Hallo

Habe mir auf meinen Pc einen ungebetenen Gast eingehandelt
der mich auffordert nachdem alles gesperrt wurde eine Seite
zu besuchen und zusätzliche Software zu laden sowie Geld zu
überweisen.Diese Meldung erscheint jetzt das dritte mal immer beim Start
von Firefox. Ich starte dann windows über kaltstart einfach neu ohne
irgendetwas anzuklicken oder downzuladen.
Nun möchte ich diesen Besucher wieder loswerden nur mit den normalen Virenscanner scheint das nicht zu funktionieren.
Habe deshalb otl scannen lassen und die Datei mit angehängt
hoffe mir kann jemand helfen

Vielen Dank

hi, hier hängt keine datei :-)
starte neu, drücke f8 wähle abgesicherter modus mit netzwerk, melde dich im infiziertem account an.
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

• Starte bitte die
  OTL.exe
  .
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Kopiere nun den Inhalt in die
  Textbox.

activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
         

• Schliesse bitte nun alle Programme. (Wichtig)
• Klicke nun bitte auf den Quick Scan Button.
• Kopiere
  nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

Der Scan mit deinen einstellungen scheint zu hängen
bei "Manual file Scan: Getting folder structure" geht es seit 10 Minuten nicht mehr weiter.
soll ich einen normalen Scan ausführen wie bei OTL beschrieben
jetzt kam die Meldung "out of memory"

otl.txt

OTL logfile created on: 09.02.2012 20:05:14 - Run 6
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\mikelsoft\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
8,00 Gb Total Physical Memory | 6,47 Gb Available Physical Memory | 80,97% Memory free
15,99 Gb Paging File | 14,61 Gb Available in Paging File | 91,37% Paging File free
Paging file location(s): d:\pagefile.sys 0 0 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 111,79 Gb Total Space | 56,33 Gb Free Space | 50,39% Space Free | Partition Type: NTFS
Drive D: | 465,66 Gb Total Space | 95,81 Gb Free Space | 20,58% Space Free | Partition Type: NTFS
Drive E: | 138,31 Gb Total Space | 14,18 Gb Free Space | 10,25% Space Free | Partition Type: NTFS
Drive F: | 793,20 Gb Total Space | 395,33 Gb Free Space | 49,84% Space Free | Partition Type: NTFS
 
Computer Name: ZENTIS | User Name: mikelsoft | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 14 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\mikelsoft\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
MOD - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (AMD FUEL Service) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Advanced Micro Devices, Inc.)
SRV:64bit: - (LBTServ) -- C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV:64bit: - (LMIMaint) -- C:\Program Files\LogMeIn\x64\RaMaint.exe (LogMeIn, Inc.)
SRV:64bit: - (LMIGuardianSvc) -- C:\Program Files\LogMeIn\x64\LMIGuardianSvc.exe (LogMeIn, Inc.)
SRV:64bit: - (LogMeIn) -- C:\Program Files\LogMeIn\x64\LogMeIn.exe (LogMeIn, Inc.)
SRV:64bit: - (RichVideo64) -- C:\Program Files\Cyberlink\Shared files\RichVideo64.exe ()
SRV:64bit: - (WinVNC4) -- C:\Program Files\RealVNC\VNC4\WinVNC4.exe (RealVNC Ltd.)
SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (SDWSCService) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Safer-Networking Ltd.)
SRV - (SDUpdateService) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (Safer-Networking Ltd.)
SRV - (SDScannerService) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (Safer-Networking Ltd.)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (TeamViewer7) -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (CyberLink PowerDVD 12 Media Server Service) -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe (CyberLink)
SRV - (CLHNServiceForPowerDVD12) -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe (CyberLink Corp.)
SRV - (CyberLink PowerDVD 12 Media Server Monitor Service) -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe (CyberLink)
SRV - (OpenVPNService) -- C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe ()
SRV - (MotoHelper) -- C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe ()
SRV - (Dyn Updater) -- C:\Program Files (x86)\Dyn Updater\DynUpSvc.exe (Dyn, Inc.)
SRV - (afcdpsrv) -- C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe (Acronis)
SRV - (UMVPFSrv) -- C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
SRV - (wxpSvc) -- C:\Program Files (x86)\wLite\wService.exe (Moonware Studios)
SRV - (AcrSch2Svc) -- C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe (Acronis)
SRV - (CLHNServiceForPowerDVD) -- C:\Program Files (x86)\CyberLink\PowerDVD11\Kernel\DMP\CLHNServiceForPowerDVD.exe ()
SRV - (CyberLink PowerDVD 11.0 Service) -- C:\Program Files (x86)\CyberLink\PowerDVD11\Common\MediaServer\CLMSServer.exe (CyberLink)
SRV - (CyberLink PowerDVD 11.0 Monitor Service) -- C:\Program Files (x86)\CyberLink\PowerDVD11\Common\MediaServer\CLMSMonitorService.exe (CyberLink)
SRV - (Secunia PSI Agent) -- C:\Program Files (x86)\Secunia\PSI\PSIA.exe (Secunia)
SRV - (Secunia Update Agent) -- C:\Program Files (x86)\Secunia\PSI\sua.exe (Secunia)
SRV - (EhttpSrv) -- C:\Programme\ESET\EHttpSrv.exe (ESET)
SRV - (ekrn) -- C:\Programme\ESET\x86\ekrn.exe (ESET)
SRV - (OODefragAgent) -- D:\Programme\OO Software\Defrag\oodag.exe (O&O Software GmbH)
SRV - (MCSWASVR) -- d:\Programme\Telekom\Mediencenter\WebDAV.AdminService.exe (Deutsche Telekom AG)
SRV - (OS Selector) -- D:\Programme\Acronis\DiskDirector\OSS\reinstall_svc.exe ()
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
SRV - (mail) -- D:\Filemon\SysinternalsSuite\winserv.exe ()
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (dtsoftbus01) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys (DT Soft Ltd)
DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys (Duplex Secure Ltd.)
DRV:64bit: - (VBoxNetAdp) -- C:\Windows\SysNative\drivers\VBoxNetAdp.sys (Oracle Corporation)
DRV:64bit: - (tap0901) -- C:\Windows\SysNative\drivers\tap0901.sys (The OpenVPN Project)
DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (usbfilter) -- C:\Windows\SysNative\drivers\usbfilter.sys (Advanced Micro Devices)
DRV:64bit: - (amd_xata) -- C:\Windows\SysNative\drivers\amd_xata.sys (Advanced Micro Devices)
DRV:64bit: - (amd_sata) -- C:\Windows\SysNative\drivers\amd_sata.sys (Advanced Micro Devices)
DRV:64bit: - (nusb3xhc) -- C:\Windows\SysNative\drivers\nusb3xhc.sys (Renesas Electronics Corporation)
DRV:64bit: - (nusb3hub) -- C:\Windows\SysNative\drivers\nusb3hub.sys (Renesas Electronics Corporation)
DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:64bit: - (afcdp) -- C:\Windows\SysNative\drivers\afcdp.sys (Acronis)
DRV:64bit: - (tdrpman273) Acronis Try&Decide and Restore Points filter (build 273) -- C:\Windows\SysNative\drivers\tdrpm273.sys (Acronis)
DRV:64bit: - (timounter) -- C:\Windows\SysNative\drivers\timntr.sys (Acronis)
DRV:64bit: - (AnyDVD) -- C:\Windows\SysNative\drivers\AnyDVD.sys (SlySoft, Inc.)
DRV:64bit: - (LVUVC64) Logitech HD Webcam C310(UVC) -- C:\Windows\SysNative\drivers\lvuvc64.sys (Logitech Inc.)
DRV:64bit: - (LVRS64) -- C:\Windows\SysNative\drivers\lvrs64.sys (Logitech Inc.)
DRV:64bit: - (AODDriver4.01) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys (Advanced Micro Devices)
DRV:64bit: - (AODDriver4.0) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys (Advanced Micro Devices)
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (LHidFilt) -- C:\Windows\SysNative\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV:64bit: - (LMouFilt) -- C:\Windows\SysNative\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV:64bit: - (LUsbFilt) -- C:\Windows\SysNative\drivers\LUsbFilt.sys (Logitech, Inc.)
DRV:64bit: - (LGBusEnum) -- C:\Windows\SysNative\drivers\LGBusEnum.sys (Logitech Inc.)
DRV:64bit: - (LGVirHid) -- C:\Windows\SysNative\drivers\LGVirHid.sys (Logitech Inc.)
DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (BackupReader) -- C:\Windows\SysNative\drivers\BackupReader.sys (Microsoft Corporation)
DRV:64bit: - (eamonm) -- C:\Windows\SysNative\drivers\eamonm.sys (ESET)
DRV:64bit: - (ehdrv) -- C:\Windows\SysNative\drivers\ehdrv.sys (ESET)
DRV:64bit: - (epfwwfpr) -- C:\Windows\SysNative\drivers\epfwwfpr.sys (ESET)
DRV:64bit: - (ElbyCDIO) -- C:\Windows\SysNative\drivers\ElbyCDIO.sys (Elaborate Bytes AG)
DRV:64bit: - (LMIRfsClientNP) -- C:\Windows\SysNative\LMIRfsClientNP.dll (LogMeIn, Inc.)
DRV:64bit: - (snapman) -- C:\Windows\SysNative\drivers\snapman.sys (Acronis)
DRV:64bit: - (RTHDMIAzAudService) -- C:\Windows\SysNative\drivers\RtHDMIVX.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (fssfltr) -- C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)
DRV:64bit: - (LMIRfsDriver) -- C:\Windows\SysNative\drivers\LMIRfsDriver.sys (LogMeIn, Inc.)
DRV:64bit: - (LMIInfo) -- C:\Program Files\LogMeIn\x64\rainfo.sys (LogMeIn, Inc.)
DRV:64bit: - (lmimirr) -- C:\Windows\SysNative\drivers\lmimirr.sys (LogMeIn, Inc.)
DRV:64bit: - (PSI) -- C:\Windows\SysNative\drivers\psi_mf.sys (Secunia)
DRV:64bit: - (NPF) -- C:\Windows\SysNative\drivers\npf.sys (CACE Technologies, Inc.)
DRV:64bit: - (AtiPcie) AMD PCI Express (3GIO) -- C:\Windows\SysNative\drivers\AtiPcie64.sys (Advanced Micro Devices Inc.)
DRV:64bit: - (cbfs3) -- C:\Windows\SysNative\drivers\cbfs3.sys (EldoS Corporation)
DRV:64bit: - (ha20x2k) -- C:\Windows\SysNative\drivers\ha20x2k.sys (Creative Technology Ltd)
DRV:64bit: - (emupia) -- C:\Windows\SysNative\drivers\emupia2k.sys (Creative Technology Ltd)
DRV:64bit: - (ctsfm2k) -- C:\Windows\SysNative\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV:64bit: - (ctprxy2k) -- C:\Windows\SysNative\drivers\ctprxy2k.sys (Creative Technology Ltd)
DRV:64bit: - (ossrv) -- C:\Windows\SysNative\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV:64bit: - (ctaud2k) Creative Audio Driver (WDM) -- C:\Windows\SysNative\drivers\ctaud2k.sys (Creative Technology Ltd)
DRV:64bit: - (ctac32k) -- C:\Windows\SysNative\drivers\ctac32k.sys (Creative Technology Ltd)
DRV:64bit: - (CTEXFIFX.SYS) -- C:\Windows\SysNative\drivers\CTEXFIFX.sys (Creative Technology Ltd.)
DRV:64bit: - (CTEXFIFX) -- C:\Windows\SysNative\drivers\CTEXFIFX.sys (Creative Technology Ltd.)
DRV:64bit: - (CTHWIUT.SYS) -- C:\Windows\SysNative\drivers\CTHWIUT.sys (Creative Technology Ltd.)
DRV:64bit: - (CTHWIUT) -- C:\Windows\SysNative\drivers\CTHWIUT.sys (Creative Technology Ltd.)
DRV:64bit: - (CT20XUT.SYS) -- C:\Windows\SysNative\drivers\CT20XUT.sys (Creative Technology Ltd.)
DRV:64bit: - (CT20XUT) -- C:\Windows\SysNative\drivers\CT20XUT.sys (Creative Technology Ltd.)
DRV:64bit: - (AmUStor) -- C:\Windows\SysNative\drivers\AmUStor.sys (Alcor Micro, Corp.)
DRV:64bit: - (amdiox64) -- C:\Windows\SysNative\drivers\amdiox64.sys (Advanced Micro Devices)
DRV:64bit: - (AtiHdmiService) -- C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV:64bit: - (teamviewervpn) -- C:\Windows\SysNative\drivers\teamviewervpn.sys (TeamViewer GmbH)
DRV:64bit: - (pcouffin) -- C:\Windows\SysNative\drivers\pcouffin.sys (VSO Software)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (lvpopf64) -- C:\Windows\SysNative\drivers\lvpopf64.sys (Logitech Inc.)
DRV:64bit: - (LVPr2M64) -- C:\Windows\SysNative\drivers\LVPr2M64.sys ()
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (atksgt) -- C:\Windows\SysNative\drivers\atksgt.sys ()
DRV:64bit: - (lirsgt) -- C:\Windows\SysNative\drivers\lirsgt.sys ()
DRV:64bit: - (tifsfilter) -- C:\Windows\SysNative\drivers\tifsfilt.sys (Acronis)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (motandroidusb) -- C:\Windows\SysNative\drivers\motoandroid.sys (Motorola)
DRV:64bit: - (MEMSWEEP2) -- C:\Windows\SysNative\EDE8.tmp (Sophos Plc)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (vncmirror) -- C:\Windows\SysNative\drivers\vncmirror.sys (RealVNC Ltd.)
DRV:64bit: - (ElbyCDFL) -- C:\Windows\SysNative\drivers\ElbyCDFL.sys (SlySoft, Inc.)
DRV:64bit: - (Hardlock) -- C:\Windows\SysNative\drivers\hardlock.sys (Aladdin Knowledge Systems Ltd.)
DRV - (ntk_PowerDVD12) -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12_64.sys (Cyberlink Corp.)
DRV - (AnyDVD) -- C:\Windows\SysWOW64\drivers\AnyDVD.sys (SlySoft, Inc.)
DRV - ({329F96B6-DF1E-4328-BFDA-39EA953C1312}) -- C:\Program Files (x86)\CyberLink\PowerDVD11\Common\NavFilter\000.fcl (CyberLink Corp.)
DRV - (ntk_PowerDVD) -- C:\Program Files (x86)\CyberLink\PowerDVD11\Kernel\DMP\ntk_PowerDVD_64.sys (Cyberlink Corp.)
DRV - (SSPORT) -- C:\Windows\SysWOW64\drivers\SSPORT.SYS (Samsung Electronics)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (ISODrive) -- C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys (EZB Systems, Inc.)
DRV - (ElbyCDFL) -- C:\Windows\SysWOW64\drivers\ElbyCDFL.sys (SlySoft, Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://uk.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://uk.yahoo.com
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.ask.com/?l=dis&o=14597
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 2B B1 F8 BA 3F 1C CA 01  [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;192.168.*.*
 
========== FireFox ==========
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa2,version=2.0.0: C:\Program Files (x86)\Picasa2\npPicasa2.dll File not found
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.5: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\support@predictad.com: C:\Program Files (x86)\AutocompletePro\support@predictad.com
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.02.01 21:51:02 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.01.11 20:20:47 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 7.0\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011.10.30 16:06:04 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 7.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Programme\ESET\Mozilla Thunderbird [2011.02.16 20:07:35 | 000,000,000 | ---D | M]
 
[2011.12.08 18:21:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Extensions
[2009.09.29 11:04:38 | 000,000,000 | ---D | M] (No name found) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Extensions\MediaCoder
[2009.12.28 20:44:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Extensions\uploadr@flickr.com
[2012.02.09 16:03:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions
[2011.08.17 14:15:59 | 000,000,000 | ---D | M] (Vista-aero) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\{07b2a769-ed19-4483-87ce-c643914c81bb}(149)
[2012.01.11 20:23:00 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
[2012.01.27 12:35:37 | 000,000,000 | ---D | M] (TV-Fox) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\{2f17f610-5e97-4fed-828f-9940b7b577a4}
[2011.08.17 14:15:59 | 000,000,000 | ---D | M] (PDF Download) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\{37E4D8EA-8BDA-4831-8EA1-89053939A250}
[2011.08.17 14:16:00 | 000,000,000 | ---D | M] (Minimap Addon) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\{398e77b8-2304-11dc-8314-0800200c9a66}(150)
[2012.01.18 16:55:44 | 000,000,000 | ---D | M] (FEBE) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}
[2011.08.17 14:16:00 | 000,000,000 | ---D | M] (Map+) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\{5359A5B3-9AFD-49ee-8C39-0A8F97A2A2D6}
[2011.08.17 14:16:00 | 000,000,000 | ---D | M] (NoScript) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}(151)
[2011.08.17 14:16:00 | 000,000,000 | ---D | M] (Live HTTP Headers) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\{8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}
[2011.11.20 15:54:50 | 000,000,000 | ---D | M] (WOT) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2012.01.27 21:56:51 | 000,000,000 | ---D | M] (ReminderFox) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\{ada4b710-8346-4b82-8199-5de2b400a6ae}
[2011.12.25 12:33:54 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011.08.17 14:16:00 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}(152)
[2011.08.17 14:16:00 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}(60)
[2011.08.17 14:15:59 | 000,000,000 | ---D | M] (DT Whois) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\beysim@beysim.net
[2011.08.17 14:15:59 | 000,000,000 | ---D | M] (Firebug) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\firebug@software.joehewitt(63).com
[2011.08.17 14:15:59 | 000,000,000 | ---D | M] (h4ck-y0u Toolbar) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\hackbar@h4ck-y0u.org
[2011.08.17 14:15:59 | 000,000,000 | ---D | M] (Locationbar²) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\locationbar2@design-noir.de
[2012.02.01 21:51:02 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.02.02 20:45:59 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2010.01.22 00:44:18 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170633FE}
[2012.01.29 17:12:48 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.07.29 14:12:26 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2010.09.29 21:00:15 | 000,075,208 | ---- | M] (Foxit Software Company) -- C:\Program Files (x86)\mozilla firefox\plugins\npFoxitReaderPlugin.dll
[2012.01.29 15:02:49 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.01.29 14:50:55 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.01.29 15:02:49 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.01.29 15:02:49 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.11.19 15:41:57 | 000,002,519 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\Search_Results.xml
[2012.01.29 15:02:49 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.01.29 15:02:49 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Search Results (Enabled)
CHR - default_search_provider: search_url = hxxp://dts.search-results.com/sr?src=crb&appid=113&systemid=406&sr=0&q={searchTerms}
CHR - default_search_provider: suggest_url = 
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\mikelsoft\AppData\Local\Google\Chrome\Application\16.0.912.75\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U26 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\mikelsoft\AppData\Local\Google\Chrome\Application\16.0.912.75\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\mikelsoft\AppData\Local\Google\Chrome\Application\16.0.912.75\pdf.dll
CHR - plugin: Skype Toolbars (Enabled) = C:\Users\mikelsoft\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8153_0\npSkypeChromePlugin.dll
CHR - plugin: DivX Player Netscape Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll
CHR - plugin: Foxit Reader Plugin for Mozilla (Enabled) = C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll
CHR - plugin: Winamp Application Detector (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll
CHR - plugin: Orbit Downloader (Enabled) = C:\Users\mikelsoft\AppData\Local\Google\Chrome\Application\plugins\nporbit.dll
CHR - plugin: DivX OVS Helper Plug-in (Enabled) = C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: CANON iMAGE GATEWAY Album Plugin Utility (Enabled) = C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL
CHR - plugin: Default Plug-in (Enabled) = default_plugin
 
O1 HOSTS File: ([2012.01.05 16:31:27 | 000,002,749 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Virtual Storage Mount Notification) - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysNative\CbFsMntNtf3.dll (EldoS Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Samsung BHO Class) - {AA609D72-8482-4076-8991-8CDAE5B93BCB} - d:\Programme\Samsung AnyWeb Print\W2PBrowser.dll ()
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (FlashFXP Helper for Internet Explorer) - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\FlashFXP\IEFlash.dll (IniCom Networks, Inc.)
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {99079a25-328f-4bd4-be04-00955acaa0a7} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4:64bit: - HKLM..\Run: [egui] C:\Programme\ESET\egui.exe (ESET)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [CTxfiHlp] C:\Windows\SysWow64\Ctxfihlp.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [LWS] C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
O4 - HKLM..\Run: [SAOB Monitor] C:\Program Files (x86)\Acronis\TrueImageHome\OnlineBackupStandalone\TrueImageMonitor.exe (Acronis)
O4 - HKLM..\Run: [SDTray] C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [TrueImageMonitor.exe] D:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe (Acronis)
O4 - HKCU..\Run: [{6C18F224-F804-11DF-A3E9-806E6F6E6963}] C:\Users\mikelsoft\AppData\Roaming\Microsoft\torrent.exe File not found
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [Steam] F:\Steam\steam.exe (Valve Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O8:64bit: - Extra context menu item: &NeoTrace It! - C:\PROGRA~2\NEOTRA~1\NTXcontext.htm ()
O8:64bit: - Extra context menu item: add to &BOM - C:\\PROGRA~2\\BIET-O~1\\\\AddToBOM.hta ()
O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: An vorhandene PDF-Datei anfügen - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html File not found
O8:64bit: - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html File not found
O8:64bit: - Extra context menu item: Linkziel in Adobe PDF konvertieren - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html File not found
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: &NeoTrace It! - C:\PROGRA~2\NEOTRA~1\NTXcontext.htm ()
O8 - Extra context menu item: add to &BOM - C:\\PROGRA~2\\BIET-O~1\\\\AddToBOM.hta ()
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html File not found
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html File not found
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html File not found
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: Samsung AnyWeb Print - {328ECD19-C167-40eb-A0C7-16FE7634105E} - d:\Programme\Samsung AnyWeb Print\W2PBrowser.dll ()
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: samsungsetup.com ([www] http in Vertrauenswürdige Sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 10.1.0)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 1.7.0_01)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab (Creative Software AutoUpdate Support Package)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15114/CTPID.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6CCCD374-6BA3-44C0-9C70-801D52F7627B}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6CCCD374-6BA3-44C0-9C70-801D52F7627B}: NameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Program Files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O20 - Winlogon\Notify\SDWinLogon: DllName - (SDWinLogon.dll) -  File not found
O21:64bit: - SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysNative\CbFsMntNtf3.dll (EldoS Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O22:64bit: - SharedTaskScheduler: {5FF49FE8-B332-4CB9-B102-FB6951629E55} - Virtual Storage Mount Notification - C:\Windows\SysNative\CbFsMntNtf3.dll (EldoS Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - D:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{06b0b34b-f84a-11df-9b38-aaa665e32000}\Shell - "" = AutoRun
O33 - MountPoints2\{06b0b34b-f84a-11df-9b38-aaa665e32000}\Shell\AutoRun\command - "" = I:\autorun.exe
O33 - MountPoints2\{1ed1d896-6326-11df-9de5-001fd0806040}\Shell - "" = AutoRun
O33 - MountPoints2\{1ed1d896-6326-11df-9de5-001fd0806040}\Shell\AutoRun\command - "" = I:\Setup.exe
O33 - MountPoints2\{1ed1d899-6326-11df-9de5-001fd0806040}\Shell - "" = AutoRun
O33 - MountPoints2\{1ed1d899-6326-11df-9de5-001fd0806040}\Shell\AutoRun\command - "" = K:\autorun.exe
O33 - MountPoints2\{31d30b1f-dd20-11de-92e7-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{31d30b1f-dd20-11de-92e7-806e6f6e6963}\Shell\AutoRun\command - "" = G:\autorun.exe setup
O33 - MountPoints2\{52df5b09-e9b0-11e0-abfd-1c6f654cb52a}\Shell - "" = AutoRun
O33 - MountPoints2\{52df5b09-e9b0-11e0-abfd-1c6f654cb52a}\Shell\AutoRun\command - "" = I:\OriginInstaller.exe
O33 - MountPoints2\{713a542d-18c5-11df-ba84-001fd0806040}\Shell - "" = AutoRun
O33 - MountPoints2\{713a542d-18c5-11df-ba84-001fd0806040}\Shell\AutoRun\command - "" = J:\SetupLauncher.exe
O33 - MountPoints2\{7b0ff70d-0d6f-11e1-bd6a-1c6f654cb52a}\Shell - "" = AutoRun
O33 - MountPoints2\{7b0ff70d-0d6f-11e1-bd6a-1c6f654cb52a}\Shell\AutoRun\command - "" = I:\whsconnectorinstall.exe
O33 - MountPoints2\{c9b764a7-2af5-11e0-81af-1c6f654cb52a}\Shell - "" = AutoRun
O33 - MountPoints2\{c9b764a7-2af5-11e0-81af-1c6f654cb52a}\Shell\AutoRun\command - "" = L:\setup.exe -a
O33 - MountPoints2\{d8860dff-fb11-11df-bfb2-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{d8860dff-fb11-11df-bfb2-806e6f6e6963}\Shell\AutoRun\command - "" = G:\Setup.exe
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\setup.exe
O33 - MountPoints2\I\Shell - "" = AutoRun
O33 - MountPoints2\I\Shell\AutoRun\command - "" = I:\setup.exe
O33 - MountPoints2\K\Shell - "" = AutoRun
O33 - MountPoints2\K\Shell\AutoRun\command - "" = K:\start.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (OODBS)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 14 Days ==========
 
[2582.02.25 10:22:54 | 000,000,000 | ---D | C] -- C:\WinHex.15.0-X_Bullet_X
[2012.02.09 18:07:33 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\mikelsoft\Desktop\OTL.exe
[2012.02.09 17:51:02 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0
[2012.02.09 15:04:05 | 052,128,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MRT.exe
[2012.02.09 14:48:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
[2012.02.09 14:48:53 | 000,017,272 | ---- | C] (Safer Networking Limited) -- C:\Windows\SysNative\sdnclean64.exe
[2012.02.09 14:48:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy 2
[2012.02.02 21:34:57 | 000,000,000 | ---D | C] -- C:\Users\mikelsoft\AppData\Roaming\Thunderbird
[2012.02.02 21:34:57 | 000,000,000 | ---D | C] -- C:\Users\mikelsoft\AppData\Local\Thunderbird
[2012.02.02 21:22:10 | 000,000,000 | ---D | C] -- C:\Users\mikelsoft\AppData\Local\{6D5B4C0A-CF20-4F92-BDFD-497ED067F1EA}
[2012.02.02 21:21:46 | 000,000,000 | ---D | C] -- C:\Users\mikelsoft\AppData\Local\{3E9616F1-935F-47C3-9677-97DA4160257F}
[2012.02.02 21:20:22 | 000,000,000 | ---D | C] -- C:\Users\mikelsoft\AppData\Local\{F13720B7-D640-413A-AA0C-0BFED2EEC0CF}
[2012.02.02 20:45:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2012.02.02 20:45:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2012.02.02 20:17:38 | 000,000,000 | ---D | C] -- C:\Users\mikelsoft\AppData\Roaming\Ember_Media_Manager
[2012.02.02 18:57:25 | 000,000,000 | ---D | C] -- C:\Users\mikelsoft\AppData\Roaming\MediaRenamer
[2012.02.02 18:49:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XBMC
[2012.02.02 18:49:51 | 000,000,000 | ---D | C] -- C:\Program Files\Media Renamer
[2012.02.01 20:50:54 | 000,381,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mfds.dll.bak
[2012.02.01 20:50:44 | 002,134,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msmpeg2vdec.dll
[2012.02.01 20:49:54 | 000,000,000 | ---D | C] -- C:\Users\mikelsoft\AppData\Roaming\Win7codecs
[2012.01.27 18:35:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2012.01.27 12:32:31 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2012.01.27 00:17:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD APP
[2012.01.27 00:17:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center
[2012.01.26 23:57:43 | 000,054,400 | ---- | C] (Advanced Micro Devices) -- C:\Windows\SysNative\drivers\usbfilter.sys
[2011.12.07 19:32:24 | 000,216,064 | ---- | C] ( ) -- C:\Windows\SysWow64\lagarith.dll
[2010.05.05 19:59:10 | 000,060,928 | ---- | C] ( ) -- C:\Windows\SysWow64\a3d.dll
[2010.05.05 19:38:18 | 000,012,800 | ---- | C] ( ) -- C:\Windows\SysWow64\killapps.exe
[2010.02.03 23:00:00 | 000,139,264 | ---- | C] ( ) -- C:\Windows\sipr3260.dll
[2009.10.10 18:29:13 | 000,082,816 | ---- | C] (VSO Software) -- C:\Users\mikelsoft\AppData\Roaming\pcouffin.sys
[5 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\mikelsoft\Documents\*.tmp files -> C:\Users\mikelsoft\Documents\*.tmp -> ]
[1 C:\Users\mikelsoft\*.tmp files -> C:\Users\mikelsoft\*.tmp -> ]
 
========== Files - Modified Within 14 Days ==========
 
[2012.02.09 20:05:29 | 011,796,480 | -HS- | M] () -- C:\Users\mikelsoft\NTUSER.DAT
[2012.02.09 19:33:55 | 001,613,412 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.02.09 19:33:55 | 000,696,848 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.02.09 19:33:55 | 000,652,166 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.02.09 19:33:55 | 000,148,144 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.02.09 19:33:55 | 000,121,098 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.02.09 19:29:33 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.02.09 19:29:31 | 001,335,972 | ---- | M] () -- C:\Windows\SysNative\oodbs.lor
[2012.02.09 19:27:08 | 001,805,838 | -H-- | M] () -- C:\Users\mikelsoft\AppData\Local\IconCache.db
[2012.02.09 19:13:07 | 000,020,704 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.02.09 19:13:07 | 000,020,704 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.02.09 19:06:14 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.02.09 19:05:54 | 000,000,266 | ---- | M] () -- C:\Windows\tasks\AutoKMS.job
[2012.02.09 19:05:54 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2012.02.09 18:07:34 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\mikelsoft\Desktop\OTL.exe
[2012.02.09 16:12:57 | 000,001,172 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Update ESET's license.lnk
[2012.02.09 16:12:57 | 000,001,136 | ---- | M] () -- C:\Users\Public\Desktop\Update ESET's license.lnk
[2012.02.09 15:50:05 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.02.09 15:35:03 | 000,001,241 | ---- | M] () -- C:\Users\mikelsoft\Desktop\taskmgr.exe - Verknüpfung.lnk
[2012.02.09 15:32:54 | 000,001,089 | ---- | M] () -- C:\Users\mikelsoft\Desktop\explorer.lnk
[2012.02.09 14:48:57 | 000,002,173 | ---- | M] () -- C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
[2012.02.09 12:45:16 | 000,000,058 | ---- | M] () -- C:\Users\mikelsoft\AppData\Local\DonationCoder_ScreenshotCaptor_InstallInfo.dat
[2012.02.08 16:47:57 | 000,000,600 | ---- | M] () -- C:\Users\mikelsoft\AppData\Roaming\winscp.rnd
[2012.02.08 16:47:52 | 000,000,600 | ---- | M] () -- C:\Users\mikelsoft\AppData\Local\PUTTY.RND
[2012.02.07 14:52:03 | 000,000,960 | ---- | M] () -- C:\Users\Public\Desktop\calibre - E-book management.lnk
[2012.02.04 20:13:08 | 005,815,523 | ---- | M] () -- C:\Users\mikelsoft\Documents\IMG_0943.JPG
[2012.02.02 20:45:56 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2012.02.01 22:53:31 | 000,002,188 | ---- | M] () -- C:\Users\Public\Desktop\CyberLink PowerDVD 12.lnk
[2012.02.01 21:51:03 | 000,001,130 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.02.01 20:49:19 | 000,001,846 | ---- | M] () -- C:\Users\Public\Desktop\Media Player Classic - Home Cinema x64.lnk
[2012.02.01 10:14:14 | 000,092,160 | ---- | M] () -- C:\Windows\SysNative\ff_vfw.dll
[2012.02.01 10:13:20 | 000,053,760 | ---- | M] () -- C:\Windows\SysNative\ff_acm.acm
[2012.01.28 12:12:40 | 000,079,360 | ---- | M] () -- C:\Windows\SysWow64\ff_vfw.dll
[2012.01.28 12:10:56 | 000,048,128 | ---- | M] () -- C:\Windows\SysWow64\ff_acm.acm
[2012.01.27 18:35:58 | 000,001,066 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2012.01.27 00:02:42 | 000,002,212 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk
[5 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\mikelsoft\Documents\*.tmp files -> C:\Users\mikelsoft\Documents\*.tmp -> ]
[1 C:\Users\mikelsoft\*.tmp files -> C:\Users\mikelsoft\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.02.09 19:27:08 | 001,805,838 | -H-- | C] () -- C:\Users\mikelsoft\AppData\Local\IconCache.db
[2012.02.09 16:12:57 | 000,001,172 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Update ESET's license.lnk
[2012.02.09 16:12:57 | 000,001,136 | ---- | C] () -- C:\Users\Public\Desktop\Update ESET's license.lnk
[2012.02.09 15:35:03 | 000,001,241 | ---- | C] () -- C:\Users\mikelsoft\Desktop\taskmgr.exe - Verknüpfung.lnk
[2012.02.09 15:32:54 | 000,001,089 | ---- | C] () -- C:\Users\mikelsoft\Desktop\explorer.lnk
[2012.02.09 14:48:57 | 000,002,185 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
[2012.02.09 14:48:57 | 000,002,173 | ---- | C] () -- C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
[2012.02.04 20:10:07 | 005,815,523 | ---- | C] () -- C:\Users\mikelsoft\Documents\IMG_0943.JPG
[2012.02.01 22:53:31 | 000,002,188 | ---- | C] () -- C:\Users\Public\Desktop\CyberLink PowerDVD 12.lnk
[2012.01.28 12:12:40 | 000,079,360 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2012.01.28 12:10:56 | 000,048,128 | ---- | C] () -- C:\Windows\SysWow64\ff_acm.acm
[2012.01.27 18:35:58 | 000,001,066 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2012.01.27 00:02:42 | 000,002,212 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2012.01.24 14:18:04 | 004,794,880 | ---- | C] () -- C:\Windows\SysWow64\x264vfw.dll
[2012.01.23 21:14:34 | 000,000,600 | ---- | C] () -- C:\Users\mikelsoft\AppData\Local\PUTTY.RND
[2011.12.12 15:27:19 | 000,000,131 | -HS- | C] () -- C:\ProgramData\.zreglib
[2011.12.05 22:04:00 | 000,059,904 | ---- | C] () -- C:\Windows\SysWow64\OpenVideo.dll
[2011.12.05 22:03:52 | 000,054,784 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll
[2011.12.05 13:11:09 | 001,641,646 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.12.03 17:32:15 | 000,482,408 | ---- | C] () -- C:\Windows\ssndii.exe
[2011.11.10 03:36:06 | 000,204,960 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2011.11.10 03:36:06 | 000,157,152 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2011.10.25 21:21:34 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OVDecoder.dll
[2011.09.12 23:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2011.08.19 09:26:20 | 010,898,456 | ---- | C] () -- C:\Windows\SysWow64\LogiDPP.dll
[2011.08.19 09:26:20 | 000,336,408 | ---- | C] () -- C:\Windows\SysWow64\DevManagerCore.dll
[2011.08.19 09:26:20 | 000,104,472 | ---- | C] () -- C:\Windows\SysWow64\LogiDPPApp.exe
[2011.06.07 16:25:55 | 001,456,640 | ---- | C] () -- C:\Program Files (x86)\Common Files\Falk Navi-Manager.msi
[2011.04.09 17:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011.03.19 10:06:02 | 000,240,640 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2011.03.19 10:04:28 | 000,650,752 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2011.02.24 15:16:48 | 000,000,058 | ---- | C] () -- C:\Users\mikelsoft\AppData\Local\DonationCoder_ScreenshotCaptor_InstallInfo.dat
[2011.01.04 13:28:18 | 000,175,616 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2010.11.29 18:29:25 | 000,000,079 | ---- | C] () -- C:\Users\mikelsoft\AppData\Local\CrystalDiskMark30.ini
[2010.11.28 17:14:53 | 000,000,169 | ---- | C] () -- C:\Windows\Bench32.INI
[2010.11.24 21:02:42 | 000,148,480 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2010.11.24 21:02:42 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2010.10.11 16:49:57 | 000,002,560 | ---- | C] () -- C:\Windows\_MSRSTRT.EXE
[2010.10.11 15:38:56 | 000,258,048 | ---- | C] () -- C:\Windows\SysWow64\libFLAC.dll
[2010.09.21 22:36:38 | 000,080,896 | ---- | C] () -- C:\Windows\cadkasdeinst01.exe
[2010.09.21 20:19:57 | 000,000,132 | ---- | C] () -- C:\Users\mikelsoft\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2010.06.25 18:03:12 | 000,053,299 | ---- | C] () -- C:\Windows\SysWow64\pthreadVC.dll
[2010.05.05 20:37:52 | 000,021,204 | ---- | C] () -- C:\Windows\SysWow64\instwdm.ini
[2010.05.05 19:56:46 | 000,002,560 | ---- | C] () -- C:\Windows\SysWow64\CtxfiRes.dll
[2010.05.05 19:46:30 | 000,321,512 | ---- | C] () -- C:\Windows\SysWow64\ctdlang.dat
[2010.05.05 19:46:30 | 000,056,509 | ---- | C] () -- C:\Windows\SysWow64\ctdnlstr.dat
[2010.05.05 19:38:22 | 000,007,680 | ---- | C] () -- C:\Windows\SysWow64\enlocstr.exe
[2010.03.24 18:44:07 | 000,000,000 | ---- | C] () -- C:\ProgramData\CLDShowX.ini
[2010.02.17 14:29:33 | 000,000,600 | ---- | C] () -- C:\Users\mikelsoft\AppData\Roaming\winscp.rnd
[2010.02.14 19:55:19 | 000,000,918 | ---- | C] () -- C:\Users\mikelsoft\AppData\Roaming\coreavc.ini
[2010.02.10 20:01:48 | 000,000,132 | ---- | C] () -- C:\Users\mikelsoft\AppData\Roaming\x264_x64.ini
[2010.01.17 20:33:51 | 000,015,873 | ---- | C] () -- C:\Windows\SysWow64\Inetde.dll
[2010.01.16 14:58:37 | 000,162,304 | ---- | C] () -- C:\Windows\SysWow64\libpng13.dll
[2010.01.16 14:58:37 | 000,052,836 | ---- | C] () -- C:\Windows\SysWow64\zlib1.dll
[2010.01.16 14:58:36 | 000,394,752 | ---- | C] () -- C:\Windows\SysWow64\cygwinb19.dll
[2010.01.16 14:58:34 | 000,709,719 | ---- | C] () -- C:\Windows\unins000.exe
[2010.01.16 14:58:34 | 000,006,581 | ---- | C] () -- C:\Windows\unins000.dat
[2009.12.15 20:07:59 | 000,917,504 | ---- | C] () -- C:\Windows\SysWow64\dtsdecoderdll.dll
[2009.11.06 16:38:03 | 000,001,992 | ---- | C] () -- C:\Windows\aopr.ini
[2009.10.23 18:22:21 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2009.10.12 17:32:36 | 000,010,752 | ---- | C] () -- C:\Windows\SysWow64\BASSMOD.dll
[2009.10.10 18:29:13 | 000,099,384 | ---- | C] () -- C:\Users\mikelsoft\AppData\Roaming\inst.exe
[2009.10.10 18:29:13 | 000,007,859 | ---- | C] () -- C:\Users\mikelsoft\AppData\Roaming\pcouffin.cat
[2009.10.10 18:29:13 | 000,001,167 | ---- | C] () -- C:\Users\mikelsoft\AppData\Roaming\pcouffin.inf
[2009.10.04 12:30:08 | 000,000,017 | ---- | C] () -- C:\Users\mikelsoft\AppData\Local\resmon.resmoncfg
[2009.10.03 15:18:42 | 000,404,656 | ---- | C] () -- C:\Windows\SysWow64\SpoonUninstall.exe
[2009.09.19 14:06:31 | 000,004,096 | -H-- | C] () -- C:\Users\mikelsoft\AppData\Local\keyfile3.drm
[2009.09.19 13:56:34 | 000,029,696 | ---- | C] () -- C:\Users\mikelsoft\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.08.16 21:22:16 | 000,000,035 | ---- | C] () -- C:\Windows\SysWow64\everest_cpl.ini
[2009.08.15 20:19:01 | 000,001,057 | ---- | C] () -- C:\Users\mikelsoft\AppData\Roaming\vso_ts_preview.xml
[2009.08.13 20:23:20 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009.08.13 19:06:40 | 000,003,072 | ---- | C] () -- C:\Windows\SysWow64\CTXFIGER.DLL
[2009.08.13 18:58:55 | 000,115,280 | ---- | C] () -- C:\Users\mikelsoft\AppData\Local\GDIPFONTCACHEV1.DAT
[2009.08.13 16:02:29 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009.07.14 03:35:42 | 000,001,405 | ---- | C] () -- C:\Windows\msdfmap.ini
[2009.07.14 03:34:57 | 000,000,478 | ---- | C] () -- C:\Windows\win.ini
[2009.07.14 03:34:57 | 000,000,269 | ---- | C] () -- C:\Windows\system.ini
[2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
[2009.06.04 00:37:06 | 000,000,054 | ---- | C] () -- C:\Windows\SysWow64\ctzapxx.ini
[2009.05.27 08:49:00 | 000,000,285 | ---- | C] () -- C:\Windows\SysWow64\kill.ini
[2008.11.15 19:02:26 | 001,866,670 | ---- | C] () -- C:\Windows\SysWow64\libfftw3f-3.dll
[2008.04.05 18:53:24 | 000,140,288 | ---- | C] () -- C:\Windows\SysWow64\avsfilter.dll
[2007.02.05 16:05:26 | 000,000,038 | ---- | C] () -- C:\Windows\AviSplitter.INI
[2005.09.13 04:09:34 | 000,004,608 | ---- | C] () -- C:\Windows\SysWow64\AvsRecursion.dll
[2004.01.24 03:35:44 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\avisynth_c.dll
 
========== LOP Check ==========
 
[2009.09.19 13:12:17 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\ACD Systems
[2009.08.13 21:49:41 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Acronis
[2011.02.27 20:34:18 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Ashampoo
[2009.08.15 18:38:30 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\avidemux
[2009.09.27 12:37:25 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\BDREBUILDER
[2011.09.09 15:57:05 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\BluRip
[2010.01.22 18:29:51 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\BOM
[2011.05.10 22:52:00 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\BPK
[2011.10.17 15:15:27 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Broad Intelligence
[2010.09.21 22:36:44 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\CAD-KAS
[2011.11.22 15:12:17 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\calibre
[2010.01.30 11:46:19 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Canneverbe Limited
[2009.11.10 18:47:48 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Canon
[2012.01.26 21:19:17 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\DAEMON Tools Lite
[2011.09.09 15:36:49 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\dcunningham.net
[2011.02.11 17:44:16 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\DiskAid
[2011.02.24 15:16:48 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\DonationCoder
[2010.02.10 20:04:42 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\DVDFab
[2011.05.24 15:57:48 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\EAC
[2012.02.02 20:17:38 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Ember_Media_Manager
[2012.02.09 16:08:33 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\FileZilla
[2009.12.28 20:44:22 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Flickr
[2011.12.03 19:22:19 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\foobar2000
[2011.05.26 11:58:31 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Foxit Software
[2011.10.17 15:11:40 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\FreeFileSync
[2010.07.08 14:04:28 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\GHISLER
[2009.11.08 15:36:42 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\gnupg
[2011.07.14 16:03:57 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\go
[2010.11.18 22:03:03 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\GrabPro
[2011.08.31 16:44:56 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\gtk-2.0
[2009.12.28 19:52:52 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Gui4Cli
[2010.02.08 22:20:28 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\HandBrake
[2010.12.02 12:11:09 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\HD Tune Pro
[2011.11.28 14:49:54 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\hybrid
[2009.08.24 17:00:14 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\ImgBurn
[2009.08.13 19:24:54 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\IrfanView
[2011.01.12 19:22:31 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\IsolatedStorage
[2009.08.15 18:13:50 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Leadertech
[2011.02.09 23:07:19 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Local
[2009.12.05 22:55:42 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\MCMPEGEnc
[2012.02.02 19:00:23 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\MediaRenamer
[2011.04.06 13:41:18 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Miranda
[2010.02.14 15:33:30 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\mkvtoolnix
[2011.07.29 20:52:49 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Mobile Atlas Creator
[2011.12.25 17:47:09 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Motorola
[2009.11.08 15:30:48 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\MuldeR
[2012.01.05 17:08:55 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\MySQL
[2012.01.06 18:39:36 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Notepad++
[2010.04.12 12:19:01 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Opera
[2012.01.20 17:30:41 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Orbit
[2011.03.04 19:59:51 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\PACE Anti-Piracy
[2010.01.16 14:13:00 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Passware
[2011.12.10 16:37:40 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\PC Suite
[2011.02.25 13:03:05 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\PhotoScape
[2010.08.30 18:43:16 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\ProgSense
[2011.12.12 17:13:51 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\redsn0w
[2010.09.22 09:38:38 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\ResourceCentral.E6E1B28A311BC518DB6C6883EA3757FDE0E90ADC.1
[2012.02.01 20:50:34 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Shark007
[2010.11.02 14:45:21 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Softland
[2011.02.27 20:03:39 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Software4u
[2010.02.05 20:30:25 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\SparVoip
[2011.03.04 19:58:52 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2010.02.18 15:48:48 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\sx264
[2011.05.10 21:51:43 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\SystemTools
[2011.12.07 19:55:26 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\TeamViewer
[2012.02.09 16:02:40 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\TeraCopy
[2011.12.08 17:50:49 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\The Creative Assembly
[2010.03.10 19:01:35 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Thinstall
[2012.02.02 21:34:58 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Thunderbird
[2012.02.09 16:08:33 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\TS3Client
[2012.01.23 21:10:54 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\ts3overlay
[2010.11.28 00:18:21 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Twan Wintjes
[2012.01.11 19:59:55 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\VidCoder
[2012.02.09 16:08:33 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Vso
[2012.02.01 20:50:46 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Win7codecs
[2009.08.14 11:06:44 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Windows Home Server
[2011.05.05 15:25:52 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Windows Live Writer
[2009.12.02 19:04:24 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Winff
[2011.08.31 15:48:15 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Wireshark
[2012.02.01 22:11:11 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\XBMC
[2012.01.05 15:56:01 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Zeon
[2012.02.09 19:05:54 | 000,000,266 | ---- | M] () -- C:\Windows\Tasks\AutoKMS.job
[2011.12.07 18:59:21 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 2560 bytes -> C:\ProgramData\CLDShowX.ini:Update.CL
@Alternate Data Stream - 145 bytes -> C:\ProgramData\Temp:0574215C
@Alternate Data Stream - 141 bytes -> C:\ProgramData\Temp:F8D65F32
@Alternate Data Stream - 139 bytes -> C:\ProgramData\Temp:D95ACC7D
@Alternate Data Stream - 137 bytes -> C:\ProgramData\Temp:E8BE05FA
@Alternate Data Stream - 1232 bytes -> C:\Users\mikelsoft\Lokale Einstellungen:9JFkVmMuWoCaz9UXl0qgvoM
@Alternate Data Stream - 1232 bytes -> C:\Users\mikelsoft\AppData\Local\Anwendungsdaten:9JFkVmMuWoCaz9UXl0qgvoM
@Alternate Data Stream - 107 bytes -> C:\ProgramData\Temp:1493A0EF

< End of report >
         

ja, dann ohne mein script bitte.

und hier die extra.txt

OTL Extras logfile created on: 09.02.2012 20:05:14 - Run 6
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\mikelsoft\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
8,00 Gb Total Physical Memory | 6,47 Gb Available Physical Memory | 80,97% Memory free
15,99 Gb Paging File | 14,61 Gb Available in Paging File | 91,37% Paging File free
Paging file location(s): d:\pagefile.sys 0 0 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 111,79 Gb Total Space | 56,33 Gb Free Space | 50,39% Space Free | Partition Type: NTFS
Drive D: | 465,66 Gb Total Space | 95,81 Gb Free Space | 20,58% Space Free | Partition Type: NTFS
Drive E: | 138,31 Gb Total Space | 14,18 Gb Free Space | 10,25% Space Free | Partition Type: NTFS
Drive F: | 793,20 Gb Total Space | 395,33 Gb Free Space | 49,84% Space Free | Partition Type: NTFS
 
Computer Name: ZENTIS | User Name: mikelsoft | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 14 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software)
.ini[@ = Notepad++_file] -- C:\Program Files (x86)\Notepad++\notepad++.exe (Don HO don.h@free.fr)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
.js[@ = Notepad++_file] -- C:\Program Files (x86)\Notepad++\notepad++.exe (Don HO don.h@free.fr)
.jse[@ = JSEFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.txt[@ = Notepad++_file] -- C:\Program Files (x86)\Notepad++\notepad++.exe (Don HO don.h@free.fr)
.vbe[@ = VBEFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.vbs[@ = VBSFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.wsf[@ = WSFFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software)
.ini [@ = Notepad++_file] -- C:\Program Files (x86)\Notepad++\notepad++.exe (Don HO don.h@free.fr)
.js [@ = Notepad++_file] -- C:\Program Files (x86)\Notepad++\notepad++.exe (Don HO don.h@free.fr)
.jse [@ = JSEFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.txt [@ = Notepad++_file] -- C:\Program Files (x86)\Notepad++\notepad++.exe (Don HO don.h@free.fr)
.vbe [@ = VBEFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.vbs [@ = VBSFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.wsf [@ = WSFFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
jsfile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
jsefile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
vbefile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
vbsfile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
wsffile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [ACDSee Pro 3.Manage] -- "C:\Program Files (x86)\ACD Systems\ACDSee Pro\3.0\ACDSeeQVPro3.exe" "%1" (ACD Systems International Inc.)
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- E:\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [Browse with &IrfanView] -- "C:\Program Files (x86)\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [PowerShellHere] -- "C:\Windows\system32\windowspowershell\v1.0\powershell.exe" -NoExit -Command Set-Location -LiteralPath '%L' (Microsoft Corporation)
Directory [PowerShellHereAsAdmin] -- "%SystemRoot%\System32\cmd.exe" /c Elevate.cmd "%SystemRoot%\System32\windowspowershell\v1.0\powershell.exe" -NoExit -Command Set-Location -LiteralPath '%L'; $host.ui.rawui.windowtitle = 'Administrator: ' + $host.ui.rawui.windowtitle (Microsoft Corporation)
Directory [PowerShellHereAsSystem] -- Elevate.cmd "C:\Program Files\Sysinternals Suite\psexec.exe" -i -s -d "C:\Windows\system32\windowspowershell\v1.0\powershell.exe" -NoExit Set-Location -LiteralPath '%L'; $host.ui.rawui.windowtitle = 'Windows PowerShell as SYSTEM - %L'; $host.ui.rawui.ForegroundColor = 'Red'; $host.ui.rawui.BackgroundColor = 'Yellow'; Clear-Host ()
Directory [rCmdHere] -- C:\Windows\system32\cmd.exe /k cd /d "%1" (Microsoft Corporation)
Directory [runas] -- C:\Windows\system32\cmd.exe /k cd /d "%1" (Microsoft Corporation)
Directory [runCmdHereAsSystem] -- Elevate.cmd "C:\Program Files\Sysinternals Suite\psexec.exe" -i -s -d "C:\Windows\system32\cmd.exe" /k "(cd /d "%1" & color ec & title "%CMD Prompt as SYSTEM% - %1")" ()
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
jsfile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
jsefile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
vbefile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
vbsfile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
wsffile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [ACDSee Pro 3.Manage] -- "C:\Program Files (x86)\ACD Systems\ACDSee Pro\3.0\ACDSeeQVPro3.exe" "%1" (ACD Systems International Inc.)
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- E:\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [Browse with &IrfanView] -- "C:\Program Files (x86)\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [PowerShellHere] -- "C:\Windows\system32\windowspowershell\v1.0\powershell.exe" -NoExit -Command Set-Location -LiteralPath '%L' (Microsoft Corporation)
Directory [PowerShellHereAsAdmin] -- "%SystemRoot%\System32\cmd.exe" /c Elevate.cmd "%SystemRoot%\System32\windowspowershell\v1.0\powershell.exe" -NoExit -Command Set-Location -LiteralPath '%L'; $host.ui.rawui.windowtitle = 'Administrator: ' + $host.ui.rawui.windowtitle (Microsoft Corporation)
Directory [PowerShellHereAsSystem] -- Elevate.cmd "C:\Program Files\Sysinternals Suite\psexec.exe" -i -s -d "C:\Windows\system32\windowspowershell\v1.0\powershell.exe" -NoExit Set-Location -LiteralPath '%L'; $host.ui.rawui.windowtitle = 'Windows PowerShell as SYSTEM - %L'; $host.ui.rawui.ForegroundColor = 'Red'; $host.ui.rawui.BackgroundColor = 'Yellow'; Clear-Host
Directory [rCmdHere] -- C:\Windows\system32\cmd.exe /k cd /d "%1" (Microsoft Corporation)
Directory [runas] -- C:\Windows\system32\cmd.exe /k cd /d "%1" (Microsoft Corporation)
Directory [runCmdHereAsSystem] -- Elevate.cmd "C:\Program Files\Sysinternals Suite\psexec.exe" -i -s -d "C:\Windows\system32\cmd.exe" /k "(cd /d "%1" & color ec & title "%CMD Prompt as SYSTEM% - %1")"
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\FlashFXP\FlashFXP.exe" = C:\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3 -- (IniCom Networks, Inc.)
"C:\FlashFXP\FlashFXP.exe" = C:\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3 -- (IniCom Networks, Inc.)
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\FlashFXP\FlashFXP.exe" = C:\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3 -- (IniCom Networks, Inc.)
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D 2 Tray Icon -- (Safer-Networking Ltd.)
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Enabled:Spybot-S&D 2 Scanner Service -- (Safer-Networking Ltd.)
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater -- (Safer-Networking Ltd.)
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service -- (Safer-Networking Ltd.)
"C:\FlashFXP\FlashFXP.exe" = C:\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3 -- (IniCom Networks, Inc.)
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D 2 Tray Icon -- (Safer-Networking Ltd.)
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Enabled:Spybot-S&D 2 Scanner Service -- (Safer-Networking Ltd.)
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater -- (Safer-Networking Ltd.)
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe" = C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service -- (Safer-Networking Ltd.)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0210B563-198E-5A4B-E757-7BC4AC7677F8}" = AMD AVIVO64 Codecs
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{03D3BAD4-28ED-4EF2-A369-D148A240D0B3}" = Foxit PDF IFilter
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX310_series" = Canon MX310 series
"{138A4072-9E64-46BD-B5F9-DB2BB395391F}" = LWS VideoEffects
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{1C55470A-7C9E-4C63-B466-6AFFC69E94E9}" = Windows Live Family Safety
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{1F6D1DB5-82B5-41A4-85A2-0A382C142A35}_is1" = Allgemeine Runtime Files (x86)
"{23170F69-40C1-2702-0922-000001000000}" = 7-Zip 9.22 (x64 edition)
"{26A24AE4-039D-4CA4-87B4-2F86416026FF}" = Java(TM) 6 Update 26 (64-bit)
"{26A24AE4-039D-4CA4-87B4-2F86417001FF}" = Java(TM) 7 Update 1 (64-bit)
"{2ACBF1FA-F5C3-4B19-A774-B22A31F231B9}_is1" = Media Player Classic - Home Cinema 1.6.1.4026 x64
"{3156336D-8E44-3671-A6FE-AE51D3D6564E}" = Microsoft Windows SDK for Windows 7 (7.1)
"{41BC9E31-0D39-462E-8E4C-767B21A3B1C3}" = MobileMe Control Panel
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{46A5FBE9-ADB3-4493-A1CC-B4CFFD24D26A}" = Windows Live Family Safety
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{53480320-4F3F-4A42-9C8A-063B5C278722}" = O&O FormatRecovery
"{5E11C972-1E76-45FE-8F92-14E0D1140B1B}" = iTunes
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{626672CD-BFCF-49A9-AEFE-AB0FED3BFC5B}" = Windows Mobile-Gerätecenter
"{690285C2-2481-44FB-8402-162EA970A6DD}" = Logitech Gaming Software 7.00
"{6C8D7973-31F9-32E1-A820-8DD857910323}" = Microsoft Windows SDK for Windows 7 Utilities for Win32 Development (30514)
"{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{6F29F195-B11C-3EAD-B883-997BB29DFA17}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{75104836-CAC7-444E-A39E-3F54151942F5}" = Apple Mobile Device Support
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{84452C2C-BDCC-36F3-A189-CE15F02A47FB}" = Microsoft Windows SDK for Windows 7 Headers and Libraries (30514)
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{869D06EA-2277-4588-9567-CDFE5C30A399}_is1" = Media Renamer
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{951E6223-AC28-345E-BCF4-B55C1267E321}" = Microsoft Windows SDK for Windows 7 Samples (30514)
"{9B2C4509-2B9F-4303-BA74-E2F9BB773F03}" = Oracle VM VirtualBox 4.1.8
"{9E3B2120-0BD8-9865-0387-E9BAC2A53AD3}" = ccc-utility64
"{A0B0F02C-410B-3DE3-9740-EC4C3D902532}" = Microsoft Windows SDK for Windows 7 Common Utilities (30514)
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{A9C6CA47-D937-D61D-4BD3-7CFAB7A5BA56}" = ATI Problem Report Wizard
"{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
"{ABE286AE-C65D-B7DE-C8D1-DF79584169B4}" = AMD Fuel
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B0C6CCC9-0BAB-4636-A06F-B43B6FBC25DF}" = Motorola Mobile Drivers Installation 5.4.0
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{BE882A12-5A45-3DFF-9FD0-306DE65EB8A5}" = AMD Catalyst Install Manager
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"{D07A61E5-A59C-433C-BCBD-22025FA2287B}" = Windows Live Language Selector
"{D1829BE5-F305-4576-9593-C66FC7E0B008}" = iCloud
"{D2DDF40C-552E-4C3D-AE5D-873044B53F7B}" = ESET NOD32 Antivirus
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319
"{DBFC6AAE-DCCB-4C23-B01C-3EDDDC03298B}" = Debugging Tools for Windows (x64)
"{DF54E1D5-B4A3-4F94-B018-75529AB97682}" = O&O Defrag Professional
"{EE269999-1AB7-7B39-7944-513CF3426CB8}" = AMD Drag and Drop Transcoding
"{EF393943-0CCE-9CD9-6181-96DF4E4428EF}" = AMD Media Foundation Decoders
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit
"CCleaner" = CCleaner
"CmdHere" = CMD Prompt Here PowerToy v1.0.3 (Uninstall only)
"CmdHereAsAdmin" = CMD Prompt Here as Administrator PowerToy for Windows Vista v1.0.2 (Uninstall only)
"CmdHereAsSystem" = CMD Prompt Here as System PowerToy for Windows Vista v1.0.0 (Uninstall only)
"doPDF 7 printer_is1" = doPDF 7.2 printer
"ElevateCommand" = Elevate Command PowerToy for Windows Vista v1.0.1 (Uninstall only)
"ElevateHTA" = Elevate HTML Application PowerToy for Windows Vista v1.0.2 (Uninstall only)
"ElevateMSI" = Elevate Windows Installer Package PowerToy for Windows Vista v1.0.1 (Uninstall only)
"ElevatePowerShellScript" = Elevate PowerShell v1.0 Script PowerToy for Windows Vista v1.0.1 (Uninstall only)
"ElevateWSHScript" = Elevate WSH Script PowerToy for Windows Vista v1.0.2 (Uninstall only)
"HashTab" = HashTab 3.0.0
"KiXtart" = KiXtart 2010 v4.60 (Uninstall only)
"lvdrivers_12.10" = Logitech Webcam Software-Treiberpaket
"MediaInfo" = MediaInfo 0.7.51
"MediaInfo.dll" = MediaInfo.dll 0.7.27
"Mediencenter Software" = Mediencenter Software
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"PowerShellHere" = PowerShell Prompt Here PowerToy for Windows PowerShell 1.0 (v1.0.2) (Uninstall only)
"PowerShellHereAsAdmin" = PowerShell Prompt Here as Administrator PowerToy for Windows PowerShell 1.0 on Windows Vista v1.0.1 (Uninstall only)
"PowerShellHereAsSystem" = PowerShell Prompt Here as System PowerToy for Windows PowerShell 1.0 on Windows Vista v.1.0.0 (Uninstall only)
"RealVNC_is1" = VNC Enterprise Edition E4.5.4
"Recuva" = Recuva
"RunAsHTA" = Run as Another User PowerToy for Windows Vista v1.0.0 (Uninstall only)
"SDKSetup_7.1.7600.0.30514" = Microsoft Windows SDK for Windows 7 (7.1)
"sp6" = Logitech SetPoint 6.30
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"TeraCopy_is1" = TeraCopy 2.22
"Unlocker" = Unlocker 1.9.1-x64
"VNCMirror_is1" = VNC Mirror Driver 1.8.0
"VNCPrinter_is1" = VNC Printer Driver 1.6.0
"WinRAR archiver" = WinRAR 4.01 (64-bit)
"x64 Components_is1" = x64 Components v3.4.3
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{024521CF-C07E-4F8E-8481-0D75695E03AF}" = PxMergeModule
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{04A3A6B0-8E19-49BB-82FF-65C5A55F917D}" = Acronis*True*Image*Home 2011
"{0507A8FD-AA20-7691-C2AA-CDE6B5182675}" = Application Profiles
"{08610298-29AE-445B-B37D-EFBE05802967}" = LWS Pictures And Video
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0D97F8D1-2102-53D2-5633-C992D6086801}" = CCC Help Chinese Traditional
"{0E3C6C75-872D-4B0D-B0B2-31C717250691}" = Adobe Encore CS5 Third Party Royalty Content
"{0EA00EA7-42C0-ED9C-9110-2C04B8EDBA66}" = CCC Help Italian
"{0EB86B70-91FF-39BF-633C-785DF2218CC6}" = CCC Help French
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{11083C7A-D0D6-4DA4-8C3A-74B8389EC07B}" = ATI Catalyst Registration
"{121634B0-2F4B-11D3-ADA3-00C04F52DD52}" = Windows Installer Clean Up
"{155F4A0E-76ED-45A2-91FB-FF2A2133C31A}" = Risen
"{15634701-BACE-4449-8B25-1567DA8C9FD3}" = CameraHelperMsi
"{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5
"{160D4381-5C4B-4441-8DAF-DECFA4762F68}" = MKVcleaver
"{1651216E-E7AD-4250-92A1-FB8ED61391C9}" = LWS Help_main
"{1686C07D-C2BB-A8B2-C5ED-32C4EE1A3E62}" = CCC Help Spanish
"{174A3B31-4C43-43DD-866F-73C9DB887B48}" = LWS Twitter
"{17528CE4-C333-48FB-A9E4-D841E795CDCE}" = Renesas Electronics USB 3.0 Host Controller Driver
"{18B6A9F8-25BC-5978-6B42-A50FA2CABC18}" = CCC Help English
"{1B280FAF-AE10-4E31-A41A-DB3917D651DC}" = ACDSee Pro 3
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1DDF0BBC-440C-446E-BB6A-594D2FD44DC6}" = Protection Center
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{1F7424F8-F992-48BC-90EF-7C4DB0405E3F}" = Alcor Micro USB Card Reader
"{1FE9FC19-7A1A-4507-81DC-D403022E301D}" = VOB2MPG v3
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{21DF0294-6B9D-4741-AB6F-B2ABFBD2387E}" = LWS YouTube Plugin
"{26A24AE4-039D-4CA4-87B4-2F83216026FF}" = Java(TM) 6 Update 26
"{298C6691-46B2-2065-0DD7-1E7B3B669A47}" = CCC Help Finnish
"{2ECA81CA-D932-4AD3-AD59-BF5CCF099C83}" = Catalyst Control Center - Branding
"{318DBE01-1E6B-4243-84B0-210391FE789A}" = Samsung AnyWeb Print
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = erLT
"{400C5445-1AE8-1A41-CAC6-AB114341F65D}" = CCC Help Swedish
"{406FB8A4-F539-48A9-809C-F94706F9C9F6}_is1" = S.T.A.L.K.E.R. - Call Of Pripyat [v1.6.01]
"{448B1C6D-02C2-7681-66B2-624E58B25375}" = CCC Help Turkish
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{46EB9D45-FC1A-2635-1693-176E6FA1C672}" = CCC Help Portuguese
"{485B2CAD-8D18-4A0F-97BE-A5202C3D7721}" = AVCHDCoder
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4BB8601D-52FF-48BA-B979-53264B2E6EF9}" = toolstar* file recovery professional
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{528145C0-462A-11E1-B8B4-B8AC6F97B88E}" = Google Earth
"{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"{5449FB4F-1802-4D5B-A6D8-087DB1142147}" = Realtek HDMI Audio Driver for ATI
"{5454083B-1308-4485-BF17-1110000B8301}" = Grand Theft Auto IV
"{54dcbccb-c905-46dc-b6e6-48563d0e9e55}" = LameXP
"{565DE707-5798-4FC3-8DF6-0F58A348A9B0}" = Adobe Premiere Pro CS5 Third Party Royalty Content
"{579BA58C-F33D-4970-9953-B94B43768AC3}" = Grand Theft Auto IV
"{5DDABB74-A879-4BE7-A4C6-FD41793942DB}" = Adobe Media Encoder CS5 Dolby X64
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{651F43AA-3F06-9277-6F1B-8E8155017463}" = CCC Help Polish
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{68A35043-C55A-4237-88C9-37EE1C63ED71}" = Microsoft Visual J# 2.0 Redistributable Package
"{68DE32E1-292B-6A02-6A53-935BFAE70C99}" = CCC Help Chinese Standard
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6CF47FD1-3CF8-4206-BA24-A2B1E43D8CCA}" = IncrediMail
"{6F76EC3C-34B1-436E-97FB-48C58D7BEDCD}" = LWS Gallery
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71E66D3F-A009-44AB-8784-75E2819BA4BA}" = LWS Motion Detection
"{76285C16-411A-488A-BCE3-C83CB933D8CF}" = Battlefield 3™
"{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7B63B2922B174135AFC0E1377DD81EC2}" = 
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{7C3228AC-BDE5-448E-8C01-E39BB0782DE8}" = Motorola Software Update
"{818212BA-7F8C-DDF9-64BE-F6D0B6F46D29}" = CCC Help German
"{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1" = PDF24 Creator 4.3.0
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{83C8FA3C-F4EA-46C4-8392-D3CE353738D6}" = LWS Launcher
"{84F4542C-ED64-28AC-49B3-1A9BAB395AB4}" = CCC Help Hungarian
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{873E4648-6F6E-47F6-A7B2-A6F8DFABDCE6}" = Windows Live Messenger
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{8937D274-C281-42E4-8CDB-A0B2DF979189}" = LWS Webcam Software
"{894084B6-BC69-43B7-BF06-B93AECFEA520}" = GameSpy Comrade
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C0CAA7A-3272-4991-A808-2C7559DE3409}" = Win7codecs
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUS_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUS_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUS_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.PROPLUS_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0407-1000-0000000FF1CE}_Office14.PROPLUS_{594128C9-2CDF-43CE-8103-DC100CF013B6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.PROPLUS_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.PROPLUS_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{9042C334-9881-4603-B1BC-7E623514A495}" = MKV2AC3 - 1.03.03
"{97368464-B643-422D-A496-29B409988488}_is1" = TFM Audio Tool 1.2.0.0 Beta
"{99011A6E-5200-11DE-BDB8-7ACD56D89593}" = Rosetta Stone Version 3
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C41195F-11B3-8EEC-6634-7183BE6CB1B1}" = CCC Help Japanese
"{9CCC78EF-027E-40E0-9B61-39932C65E3FE}" = Acronis*Disk*Director*Home
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9DAEA76B-E50F-4272-A595-0124E826553D}" = LWS WLM Plugin
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A33A89D0-2F48-FD1C-A243-9073EE0592E0}" = Catalyst Control Center InstallProxy
"{A498D9EB-927B-459B-85D6-DD6EF8C2C564}" = erLT
"{A66FB6C7-B689-AFD5-21BA-7CAF8E44E6E6}" = Catalyst Control Center Graphics Previews Common
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{ADFAAD69-2F06-448C-8C78-B10ABE62952B}" = Hyena v8.1
"{AE136F7F-7DC6-600F-9DF9-BFA0DF516135}" = Catalyst Control Center Localization All
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1" = Spybot - Search & Destroy 2
"{B46BEA36-0B71-4A4E-AE41-87241643FA0A}" = CyberLink PowerDVD 12
"{B4CF00AE-2622-7BC6-24EC-4E5A0A8C9135}" = CCC Help Czech
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{BAE1C0A8-634D-CFF1-0E0C-893092427D34}" = CCC Help Danish
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C2DEC505-79A9-E952-32B0-31B67B83E231}" = CCC Help Korean
"{C2FB14FB-DF6B-287D-BDC3-C7BEC86F539E}" = AMD VISION Engine Control Center
"{C53CFB2A-B76B-4C8E-842F-9961EFE760EB}" = RSDLite
"{CCEFAE22-4D01-0084-D1CA-AC14AA743A97}" = CCC Help Greek
"{CCF298AF-9CE1-4B26-B251-486E98A34789}" = Windows 7 USB/DVD Download Tool
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CFF8B8E8-E086-4DE0-935F-FE22CAB54F80}" = Microsoft Search Enhancement Pack
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D14AAC37-38FC-4454-9CEC-B3CD081632C4}" = calibre
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D40EB009-0499-459c-A8AF-C9C110766215}" = Logitech Webcam-Software
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D6D62F1D-E3D6-E982-48B4-A20663B1FB7D}" = HydraVision
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DB6AB705-C9BD-40E3-8929-2EA57F36A4FF}_is1" = ConvertXtoDVD 4.1.9.347
"{DB9E4EAB-2717-499F-8D56-4CC8A644AB60}" = MPlayer für Windows (Full Package)
"{DC754D8F-1D06-4016-BF57-8D21F97E1F0A}" = JunkFilterPlus
"{DE460826-5E72-2357-154F-E376F9926008}" = CCC Help Norwegian
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E21FFD29-D231-3BD3-6941-15710E44BED4}" = CCC Help Dutch
"{E268ADBD-A002-4684-AEDF-EA0F83F7E00B}" = WOL Magic Packet Sender
"{E3E313C7-0AE2-7F44-52E8-528D4EDC74B2}" = CCC Help Thai
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.8
"{EED027B7-0DB6-404B-8F45-6DFEE34A0441}" = LWS Video Mask Maker
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219


"
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Advanced Office Password Recovery" = Advanced Office Password Recovery (remove only)
"AIDA64 Extreme Edition_is1" = AIDA64 Extreme Edition v1.80
"Akamai" = Akamai NetSession Interface
"AnyDVD" = AnyDVD
"Avidemux 2.5" = Avidemux 2.5 (32-bit)
"AviSynth" = AviSynth 2.5
"Biet-O-Matic v2.12.6" = Biet-O-Matic v2.12.6
"CameraWindowDC" = Canon Utilities CameraWindow DC
"CameraWindowDVC6" = Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
"CameraWindowLauncher" = Canon Utilities CameraWindow
"Canon G.726 WMP-Decoder" = Canon G.726 WMP-Decoder
"Canon Internet Library for ZoomBrowser EX" = Canon Internet Library for ZoomBrowser EX
"CanonMyPrinter" = Canon Utilities My Printer
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"DAEMON Tools Lite" = DAEMON Tools Lite
"DVBViewer Pro_is1" = DVBViewer Pro
"DynUpdater" = Dyn Updater
"HD Tune_is1" = HD Tune 2.55
"HyperSnap 6" = HyperSnap 6
"ImgBurn" = ImgBurn
"IncrediMail" = IncrediMail 2.0
"InstallShield_{17528CE4-C333-48FB-A9E4-D841E795CDCE}" = Renesas Electronics USB 3.0 Host Controller Driver
"InstallShield_{1F7424F8-F992-48BC-90EF-7C4DB0405E3F}" = Alcor Micro USB Card Reader
"InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9
"InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}" = CyberLink PowerDVD 12
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"InstallShield_{F232C87C-6E92-4775-8210-DFE90B7777D9}" = CyberLink PowerDVD 11
"IrfanView" = IrfanView (remove only)
"IsoBuster_is1" = IsoBuster 2.7
"JunkFilterPlus" = IncrediMail JunkFilter Plus
"MediaCoder" = MediaCoder 2011
"MKVtoolnix" = MKVToolNix 5.1.0
"MotoHelper" = MotoHelper 2.1.32 Driver 5.4.0
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"MozBackup" = MozBackup 1.5.1
"Mozilla Firefox 10.0 (x86 de)" = Mozilla Firefox 10.0 (x86 de)
"Mozilla Thunderbird (7.0)" = Mozilla Thunderbird (7.0)
"MP Navigator EX 1.0" = Canon MP Navigator EX 1.0
"MyCamera" = Canon Utilities MyCamera
"MyCameraDC" = Canon Utilities MyCamera DC
"NAVIGON Fresh" = NAVIGON Fresh 3.4.1
"Notepad++" = Notepad++
"OpenVPN" = OpenVPN 2.2.2
"Opera 11.61.1250" = Opera 11.61
"Perfect Keylogger" = BlazingTools Perfect Keylogger
"PhotoStitch" = Canon Utilities PhotoStitch
"Picasa 3" = Picasa 3
"Protection Center" = IncrediMail Protection Center
"PuTTY_is1" = PuTTY version 0.62
"Rage_is1" = Rage
"RAW Image Task" = Canon RAW Image Task for ZoomBrowser EX
"RemoteCaptureDC" = Canon Utilities RemoteCapture DC
"RemoteCaptureTask" = Canon Utilities RemoteCapture Task for ZoomBrowser EX
"Samsung ML-2525W Series" = Wartung Samsung ML-2525W Series
"ScreenshotCaptor_is1" = Screenshot Captor 3.00.00
"Secunia PSI" = Secunia PSI (2.0.0.3003)
"StarCraft II" = StarCraft II
"Steam App 72850" = The Elder Scrolls V: Skyrim
"SurCode CD Pro DTS" = SurCode CD Pro DTS
"SurCode DVD Pro DTS Encoder" = SurCode DVD Pro DTS Encoder
"TeamViewer 7" = TeamViewer 7
"VLC media player" = VLC media player 2.0.0-rc1
"Winamp" = Winamp
"WinLiveSuite" = Windows Live Essentials
"WinPcapInst" = WinPcap 4.1.2
"winscp3_is1" = WinSCP 4.3.6
"Wireshark" = Wireshark 1.6.1
"Xilisoft Video Converter Ultimate" = Xilisoft Video Converter Ultimate
"XnView_is1" = XnView 1.98.5
"XviD4PSP60" = XviD4PSP 6.0

========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{79A765E1-C399-405B-85AF-466F52E918B0}" = Ask Toolbar Updater
"Audiogalaxy" = Audiogalaxy
"XBMC" = XBMC
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 09.02.2012 09:40:18 | Computer Name = zentis | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files
 (x86)\Common Files\Acronis\DiskDirector\WinPE\Files\RecoveryExpert.exe".  Die abhängige
 Assemblierung "Microsoft.VC80.CRT,processorArchitecture="x86",type="win32",version="8.0.50727.762""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 09.02.2012 09:40:21 | Computer Name = zentis | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files
 (x86)\Common Files\Acronis\DiskDirector\WinPE\Files\ManagementConsole.exe".  Die 
abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="x86",type="win32",version="8.0.50727.762""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 09.02.2012 09:40:22 | Computer Name = zentis | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files
 (x86)\Common Files\Acronis\DiskDirector\WinPE\Files\mmsBundle.dll".  Die abhängige
 Assemblierung "Microsoft.VC80.CRT,processorArchitecture="x86",type="win32",version="8.0.50727.762""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 09.02.2012 09:40:32 | Computer Name = zentis | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files
 (x86)\Acronis\TrueImageHome\BartPE\Files\TrueImage.exe".  Die abhängige Assemblierung
 "Microsoft.VC80.CRT,processorArchitecture="x86",type="win32",version="8.0.50727.762""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 09.02.2012 09:40:49 | Computer Name = zentis | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files
 (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll". Fehler in Manifest- oder
 Richtliniendatei "C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe
 AIR.dll" in Zeile 3.  Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR"
 des "version"-Attributs im assemblyIdentity-Element ist ungültig.
 
Error - 09.02.2012 09:40:58 | Computer Name = zentis | Source = SideBySide | ID = 16842832
Description = Fehler beim Generieren des Aktivierungskontexts für "c:\program files
 (x86)\ESET\eset online scanner\ESETSmartInstaller.exe". Fehler in  Manifest- oder
 Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche Komponentenversion
 steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.  In Konflikt
 stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente
 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 
Error - 09.02.2012 13:06:58 | Computer Name = zentis | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 09.02.2012 13:22:17 | Computer Name = zentis | Source = System Restore | ID = 8193
Description = 
 
Error - 09.02.2012 14:06:13 | Computer Name = zentis | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 09.02.2012 14:34:00 | Computer Name = zentis | Source = System Restore | ID = 8193
Description = 
 
[ Media Center Events ]
Error - 11.09.2010 14:13:28 | Computer Name = zentis | Source = MCUpdate | ID = 0
Description = 20:13:28 - Fehler beim Herstellen der Internetverbindung.  20:13:28 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 12.09.2010 05:49:52 | Computer Name = zentis | Source = MCUpdate | ID = 0
Description = 11:49:49 - Fehler beim Herstellen der Internetverbindung.  11:49:49 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 23.09.2010 12:42:17 | Computer Name = zentis | Source = MCUpdate | ID = 0
Description = 18:42:17 - Fehler beim Herstellen der Internetverbindung.  18:42:17 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 23.09.2010 12:42:26 | Computer Name = zentis | Source = MCUpdate | ID = 0
Description = 18:42:22 - Fehler beim Herstellen der Internetverbindung.  18:42:22 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 23.09.2010 13:44:03 | Computer Name = zentis | Source = MCUpdate | ID = 0
Description = 19:44:02 - Fehler beim Herstellen der Internetverbindung.  19:44:02 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 23.09.2010 13:44:08 | Computer Name = zentis | Source = MCUpdate | ID = 0
Description = 19:44:08 - Fehler beim Herstellen der Internetverbindung.  19:44:08 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 23.09.2010 14:46:07 | Computer Name = zentis | Source = MCUpdate | ID = 0
Description = 20:46:07 - Fehler beim Herstellen der Internetverbindung.  20:46:07 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 23.09.2010 14:46:13 | Computer Name = zentis | Source = MCUpdate | ID = 0
Description = 20:46:12 - Fehler beim Herstellen der Internetverbindung.  20:46:12 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 23.09.2010 15:48:12 | Computer Name = zentis | Source = MCUpdate | ID = 0
Description = 21:48:12 - Fehler beim Herstellen der Internetverbindung.  21:48:12 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 23.09.2010 15:48:18 | Computer Name = zentis | Source = MCUpdate | ID = 0
Description = 21:48:17 - Fehler beim Herstellen der Internetverbindung.  21:48:17 
-     Serververbindung konnte nicht hergestellt werden..  
 
[ System Events ]
Error - 09.02.2012 14:30:11 | Computer Name = zentis | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 09.02.2012 14:30:11 | Computer Name = zentis | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 09.02.2012 14:30:11 | Computer Name = zentis | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 09.02.2012 14:30:11 | Computer Name = zentis | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 09.02.2012 14:30:11 | Computer Name = zentis | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 09.02.2012 14:30:11 | Computer Name = zentis | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 09.02.2012 14:30:12 | Computer Name = zentis | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuchanbieter-Host"
 abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 09.02.2012 14:30:31 | Computer Name = zentis | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuchanbieter-Host"
 abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 09.02.2012 14:59:04 | Computer Name = zentis | Source = DCOM | ID = 10005
Description = 
 
Error - 09.02.2012 14:59:04 | Computer Name = zentis | Source = DCOM | ID = 10005
Description = 
 
 
< End of report >
         

otl.txt

OTL logfile created on: 09.02.2012 20:05:14 - Run 6
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\mikelsoft\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
8,00 Gb Total Physical Memory | 6,47 Gb Available Physical Memory | 80,97% Memory free
15,99 Gb Paging File | 14,61 Gb Available in Paging File | 91,37% Paging File free
Paging file location(s): d:\pagefile.sys 0 0 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 111,79 Gb Total Space | 56,33 Gb Free Space | 50,39% Space Free | Partition Type: NTFS
Drive D: | 465,66 Gb Total Space | 95,81 Gb Free Space | 20,58% Space Free | Partition Type: NTFS
Drive E: | 138,31 Gb Total Space | 14,18 Gb Free Space | 10,25% Space Free | Partition Type: NTFS
Drive F: | 793,20 Gb Total Space | 395,33 Gb Free Space | 49,84% Space Free | Partition Type: NTFS
 
Computer Name: ZENTIS | User Name: mikelsoft | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 14 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\mikelsoft\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
MOD - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (AMD FUEL Service) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Advanced Micro Devices, Inc.)
SRV:64bit: - (LBTServ) -- C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV:64bit: - (LMIMaint) -- C:\Program Files\LogMeIn\x64\RaMaint.exe (LogMeIn, Inc.)
SRV:64bit: - (LMIGuardianSvc) -- C:\Program Files\LogMeIn\x64\LMIGuardianSvc.exe (LogMeIn, Inc.)
SRV:64bit: - (LogMeIn) -- C:\Program Files\LogMeIn\x64\LogMeIn.exe (LogMeIn, Inc.)
SRV:64bit: - (RichVideo64) -- C:\Program Files\Cyberlink\Shared files\RichVideo64.exe ()
SRV:64bit: - (WinVNC4) -- C:\Program Files\RealVNC\VNC4\WinVNC4.exe (RealVNC Ltd.)
SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (SDWSCService) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Safer-Networking Ltd.)
SRV - (SDUpdateService) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (Safer-Networking Ltd.)
SRV - (SDScannerService) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (Safer-Networking Ltd.)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (TeamViewer7) -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (CyberLink PowerDVD 12 Media Server Service) -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe (CyberLink)
SRV - (CLHNServiceForPowerDVD12) -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe (CyberLink Corp.)
SRV - (CyberLink PowerDVD 12 Media Server Monitor Service) -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe (CyberLink)
SRV - (OpenVPNService) -- C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe ()
SRV - (MotoHelper) -- C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe ()
SRV - (Dyn Updater) -- C:\Program Files (x86)\Dyn Updater\DynUpSvc.exe (Dyn, Inc.)
SRV - (afcdpsrv) -- C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe (Acronis)
SRV - (UMVPFSrv) -- C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
SRV - (wxpSvc) -- C:\Program Files (x86)\wLite\wService.exe (Moonware Studios)
SRV - (AcrSch2Svc) -- C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe (Acronis)
SRV - (CLHNServiceForPowerDVD) -- C:\Program Files (x86)\CyberLink\PowerDVD11\Kernel\DMP\CLHNServiceForPowerDVD.exe ()
SRV - (CyberLink PowerDVD 11.0 Service) -- C:\Program Files (x86)\CyberLink\PowerDVD11\Common\MediaServer\CLMSServer.exe (CyberLink)
SRV - (CyberLink PowerDVD 11.0 Monitor Service) -- C:\Program Files (x86)\CyberLink\PowerDVD11\Common\MediaServer\CLMSMonitorService.exe (CyberLink)
SRV - (Secunia PSI Agent) -- C:\Program Files (x86)\Secunia\PSI\PSIA.exe (Secunia)
SRV - (Secunia Update Agent) -- C:\Program Files (x86)\Secunia\PSI\sua.exe (Secunia)
SRV - (EhttpSrv) -- C:\Programme\ESET\EHttpSrv.exe (ESET)
SRV - (ekrn) -- C:\Programme\ESET\x86\ekrn.exe (ESET)
SRV - (OODefragAgent) -- D:\Programme\OO Software\Defrag\oodag.exe (O&O Software GmbH)
SRV - (MCSWASVR) -- d:\Programme\Telekom\Mediencenter\WebDAV.AdminService.exe (Deutsche Telekom AG)
SRV - (OS Selector) -- D:\Programme\Acronis\DiskDirector\OSS\reinstall_svc.exe ()
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
SRV - (mail) -- D:\Filemon\SysinternalsSuite\winserv.exe ()
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (dtsoftbus01) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys (DT Soft Ltd)
DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys (Duplex Secure Ltd.)
DRV:64bit: - (VBoxNetAdp) -- C:\Windows\SysNative\drivers\VBoxNetAdp.sys (Oracle Corporation)
DRV:64bit: - (tap0901) -- C:\Windows\SysNative\drivers\tap0901.sys (The OpenVPN Project)
DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (usbfilter) -- C:\Windows\SysNative\drivers\usbfilter.sys (Advanced Micro Devices)
DRV:64bit: - (amd_xata) -- C:\Windows\SysNative\drivers\amd_xata.sys (Advanced Micro Devices)
DRV:64bit: - (amd_sata) -- C:\Windows\SysNative\drivers\amd_sata.sys (Advanced Micro Devices)
DRV:64bit: - (nusb3xhc) -- C:\Windows\SysNative\drivers\nusb3xhc.sys (Renesas Electronics Corporation)
DRV:64bit: - (nusb3hub) -- C:\Windows\SysNative\drivers\nusb3hub.sys (Renesas Electronics Corporation)
DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:64bit: - (afcdp) -- C:\Windows\SysNative\drivers\afcdp.sys (Acronis)
DRV:64bit: - (tdrpman273) Acronis Try&Decide and Restore Points filter (build 273) -- C:\Windows\SysNative\drivers\tdrpm273.sys (Acronis)
DRV:64bit: - (timounter) -- C:\Windows\SysNative\drivers\timntr.sys (Acronis)
DRV:64bit: - (AnyDVD) -- C:\Windows\SysNative\drivers\AnyDVD.sys (SlySoft, Inc.)
DRV:64bit: - (LVUVC64) Logitech HD Webcam C310(UVC) -- C:\Windows\SysNative\drivers\lvuvc64.sys (Logitech Inc.)
DRV:64bit: - (LVRS64) -- C:\Windows\SysNative\drivers\lvrs64.sys (Logitech Inc.)
DRV:64bit: - (AODDriver4.01) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys (Advanced Micro Devices)
DRV:64bit: - (AODDriver4.0) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys (Advanced Micro Devices)
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (LHidFilt) -- C:\Windows\SysNative\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV:64bit: - (LMouFilt) -- C:\Windows\SysNative\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV:64bit: - (LUsbFilt) -- C:\Windows\SysNative\drivers\LUsbFilt.sys (Logitech, Inc.)
DRV:64bit: - (LGBusEnum) -- C:\Windows\SysNative\drivers\LGBusEnum.sys (Logitech Inc.)
DRV:64bit: - (LGVirHid) -- C:\Windows\SysNative\drivers\LGVirHid.sys (Logitech Inc.)
DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (BackupReader) -- C:\Windows\SysNative\drivers\BackupReader.sys (Microsoft Corporation)
DRV:64bit: - (eamonm) -- C:\Windows\SysNative\drivers\eamonm.sys (ESET)
DRV:64bit: - (ehdrv) -- C:\Windows\SysNative\drivers\ehdrv.sys (ESET)
DRV:64bit: - (epfwwfpr) -- C:\Windows\SysNative\drivers\epfwwfpr.sys (ESET)
DRV:64bit: - (ElbyCDIO) -- C:\Windows\SysNative\drivers\ElbyCDIO.sys (Elaborate Bytes AG)
DRV:64bit: - (LMIRfsClientNP) -- C:\Windows\SysNative\LMIRfsClientNP.dll (LogMeIn, Inc.)
DRV:64bit: - (snapman) -- C:\Windows\SysNative\drivers\snapman.sys (Acronis)
DRV:64bit: - (RTHDMIAzAudService) -- C:\Windows\SysNative\drivers\RtHDMIVX.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (fssfltr) -- C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)
DRV:64bit: - (LMIRfsDriver) -- C:\Windows\SysNative\drivers\LMIRfsDriver.sys (LogMeIn, Inc.)
DRV:64bit: - (LMIInfo) -- C:\Program Files\LogMeIn\x64\rainfo.sys (LogMeIn, Inc.)
DRV:64bit: - (lmimirr) -- C:\Windows\SysNative\drivers\lmimirr.sys (LogMeIn, Inc.)
DRV:64bit: - (PSI) -- C:\Windows\SysNative\drivers\psi_mf.sys (Secunia)
DRV:64bit: - (NPF) -- C:\Windows\SysNative\drivers\npf.sys (CACE Technologies, Inc.)
DRV:64bit: - (AtiPcie) AMD PCI Express (3GIO) -- C:\Windows\SysNative\drivers\AtiPcie64.sys (Advanced Micro Devices Inc.)
DRV:64bit: - (cbfs3) -- C:\Windows\SysNative\drivers\cbfs3.sys (EldoS Corporation)
DRV:64bit: - (ha20x2k) -- C:\Windows\SysNative\drivers\ha20x2k.sys (Creative Technology Ltd)
DRV:64bit: - (emupia) -- C:\Windows\SysNative\drivers\emupia2k.sys (Creative Technology Ltd)
DRV:64bit: - (ctsfm2k) -- C:\Windows\SysNative\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV:64bit: - (ctprxy2k) -- C:\Windows\SysNative\drivers\ctprxy2k.sys (Creative Technology Ltd)
DRV:64bit: - (ossrv) -- C:\Windows\SysNative\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV:64bit: - (ctaud2k) Creative Audio Driver (WDM) -- C:\Windows\SysNative\drivers\ctaud2k.sys (Creative Technology Ltd)
DRV:64bit: - (ctac32k) -- C:\Windows\SysNative\drivers\ctac32k.sys (Creative Technology Ltd)
DRV:64bit: - (CTEXFIFX.SYS) -- C:\Windows\SysNative\drivers\CTEXFIFX.sys (Creative Technology Ltd.)
DRV:64bit: - (CTEXFIFX) -- C:\Windows\SysNative\drivers\CTEXFIFX.sys (Creative Technology Ltd.)
DRV:64bit: - (CTHWIUT.SYS) -- C:\Windows\SysNative\drivers\CTHWIUT.sys (Creative Technology Ltd.)
DRV:64bit: - (CTHWIUT) -- C:\Windows\SysNative\drivers\CTHWIUT.sys (Creative Technology Ltd.)
DRV:64bit: - (CT20XUT.SYS) -- C:\Windows\SysNative\drivers\CT20XUT.sys (Creative Technology Ltd.)
DRV:64bit: - (CT20XUT) -- C:\Windows\SysNative\drivers\CT20XUT.sys (Creative Technology Ltd.)
DRV:64bit: - (AmUStor) -- C:\Windows\SysNative\drivers\AmUStor.sys (Alcor Micro, Corp.)
DRV:64bit: - (amdiox64) -- C:\Windows\SysNative\drivers\amdiox64.sys (Advanced Micro Devices)
DRV:64bit: - (AtiHdmiService) -- C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV:64bit: - (teamviewervpn) -- C:\Windows\SysNative\drivers\teamviewervpn.sys (TeamViewer GmbH)
DRV:64bit: - (pcouffin) -- C:\Windows\SysNative\drivers\pcouffin.sys (VSO Software)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (lvpopf64) -- C:\Windows\SysNative\drivers\lvpopf64.sys (Logitech Inc.)
DRV:64bit: - (LVPr2M64) -- C:\Windows\SysNative\drivers\LVPr2M64.sys ()
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (atksgt) -- C:\Windows\SysNative\drivers\atksgt.sys ()
DRV:64bit: - (lirsgt) -- C:\Windows\SysNative\drivers\lirsgt.sys ()
DRV:64bit: - (tifsfilter) -- C:\Windows\SysNative\drivers\tifsfilt.sys (Acronis)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (motandroidusb) -- C:\Windows\SysNative\drivers\motoandroid.sys (Motorola)
DRV:64bit: - (MEMSWEEP2) -- C:\Windows\SysNative\EDE8.tmp (Sophos Plc)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (vncmirror) -- C:\Windows\SysNative\drivers\vncmirror.sys (RealVNC Ltd.)
DRV:64bit: - (ElbyCDFL) -- C:\Windows\SysNative\drivers\ElbyCDFL.sys (SlySoft, Inc.)
DRV:64bit: - (Hardlock) -- C:\Windows\SysNative\drivers\hardlock.sys (Aladdin Knowledge Systems Ltd.)
DRV - (ntk_PowerDVD12) -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12_64.sys (Cyberlink Corp.)
DRV - (AnyDVD) -- C:\Windows\SysWOW64\drivers\AnyDVD.sys (SlySoft, Inc.)
DRV - ({329F96B6-DF1E-4328-BFDA-39EA953C1312}) -- C:\Program Files (x86)\CyberLink\PowerDVD11\Common\NavFilter\000.fcl (CyberLink Corp.)
DRV - (ntk_PowerDVD) -- C:\Program Files (x86)\CyberLink\PowerDVD11\Kernel\DMP\ntk_PowerDVD_64.sys (Cyberlink Corp.)
DRV - (SSPORT) -- C:\Windows\SysWOW64\drivers\SSPORT.SYS (Samsung Electronics)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (ISODrive) -- C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys (EZB Systems, Inc.)
DRV - (ElbyCDFL) -- C:\Windows\SysWOW64\drivers\ElbyCDFL.sys (SlySoft, Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://uk.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://uk.yahoo.com
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.ask.com/?l=dis&o=14597
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 2B B1 F8 BA 3F 1C CA 01  [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;192.168.*.*
 
========== FireFox ==========
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa2,version=2.0.0: C:\Program Files (x86)\Picasa2\npPicasa2.dll File not found
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.5: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\support@predictad.com: C:\Program Files (x86)\AutocompletePro\support@predictad.com
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.02.01 21:51:02 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.01.11 20:20:47 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 7.0\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011.10.30 16:06:04 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 7.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Programme\ESET\Mozilla Thunderbird [2011.02.16 20:07:35 | 000,000,000 | ---D | M]
 
[2011.12.08 18:21:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Extensions
[2009.09.29 11:04:38 | 000,000,000 | ---D | M] (No name found) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Extensions\MediaCoder
[2009.12.28 20:44:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Extensions\uploadr@flickr.com
[2012.02.09 16:03:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions
[2011.08.17 14:15:59 | 000,000,000 | ---D | M] (Vista-aero) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\{07b2a769-ed19-4483-87ce-c643914c81bb}(149)
[2012.01.11 20:23:00 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
[2012.01.27 12:35:37 | 000,000,000 | ---D | M] (TV-Fox) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\{2f17f610-5e97-4fed-828f-9940b7b577a4}
[2011.08.17 14:15:59 | 000,000,000 | ---D | M] (PDF Download) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\{37E4D8EA-8BDA-4831-8EA1-89053939A250}
[2011.08.17 14:16:00 | 000,000,000 | ---D | M] (Minimap Addon) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\{398e77b8-2304-11dc-8314-0800200c9a66}(150)
[2012.01.18 16:55:44 | 000,000,000 | ---D | M] (FEBE) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}
[2011.08.17 14:16:00 | 000,000,000 | ---D | M] (Map+) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\{5359A5B3-9AFD-49ee-8C39-0A8F97A2A2D6}
[2011.08.17 14:16:00 | 000,000,000 | ---D | M] (NoScript) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}(151)
[2011.08.17 14:16:00 | 000,000,000 | ---D | M] (Live HTTP Headers) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\{8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}
[2011.11.20 15:54:50 | 000,000,000 | ---D | M] (WOT) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2012.01.27 21:56:51 | 000,000,000 | ---D | M] (ReminderFox) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\{ada4b710-8346-4b82-8199-5de2b400a6ae}
[2011.12.25 12:33:54 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011.08.17 14:16:00 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}(152)
[2011.08.17 14:16:00 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}(60)
[2011.08.17 14:15:59 | 000,000,000 | ---D | M] (DT Whois) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\beysim@beysim.net
[2011.08.17 14:15:59 | 000,000,000 | ---D | M] (Firebug) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\firebug@software.joehewitt(63).com
[2011.08.17 14:15:59 | 000,000,000 | ---D | M] (h4ck-y0u Toolbar) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\hackbar@h4ck-y0u.org
[2011.08.17 14:15:59 | 000,000,000 | ---D | M] (Locationbar²) -- C:\Users\mikelsoft\AppData\Roaming\mozilla\Firefox\Profiles\5ggse99m.default\extensions\locationbar2@design-noir.de
[2012.02.01 21:51:02 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.02.02 20:45:59 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2010.01.22 00:44:18 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170633FE}
[2012.01.29 17:12:48 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.07.29 14:12:26 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2010.09.29 21:00:15 | 000,075,208 | ---- | M] (Foxit Software Company) -- C:\Program Files (x86)\mozilla firefox\plugins\npFoxitReaderPlugin.dll
[2012.01.29 15:02:49 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.01.29 14:50:55 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.01.29 15:02:49 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.01.29 15:02:49 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.11.19 15:41:57 | 000,002,519 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\Search_Results.xml
[2012.01.29 15:02:49 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.01.29 15:02:49 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Search Results (Enabled)
CHR - default_search_provider: search_url = hxxp://dts.search-results.com/sr?src=crb&appid=113&systemid=406&sr=0&q={searchTerms}
CHR - default_search_provider: suggest_url = 
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\mikelsoft\AppData\Local\Google\Chrome\Application\16.0.912.75\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U26 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\mikelsoft\AppData\Local\Google\Chrome\Application\16.0.912.75\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\mikelsoft\AppData\Local\Google\Chrome\Application\16.0.912.75\pdf.dll
CHR - plugin: Skype Toolbars (Enabled) = C:\Users\mikelsoft\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8153_0\npSkypeChromePlugin.dll
CHR - plugin: DivX Player Netscape Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll
CHR - plugin: Foxit Reader Plugin for Mozilla (Enabled) = C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll
CHR - plugin: Winamp Application Detector (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll
CHR - plugin: Orbit Downloader (Enabled) = C:\Users\mikelsoft\AppData\Local\Google\Chrome\Application\plugins\nporbit.dll
CHR - plugin: DivX OVS Helper Plug-in (Enabled) = C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: CANON iMAGE GATEWAY Album Plugin Utility (Enabled) = C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL
CHR - plugin: Default Plug-in (Enabled) = default_plugin
 
O1 HOSTS File: ([2012.01.05 16:31:27 | 000,002,749 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Virtual Storage Mount Notification) - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysNative\CbFsMntNtf3.dll (EldoS Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Samsung BHO Class) - {AA609D72-8482-4076-8991-8CDAE5B93BCB} - d:\Programme\Samsung AnyWeb Print\W2PBrowser.dll ()
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (FlashFXP Helper for Internet Explorer) - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\FlashFXP\IEFlash.dll (IniCom Networks, Inc.)
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {99079a25-328f-4bd4-be04-00955acaa0a7} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4:64bit: - HKLM..\Run: [egui] C:\Programme\ESET\egui.exe (ESET)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [CTxfiHlp] C:\Windows\SysWow64\Ctxfihlp.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [LWS] C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
O4 - HKLM..\Run: [SAOB Monitor] C:\Program Files (x86)\Acronis\TrueImageHome\OnlineBackupStandalone\TrueImageMonitor.exe (Acronis)
O4 - HKLM..\Run: [SDTray] C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [TrueImageMonitor.exe] D:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe (Acronis)
O4 - HKCU..\Run: [{6C18F224-F804-11DF-A3E9-806E6F6E6963}] C:\Users\mikelsoft\AppData\Roaming\Microsoft\torrent.exe File not found
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [Steam] F:\Steam\steam.exe (Valve Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O8:64bit: - Extra context menu item: &NeoTrace It! - C:\PROGRA~2\NEOTRA~1\NTXcontext.htm ()
O8:64bit: - Extra context menu item: add to &BOM - C:\\PROGRA~2\\BIET-O~1\\\\AddToBOM.hta ()
O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: An vorhandene PDF-Datei anfügen - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html File not found
O8:64bit: - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html File not found
O8:64bit: - Extra context menu item: Linkziel in Adobe PDF konvertieren - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html File not found
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: &NeoTrace It! - C:\PROGRA~2\NEOTRA~1\NTXcontext.htm ()
O8 - Extra context menu item: add to &BOM - C:\\PROGRA~2\\BIET-O~1\\\\AddToBOM.hta ()
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html File not found
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html File not found
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html File not found
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: Samsung AnyWeb Print - {328ECD19-C167-40eb-A0C7-16FE7634105E} - d:\Programme\Samsung AnyWeb Print\W2PBrowser.dll ()
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: samsungsetup.com ([www] http in Vertrauenswürdige Sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 10.1.0)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 1.7.0_01)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab (Creative Software AutoUpdate Support Package)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15114/CTPID.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6CCCD374-6BA3-44C0-9C70-801D52F7627B}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6CCCD374-6BA3-44C0-9C70-801D52F7627B}: NameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Program Files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O20 - Winlogon\Notify\SDWinLogon: DllName - (SDWinLogon.dll) -  File not found
O21:64bit: - SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysNative\CbFsMntNtf3.dll (EldoS Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O22:64bit: - SharedTaskScheduler: {5FF49FE8-B332-4CB9-B102-FB6951629E55} - Virtual Storage Mount Notification - C:\Windows\SysNative\CbFsMntNtf3.dll (EldoS Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - D:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{06b0b34b-f84a-11df-9b38-aaa665e32000}\Shell - "" = AutoRun
O33 - MountPoints2\{06b0b34b-f84a-11df-9b38-aaa665e32000}\Shell\AutoRun\command - "" = I:\autorun.exe
O33 - MountPoints2\{1ed1d896-6326-11df-9de5-001fd0806040}\Shell - "" = AutoRun
O33 - MountPoints2\{1ed1d896-6326-11df-9de5-001fd0806040}\Shell\AutoRun\command - "" = I:\Setup.exe
O33 - MountPoints2\{1ed1d899-6326-11df-9de5-001fd0806040}\Shell - "" = AutoRun
O33 - MountPoints2\{1ed1d899-6326-11df-9de5-001fd0806040}\Shell\AutoRun\command - "" = K:\autorun.exe
O33 - MountPoints2\{31d30b1f-dd20-11de-92e7-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{31d30b1f-dd20-11de-92e7-806e6f6e6963}\Shell\AutoRun\command - "" = G:\autorun.exe setup
O33 - MountPoints2\{52df5b09-e9b0-11e0-abfd-1c6f654cb52a}\Shell - "" = AutoRun
O33 - MountPoints2\{52df5b09-e9b0-11e0-abfd-1c6f654cb52a}\Shell\AutoRun\command - "" = I:\OriginInstaller.exe
O33 - MountPoints2\{713a542d-18c5-11df-ba84-001fd0806040}\Shell - "" = AutoRun
O33 - MountPoints2\{713a542d-18c5-11df-ba84-001fd0806040}\Shell\AutoRun\command - "" = J:\SetupLauncher.exe
O33 - MountPoints2\{7b0ff70d-0d6f-11e1-bd6a-1c6f654cb52a}\Shell - "" = AutoRun
O33 - MountPoints2\{7b0ff70d-0d6f-11e1-bd6a-1c6f654cb52a}\Shell\AutoRun\command - "" = I:\whsconnectorinstall.exe
O33 - MountPoints2\{c9b764a7-2af5-11e0-81af-1c6f654cb52a}\Shell - "" = AutoRun
O33 - MountPoints2\{c9b764a7-2af5-11e0-81af-1c6f654cb52a}\Shell\AutoRun\command - "" = L:\setup.exe -a
O33 - MountPoints2\{d8860dff-fb11-11df-bfb2-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{d8860dff-fb11-11df-bfb2-806e6f6e6963}\Shell\AutoRun\command - "" = G:\Setup.exe
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\setup.exe
O33 - MountPoints2\I\Shell - "" = AutoRun
O33 - MountPoints2\I\Shell\AutoRun\command - "" = I:\setup.exe
O33 - MountPoints2\K\Shell - "" = AutoRun
O33 - MountPoints2\K\Shell\AutoRun\command - "" = K:\start.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (OODBS)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 14 Days ==========
 
[2582.02.25 10:22:54 | 000,000,000 | ---D | C] -- C:\WinHex.15.0-X_Bullet_X
[2012.02.09 18:07:33 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\mikelsoft\Desktop\OTL.exe
[2012.02.09 17:51:02 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0
[2012.02.09 15:04:05 | 052,128,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MRT.exe
[2012.02.09 14:48:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
[2012.02.09 14:48:53 | 000,017,272 | ---- | C] (Safer Networking Limited) -- C:\Windows\SysNative\sdnclean64.exe
[2012.02.09 14:48:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy 2
[2012.02.02 21:34:57 | 000,000,000 | ---D | C] -- C:\Users\mikelsoft\AppData\Roaming\Thunderbird
[2012.02.02 21:34:57 | 000,000,000 | ---D | C] -- C:\Users\mikelsoft\AppData\Local\Thunderbird
[2012.02.02 21:22:10 | 000,000,000 | ---D | C] -- C:\Users\mikelsoft\AppData\Local\{6D5B4C0A-CF20-4F92-BDFD-497ED067F1EA}
[2012.02.02 21:21:46 | 000,000,000 | ---D | C] -- C:\Users\mikelsoft\AppData\Local\{3E9616F1-935F-47C3-9677-97DA4160257F}
[2012.02.02 21:20:22 | 000,000,000 | ---D | C] -- C:\Users\mikelsoft\AppData\Local\{F13720B7-D640-413A-AA0C-0BFED2EEC0CF}
[2012.02.02 20:45:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2012.02.02 20:45:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2012.02.02 20:17:38 | 000,000,000 | ---D | C] -- C:\Users\mikelsoft\AppData\Roaming\Ember_Media_Manager
[2012.02.02 18:57:25 | 000,000,000 | ---D | C] -- C:\Users\mikelsoft\AppData\Roaming\MediaRenamer
[2012.02.02 18:49:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XBMC
[2012.02.02 18:49:51 | 000,000,000 | ---D | C] -- C:\Program Files\Media Renamer
[2012.02.01 20:50:54 | 000,381,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mfds.dll.bak
[2012.02.01 20:50:44 | 002,134,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msmpeg2vdec.dll
[2012.02.01 20:49:54 | 000,000,000 | ---D | C] -- C:\Users\mikelsoft\AppData\Roaming\Win7codecs
[2012.01.27 18:35:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2012.01.27 12:32:31 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2012.01.27 00:17:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD APP
[2012.01.27 00:17:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center
[2012.01.26 23:57:43 | 000,054,400 | ---- | C] (Advanced Micro Devices) -- C:\Windows\SysNative\drivers\usbfilter.sys
[2011.12.07 19:32:24 | 000,216,064 | ---- | C] ( ) -- C:\Windows\SysWow64\lagarith.dll
[2010.05.05 19:59:10 | 000,060,928 | ---- | C] ( ) -- C:\Windows\SysWow64\a3d.dll
[2010.05.05 19:38:18 | 000,012,800 | ---- | C] ( ) -- C:\Windows\SysWow64\killapps.exe
[2010.02.03 23:00:00 | 000,139,264 | ---- | C] ( ) -- C:\Windows\sipr3260.dll
[2009.10.10 18:29:13 | 000,082,816 | ---- | C] (VSO Software) -- C:\Users\mikelsoft\AppData\Roaming\pcouffin.sys
[5 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\mikelsoft\Documents\*.tmp files -> C:\Users\mikelsoft\Documents\*.tmp -> ]
[1 C:\Users\mikelsoft\*.tmp files -> C:\Users\mikelsoft\*.tmp -> ]
 
========== Files - Modified Within 14 Days ==========
 
[2012.02.09 20:05:29 | 011,796,480 | -HS- | M] () -- C:\Users\mikelsoft\NTUSER.DAT
[2012.02.09 19:33:55 | 001,613,412 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.02.09 19:33:55 | 000,696,848 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.02.09 19:33:55 | 000,652,166 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.02.09 19:33:55 | 000,148,144 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.02.09 19:33:55 | 000,121,098 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.02.09 19:29:33 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.02.09 19:29:31 | 001,335,972 | ---- | M] () -- C:\Windows\SysNative\oodbs.lor
[2012.02.09 19:27:08 | 001,805,838 | -H-- | M] () -- C:\Users\mikelsoft\AppData\Local\IconCache.db
[2012.02.09 19:13:07 | 000,020,704 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.02.09 19:13:07 | 000,020,704 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.02.09 19:06:14 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.02.09 19:05:54 | 000,000,266 | ---- | M] () -- C:\Windows\tasks\AutoKMS.job
[2012.02.09 19:05:54 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2012.02.09 18:07:34 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\mikelsoft\Desktop\OTL.exe
[2012.02.09 16:12:57 | 000,001,172 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Update ESET's license.lnk
[2012.02.09 16:12:57 | 000,001,136 | ---- | M] () -- C:\Users\Public\Desktop\Update ESET's license.lnk
[2012.02.09 15:50:05 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.02.09 15:35:03 | 000,001,241 | ---- | M] () -- C:\Users\mikelsoft\Desktop\taskmgr.exe - Verknüpfung.lnk
[2012.02.09 15:32:54 | 000,001,089 | ---- | M] () -- C:\Users\mikelsoft\Desktop\explorer.lnk
[2012.02.09 14:48:57 | 000,002,173 | ---- | M] () -- C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
[2012.02.09 12:45:16 | 000,000,058 | ---- | M] () -- C:\Users\mikelsoft\AppData\Local\DonationCoder_ScreenshotCaptor_InstallInfo.dat
[2012.02.08 16:47:57 | 000,000,600 | ---- | M] () -- C:\Users\mikelsoft\AppData\Roaming\winscp.rnd
[2012.02.08 16:47:52 | 000,000,600 | ---- | M] () -- C:\Users\mikelsoft\AppData\Local\PUTTY.RND
[2012.02.07 14:52:03 | 000,000,960 | ---- | M] () -- C:\Users\Public\Desktop\calibre - E-book management.lnk
[2012.02.04 20:13:08 | 005,815,523 | ---- | M] () -- C:\Users\mikelsoft\Documents\IMG_0943.JPG
[2012.02.02 20:45:56 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2012.02.01 22:53:31 | 000,002,188 | ---- | M] () -- C:\Users\Public\Desktop\CyberLink PowerDVD 12.lnk
[2012.02.01 21:51:03 | 000,001,130 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.02.01 20:49:19 | 000,001,846 | ---- | M] () -- C:\Users\Public\Desktop\Media Player Classic - Home Cinema x64.lnk
[2012.02.01 10:14:14 | 000,092,160 | ---- | M] () -- C:\Windows\SysNative\ff_vfw.dll
[2012.02.01 10:13:20 | 000,053,760 | ---- | M] () -- C:\Windows\SysNative\ff_acm.acm
[2012.01.28 12:12:40 | 000,079,360 | ---- | M] () -- C:\Windows\SysWow64\ff_vfw.dll
[2012.01.28 12:10:56 | 000,048,128 | ---- | M] () -- C:\Windows\SysWow64\ff_acm.acm
[2012.01.27 18:35:58 | 000,001,066 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2012.01.27 00:02:42 | 000,002,212 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk
[5 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\mikelsoft\Documents\*.tmp files -> C:\Users\mikelsoft\Documents\*.tmp -> ]
[1 C:\Users\mikelsoft\*.tmp files -> C:\Users\mikelsoft\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.02.09 19:27:08 | 001,805,838 | -H-- | C] () -- C:\Users\mikelsoft\AppData\Local\IconCache.db
[2012.02.09 16:12:57 | 000,001,172 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Update ESET's license.lnk
[2012.02.09 16:12:57 | 000,001,136 | ---- | C] () -- C:\Users\Public\Desktop\Update ESET's license.lnk
[2012.02.09 15:35:03 | 000,001,241 | ---- | C] () -- C:\Users\mikelsoft\Desktop\taskmgr.exe - Verknüpfung.lnk
[2012.02.09 15:32:54 | 000,001,089 | ---- | C] () -- C:\Users\mikelsoft\Desktop\explorer.lnk
[2012.02.09 14:48:57 | 000,002,185 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
[2012.02.09 14:48:57 | 000,002,173 | ---- | C] () -- C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
[2012.02.04 20:10:07 | 005,815,523 | ---- | C] () -- C:\Users\mikelsoft\Documents\IMG_0943.JPG
[2012.02.01 22:53:31 | 000,002,188 | ---- | C] () -- C:\Users\Public\Desktop\CyberLink PowerDVD 12.lnk
[2012.01.28 12:12:40 | 000,079,360 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2012.01.28 12:10:56 | 000,048,128 | ---- | C] () -- C:\Windows\SysWow64\ff_acm.acm
[2012.01.27 18:35:58 | 000,001,066 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2012.01.27 00:02:42 | 000,002,212 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2012.01.24 14:18:04 | 004,794,880 | ---- | C] () -- C:\Windows\SysWow64\x264vfw.dll
[2012.01.23 21:14:34 | 000,000,600 | ---- | C] () -- C:\Users\mikelsoft\AppData\Local\PUTTY.RND
[2011.12.12 15:27:19 | 000,000,131 | -HS- | C] () -- C:\ProgramData\.zreglib
[2011.12.05 22:04:00 | 000,059,904 | ---- | C] () -- C:\Windows\SysWow64\OpenVideo.dll
[2011.12.05 22:03:52 | 000,054,784 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll
[2011.12.05 13:11:09 | 001,641,646 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.12.03 17:32:15 | 000,482,408 | ---- | C] () -- C:\Windows\ssndii.exe
[2011.11.10 03:36:06 | 000,204,960 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2011.11.10 03:36:06 | 000,157,152 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2011.10.25 21:21:34 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OVDecoder.dll
[2011.09.12 23:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2011.08.19 09:26:20 | 010,898,456 | ---- | C] () -- C:\Windows\SysWow64\LogiDPP.dll
[2011.08.19 09:26:20 | 000,336,408 | ---- | C] () -- C:\Windows\SysWow64\DevManagerCore.dll
[2011.08.19 09:26:20 | 000,104,472 | ---- | C] () -- C:\Windows\SysWow64\LogiDPPApp.exe
[2011.06.07 16:25:55 | 001,456,640 | ---- | C] () -- C:\Program Files (x86)\Common Files\Falk Navi-Manager.msi
[2011.04.09 17:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011.03.19 10:06:02 | 000,240,640 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2011.03.19 10:04:28 | 000,650,752 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2011.02.24 15:16:48 | 000,000,058 | ---- | C] () -- C:\Users\mikelsoft\AppData\Local\DonationCoder_ScreenshotCaptor_InstallInfo.dat
[2011.01.04 13:28:18 | 000,175,616 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2010.11.29 18:29:25 | 000,000,079 | ---- | C] () -- C:\Users\mikelsoft\AppData\Local\CrystalDiskMark30.ini
[2010.11.28 17:14:53 | 000,000,169 | ---- | C] () -- C:\Windows\Bench32.INI
[2010.11.24 21:02:42 | 000,148,480 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2010.11.24 21:02:42 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2010.10.11 16:49:57 | 000,002,560 | ---- | C] () -- C:\Windows\_MSRSTRT.EXE
[2010.10.11 15:38:56 | 000,258,048 | ---- | C] () -- C:\Windows\SysWow64\libFLAC.dll
[2010.09.21 22:36:38 | 000,080,896 | ---- | C] () -- C:\Windows\cadkasdeinst01.exe
[2010.09.21 20:19:57 | 000,000,132 | ---- | C] () -- C:\Users\mikelsoft\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2010.06.25 18:03:12 | 000,053,299 | ---- | C] () -- C:\Windows\SysWow64\pthreadVC.dll
[2010.05.05 20:37:52 | 000,021,204 | ---- | C] () -- C:\Windows\SysWow64\instwdm.ini
[2010.05.05 19:56:46 | 000,002,560 | ---- | C] () -- C:\Windows\SysWow64\CtxfiRes.dll
[2010.05.05 19:46:30 | 000,321,512 | ---- | C] () -- C:\Windows\SysWow64\ctdlang.dat
[2010.05.05 19:46:30 | 000,056,509 | ---- | C] () -- C:\Windows\SysWow64\ctdnlstr.dat
[2010.05.05 19:38:22 | 000,007,680 | ---- | C] () -- C:\Windows\SysWow64\enlocstr.exe
[2010.03.24 18:44:07 | 000,000,000 | ---- | C] () -- C:\ProgramData\CLDShowX.ini
[2010.02.17 14:29:33 | 000,000,600 | ---- | C] () -- C:\Users\mikelsoft\AppData\Roaming\winscp.rnd
[2010.02.14 19:55:19 | 000,000,918 | ---- | C] () -- C:\Users\mikelsoft\AppData\Roaming\coreavc.ini
[2010.02.10 20:01:48 | 000,000,132 | ---- | C] () -- C:\Users\mikelsoft\AppData\Roaming\x264_x64.ini
[2010.01.17 20:33:51 | 000,015,873 | ---- | C] () -- C:\Windows\SysWow64\Inetde.dll
[2010.01.16 14:58:37 | 000,162,304 | ---- | C] () -- C:\Windows\SysWow64\libpng13.dll
[2010.01.16 14:58:37 | 000,052,836 | ---- | C] () -- C:\Windows\SysWow64\zlib1.dll
[2010.01.16 14:58:36 | 000,394,752 | ---- | C] () -- C:\Windows\SysWow64\cygwinb19.dll
[2010.01.16 14:58:34 | 000,709,719 | ---- | C] () -- C:\Windows\unins000.exe
[2010.01.16 14:58:34 | 000,006,581 | ---- | C] () -- C:\Windows\unins000.dat
[2009.12.15 20:07:59 | 000,917,504 | ---- | C] () -- C:\Windows\SysWow64\dtsdecoderdll.dll
[2009.11.06 16:38:03 | 000,001,992 | ---- | C] () -- C:\Windows\aopr.ini
[2009.10.23 18:22:21 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2009.10.12 17:32:36 | 000,010,752 | ---- | C] () -- C:\Windows\SysWow64\BASSMOD.dll
[2009.10.10 18:29:13 | 000,099,384 | ---- | C] () -- C:\Users\mikelsoft\AppData\Roaming\inst.exe
[2009.10.10 18:29:13 | 000,007,859 | ---- | C] () -- C:\Users\mikelsoft\AppData\Roaming\pcouffin.cat
[2009.10.10 18:29:13 | 000,001,167 | ---- | C] () -- C:\Users\mikelsoft\AppData\Roaming\pcouffin.inf
[2009.10.04 12:30:08 | 000,000,017 | ---- | C] () -- C:\Users\mikelsoft\AppData\Local\resmon.resmoncfg
[2009.10.03 15:18:42 | 000,404,656 | ---- | C] () -- C:\Windows\SysWow64\SpoonUninstall.exe
[2009.09.19 14:06:31 | 000,004,096 | -H-- | C] () -- C:\Users\mikelsoft\AppData\Local\keyfile3.drm
[2009.09.19 13:56:34 | 000,029,696 | ---- | C] () -- C:\Users\mikelsoft\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.08.16 21:22:16 | 000,000,035 | ---- | C] () -- C:\Windows\SysWow64\everest_cpl.ini
[2009.08.15 20:19:01 | 000,001,057 | ---- | C] () -- C:\Users\mikelsoft\AppData\Roaming\vso_ts_preview.xml
[2009.08.13 20:23:20 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009.08.13 19:06:40 | 000,003,072 | ---- | C] () -- C:\Windows\SysWow64\CTXFIGER.DLL
[2009.08.13 18:58:55 | 000,115,280 | ---- | C] () -- C:\Users\mikelsoft\AppData\Local\GDIPFONTCACHEV1.DAT
[2009.08.13 16:02:29 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009.07.14 03:35:42 | 000,001,405 | ---- | C] () -- C:\Windows\msdfmap.ini
[2009.07.14 03:34:57 | 000,000,478 | ---- | C] () -- C:\Windows\win.ini
[2009.07.14 03:34:57 | 000,000,269 | ---- | C] () -- C:\Windows\system.ini
[2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
[2009.06.04 00:37:06 | 000,000,054 | ---- | C] () -- C:\Windows\SysWow64\ctzapxx.ini
[2009.05.27 08:49:00 | 000,000,285 | ---- | C] () -- C:\Windows\SysWow64\kill.ini
[2008.11.15 19:02:26 | 001,866,670 | ---- | C] () -- C:\Windows\SysWow64\libfftw3f-3.dll
[2008.04.05 18:53:24 | 000,140,288 | ---- | C] () -- C:\Windows\SysWow64\avsfilter.dll
[2007.02.05 16:05:26 | 000,000,038 | ---- | C] () -- C:\Windows\AviSplitter.INI
[2005.09.13 04:09:34 | 000,004,608 | ---- | C] () -- C:\Windows\SysWow64\AvsRecursion.dll
[2004.01.24 03:35:44 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\avisynth_c.dll
 
========== LOP Check ==========
 
[2009.09.19 13:12:17 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\ACD Systems
[2009.08.13 21:49:41 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Acronis
[2011.02.27 20:34:18 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Ashampoo
[2009.08.15 18:38:30 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\avidemux
[2009.09.27 12:37:25 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\BDREBUILDER
[2011.09.09 15:57:05 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\BluRip
[2010.01.22 18:29:51 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\BOM
[2011.05.10 22:52:00 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\BPK
[2011.10.17 15:15:27 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Broad Intelligence
[2010.09.21 22:36:44 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\CAD-KAS
[2011.11.22 15:12:17 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\calibre
[2010.01.30 11:46:19 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Canneverbe Limited
[2009.11.10 18:47:48 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Canon
[2012.01.26 21:19:17 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\DAEMON Tools Lite
[2011.09.09 15:36:49 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\dcunningham.net
[2011.02.11 17:44:16 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\DiskAid
[2011.02.24 15:16:48 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\DonationCoder
[2010.02.10 20:04:42 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\DVDFab
[2011.05.24 15:57:48 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\EAC
[2012.02.02 20:17:38 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Ember_Media_Manager
[2012.02.09 16:08:33 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\FileZilla
[2009.12.28 20:44:22 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Flickr
[2011.12.03 19:22:19 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\foobar2000
[2011.05.26 11:58:31 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Foxit Software
[2011.10.17 15:11:40 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\FreeFileSync
[2010.07.08 14:04:28 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\GHISLER
[2009.11.08 15:36:42 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\gnupg
[2011.07.14 16:03:57 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\go
[2010.11.18 22:03:03 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\GrabPro
[2011.08.31 16:44:56 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\gtk-2.0
[2009.12.28 19:52:52 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Gui4Cli
[2010.02.08 22:20:28 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\HandBrake
[2010.12.02 12:11:09 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\HD Tune Pro
[2011.11.28 14:49:54 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\hybrid
[2009.08.24 17:00:14 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\ImgBurn
[2009.08.13 19:24:54 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\IrfanView
[2011.01.12 19:22:31 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\IsolatedStorage
[2009.08.15 18:13:50 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Leadertech
[2011.02.09 23:07:19 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Local
[2009.12.05 22:55:42 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\MCMPEGEnc
[2012.02.02 19:00:23 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\MediaRenamer
[2011.04.06 13:41:18 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Miranda
[2010.02.14 15:33:30 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\mkvtoolnix
[2011.07.29 20:52:49 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Mobile Atlas Creator
[2011.12.25 17:47:09 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Motorola
[2009.11.08 15:30:48 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\MuldeR
[2012.01.05 17:08:55 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\MySQL
[2012.01.06 18:39:36 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Notepad++
[2010.04.12 12:19:01 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Opera
[2012.01.20 17:30:41 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Orbit
[2011.03.04 19:59:51 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\PACE Anti-Piracy
[2010.01.16 14:13:00 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Passware
[2011.12.10 16:37:40 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\PC Suite
[2011.02.25 13:03:05 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\PhotoScape
[2010.08.30 18:43:16 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\ProgSense
[2011.12.12 17:13:51 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\redsn0w
[2010.09.22 09:38:38 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\ResourceCentral.E6E1B28A311BC518DB6C6883EA3757FDE0E90ADC.1
[2012.02.01 20:50:34 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Shark007
[2010.11.02 14:45:21 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Softland
[2011.02.27 20:03:39 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Software4u
[2010.02.05 20:30:25 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\SparVoip
[2011.03.04 19:58:52 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2010.02.18 15:48:48 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\sx264
[2011.05.10 21:51:43 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\SystemTools
[2011.12.07 19:55:26 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\TeamViewer
[2012.02.09 16:02:40 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\TeraCopy
[2011.12.08 17:50:49 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\The Creative Assembly
[2010.03.10 19:01:35 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Thinstall
[2012.02.02 21:34:58 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Thunderbird
[2012.02.09 16:08:33 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\TS3Client
[2012.01.23 21:10:54 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\ts3overlay
[2010.11.28 00:18:21 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Twan Wintjes
[2012.01.11 19:59:55 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\VidCoder
[2012.02.09 16:08:33 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Vso
[2012.02.01 20:50:46 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Win7codecs
[2009.08.14 11:06:44 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Windows Home Server
[2011.05.05 15:25:52 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Windows Live Writer
[2009.12.02 19:04:24 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Winff
[2011.08.31 15:48:15 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Wireshark
[2012.02.01 22:11:11 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\XBMC
[2012.01.05 15:56:01 | 000,000,000 | ---D | M] -- C:\Users\mikelsoft\AppData\Roaming\Zeon
[2012.02.09 19:05:54 | 000,000,266 | ---- | M] () -- C:\Windows\Tasks\AutoKMS.job
[2011.12.07 18:59:21 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 2560 bytes -> C:\ProgramData\CLDShowX.ini:Update.CL
@Alternate Data Stream - 145 bytes -> C:\ProgramData\Temp:0574215C
@Alternate Data Stream - 141 bytes -> C:\ProgramData\Temp:F8D65F32
@Alternate Data Stream - 139 bytes -> C:\ProgramData\Temp:D95ACC7D
@Alternate Data Stream - 137 bytes -> C:\ProgramData\Temp:E8BE05FA
@Alternate Data Stream - 1232 bytes -> C:\Users\mikelsoft\Lokale Einstellungen:9JFkVmMuWoCaz9UXl0qgvoM
@Alternate Data Stream - 1232 bytes -> C:\Users\mikelsoft\AppData\Local\Anwendungsdaten:9JFkVmMuWoCaz9UXl0qgvoM
@Alternate Data Stream - 107 bytes -> C:\ProgramData\Temp:1493A0EF

< End of report >
         

im normalen modus, denn laut log sollte der gehen:

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.

• Besuche folgende Seite für Downloadlinks und Anweisungen für dieses
  Tool
  
  Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  
• Hinweis:
  Gehe sicher das all deine Anti Virus und Anti Malware Programme abgeschalten sind, damit diese Combofix nicht bei der Arbeit stören.
  
• Poste bitte die C:\Combofix.txt in deiner nächsten Antwort.

Hallo Makusg

Habe diese combofix ausgeführt siehe anhang
hat mir übrigens mein antivirus gelöscht

war der eset download direkt von der homepage? welche version?
lad dir mal das neueste setup und instaliere es noch mal, klappt das?

ist direkt von eset Version 4.2. Habe nun neue version von eset geladen 5.0
und virenscanner funktioniert.

sehr gut, version 5 ist ja sowieso aktueller :-)
malwarebytes:
Downloade Dir bitte Malwarebytes

• Installiere
  das Programm in den vorgegebenen Pfad.
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Starte Malwarebytes, klicke auf Aktualisierung --> Suche
  nach Aktualisierung
• Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
• Wenn der Scan beendet
  ist, klicke auf Ergebnisse anzeigen.
• Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
• Poste
  das Logfile, welches sich in Notepad öffnet, hier in den Thread.
• Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Eset Antivirus hatte beim nächsten Neustart eine Firefox.exe gefunden in
Appdata\local und gelöscht.
Name des Schädlings LockScreenAig Trojaner
Ein suchlauf mit Malware brachte dieses Ergebniss

 Malwarebytes Anti-Malware  (PRO) 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.02.10.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
mikelsoft :: ZENTIS [Administrator]

Schutz: Deaktiviert

11.02.2012 15:01:46
mbam-log-2012-02-11 (16-09-12).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 599045
Laufzeit: 30 Minute(n), 25 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 7
C:\Program Files (x86)\Cain\Abel.exe (HackTool.Cain) -> Keine Aktion durchgeführt.
C:\Program Files (x86)\Cain\Abel64.exe (HackTool.Cain) -> Keine Aktion durchgeführt.
C:\Program Files (x86)\Cain\Cain.exe (PUP.Passwordtool.Cain) -> Keine Aktion durchgeführt.


(Ende)
         

+

wieso soll ich mir die logs ansehen wenn du eh machst was du willst, so hat ne zusammenarbeit wohl kaum sinn...

Das hat eset nod selber gemacht ohne mein zutun
Ich habe gestern meine Pc runtergefahren und beim starten heute
kam diese Meldung. übrigens diese Datei befindet sich noch in Quarantäne

sorry, ich hab das in den falschen thread geschrieben, vergiss das einfach :-)
lade den CCleaner standard:
CCleaner Download - CCleaner 3.15.1643
falls der CCleaner
bereits instaliert, überspringen.
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.