,336 | ---- | M] (CyberLink Corp.) -- C:\Programme\CyberLink\PowerDVD10\PDVD10Serv.exe
PRC - [2009.07.24 15:05:24 | 000,139,120 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft LifeCam\MSCamS32.exe
PRC - [2009.07.14 02:14:47 | 001,121,280 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2009.07.14 02:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009.06.30 21:24:14 | 000,762,208 | ---- | M] (Microsoft Corporation) -- C:\Windows\vVX3000.exe
PRC - [2009.02.26 15:24:50 | 000,097,680 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE
PRC - [2008.10.25 11:44:34 | 000,031,072 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe
PRC - [2008.08.27 03:21:48 | 000,536,576 | ---- | M] () -- C:\Windows\Samsung\PanelMgr\SSMMgr.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.02.08 22:39:16 | 014,415,144 | ---- | M] () -- C:\Programme\Steam\bin\libcef.dll
MOD - [2012.02.08 22:38:59 | 000,853,800 | ---- | M] () -- C:\Programme\Steam\bin\chromehtml.dll
MOD - [2012.02.08 22:38:57 | 000,155,432 | ---- | M] () -- C:\Programme\Steam\bin\avformat-52.dll
MOD - [2012.02.08 22:38:57 | 000,091,432 | ---- | M] () -- C:\Programme\Steam\bin\avutil-50.dll
MOD - [2012.02.08 22:38:56 | 000,914,216 | ---- | M] () -- C:\Programme\Steam\bin\avcodec-52.dll
MOD - [2011.03.31 19:34:42 | 000,077,824 | ---- | M] () -- C:\Programme\MediaMonkey\DeskPlayer.dll
MOD - [2009.09.04 23:15:06 | 000,067,872 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2009.08.16 17:06:02 | 000,141,312 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
MOD - [2008.08.27 03:21:48 | 000,536,576 | ---- | M] () -- C:\Windows\Samsung\PanelMgr\SSMMgr.exe
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012.02.08 22:39:27 | 000,481,064 | ---- | M] (Valve Corporation) [On_Demand | Running] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.02.02 13:22:40 | 001,373,576 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- C:\Program Files\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2011.12.15 14:59:39 | 000,059,088 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Windows\TEMP\AVSETUP_4f33bfa6\avupgsvc.exe -- (AviraUpgradeService)
SRV - [2011.12.12 21:35:08 | 000,751,464 | ---- | M] (Tunngle.net GmbH) [On_Demand | Stopped] -- C:\Programme\Tunngle\TnglCtrl.exe -- (TunngleService)
SRV - [2011.10.15 09:53:00 | 002,253,120 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2011.10.15 00:54:40 | 000,381,248 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2011.07.13 21:57:18 | 008,155,648 | ---- | M] () [Auto | Running] -- C:\Program Files\Aspyr\Guitar Hero World Tour\bin\mysqld.exe -- (MySQL55)
SRV - [2010.11.21 10:49:24 | 000,247,608 | ---- | M] () [Auto | Running] -- C:\Programme\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)
SRV - [2009.09.23 16:36:06 | 000,051,168 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Programme\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus(R)
SRV - [2009.07.24 15:05:24 | 000,139,120 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe -- (MSCamSvc)
SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.05.31 16:21:24 | 000,379,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007.05.31 16:21:18 | 000,183,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
SRV - [2005.11.17 13:18:52 | 001,527,900 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Programme\MAGIX\Common\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.10.15 09:53:00 | 010,327,360 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2010.12.29 10:26:08 | 000,087,536 | ---- | M] (CyberLink Corp.) [2011/09/10 22:59:22] [Kernel | Auto | Running] -- C:\Programme\CyberLink\PowerDVD10\NavFilter\000.fcl -- ({1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC})
DRV - [2010.02.03 14:56:56 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\hamachi.sys -- (hamachi)
DRV - [2009.12.07 20:18:58 | 000,056,816 | ---- | M] (Avira GmbH) [File_System | Disabled | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009.09.16 07:02:40 | 000,027,136 | ---- | M] (Tunngle.net) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tap0901t.sys -- (tap0901t) TAP-Win32 Adapter V9 (Tunngle)
DRV - [2009.07.14 02:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vmbus.sys -- (vmbus)
DRV - [2009.07.14 02:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\vmstorfl.sys -- (storflt)
DRV - [2009.07.14 02:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\storvsc.sys -- (storvsc)
DRV - [2009.07.14 00:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2009.07.14 00:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vms3cap.sys -- (s3cap)
DRV - [2009.07.14 00:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\VMBusHID.sys -- (VMBusHID)
DRV - [2009.07.13 23:02:52 | 000,347,264 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvm62x32.sys -- (NVENETFD)
DRV - [2009.06.30 21:24:14 | 001,961,328 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VX3000.sys -- (VX3000)
DRV - [2007.03.05 09:11:00 | 000,041,984 | ---- | M] (Samsung Electronics Co., Ltd.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\DGIVECP.SYS -- (DgiVecp)
DRV - [2006.03.20 16:17:56 | 000,402,944 | ---- | M] (ZyDAS Technology Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WlanUZXP.sys -- (ZY760_XP)
DRV - [2004.08.13 08:56:20 | 000,005,810 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ASACPI.sys -- (MTsensor)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 60 09 00 48 9F 88 CA 01  [binary data]
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - No CLSID value found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://start.icq.com/"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: chromeview@systemantics.net:0.2.2
FF - prefs.js..extensions.enabledItems: piclens@cooliris.com:1.12.0.36949
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.071303000004
FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.6.0.8442
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}:6.0.27
FF - prefs.js..extensions.enabledItems: {66871bd1-5ba2-4739-b485-2a15f5969bd8}:2.20100123
FF - prefs.js..keyword.URL: "hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q="
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.0&q="
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@ngm.nexoneu.com/NxGame: C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Users\Rox\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll ( )
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player:  File not found
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Rox\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Rox\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.10.30 19:41:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.10.30 19:41:39 | 000,000,000 | ---D | M]
 
[2009.11.05 20:45:46 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Rox\AppData\Roaming\mozilla\Extensions
[2012.02.08 20:19:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Rox\AppData\Roaming\mozilla\Firefox\Profiles\ycw1bw31.default\extensions
[2011.06.02 13:39:24 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Users\Rox\AppData\Roaming\mozilla\Firefox\Profiles\ycw1bw31.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2010.06.18 10:21:05 | 000,000,000 | ---D | M] (MidnightFox) -- C:\Users\Rox\AppData\Roaming\mozilla\Firefox\Profiles\ycw1bw31.default\extensions\{66871bd1-5ba2-4739-b485-2a15f5969bd8}
[2012.02.08 20:19:11 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Rox\AppData\Roaming\mozilla\Firefox\Profiles\ycw1bw31.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2012.02.08 20:19:18 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\Rox\AppData\Roaming\mozilla\Firefox\Profiles\ycw1bw31.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2011.08.16 22:26:53 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Rox\AppData\Roaming\mozilla\Firefox\Profiles\ycw1bw31.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.11.01 17:26:33 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Rox\AppData\Roaming\mozilla\Firefox\Profiles\ycw1bw31.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010.12.20 18:24:36 | 000,000,000 | ---D | M] (Chrome View) -- C:\Users\Rox\AppData\Roaming\mozilla\Firefox\Profiles\ycw1bw31.default\extensions\chromeview@systemantics.net
[2009.11.15 17:05:43 | 000,000,000 | ---D | M] (Move Media Player) -- C:\Users\Rox\AppData\Roaming\mozilla\Firefox\Profiles\ycw1bw31.default\extensions\moveplayer@movenetworks.com
[2011.11.01 17:26:32 | 000,000,000 | ---D | M] (Cooliris) -- C:\Users\Rox\AppData\Roaming\mozilla\Firefox\Profiles\ycw1bw31.default\extensions\piclens@cooliris.com
[2012.02.08 20:21:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Rox\AppData\Roaming\mozilla\Firefox\Profiles\ycw1bw31.default\extensions\staged
[2010.06.18 10:21:07 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Rox\AppData\Roaming\mozilla\Firefox\Profiles\ycw1bw31.default\extensions\{66871bd1-5ba2-4739-b485-2a15f5969bd8}\chrome\mozapps\extensions
[2010.06.18 10:21:07 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Rox\AppData\Roaming\mozilla\Firefox\Profiles\ycw1bw31.default\extensions\{66871bd1-5ba2-4739-b485-2a15f5969bd8}\chrome\mozapps\extensions\CVS
[2010.04.15 09:46:06 | 000,002,333 | ---- | M] () -- C:\Users\Rox\AppData\Roaming\Mozilla\Firefox\Profiles\ycw1bw31.default\searchplugins\askcom.xml
[2010.09.22 15:40:40 | 000,000,881 | ---- | M] () -- C:\Users\Rox\AppData\Roaming\Mozilla\Firefox\Profiles\ycw1bw31.default\searchplugins\conduit.xml
[2012.02.08 20:15:00 | 000,001,056 | ---- | M] () -- C:\Users\Rox\AppData\Roaming\Mozilla\Firefox\Profiles\ycw1bw31.default\searchplugins\icqplugin.xml
[2010.02.15 14:18:11 | 000,003,915 | ---- | M] () -- C:\Users\Rox\AppData\Roaming\Mozilla\Firefox\Profiles\ycw1bw31.default\searchplugins\sweetim.xml
[2011.10.30 19:41:40 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.01.30 17:31:40 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2011.10.17 18:20:00 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2010.11.07 11:57:30 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011.10.11 15:18:59 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}
[2011.10.17 18:20:00 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
() (No name found) -- C:\USERS\ROX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YCW1BW31.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2011.09.29 08:09:51 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.07.19 04:05:25 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011.09.29 02:24:37 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.09.29 02:16:42 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011.09.29 02:24:37 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.09.29 02:24:37 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.09.29 02:24:37 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.09.29 02:24:37 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\Rox\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Rox\AppData\Local\Google\Chrome\Application\17.0.963.46\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Rox\AppData\Local\Google\Chrome\Application\17.0.963.46\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Rox\AppData\Local\Google\Chrome\Application\17.0.963.46\pdf.dll
CHR - plugin: Skype Toolbars (Enabled) = C:\Users\Rox\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0\npSkypeChromePlugin.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.270.7 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U27 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: getPlusPlus for Adobe 16248 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np_gp.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll
CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll
CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Nexon Game Controller (Enabled) = C:\ProgramData\NexonEU\NGM\npNxGameeu.dll
CHR - plugin: Facebook Plugin (Enabled) = C:\Users\Rox\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: AT_JamesWhite = C:\Users\Rox\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkeidgmehkdjmpjodpjkepolokanalkm\3_0\
CHR - Extension: YouTube = C:\Users\Rox\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.3_0\
CHR - Extension: Wei\u00DFes Rauschen = C:\Users\Rox\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejkjpdnomgodmagfmhojepjlajpoicip\1.6_0\
CHR - Extension: Box - 5 GB freier Speicher = C:\Users\Rox\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejnkaeblpdcamcioiiabclakabcbjmbl\1.1.6_0\
CHR - Extension: Uhr = C:\Users\Rox\AppData\Local\Google\Chrome\User Data\Default\Extensions\gdkjifoifglkpcdffkenpinlbjgephlo\1.9_0\
CHR - Extension: Guitar Tuner = C:\Users\Rox\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbenbgblhhlecmfechhfecgioakobfdl\3.0.0.2_0\
CHR - Extension: Isoball 3 = C:\Users\Rox\AppData\Local\Google\Chrome\User Data\Default\Extensions\iajlkcpgcnbhfhpdeooockfaincfkjjj\1.2.1_0\
CHR - Extension: Layers - Facebook, Twitter, RSS = C:\Users\Rox\AppData\Local\Google\Chrome\User Data\Default\Extensions\iehdddmijbgofffjjmhkodckmnombhmf\0.5.6_0\
CHR - Extension: Picnik = C:\Users\Rox\AppData\Local\Google\Chrome\User Data\Default\Extensions\inmnggcpelemfookhlhkdfbechcdadfp\1.0.6_0\
CHR - Extension: Skype Click to Call = C:\Users\Rox\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0\
CHR - Extension: Click to activate/deactivate ProxTube = C:\Users\Rox\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkdbaehcjcomcnnjhlmnfddpgoafpcko\1.0.5_0\
CHR - Extension: Pipedrive CRM = C:\Users\Rox\AppData\Local\Google\Chrome\User Data\Default\Extensions\oofakdmdcdjgmilfepadallikeeibfdm\1.3.7_0\
 
O1 HOSTS File: ([2011.08.01 13:11:34 | 000,000,211 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 novirusthanks.org
O1 - Hosts: 127.0.0.1 www.virusscan.jotti.org
O1 - Hosts: 127.0.0.1 virus-trap.org
O1 - Hosts: 127.0.0.1 www.virus-trap.org
O1 - Hosts: 127.0.0.1 filterbit.com
O1 - Hosts: 127.0.0.1 www.filterbit.com
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Windows Live Messenger Companion Helper) - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Programme\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [BDRegion] C:\Programme\CyberLink\Shared files\brs.exe (cyberlink)
O4 - HKLM..\Run: [LifeCam] C:\Program Files\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation)
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [RemoteControl10] C:\Program Files\CyberLink\PowerDVD10\PDVD10Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\SSMMgr.exe ()
O4 - HKLM..\Run: [VX3000] C:\Windows\vVX3000.exe (Microsoft Corporation)
O4 - HKCU..\Run: [ArchosLink] C:\Program Files\Archos\ArchosLink\ArchosLink.exe (Archos)
O4 - HKCU..\Run: [HKCU] C:\Users\Rox\AppData\Roaming\install\Adobee.exe File not found
O4 - HKCU..\Run: [ICQ] "C:\Program Files\ICQ7.4\ICQ.exe" silent loginmode=4 File not found
O4 - HKCU..\Run: [Java Update] C:\Users\Rox\AppData\Local\Temp\\Java_Updater.exe File not found
O4 - HKCU..\Run: [KPeerNexonEU] C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe File not found
O4 - HKCU..\Run: [Realtek] C:\Users\Rox\AppData\Roaming\Realtek\Realtek.exe (Realtek)
O4 - HKCU..\Run: [Steam] C:\Program Files\Steam\steam.exe (Valve Corporation)
O4 - HKCU..\Run: [Wisdom-soft AutoScreenRecorder 3.1 Free] 0 File not found
O4 - Startup: C:\Users\Rox\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O8 - Extra context menu item: &Abonnieren ArchosLink - C:\Program Files\Archos\ArchosLink\script.js ()
O8 - Extra context menu item: Free YouTube Download - C:\Users\Rox\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Rox\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9 - Extra Button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Programme\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0C85A3D7-761D-4D54-83D4-A1423030EE00}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AF46F825-4F33-47D9-8FD6-9E8FE617A610}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B7DF500E-EA91-41CF-81BC-11933C5FC09A}: DhcpNameServer = 7.254.254.254
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Users\Rox\AppData\Roaming\Realtek\Realtek.exe) -C:\Users\Rox\AppData\Roaming\Realtek\Realtek.exe (Realtek)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.02.09 13:48:40 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Rox\Desktop\OTL.exe
[2012.02.09 07:22:30 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{0571BEF1-7BBA-474E-B8FC-5A085277979C}
[2012.02.07 18:22:55 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{A5829380-F4A2-4834-AC25-33D7043B70C8}
[2012.02.07 18:22:15 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{69DE4F62-C0FE-472F-BAD6-638BFE1AF78E}
[2012.02.07 18:18:25 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{F420B6FC-766A-4DB6-AA6D-CA031D3A7A07}
[2012.02.07 18:18:11 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{0F6ACC14-5DA6-4F4E-9D0F-D5460DF45FD2}
[2012.02.07 13:59:51 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{378CD450-A4BC-4858-B5DB-78A80EC909D9}
[2012.02.06 15:08:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
[2012.02.06 15:08:46 | 000,000,000 | ---D | C] -- C:\Program Files\LogMeIn Hamachi
[2012.02.05 17:23:35 | 000,000,000 | ---D | C] -- C:\Users\Rox\Desktop\cod4 hack
[2012.02.05 10:11:05 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{79E5AC7C-C80C-4AF1-88DC-27C3A98A921B}
[2012.02.05 10:10:29 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{C92DD602-20F5-4D4B-9953-174DB3040A11}
[2012.02.02 06:57:00 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{31C41461-962A-4271-8973-FAB2DA16C510}
[2012.02.02 06:56:47 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{DCFD36E7-7F69-46D8-97E0-D331B9B89EBA}
[2012.02.01 18:47:42 | 000,000,000 | ---D | C] -- C:\Users\Rox\Desktop\Band-Bilder
[2012.02.01 18:45:33 | 000,000,000 | ---D | C] -- C:\Users\Rox\Desktop\Aufnahmen
[2012.02.01 18:45:25 | 000,000,000 | ---D | C] -- C:\Users\Rox\Desktop\Gruppenbilder
[2012.02.01 18:44:50 | 000,000,000 | ---D | C] -- C:\Users\Rox\Desktop\Einzelbilder
[2012.02.01 17:05:05 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{E909E241-C608-4C92-BAE4-7BB8192C9CC9}
[2012.02.01 17:04:24 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{9E93AF9D-3F7B-43F9-947A-53ABCC9C75D9}
[2012.01.31 20:33:13 | 000,000,000 | ---D | C] -- C:\ProgramData\DivX
[2012.01.31 11:34:02 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{7AF93A0A-8F0D-4347-89C9-B9F2DAD996C1}
[2012.01.30 19:49:47 | 000,000,000 | ---D | C] -- C:\Users\Rox\Desktop\Spartacus
[2012.01.30 19:39:31 | 000,000,000 | ---D | C] -- C:\Users\Rox\Desktop\Centurion.Fight.or.Die.German.2010.AC3.BDRip.XviD-EXQUiSiTE
[2012.01.30 19:38:32 | 000,000,000 | ---D | C] -- C:\Users\Rox\Desktop\Public.Enemies.German.DL.DVDR-CRUCiAL
[2012.01.30 19:31:23 | 000,000,000 | ---D | C] -- C:\Users\Rox\Desktop\Your.Highness.2011.German.DL.720p.BluRay.x264-ROOR__www.realmom.info__
[2012.01.30 19:30:59 | 000,000,000 | ---D | C] -- C:\Users\Rox\Desktop\Moon.DVDRip.MD.German.XviD-XCOPY
[2012.01.30 19:29:06 | 000,000,000 | ---D | C] -- C:\Users\Rox\Desktop\Cash.German.2010.DVDRip.XviD-ViDEOWELT
[2012.01.30 19:12:41 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{F0EDE07E-C80A-430C-B2AA-128DFAEE241C}
[2012.01.29 20:11:52 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{81675337-B90A-414D-B1AA-74055B7131E5}
[2012.01.29 20:11:36 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{4C6A914F-7CB4-48EA-95FB-6EEC74040B9A}
[2012.01.29 15:03:17 | 000,000,000 | -HSD | C] -- C:\Users\Rox\AppData\Roaming\Realtek
[2012.01.28 21:16:50 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{ED38EF00-73CF-4533-A838-7164CF8D8D63}
[2012.01.28 21:16:17 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{B72808EC-BD7C-47B8-BD96-4CB01D864B03}
[2012.01.26 20:00:50 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{78CE24A2-4EF3-4BA0-B31C-1A847046966E}
[2012.01.25 16:21:31 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{6DC1D9CF-2B70-49EB-9EC1-3F3B5D79B6EA}
[2012.01.25 16:20:58 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{5B2C53C8-A5A8-4547-BF78-25C0BD852DDD}
[2012.01.24 18:23:58 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{20D8A50C-8DFD-4122-B5D5-3708B8FA6762}
[2012.01.24 18:23:45 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{001F0E63-498D-4D4C-BA0B-1B1A4E5EB914}
[2012.01.22 19:34:07 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{82BBC232-FDFD-46D3-9054-87D3DFC1C9AE}
[2012.01.22 19:33:31 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{66126599-5DA5-47D6-8841-4781BE82F650}
[2012.01.22 13:03:49 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{B55AA3D6-63CD-411A-8FF8-736FBE699906}
[2012.01.21 12:24:04 | 000,000,000 | ---D | C] -- C:\Users\Rox\Desktop\MW3 Multi-Level hack
[2012.01.20 15:57:06 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{2E28AD2B-0F73-43BC-8F4E-1704B74C5D61}
[2012.01.20 15:56:53 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{184DDA00-210E-4B94-95CF-9A05298DD8EA}
[2012.01.19 14:21:53 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{39569E13-FDC3-4EA3-BADD-8A4C0DBA9D0B}
[2012.01.19 14:21:38 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{C0F80DA2-DB5A-4965-AAA8-BD59F761218F}
[2012.01.17 21:53:31 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{74D9D948-CA37-4E70-A694-3A8EA1AEECF9}
[2012.01.17 21:53:18 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{3523F226-8D2E-4CA0-A34F-2FF01B89E0E3}
[2012.01.17 15:39:55 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{822188EE-9C28-449F-B403-CC43BFAE06B7}
[2012.01.17 15:39:40 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{C0E79868-ECF3-44F3-ABDF-19D49CC780CF}
[2012.01.16 18:15:31 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{7764C7FB-8AF1-4B66-B260-5A556E6CAD0D}
[2012.01.16 18:15:16 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{BC61E754-DFE4-44E1-AB9C-6D7EADF8C626}
[2012.01.15 18:53:19 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{86149BB4-27F5-4B97-918D-7A8838B5A9DE}
[2012.01.15 16:42:50 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{52157777-32B1-44DD-B20F-23C8EDFC46AC}
[2012.01.15 16:42:37 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{75BEC158-085D-4B0A-9B75-A3582EA12432}
[2012.01.13 17:52:16 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{332C4C5A-05F8-4AA9-B279-B8A82A717DBC}
[2012.01.13 17:51:39 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{D11F9A05-8EEB-42D9-9C4E-8222953A2710}
[2012.01.13 15:50:43 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{99A4064F-4FDA-4F42-BAD9-B4243967F98E}
[2012.01.12 13:53:47 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{81228D70-0ABE-4F17-9932-E91698978B87}
[2012.01.12 13:53:13 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{188240DF-5F08-4CD7-BCA1-B0EB6334A8CE}
[2012.01.11 19:30:51 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{25B80C62-D1BF-4863-ADA4-F9B9B5B11BDB}
[2012.01.11 19:30:18 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{21DFD699-C922-4EBA-961E-E04A3187FF37}
[2012.01.11 16:58:47 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{C3F0DF9C-6596-4E15-88A5-3B2E99FBA6F1}
[2012.01.11 16:58:33 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{4E7EECD4-8048-4BB9-BD8E-889E0EC70C95}
[2012.01.10 18:24:08 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{ED51F8D8-289F-40C8-9B59-D9BA582AD5E6}
[2012.01.10 18:23:31 | 000,000,000 | ---D | C] -- C:\Users\Rox\AppData\Local\{A179643E-DC2A-49D8-A80A-2870F784D20F}
[3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Rox\Documents\*.tmp files -> C:\Users\Rox\Documents\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.02.09 13:49:41 | 001,412,309 | ---- | M] () -- C:\Users\Rox\Desktop\MW3 Multi-Level hack.rar
[2012.02.09 13:48:32 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Rox\Desktop\OTL.exe
[2012.02.09 13:34:00 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.02.09 13:27:02 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2916697408-2345766494-1444788071-1000UA.job
[2012.02.09 13:25:58 | 000,014,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.02.09 13:25:58 | 000,014,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.02.09 13:21:39 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.02.09 13:20:42 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.02.09 13:20:40 | 2414,731,264 | -HS- | M] () -- C:\hiberfil.sys
[2012.02.08 22:27:00 | 000,001,060 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2916697408-2345766494-1444788071-1000Core.job
[2012.02.08 19:44:42 | 000,664,858 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.02.08 19:44:42 | 000,625,040 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.02.08 19:44:42 | 000,134,736 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.02.08 19:44:42 | 000,110,388 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.02.07 18:51:14 | 000,138,160 | ---- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2012.02.07 18:51:09 | 000,271,200 | ---- | M] () -- C:\Windows\System32\PnkBstrB.xtr
[2012.02.07 15:11:17 | 000,271,200 | ---- | M] () -- C:\Windows\System32\PnkBstrB.ex0
[2012.02.05 15:38:10 | 000,000,903 | ---- | M] () -- C:\Users\Public\Desktop\Tunngle beta.lnk
[2012.02.05 01:03:42 | 000,000,000 | ---- | M] () -- C:\Windows\System32\Access.dat
[2012.01.30 17:19:29 | 000,019,425 | ---- | M] () -- C:\Users\Rox\Desktop\die  2.gpx
[2012.01.30 16:58:51 | 000,019,039 | ---- | M] () -- C:\Users\Rox\Desktop\Metal Band.gpx
[2012.01.26 20:03:28 | 000,014,848 | ---- | M] () -- C:\Users\Rox\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.01.25 16:40:44 | 000,020,407 | ---- | M] () -- C:\Users\Rox\Desktop\dropped c.gpx
[2012.01.18 14:54:23 | 000,019,396 | ---- | M] () -- C:\Users\Rox\Desktop\casjk.gpx
[2012.01.16 19:02:50 | 000,000,215 | ---- | M] () -- C:\Users\Rox\Desktop\Call of Duty Modern Warfare 3 - Multiplayer.url
[2012.01.16 19:02:50 | 000,000,215 | ---- | M] () -- C:\Users\Rox\Desktop\Call of Duty Modern Warfare 3 - Dedicated Server.url
[2012.01.16 19:02:49 | 000,000,215 | ---- | M] () -- C:\Users\Rox\Desktop\Call of Duty Modern Warfare 3.url
[3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Rox\Documents\*.tmp files -> C:\Users\Rox\Documents\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.02.09 13:49:41 | 001,412,309 | ---- | C] () -- C:\Users\Rox\Desktop\MW3 Multi-Level hack.rar
[2012.02.05 15:38:10 | 000,000,903 | ---- | C] () -- C:\Users\Public\Desktop\Tunngle beta.lnk
[2012.01.30 17:14:44 | 000,019,425 | ---- | C] () -- C:\Users\Rox\Desktop\die  2.gpx
[2012.01.30 16:58:51 | 000,019,039 | ---- | C] () -- C:\Users\Rox\Desktop\Metal Band.gpx
[2012.01.22 22:46:24 | 000,020,407 | ---- | C] () -- C:\Users\Rox\Desktop\dropped c.gpx
[2012.01.18 14:54:23 | 000,019,396 | ---- | C] () -- C:\Users\Rox\Desktop\casjk.gpx
[2012.01.16 19:02:50 | 000,000,215 | ---- | C] () -- C:\Users\Rox\Desktop\Call of Duty Modern Warfare 3 - Multiplayer.url
[2012.01.16 19:02:50 | 000,000,215 | ---- | C] () -- C:\Users\Rox\Desktop\Call of Duty Modern Warfare 3 - Dedicated Server.url
[2012.01.16 19:02:49 | 000,000,215 | ---- | C] () -- C:\Users\Rox\Desktop\Call of Duty Modern Warfare 3.url
[2011.12.19 19:52:14 | 000,000,232 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2011.10.16 20:22:53 | 000,000,000 | ---- | C] () -- C:\Users\Rox\AppData\Local\{0C1EBFC4-CCF6-4DC8-9F38-3356A56896B7}
[2011.10.15 00:54:52 | 000,321,856 | ---- | C] () -- C:\Windows\System32\nvStreaming.exe
[2011.07.28 11:37:50 | 000,000,000 | ---- | C] () -- C:\Users\Rox\AppData\Local\{0ABC1A2C-4EC7-47DF-9610-58681B7C3380}
[2011.02.19 04:47:43 | 000,000,091 | ---- | C] () -- C:\Users\Rox\AppData\Local\fusioncache.dat
[2011.02.19 04:22:19 | 000,837,192 | ---- | C] () -- C:\Windows\System32\pbsvc.exe
[2010.07.09 15:09:57 | 000,053,248 | ---- | C] () -- C:\Windows\System32\mgxasio2.dll
[2010.07.09 15:09:10 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll
[2010.07.09 15:08:48 | 000,006,211 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2010.03.10 13:09:35 | 000,000,000 | ---- | C] () -- C:\Windows\System32\Access.dat
[2010.03.06 17:36:38 | 000,271,200 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe
[2010.03.05 16:17:35 | 000,007,605 | ---- | C] () -- C:\Users\Rox\AppData\Local\Resmon.ResmonCfg
[2009.12.29 17:39:30 | 001,970,176 | ---- | C] () -- C:\Windows\System32\d3dx9.dll
[2009.12.11 22:37:22 | 000,000,319 | ---- | C] () -- C:\Windows\game.ini
[2009.11.13 17:26:28 | 000,014,848 | ---- | C] () -- C:\Users\Rox\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.10.28 11:13:19 | 000,162,304 | ---- | C] () -- C:\Windows\System32\ztvunrar36.dll
[2009.10.28 11:13:19 | 000,077,312 | ---- | C] () -- C:\Windows\System32\ztvunace26.dll
[2009.10.27 19:31:57 | 000,479,232 | ---- | C] () -- C:\Windows\ssndii.exe
[2009.10.27 14:42:44 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009.10.23 18:29:20 | 000,138,160 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2009.10.23 18:28:47 | 000,075,136 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe
[2009.07.14 09:47:43 | 000,664,858 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2009.07.14 09:47:43 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2009.07.14 09:47:43 | 000,134,736 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2009.07.14 09:47:43 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2009.07.14 05:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 05:33:53 | 000,445,104 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009.07.14 03:05:48 | 000,625,040 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009.07.14 03:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009.07.14 03:05:48 | 000,110,388 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009.07.14 03:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009.07.14 03:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009.07.14 03:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009.07.14 01:19:49 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2009.07.14 00:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009.06.26 17:21:02 | 000,015,498 | ---- | C] () -- C:\Windows\VX3000.ini
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2007.02.09 01:22:52 | 000,022,723 | ---- | C] () -- C:\Windows\System32\ml163sl3.dll
[2004.08.13 08:56:20 | 000,005,810 | ---- | C] () -- C:\Windows\System32\drivers\ASACPI.sys
 
========== LOP Check ==========
 
[2011.06.07 21:18:29 | 000,000,000 | ---D | M] -- C:\Users\Rox\AppData\Roaming\.minecraft
[2011.12.18 16:40:29 | 000,000,000 | ---D | M] -- C:\Users\Rox\AppData\Roaming\Amazon
[2010.06.16 14:54:08 | 000,000,000 | ---D | M] -- C:\Users\Rox\AppData\Roaming\ArchosLink
[2011.01.07 14:22:37 | 000,000,000 | ---D | M] -- C:\Users\Rox\AppData\Roaming\Audacity
[2009.11.15 15:01:04 | 000,000,000 | ---D | M] -- C:\Users\Rox\AppData\Roaming\Canon
[2012.01.30 19:12:01 | 000,000,000 | RHSD | M] -- C:\Users\Rox\AppData\Roaming\Drvrs
[2011.08.16 22:35:09 | 000,000,000 | ---D | M] -- C:\Users\Rox\AppData\Roaming\DVDVideoSoft
[2011.08.16 22:26:53 | 000,000,000 | ---D | M] -- C:\Users\Rox\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.06.24 21:37:17 | 000,000,000 | ---D | M] -- C:\Users\Rox\AppData\Roaming\Facebook
[2011.05.06 20:39:28 | 000,000,000 | ---D | M] -- C:\Users\Rox\AppData\Roaming\gnupg
[2011.01.13 16:39:09 | 000,000,000 | ---D | M] -- C:\Users\Rox\AppData\Roaming\Guitar Pro 6
[2010.07.08 09:47:27 | 000,000,000 | ---D | M] -- C:\Users\Rox\AppData\Roaming\HLSW
[2012.02.01 19:55:01 | 000,000,000 | ---D | M] -- C:\Users\Rox\AppData\Roaming\ICQ
[2011.06.14 11:38:16 | 000,000,000 | ---D | M] -- C:\Users\Rox\AppData\Roaming\InfraRecorder
[2012.02.03 06:59:47 | 000,000,000 | RHSD | M] -- C:\Users\Rox\AppData\Roaming\install
[2010.02.14 10:14:55 | 000,000,000 | ---D | M] -- C:\Users\Rox\AppData\Roaming\Juce VST Host
[2010.03.06 17:29:51 | 000,000,000 | ---D | M] -- C:\Users\Rox\AppData\Roaming\Leadertech
[2010.07.09 15:12:12 | 000,000,000 | ---D | M] -- C:\Users\Rox\AppData\Roaming\MAGIX
[2010.05.15 15:10:37 | 000,000,000 | ---D | M] -- C:\Users\Rox\AppData\Roaming\Meine Der Herr der Ringe™, Aufstieg des Hexenkönigs™-Dateien
[2010.05.15 11:57:24 | 000,000,000 | ---D | M] -- C:\Users\Rox\AppData\Roaming\Meine Die Schlacht um Mittelerde™ II-Dateien
[2011.12.19 19:58:17 | 000,000,000 | ---D | M] -- C:\Users\Rox\AppData\Roaming\MySQL
[2011.07.19 14:59:01 | 000,000,000 | ---D | M] -- C:\Users\Rox\AppData\Roaming\PhotoScape
[2010.04.15 18:04:37 | 000,000,000 | ---D | M] -- C:\Users\Rox\AppData\Roaming\PopCapv1005eni
[2011.03.22 20:40:12 | 000,000,000 | ---D | M] -- C:\Users\Rox\AppData\Roaming\PunkBuster
[2011.01.17 19:54:00 | 000,000,000 | ---D | M] -- C:\Users\Rox\AppData\Roaming\Systweak
[2010.03.22 14:43:27 | 000,000,000 | ---D | M] -- C:\Users\Rox\AppData\Roaming\TeamViewer
[2011.08.16 17:17:07 | 000,000,000 | ---D | M] -- C:\Users\Rox\AppData\Roaming\TS3Client
[2011.08.12 13:19:40 | 000,000,000 | ---D | M] -- C:\Users\Rox\AppData\Roaming\ts3overlay
[2011.07.23 15:12:17 | 000,000,000 | ---D | M] -- C:\Users\Rox\AppData\Roaming\TubeBox
[2012.02.07 16:56:53 | 000,000,000 | ---D | M] -- C:\Users\Rox\AppData\Roaming\Tunngle
[2011.12.13 23:08:59 | 000,000,000 | ---D | M] -- C:\Users\Rox\AppData\Roaming\Ubisoft
[2011.04.24 13:51:07 | 000,000,000 | ---D | M] -- C:\Users\Rox\AppData\Roaming\UDC Profiles
[2012.02.03 23:47:51 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2010.01.27 06:14:39 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2009.10.23 18:12:17 | 000,000,000 | -HSD | M] -- C:\Boot
[2009.11.15 14:57:52 | 000,000,000 | -H-D | M] -- C:\CanoScan
[2012.02.09 13:44:10 | 000,000,000 | -HSD | M] -- C:\Config.Msi
[2009.10.23 17:20:42 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2011.05.08 22:04:56 | 000,000,000 | ---D | M] -- C:\Download
[2010.05.24 16:51:15 | 000,000,000 | -HSD | M] -- C:\found.000
[2010.06.16 11:46:06 | 000,000,000 | -HSD | M] -- C:\found.001
[2011.09.01 21:08:19 | 000,000,000 | -HSD | M] -- C:\found.002
[2011.11.09 13:35:45 | 000,000,000 | ---D | M] -- C:\Fraps
[2011.07.04 16:44:51 | 000,000,000 | RH-D | M] -- C:\MSOCache
[2011.11.20 18:50:18 | 000,000,000 | ---D | M] -- C:\NVIDIA
[2009.07.14 03:37:05 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2012.02.06 15:08:46 | 000,000,000 | R--D | M] -- C:\Program Files
[2011.10.03 16:48:19 | 000,000,000 | ---D | M] -- C:\Program Files (x86)
[2012.02.09 13:45:21 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2009.10.23 17:20:42 | 000,000,000 | -HSD | M] -- C:\Programme
[2009.10.23 17:20:42 | 000,000,000 | -HSD | M] -- C:\Recovery
[2012.02.09 13:53:22 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011.11.20 18:52:28 | 000,000,000 | R--D | M] -- C:\Users
[2012.02.05 18:35:24 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: AGP440.SYS  >
[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys
[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys
[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys
[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2011.02.26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe
[2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe
[2011.02.26 06:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_525b5180f3f95373\explorer.exe
[2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe
[2011.02.26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\explorer.exe
[2011.02.26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_51a3a583dafd0cef\explorer.exe
[2011.01.16 15:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\Rox\AppData\Local\Temp\RarSFX0\procs\explorer.exe
[2010.11.20 13:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe
[2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe
[2009.08.03 06:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe
[2005.08.16 01:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\Rox\AppData\Local\Temp\RarSFX0\h\explorer.exe
[2009.08.03 06:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe
[2009.10.31 07:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe
 
< MD5 for: IASTORV.SYS  >
[2011.03.11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys
[2011.03.11 06:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\System32\drivers\iaStorV.sys
[2011.03.11 06:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0033117673c16921\iaStorV.sys
[2011.03.11 06:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys
[2011.03.11 06:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys
[2009.07.14 02:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys
[2009.07.14 02:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys
[2010.11.20 13:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys
[2011.03.11 06:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll
[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\System32\netlogon.dll
[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2011.03.11 06:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys
[2011.03.11 06:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\System32\drivers\nvstor.sys
[2011.03.11 06:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_38e464dbe521cc7f\nvstor.sys
[2011.03.11 06:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys
[2011.03.11 06:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys
[2011.03.11 06:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys
[2010.11.20 13:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys
[2009.07.14 02:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys
[2009.07.14 02:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\System32\scecli.dll
[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll
[2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.07.14 02:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\System32\user32.dll
[2009.07.14 02:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
[2010.11.20 13:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\System32\userinit.exe
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Rox\AppData\Local\Temp\RarSFX0\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.10.28 07:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\System32\winlogon.exe
[2009.10.28 07:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009.10.28 06:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2010.11.20 13:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2009.07.14 02:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
[2009.05.26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Rox\AppData\Local\Temp\RarSFX0\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 00:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009.07.14 00:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
< %USERPROFILE%\*.* >
[2009.12.13 20:45:36 | 002,920,313 | ---- | M] () -- C:\Users\Rox\08-Bicycle.mp3
[2009.11.30 16:18:56 | 004,652,542 | ---- | M] () -- C:\Users\Rox\107-2-4_grooves_-_relax_(michael_mind_remix).mp3
[2011.02.18 14:29:21 | 000,003,041 | -HS- | M] () -- C:\Users\Rox\AlbumArtSmall.jpg
[2009.10.27 15:52:26 | 000,011,338 | -HS- | M] () -- C:\Users\Rox\AlbumArt_{22EBCCE5-0A05-47E9-8608-3A8D7CD9EB44}_Large.jpg
[2009.10.27 15:52:26 | 000,002,461 | -HS- | M] () -- C:\Users\Rox\AlbumArt_{22EBCCE5-0A05-47E9-8608-3A8D7CD9EB44}_Small.jpg
[2011.02.18 14:29:22 | 000,012,989 | -HS- | M] () -- C:\Users\Rox\AlbumArt_{ABF61527-B1EA-4C8A-BC34-052A05302219}_Large.jpg
[2011.02.18 14:29:21 | 000,003,041 | -HS- | M] () -- C:\Users\Rox\AlbumArt_{ABF61527-B1EA-4C8A-BC34-052A05302219}_Small.jpg
[2009.11.30 16:19:05 | 005,161,098 | ---- | M] () -- C:\Users\Rox\Band of Horses - The Funeral.mp3
[2011.02.18 14:29:22 | 000,000,362 | -HS- | M] () -- C:\Users\Rox\desktop.ini
[2011.02.18 14:29:22 | 000,012,989 | -HS- | M] () -- C:\Users\Rox\Folder.jpg
[2011.02.20 10:52:36 | 005,233,821 | ---- | M] () -- C:\Users\Rox\Ich & Ich - Dienen.mp3
[2012.02.09 14:04:27 | 004,456,448 | -HS- | M] () -- C:\Users\Rox\ntuser.dat
[2012.02.09 14:04:27 | 000,262,144 | -HS- | M] () -- C:\Users\Rox\ntuser.dat.LOG1
[2009.11.23 13:26:38 | 000,262,144 | -HS- | M] () -- C:\Users\Rox\ntuser.dat.LOG2
[2011.03.03 18:33:29 | 000,065,536 | -HS- | M] () -- C:\Users\Rox\ntuser.dat{2c4330d0-4594-11e0-881e-001731d8d177}.TM.blf
[2011.03.03 18:33:29 | 000,524,288 | -HS- | M] () -- C:\Users\Rox\ntuser.dat{2c4330d0-4594-11e0-881e-001731d8d177}.TMContainer00000000000000000001.regtrans-ms
[2011.03.03 18:33:29 | 000,524,288 | -HS- | M] () -- C:\Users\Rox\ntuser.dat{2c4330d0-4594-11e0-881e-001731d8d177}.TMContainer00000000000000000002.regtrans-ms
[2011.07.31 23:56:20 | 000,065,536 | -HS- | M] () -- C:\Users\Rox\ntuser.dat{4bba430a-bb98-11e0-a3de-001731d8d177}.TM.blf
[2011.07.31 23:56:20 | 000,524,288 | -HS- | M] () -- C:\Users\Rox\ntuser.dat{4bba430a-bb98-11e0-a3de-001731d8d177}.TMContainer00000000000000000001.regtrans-ms
[2011.07.31 23:56:20 | 000,524,288 | -HS- | M] () -- C:\Users\Rox\ntuser.dat{4bba430a-bb98-11e0-a3de-001731d8d177}.TMContainer00000000000000000002.regtrans-ms
[2011.07.04 21:36:49 | 000,065,536 | -HS- | M] () -- C:\Users\Rox\ntuser.dat{5b55d5dc-a64c-11e0-9528-001731d8d177}.TM.blf
[2011.07.04 21:36:49 | 000,524,288 | -HS- | M] () -- C:\Users\Rox\ntuser.dat{5b55d5dc-a64c-11e0-9528-001731d8d177}.TMContainer00000000000000000001.regtrans-ms
[2011.07.04 21:36:49 | 000,524,288 | -HS- | M] () -- C:\Users\Rox\ntuser.dat{5b55d5dc-a64c-11e0-9528-001731d8d177}.TMContainer00000000000000000002.regtrans-ms
[2010.06.04 23:06:39 | 000,065,536 | -HS- | M] () -- C:\Users\Rox\ntuser.dat{5d4a9e00-701a-11df-9e9c-001731d90298}.TM.blf
[2010.06.04 23:06:39 | 000,524,288 | -HS- | M] () -- C:\Users\Rox\ntuser.dat{5d4a9e00-701a-11df-9e9c-001731d90298}.TMContainer00000000000000000001.regtrans-ms
[2010.06.04 23:06:39 | 000,524,288 | -HS- | M] () -- C:\Users\Rox\ntuser.dat{5d4a9e00-701a-11df-9e9c-001731d90298}.TMContainer00000000000000000002.regtrans-ms
[2010.09.26 19:10:49 | 000,065,536 | -HS- | M] () -- C:\Users\Rox\ntuser.dat{60b79425-c970-11df-b61a-001731d90298}.TM.blf
[2010.09.26 19:10:49 | 000,524,288 | -HS- | M] () -- C:\Users\Rox\ntuser.dat{60b79425-c970-11df-b61a-001731d90298}.TMContainer00000000000000000001.regtrans-ms
[2010.09.26 19:10:49 | 000,524,288 | -HS- | M] () -- C:\Users\Rox\ntuser.dat{60b79425-c970-11df-b61a-001731d90298}.TMContainer00000000000000000002.regtrans-ms
[2009.11.23 13:26:38 | 001,048,576 | -HS- | M] () -- C:\Users\Rox\NTUSER.DAT{6cced2f0-6e01-11de-8bed-001e0bcd1824}.TxR.0.regtrans-ms
[2009.11.23 13:26:38 | 001,048,576 | -HS- | M] () -- C:\Users\Rox\NTUSER.DAT{6cced2f0-6e01-11de-8bed-001e0bcd1824}.TxR.1.regtrans-ms
[2009.11.23 13:26:38 | 001,048,576 | -HS- | M] () -- C:\Users\Rox\NTUSER.DAT{6cced2f0-6e01-11de-8bed-001e0bcd1824}.TxR.2.regtrans-ms
[2009.11.23 13:26:38 | 000,065,536 | -HS- | M] () -- C:\Users\Rox\NTUSER.DAT{6cced2f0-6e01-11de-8bed-001e0bcd1824}.TxR.blf
[2009.10.23 17:44:13 | 000,065,536 | -HS- | M] () -- C:\Users\Rox\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf
[2009.10.23 17:44:13 | 000,524,288 | -HS- | M] () -- C:\Users\Rox\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms
[2009.10.23 17:44:13 | 000,524,288 | -HS- | M] () -- C:\Users\Rox\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms
[2009.10.23 17:23:11 | 000,000,020 | -HS- | M] () -- C:\Users\Rox\ntuser.ini
[2011.08.07 22:38:34 | 000,035,840 | -H-- | M] () -- C:\Users\Rox\photothumb.db
[2009.10.25 09:27:52 | 008,621,775 | ---- | M] () -- C:\Users\Rox\Rotersand - Don't Know.mp3
[2011.10.31 14:29:48 | 000,070,144 | -HS- | M] () -- C:\Users\Rox\Thumbs.db
 
< %USERPROFILE%\Local Settings\Temp\*.exe >
 
< %USERPROFILE%\Local Settings\Temp\*.dll >
 
< %USERPROFILE%\Application Data\*.exe >
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

< End of report >
         

--- --- ---

--- --- ---

das ist der Report den ich habe durch OTL.

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.

• Besuche folgende Seite für Downloadlinks und Anweisungen für dieses
  Tool
  
  Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  
• Hinweis:
  Gehe sicher das all deine Anti Virus und Anti Malware Programme abgeschalten sind, damit diese Combofix nicht bei der Arbeit stören.
  
• Poste bitte die C:\Combofix.txt in deiner nächsten Antwort.

Combofix Logfile:

ComboFix 12-02-09.02 - Rox 12.02.2012  14:04:34.1.2 - x86
Microsoft Windows 7 Ultimate   6.1.7600.0.1252.49.1031.18.3070.1966 [GMT 1:00]
ausgeführt von:: c:\users\Rox\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\SEC6588.tmp
c:\users\Rox\AppData\Local\Microsoft\Windows\cod6espv207.exe
c:\users\Rox\AppData\Local\Microsoft\Windows\Updater.exe
c:\users\Rox\Documents\~WRL1647.tmp
c:\windows\ST6UNST.000
c:\windows\system32\drivers\etc\hosts.txt
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-01-12 bis 2012-02-12  ))))))))))))))))))))))))))))))
.
.
2012-02-12 13:11 . 2012-02-12 13:11	--------	d-----w-	c:\users\UpdatusUser\AppData\Local\temp
2012-02-12 13:11 . 2012-02-12 13:11	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-02-12 13:11 . 2012-02-12 13:11	--------	d-----w-	c:\users\Familie\AppData\Local\temp
2012-02-12 13:10 . 2012-02-12 13:10	56200	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{D7DBCE0B-1B8F-445C-A7C1-6D8042902005}\offreg.dll
2012-02-10 14:58 . 2012-01-06 04:19	6557240	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{D7DBCE0B-1B8F-445C-A7C1-6D8042902005}\mpengine.dll
2012-02-09 14:01 . 2012-02-09 14:01	--------	d-----w-	c:\users\Rox\AppData\Roaming\Avira
2012-02-09 13:47 . 2011-12-15 14:00	36000	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2012-02-09 13:47 . 2011-12-15 14:00	134856	----a-w-	c:\windows\system32\drivers\avipbb.sys
2012-02-09 13:47 . 2012-02-09 13:47	--------	d-----w-	c:\programdata\Avira
2012-02-09 13:47 . 2012-02-09 13:47	--------	d-----w-	c:\program files\Avira
2012-02-06 14:08 . 2012-02-06 14:08	--------	d-----w-	c:\program files\LogMeIn Hamachi
2012-01-31 19:33 . 2012-01-31 19:33	--------	d-----w-	c:\programdata\DivX
2012-01-31 10:37 . 2011-11-17 05:38	1037312	----a-w-	c:\windows\system32\lsasrv.dll
2012-01-31 10:37 . 2011-11-17 05:48	134000	----a-w-	c:\windows\system32\drivers\ksecpkg.sys
2012-01-31 10:37 . 2011-11-17 05:48	67440	----a-w-	c:\windows\system32\drivers\ksecdd.sys
2012-01-31 10:37 . 2011-11-17 05:42	369352	----a-w-	c:\windows\system32\drivers\cng.sys
2012-01-31 10:37 . 2011-11-17 05:39	314368	----a-w-	c:\windows\system32\webio.dll
2012-01-31 10:37 . 2011-11-17 05:39	99840	----a-w-	c:\windows\system32\sspicli.dll
2012-01-31 10:37 . 2011-11-17 05:39	15360	----a-w-	c:\windows\system32\sspisrv.dll
2012-01-31 10:37 . 2011-11-17 05:39	224768	----a-w-	c:\windows\system32\schannel.dll
2012-01-31 10:37 . 2011-11-17 05:39	22016	----a-w-	c:\windows\system32\secur32.dll
2012-01-31 10:37 . 2011-11-17 05:36	22528	----a-w-	c:\windows\system32\lsass.exe
2012-01-29 14:03 . 2012-01-29 14:03	--------	d-sh--w-	c:\users\Rox\AppData\Roaming\Realtek
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-07 17:51 . 2009-10-23 17:29	138160	----a-w-	c:\windows\system32\drivers\PnkBstrK.sys
2012-02-07 17:51 . 2011-07-16 14:26	271200	----a-w-	c:\windows\system32\PnkBstrB.xtr
2012-02-07 17:51 . 2010-03-06 16:36	271200	----a-w-	c:\windows\system32\PnkBstrB.exe
2012-02-07 14:11 . 2010-03-06 16:36	271200	----a-w-	c:\windows\system32\PnkBstrB.ex0
2012-01-26 23:21 . 2009-10-14 02:21	237072	------w-	c:\windows\system32\MpSigStub.exe
2011-12-15 14:00 . 2009-10-23 17:16	74640	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2011-12-01 18:30 . 2011-03-28 17:36	18328	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-11-24 04:23 . 2011-12-14 11:42	2340352	----a-w-	c:\windows\system32\win32k.sys
2011-11-19 14:06 . 2012-01-11 20:20	67072	----a-w-	c:\windows\system32\packager.dll
2011-11-17 05:41 . 2012-01-11 20:20	1288984	----a-w-	c:\windows\system32\ntdll.dll
2011-09-29 07:09 . 2011-10-30 18:41	134104	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-04-15 08:50	1375624	----a-w-	c:\program files\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-04-15 1375624]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-04-15 1375624]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Wisdom-soft AutoScreenRecorder 3.1 Free"="0" [X]
"ArchosLink"="c:\program files\Archos\ArchosLink\ArchosLink.exe" [2008-06-05 1863680]
"Steam"="c:\program files\Steam\steam.exe" [2011-08-14 1242448]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-10-13 17762440]
"Realtek"="c:\users\Rox\AppData\Roaming\Realtek\Realtek.exe" [2012-01-23 1773568]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-05-26 85160]
"VX3000"="c:\windows\vVX3000.exe" [2009-06-30 762208]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2009-07-24 118640]
"Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\SSMMgr.exe" [2008-08-27 536576]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-17 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-04-28 142120]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"RemoteControl10"="c:\program files\CyberLink\PowerDVD10\PDVD10Serv.exe" [2010-02-02 87336]
"BDRegion"="c:\program files\Cyberlink\Shared files\brs.exe" [2010-12-29 75048]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"LogMeIn Hamachi Ui"="c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe" [2012-02-02 1987976]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-12-15 258512]
.
c:\users\Familie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\users\Rox\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer6"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-05-14 136176]
R2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys [x]
R3 EagleXNt;EagleXNt;c:\windows\system32\drivers\EagleXNt.sys [x]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [2005-11-17 1527900]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-05-14 136176]
R3 TunngleService;TunngleService;c:\program files\Tunngle\TnglCtrl.exe [2011-12-12 751464]
R3 ZY760_XP;ZyXEL 802.11g XG762 1211 Driver;c:\windows\system32\DRIVERS\WlanUZXP.sys [2006-03-20 402944]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2011-12-15 36000]
S2 {1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC};Power Control [2011/09/10 22:59];c:\program files\CyberLink\PowerDVD10\NavFilter\000.fcl [2010-12-29 09:26 87536]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-12-15 86224]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [2012-02-02 1373576]
S2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [2010-11-21 247608]
S2 MySQL55;MySQL55;c:\program files\Aspyr\Guitar Hero World Tour\bin\mysqld --defaults-file=c:\programdata\MySQL\MySQL Server 5.5\my.ini MySQL55 [x]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-10-15 2253120]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-10-14 381248]
S3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys [2009-09-16 27136]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper	REG_MULTI_SZ   	getPlusHelper
WindowsMobile	REG_MULTI_SZ   	wcescomm rapimgr
LocalServiceRestricted	REG_MULTI_SZ   	WcesComm RapiMgr
.
Inhalt des "geplante Tasks" Ordners
.
2012-02-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-14 14:06]
.
2012-02-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-14 14:06]
.
2012-02-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2916697408-2345766494-1444788071-1000Core.job
- c:\users\Rox\AppData\Local\Google\Update\GoogleUpdate.exe [2011-04-11 08:16]
.
2012-02-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2916697408-2345766494-1444788071-1000UA.job
- c:\users\Rox\AppData\Local\Google\Update\GoogleUpdate.exe [2011-04-11 08:16]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://start.icq.com/
IE: &Abonnieren ArchosLink - file://c:\program files\Archos\ArchosLink\\script.js
IE: Free YouTube Download - c:\users\Rox\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\Rox\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\ICQ7.5\ICQ.exe
FF - ProfilePath - c:\users\Rox\AppData\Roaming\Mozilla\Firefox\Profiles\ycw1bw31.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://start.icq.com/
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{EEE6C35D-6118-11DC-9C72-001320C79847} - (no file)
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
HKCU-Run-KPeerNexonEU - c:\nexon\NEXON_EU_Downloader\nxEULauncher.exe
HKCU-Run-ICQ - c:\program files\ICQ7.4\ICQ.exe
AddRemove-Free Audio CD Burner_is1 - c:\program files\DVDVideoSoft\Free Audio CD Burner\unins000.exe
AddRemove-Uninstall_is1 - c:\program files\Common Files\DVDVideoSoft\unins000.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\MySQL55]
"ImagePath"="\"c:\program files\Aspyr\Guitar Hero World Tour\bin\mysqld\" --defaults-file=\"c:\programdata\MySQL\MySQL Server 5.5\my.ini\" MySQL55"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\{1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD10\NavFilter\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-2916697408-2345766494-1444788071-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:af,33,e8,67,bc,6a,1f,db,3e,25,0f,8b,2a,dc,c6,bf,e2,d7,bd,69,d5,33,68,
   c2,5e,3c,48,29,e8,da,f5,76,10,ac,24,8f,54,35,e6,78,3f,ed,15,42,65,6c,47,95,\
"??"=hex:a1,5e,47,db,25,65,bb,27,8b,92,55,34,10,3f,d9,49
.
[HKEY_USERS\S-1-5-21-2916697408-2345766494-1444788071-1000\Software\SecuROM\License information*]
"datasecu"=hex:e7,6d,bd,e0,69,b2,0b,09,cb,99,46,68,7d,b2,07,de,4a,c1,f0,18,1f,
   53,a5,19,c2,7a,22,63,98,bf,02,9f,ec,03,df,47,02,11,06,33,f3,d9,ac,68,9f,71,\
"rkeysecu"=hex:7f,17,72,6c,12,4f,37,14,75,58,c7,a3,45,ab,c6,01
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-02-12  14:13:49
ComboFix-quarantined-files.txt  2012-02-12 13:13
.
Vor Suchlauf: 9 Verzeichnis(se), 341.213.544.448 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 344.458.080.256 Bytes frei
.
- - End Of File - - 9C2C8CEE31F01B3778AF7BC6326621E0
         

--- --- ---


Was bringen euch diese Informationen? bzw was lest ihr aus ihnen heraus ?

hi,
combofix löscht im normalfall weitere malware und zeigt uns erstellte dateien etc.
ich möchte mir etwas ansehen.
öffne computer, c: qoobox. rechtsklick quarantain, und mit winrar, zip oder anderem archivierungsprogramm packen und archiv hochladen.
Trojaner-Board Upload Channel

Ich hoffe ihr habts empfangen da ichs jetzt hier nicht gepostet sehe.

ja, danke.
malwarebytes:
Downloade Dir bitte Malwarebytes

• Installiere
  das Programm in den vorgegebenen Pfad.
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Starte Malwarebytes, klicke auf Aktualisierung --> Suche
  nach Aktualisierung
• Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
• Wenn der Scan beendet
  ist, klicke auf Ergebnisse anzeigen.
• Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
• Poste
  das Logfile, welches sich in Notepad öffnet, hier in den Thread.
• Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Malwarebytes Anti-Malware (Test) 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.02.13.02

Windows 7 x86 NTFS
Internet Explorer 8.0.7600.16385
Rox :: ROX-PC [Administrator]

Schutz: Aktiviert

13.02.2012 19:51:15
mbam-log-2012-02-13 (19-51-15).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 468529
Laufzeit: 1 Stunde(n), 49 Minute(n), 2 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 1
HKCU\SOFTWARE\CYBER (Backdoor.Trace) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 1
HKCU\Software\Cyber|FirstExecution (Backdoor.Trace) -> Daten: 02/02/2012 -- 19:28 -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 9

C:\Users\Rox\AppData\Local\Temp\dclogs\2012-02-13-2.dc (Stolen.Data) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

Es gab noch ander Dateien die jedoch nicht von Belang waren und hier auch nicht gepostet werden sollten. (Waren jedoch sichere Dateien, von welchen ich weiß das sie keinen Schaden anrichten.)

ich hätte schon gern das ganze log.
du hast auf jeden fall nen keylogger oder schlimmeres.
nutzt du den pc für onlinebanking, einkäufe, sonstige zahlugnsabwicklungen, oder ähnlich wichtiges, wie berufliches?
wenn es keygens waren, woher willst du wissen ob die "sicher" sind, kennst du dich mit programierung aus?

Malwarebytes Anti-Malware (Test) 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.02.13.02

Windows 7 x86 NTFS
Internet Explorer 8.0.7600.16385
Rox :: ROX-PC [Administrator]

Schutz: Aktiviert

13.02.2012 19:51:15
mbam-log-2012-02-13 (19-51-15).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 468529
Laufzeit: 1 Stunde(n), 49 Minute(n), 2 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 1
HKCU\SOFTWARE\CYBER (Backdoor.Trace) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 1
HKCU\Software\Cyber|FirstExecution (Backdoor.Trace) -> Daten: 02/02/2012 -- 19:28 -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 9
C:\Program Files\Image-Line\Toxic Biohazard\Toxic Biohazard.dll (Trojan.Backdoor) -> Keine Aktion durchgeführt.
C:\Users\Rox\Music\Downloads\auslagerung\catalyst 180\RenameMe.dll (Trojan.Agent) -> Keine Aktion durchgeführt.
C:\Users\Rox\Music\Downloads\auslagerung\catalyst 180\RenameMe.exe (Trojan.Agent) -> Keine Aktion durchgeführt.
C:\Users\Rox\Documents\gtr6\gtrpr61\CRACK\guitarpro6-patch-Fixed.exe (Malware.Packer.Gen) -> Keine Aktion durchgeführt.
C:\Users\Rox\Documents\gtr6\gtrpr61\CRACK\keygen.exe (RiskWare.Tool.CK) -> Keine Aktion durchgeführt.
C:\Users\Rox\Desktop\Call Of Duty Modern Warfare 2\TeknoGods_MW2SP.exe (Backdoor.Agent.Gen) -> Keine Aktion durchgeführt.
C:\Users\Rox\Desktop\Call Of Duty Modern Warfare 2 - Kopie\TeknoGods_MW2SP.exe (Backdoor.Agent.Gen) -> Keine Aktion durchgeführt.
C:\Users\Rox\Desktop\Ordner desktp\Call of Duty - Modern Warfare II\TeknoGods_MW2SP.exe (Backdoor.Agent.Gen) -> Keine Aktion durchgeführt.
C:\Users\Rox\AppData\Local\Temp\dclogs\2012-02-13-2.dc (Stolen.Data) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

Na gut dann mal viel Glück bei der Analyse.

jo, keygens kann ich nicht unterstützen, du hast dir bei deren verwendung weitere malware geladen, wie gesagt, mit backdoor charakter, weswegen ein neu aufsetzen sowieso ratsam ist.

Alles klar, danke für eure Hilfe. Werd dann mal am Wochenende mein glück versuchen in Sachen neu machen.
Danke werde euch empfehlen.