Bundespolizei Trojaner 100 euro

hewu · 03.04.2012, 22:48

Hallo Leute!
Ich habe einen Bundespolizei Trojaner und kann windows im Sicherheitsmodus starten, sonst aber nicht. Hab den Defogger runtergeladen, die Logfiles und dieses 7 Zip. Brauche nun Anweisungen wie ich den Trojaner von meinem Laptop runter bekomme. Bitte um Hilfe und um Nachsicht, da ich absolut kein Plan von Computern habe!
Zur Beschreibung des Problems: Wenn ich den Laptop starte, kommt ein kurzes Geräusch und das Bundespolizeifenster bedeckt meinen Desktop, sodass ich keine Möglichkeit habe meinen Computer zu nutzen. Ich werde zu 100 Euro Zahlung aufgefordert, aufgrund angeblicher terroristischer e-mails!!! Im Sicherheitsmodus funktioniert Internet, so kann ich mich auch an euch wenden.

markusg · 04.04.2012, 12:37

melde dich im abgesicherten modus mit netzwerk unter dem betroffenen konto an.
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die
OTL.exe
.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die
Textbox.

Code:

ATTFilter

activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Kopiere
nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

hewu · 04.04.2012, 16:52

OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 04.04.2012 17:41:26 - Run 1
OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\Henni\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,93 Gb Total Physical Memory | 1,91 Gb Available Physical Memory | 65,12% Memory free
6,06 Gb Paging File | 4,88 Gb Available in Paging File | 80,49% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455,99 Gb Total Space | 320,44 Gb Free Space | 70,27% Space Free | Partition Type: NTFS
 
Computer Name: HENNI-PC | User Name: Henni | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Henni\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Users\Henni\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe (TuneUp Software)
PRC - C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe (TuneUp Software)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Launch Manager\dsiwmis.exe (Dritek System Inc.)
PRC - C:\Programme\Acer\Optical Drive Power Management\ODDPWRSvc.exe (Acer Incorporated)
PRC - C:\Programme\Acer\Acer PowerSmart Manager\ePowerSvc.exe (Acer Incorporated)
PRC - C:\Programme\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (NewTech Infosystems, Inc.)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Programme\Acer\Acer VCM\RS_Service.exe (Acer Incorporated)
PRC - C:\Programme\EgisTec\MyWinLocker 3\x86\MWLService.exe (EgisTec Inc.)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Users\Henni\AppData\Local\Temp\wpbt0.dll ()
MOD - C:\Programme\Mozilla Firefox\js3250.dll ()
MOD - C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (odserv) -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (TuneUp.Defrag) -- C:\Programme\TuneUp Utilities 2010\TuneUpDefragService.exe (TuneUp Software)
SRV - (TuneUp.UtilitiesSvc) -- C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\Windows\System32\uxtuneup.dll (TuneUp Software)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (DsiWMIService) -- C:\Programme\Launch Manager\dsiwmis.exe (Dritek System Inc.)
SRV - (ODDPwrSvc) -- C:\Programme\Acer\Optical Drive Power Management\ODDPWRSvc.exe (Acer Incorporated)
SRV - (ePowerSvc) -- C:\Programme\Acer\Acer PowerSmart Manager\ePowerSvc.exe (Acer Incorporated)
SRV - (NTI IScheduleSvc) -- C:\Programme\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (NewTech Infosystems, Inc.)
SRV - (IAANTMON) Intel(R) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (RS_Service) -- C:\Programme\Acer\Acer VCM\RS_Service.exe (Acer Incorporated)
SRV - (MWLService) -- C:\Program Files\EgisTec\MyWinLocker 3\x86\\MWLService.exe ()
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found
DRV - (TuneUpUtilitiesDrv) -- C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys (TuneUp Software)
DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (AF15BDA) -- C:\Windows\System32\drivers\AF15BDA.sys (ITETech                  )
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (L1C) -- C:\Windows\System32\drivers\L1C60x86.sys (Atheros Communications, Inc.)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (mwlPSDVDisk) -- C:\Windows\System32\drivers\mwlPSDVDisk.sys (Egis Incorporated.)
DRV - (mwlPSDFilter) -- C:\Windows\System32\drivers\mwlPSDFilter.sys (Egis Incorporated.)
DRV - (mwlPSDNServ) -- C:\Windows\System32\drivers\mwlPSDNserv.sys (Egis Incorporated.)
DRV - (NETw5v32) Intel(R) -- C:\Windows\System32\drivers\NETw5v32.sys (Intel Corporation)
DRV - (IntcHdmiAddService) Intel(R) -- C:\Windows\System32\drivers\IntcHdmi.sys (Intel(R) Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = iGoogle Redirect
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = iGoogle Redirect
IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = iGoogle Redirect
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = Acer.com Worldwide - Select your local country or region [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = Acer.com Worldwide - Select your local country or region [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Babylon Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=109986&babsrc=SP_ss&mntrId=0e0e6d960000000000000022fb3d61b8
IE - HKCU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE337
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.startup.homepage: "hxxp://search.babylon.com/?affID=109986&babsrc=HP_ss&mntrId=0e0e6d960000000000000022fb3d61b8"
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..extensions.enabledItems: crossriderapp2258@crossrider.com:0.80.26
FF - prefs.js..extensions.enabledItems: ffxtlbr@babylon.com:1.2.0
FF - prefs.js..keyword.URL: "hxxp://search.babylon.com/?affID=109986&babsrc=KW_ss&mntrId=0e0e6d960000000000000022fb3d61b8&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8051.1204: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.09.25 13:49:32 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.28\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.03.21 20:26:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.28\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.03.21 20:26:33 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.09.25 13:49:32 | 000,000,000 | ---D | M]
 
[2010.03.10 16:04:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Henni\AppData\Roaming\mozilla\Extensions
[2012.04.04 07:35:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Henni\AppData\Roaming\mozilla\Firefox\Profiles\ls5kuqzb.default\extensions
[2010.07.04 13:28:30 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Henni\AppData\Roaming\mozilla\Firefox\Profiles\ls5kuqzb.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.07.21 20:44:22 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\Henni\AppData\Roaming\mozilla\Firefox\Profiles\ls5kuqzb.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2012.04.03 23:33:47 | 000,000,000 | ---D | M] ("I Want This") -- C:\Users\Henni\AppData\Roaming\mozilla\Firefox\Profiles\ls5kuqzb.default\extensions\crossriderapp2258@crossrider.com
[2012.04.03 23:33:51 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\Henni\AppData\Roaming\mozilla\Firefox\Profiles\ls5kuqzb.default\extensions\ffxtlbr@babylon.com
[2010.07.21 20:44:25 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.06.20 21:22:00 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010.06.20 21:22:00 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{AB2CE124-6272-4B12-94A9-7303C7397BD1}
[2011.09.15 17:16:45 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.04.03 23:33:45 | 000,002,313 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2011.09.15 17:16:45 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.09.15 17:16:45 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.09.15 17:16:45 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.09.15 17:16:45 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (I Want This) - {11111111-1111-1111-1111-110011221158} - C:\Programme\I Want This\I Want This.dll (215 Apps)
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (TerraTec Home Cinema) - {AD6E6555-FB2C-47D4-8339-3E2965509877} - C:\Programme\TerraTec\TerraTec Home Cinema\ThcDeskBand.dll (TerraTec Electronic GmbH)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [IAAnotif] C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [Nikon Message Center 2] C:\Program Files\Nikon\Nikon Message Center 2\NkMC2.exe (Nikon Corporation)
O4 - HKLM..\Run: [Skytel] C:\Programme\Realtek\Audio\HDA\SkyTel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Upgrade] C:\Users\Henni\AppData\Roaming\Dropbox\{24730F59-148A-4E6E-8093-19582F366F12}\Upgrade.exe File not found
O4 - Startup: C:\Users\Henni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Henni\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\Henni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx (WRC Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EBBD3128-A8FD-48A7-A09D-361622CA09D5}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Public\Pictures\Sample Pictures\Dock.jpg
O24 - Desktop BackupWallPaper: C:\Users\Public\Pictures\Sample Pictures\Dock.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{50b80cdf-0643-11e1-8ed7-0022fb3d61b8}\Shell - "" = AutoRun
O33 - MountPoints2\{50b80cdf-0643-11e1-8ed7-0022fb3d61b8}\Shell\AutoRun\command - "" = D:\AutoRun.exe
O33 - MountPoints2\D\Shell - "" = AutoRun
O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\AutoRun.exe
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\start.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.04.04 17:41:04 | 000,593,920 | ---- | C] (OldTimer Tools) -- C:\Users\Henni\Desktop\OTL.exe
[2012.04.03 23:39:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
[2012.04.03 23:38:59 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip
[2012.04.03 23:33:51 | 000,000,000 | ---D | C] -- C:\Program Files\BabylonToolbar
[2012.04.03 23:33:47 | 000,000,000 | ---D | C] -- C:\Users\Henni\AppData\Local\I Want This
[2012.04.03 23:33:44 | 000,000,000 | ---D | C] -- C:\Program Files\I Want This
[2012.04.03 23:33:43 | 000,000,000 | ---D | C] -- C:\Users\Henni\AppData\Local\Babylon
[2012.04.03 23:33:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon
[2012.04.03 23:33:42 | 000,000,000 | ---D | C] -- C:\Users\Henni\AppData\Roaming\Babylon
[2012.04.03 23:33:40 | 000,000,000 | ---D | C] -- C:\Users\Henni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Uncompressor
[2012.04.03 23:33:40 | 000,000,000 | ---D | C] -- C:\Program Files\Uncompressor
[2012.04.03 23:17:48 | 000,607,260 | R--- | C] (Swearware) -- C:\Users\Henni\Desktop\dds.com
[2012.03.14 13:47:42 | 002,044,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012.03.14 13:47:41 | 001,172,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll
[2012.03.14 13:47:41 | 001,068,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll
[2012.03.14 13:47:41 | 000,683,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll
[2012.03.14 13:47:41 | 000,219,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll
[2012.03.14 13:47:41 | 000,160,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll
[2012.03.14 13:47:04 | 000,613,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpencom.dll
[2012.03.05 22:48:07 | 000,000,000 | ---D | C] -- C:\Users\Henni\AppData\Roaming\Help
[2012.03.05 22:44:01 | 000,000,000 | ---D | C] -- C:\Users\Henni\AppData\Roaming\TeamViewer
 
========== Files - Modified Within 30 Days ==========
 
[2012.04.04 17:41:09 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\Henni\Desktop\OTL.exe
[2012.04.04 17:34:09 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.04.04 17:32:44 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.04.04 17:19:15 | 000,644,136 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.04.04 17:19:15 | 000,598,554 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.04.04 17:19:15 | 000,131,388 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.04.04 17:19:15 | 000,106,436 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.04.04 17:13:57 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.04.04 17:13:56 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.04.04 17:12:55 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.04.04 17:12:09 | 3145,523,200 | -HS- | M] () -- C:\hiberfil.sys
[2012.04.04 17:10:05 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2012.04.03 23:57:43 | 000,007,765 | ---- | M] () -- C:\Users\Henni\Desktop\Desktop.zip
[2012.04.03 23:56:23 | 000,006,979 | ---- | M] () -- C:\Users\Henni\Desktop\Desktop.7z
[2012.04.03 23:38:13 | 001,110,476 | ---- | M] () -- C:\Users\Henni\Desktop\7z920.exe
[2012.04.03 23:33:53 | 000,000,237 | ---- | M] () -- C:\user.js
[2012.04.03 23:33:40 | 000,000,858 | ---- | M] () -- C:\Users\Henni\Desktop\Uncompressor.lnk
[2012.04.03 23:31:29 | 000,560,648 | ---- | M] () -- C:\Users\Henni\Desktop\ADLSoft_UnCompressor.exe
[2012.04.03 23:17:49 | 000,607,260 | R--- | M] (Swearware) -- C:\Users\Henni\Desktop\dds.com
[2012.04.03 23:14:21 | 000,000,000 | ---- | M] () -- C:\Users\Henni\defogger_reenable
[2012.04.03 21:33:20 | 000,000,870 | ---- | M] () -- C:\Users\Henni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpbt0.dll.lnk
[2012.03.30 15:00:36 | 000,025,471 | ---- | M] () -- C:\Users\Henni\Desktop\AC-Protokoll 15.odt
[2012.03.29 17:36:12 | 000,114,882 | ---- | M] () -- C:\Users\Henni\Documents\Matheübung7 (2).ods
[2012.03.29 17:25:37 | 000,063,270 | ---- | M] () -- C:\Users\Henni\Documents\Matheübung7.ods
[2012.03.29 16:38:01 | 000,074,819 | ---- | M] () -- C:\Users\Henni\Documents\Übungsklausur 2.ods
[2012.03.29 16:36:07 | 000,495,771 | ---- | M] () -- C:\Users\Henni\Documents\Übungsklausur.ods
[2012.03.29 13:50:06 | 000,041,994 | ---- | M] () -- C:\Users\Henni\Documents\Matheübung11.1.ods
[2012.03.29 13:04:19 | 000,066,221 | ---- | M] () -- C:\Users\Henni\Documents\Matheübung 10.1.ods
[2012.03.28 14:31:40 | 000,045,328 | ---- | M] () -- C:\Users\Henni\Documents\Matheübung 9.1.ods
[2012.03.27 17:57:08 | 000,027,528 | ---- | M] () -- C:\Users\Henni\Documents\Matheübung6.ods
[2012.03.27 17:38:01 | 000,025,113 | ---- | M] () -- C:\Users\Henni\Desktop\AC-Protokoll 11.odt
[2012.03.27 17:10:33 | 000,069,757 | ---- | M] () -- C:\Users\Henni\Documents\Matheübung 5.ods
[2012.03.27 16:01:32 | 000,023,080 | ---- | M] () -- C:\Users\Henni\Documents\Matheübung4.ods
[2012.03.27 16:00:36 | 000,032,673 | ---- | M] () -- C:\Users\Henni\Documents\Matheübung3.ods
[2012.03.27 16:00:11 | 000,029,106 | ---- | M] () -- C:\Users\Henni\Documents\Matheübung3,1.ods
[2012.03.27 14:49:02 | 000,014,969 | ---- | M] () -- C:\Users\Henni\Documents\Matheübung 2.ods
[2012.03.27 14:31:21 | 000,068,043 | ---- | M] () -- C:\Users\Henni\Documents\Mathe übung 1.ods
[2012.03.25 20:14:44 | 000,022,723 | ---- | M] () -- C:\Users\Henni\Desktop\AC-Protokoll 6.odt
[2012.03.16 15:33:20 | 000,320,504 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
 
========== Files Created - No Company Name ==========
 
[2012.04.04 17:12:09 | 3145,523,200 | -HS- | C] () -- C:\hiberfil.sys
[2012.04.03 23:57:43 | 000,007,765 | ---- | C] () -- C:\Users\Henni\Desktop\Desktop.zip
[2012.04.03 23:41:11 | 000,006,979 | ---- | C] () -- C:\Users\Henni\Desktop\Desktop.7z
[2012.04.03 23:38:11 | 001,110,476 | ---- | C] () -- C:\Users\Henni\Desktop\7z920.exe
[2012.04.03 23:33:52 | 000,000,237 | ---- | C] () -- C:\user.js
[2012.04.03 23:33:40 | 000,000,858 | ---- | C] () -- C:\Users\Henni\Desktop\Uncompressor.lnk
[2012.04.03 23:31:28 | 000,560,648 | ---- | C] () -- C:\Users\Henni\Desktop\ADLSoft_UnCompressor.exe
[2012.04.03 23:14:21 | 000,000,000 | ---- | C] () -- C:\Users\Henni\defogger_reenable
[2012.04.03 21:33:20 | 000,000,870 | ---- | C] () -- C:\Users\Henni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpbt0.dll.lnk
[2012.03.29 13:50:05 | 000,041,994 | ---- | C] () -- C:\Users\Henni\Documents\Matheübung11.1.ods
[2012.03.29 12:32:42 | 000,066,221 | ---- | C] () -- C:\Users\Henni\Documents\Matheübung 10.1.ods
[2012.03.28 14:09:56 | 000,045,328 | ---- | C] () -- C:\Users\Henni\Documents\Matheübung 9.1.ods
[2012.03.27 16:19:19 | 000,069,757 | ---- | C] () -- C:\Users\Henni\Documents\Matheübung 5.ods
[2012.03.27 16:01:31 | 000,023,080 | ---- | C] () -- C:\Users\Henni\Documents\Matheübung4.ods
[2012.03.27 15:38:04 | 000,029,106 | ---- | C] () -- C:\Users\Henni\Documents\Matheübung3,1.ods
[2012.03.27 14:49:28 | 000,032,673 | ---- | C] () -- C:\Users\Henni\Documents\Matheübung3.ods
[2012.03.27 14:49:01 | 000,014,969 | ---- | C] () -- C:\Users\Henni\Documents\Matheübung 2.ods
[2012.03.25 20:16:05 | 000,025,471 | ---- | C] () -- C:\Users\Henni\Desktop\AC-Protokoll 15.odt
[2012.03.18 18:44:47 | 000,495,771 | ---- | C] () -- C:\Users\Henni\Documents\Übungsklausur.ods
[2012.03.18 18:44:47 | 000,114,882 | ---- | C] () -- C:\Users\Henni\Documents\Matheübung7 (2).ods
[2012.03.18 18:44:47 | 000,074,819 | ---- | C] () -- C:\Users\Henni\Documents\Übungsklausur 2.ods
[2012.03.18 18:44:47 | 000,068,043 | ---- | C] () -- C:\Users\Henni\Documents\Mathe übung 1.ods
[2012.03.18 18:44:47 | 000,063,270 | ---- | C] () -- C:\Users\Henni\Documents\Matheübung7.ods
[2012.03.18 18:44:47 | 000,048,173 | ---- | C] () -- C:\Users\Henni\Documents\Übungsaufgabe 9.ots
[2012.03.18 18:44:47 | 000,046,926 | ---- | C] () -- C:\Users\Henni\Documents\Matheübung8.ods
[2012.03.18 18:44:47 | 000,041,875 | ---- | C] () -- C:\Users\Henni\Documents\Übungsaufgabe 10.ots
[2012.03.18 18:44:47 | 000,031,023 | ---- | C] () -- C:\Users\Henni\Documents\Übungsaufgabe 11.ots
[2012.03.18 18:44:47 | 000,028,815 | ---- | C] () -- C:\Users\Henni\Documents\Übung 11.ods
[2012.03.18 18:44:47 | 000,027,528 | ---- | C] () -- C:\Users\Henni\Documents\Matheübung6.ods
[2012.03.18 18:40:52 | 000,025,113 | ---- | C] () -- C:\Users\Henni\Desktop\AC-Protokoll 11.odt
[2012.03.12 17:45:03 | 000,022,723 | ---- | C] () -- C:\Users\Henni\Desktop\AC-Protokoll 6.odt
[2011.11.21 22:33:05 | 000,400,691 | ---- | C] () -- C:\Users\Henni\AppData\Local\Genetik vortrag.pdf
[2011.11.21 22:31:22 | 000,436,930 | ---- | C] () -- C:\Users\Henni\AppData\Local\Genetik vortrag.odp
[2011.11.04 14:02:06 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Definition Bundle
[2011.11.04 14:02:06 | 000,000,268 | RH-- | C] () -- C:\Users\Henni\AppData\Roaming\CustomDataViews
[2011.11.04 14:02:06 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLev.DAT
[2011.11.04 14:02:06 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Drums
[2011.11.04 14:02:05 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Database
[2011.11.04 14:02:05 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Dance Kit
[2011.11.04 14:02:05 | 000,000,268 | RH-- | C] () -- C:\Users\Henni\AppData\Roaming\Core Data Application
[2011.11.04 14:02:05 | 000,000,268 | RH-- | C] () -- C:\Users\Henni\AppData\Roaming\Contextual Menu Items
[2011.11.04 14:02:05 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLet.DAT
[2011.11.04 14:02:05 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLes.DAT
[2011.11.04 14:02:05 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Documents
[2011.11.04 14:02:05 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Distortion
[2010.09.25 13:40:53 | 000,230,166 | ---- | C] () -- C:\Windows\hpoins46.dat
[2010.08.25 20:30:02 | 000,439,308 | ---- | C] () -- C:\Windows\System32\igcompkrng500.bin
[2010.08.25 20:30:00 | 000,982,240 | ---- | C] () -- C:\Windows\System32\igkrng500.bin
[2010.08.25 20:30:00 | 000,092,356 | ---- | C] () -- C:\Windows\System32\igfcg500m.bin
[2010.08.25 19:59:08 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll
[2010.08.25 19:57:00 | 000,000,151 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config
[2010.08.25 19:52:00 | 000,208,896 | ---- | C] () -- C:\Windows\System32\iglhsip32.dll
[2010.08.25 19:52:00 | 000,143,360 | ---- | C] () -- C:\Windows\System32\iglhcp32.dll
[2010.06.20 21:24:57 | 000,000,048 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.05.06 14:04:53 | 000,000,560 | ---- | C] () -- C:\Users\Henni\AppData\Roaming\wklnhst.dat
 
========== LOP Check ==========
 
[2009.04.08 20:21:40 | 000,000,000 | ---D | M] -- C:\Users\Henni\AppData\Roaming\Acer GameZone Console
[2012.04.03 23:33:42 | 000,000,000 | ---D | M] -- C:\Users\Henni\AppData\Roaming\Babylon
[2012.04.04 17:13:48 | 000,000,000 | ---D | M] -- C:\Users\Henni\AppData\Roaming\Dropbox
[2011.11.04 14:12:04 | 000,000,000 | ---D | M] -- C:\Users\Henni\AppData\Roaming\Nikon
[2010.11.02 12:36:38 | 000,000,000 | ---D | M] -- C:\Users\Henni\AppData\Roaming\OpenOffice.org
[2009.10.25 13:20:39 | 000,000,000 | ---D | M] -- C:\Users\Henni\AppData\Roaming\ScanSoft
[2012.03.05 22:44:01 | 000,000,000 | ---D | M] -- C:\Users\Henni\AppData\Roaming\TeamViewer
[2010.05.06 14:37:15 | 000,000,000 | ---D | M] -- C:\Users\Henni\AppData\Roaming\Template
[2011.07.03 18:37:30 | 000,000,000 | ---D | M] -- C:\Users\Henni\AppData\Roaming\TerraTec
[2010.07.21 19:54:14 | 000,000,000 | ---D | M] -- C:\Users\Henni\AppData\Roaming\TuneUp Software
[2012.04.04 17:10:05 | 000,032,586 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >

--- --- ---
OTL Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 04.04.2012 17:41:26 - Run 1
OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\Henni\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,93 Gb Total Physical Memory | 1,91 Gb Available Physical Memory | 65,12% Memory free
6,06 Gb Paging File | 4,88 Gb Available in Paging File | 80,49% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455,99 Gb Total Space | 320,44 Gb Free Space | 70,27% Space Free | Partition Type: NTFS
 
Computer Name: HENNI-PC | User Name: Henni | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~3\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1EE6F855-478D-4BC1-9700-0CDF42377CE8}" = lport=445 | protocol=6 | dir=in | app=system | 
"{1FF870A8-CBBD-439A-9619-A4A7789350E9}" = lport=137 | protocol=17 | dir=in | app=system | 
"{2C5FA19D-1A7F-46C7-9233-FADA78453C49}" = rport=139 | protocol=6 | dir=out | app=system | 
"{3183DC0D-3AAD-4CEA-9667-63874A416782}" = lport=139 | protocol=6 | dir=in | app=system | 
"{32AC4EBE-4921-4E51-86F9-54CCB508831C}" = lport=138 | protocol=17 | dir=in | app=system | 
"{44EAD10F-DE1B-4353-8EF2-54DD09D8DDC0}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{58C6E89D-A0E5-4C07-BD8D-53040F1EE062}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{8A1DADF3-96D0-4505-A7DE-C8E137A6B945}" = rport=445 | protocol=6 | dir=out | app=system | 
"{CACA05BC-0732-4E7E-9A4A-8322D83E5094}" = rport=138 | protocol=17 | dir=out | app=system | 
"{EE456E5F-DFC1-4E76-8F28-D7D6D4298AF0}" = rport=137 | protocol=17 | dir=out | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{06AC56F8-D6CA-4556-93FB-C3FDC9D619B8}" = protocol=6 | dir=in | app=c:\program files\terratec\terratec home cinema\cinergydvr.exe | 
"{0DC6E385-BA07-4AA3-B8CA-AED76642D0B8}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{11257F36-E3B8-45A9-AC81-34E23FC4444C}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgpc01.exe | 
"{1213B9CB-AA9E-4520-AA8C-0410E4EB3401}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\schedulersvc.exe | 
"{172B75C8-1920-4C5D-BDB0-9F43FE08AB86}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{1C0C3D0A-86F7-43EE-9689-693FEF231110}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe | 
"{2563E0C9-6F24-47BE-A4D3-9C6F15E8C464}" = protocol=17 | dir=in | app=c:\program files\terratec\terratec home cinema\tvtvsetup\tvtv_wizard.exe | 
"{26E17B6C-5EC4-45BA-BFEF-DA5934148146}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{2AA2CD78-C714-4878-BCD5-EDE5948CF13C}" = dir=in | app=c:\program files\cyberlink\powerdvd\powerdvd.exe | 
"{2D29E058-87EE-481B-A13F-CCF8F6589714}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgplgtupl.exe | 
"{2DCB8C26-A974-4599-9EE4-81A981F99CC0}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe | 
"{357BD2C4-A961-4E37-A38F-B1C05903B622}" = dir=in | app=c:\program files\hp\digital imaging\bin\hposid01.exe | 
"{3AB24AAA-49D8-4790-9134-98417746E747}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqcopy2.exe | 
"{3DAC0E72-436A-4404-BED5-CF2C7D341547}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{3FAD6E5C-C8B8-46B8-B817-E93EB4BBAD9F}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\backupsvc.exe | 
"{4955F302-8CD6-488B-B1F2-E020D7B1D920}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{54F3CBF4-FDE0-432A-81A7-D80AE76DD03E}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqtra08.exe | 
"{57BF3B60-8391-4A9B-8AB3-EBC2D065EBF6}" = dir=in | app=c:\program files\acer\acer vcm\vc.exe | 
"{57F70972-813E-4EB0-A48D-0414D2B537C5}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpfccopy.exe | 
"{58E6D034-2002-4D63-968B-41E585AAC97E}" = protocol=6 | dir=in | app=c:\users\henni\appdata\roaming\dropbox\bin\dropbox.exe | 
"{6431F151-3429-44E3-9318-4F6ADE30090B}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqkygrp.exe | 
"{661D9833-DE3C-48CE-81A9-2C86369E569E}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{6629C92B-7CF8-4880-8608-9A7C9384BABB}" = protocol=17 | dir=in | app=c:\program files\terratec\terratec home cinema\cinergydvr.exe | 
"{82C31A43-AD14-4A76-9AEB-08F18A59E0D3}" = protocol=6 | dir=in | app=c:\program files\terratec\terratec home cinema\tvtvsetup\tvtv_wizard.exe | 
"{88AB9911-382F-4474-AD32-11D5EE32A8EC}" = protocol=6 | dir=in | app=c:\program files\terratec\terratec home cinema\insttool.exe | 
"{8B452A8A-B927-4A34-858D-3E322EF3E989}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{8C5E83C7-F549-41D6-9D3C-9C4F63CCF558}" = protocol=17 | dir=in | app=c:\program files\terratec\terratec home cinema\insttool.exe | 
"{96D4DE68-F65E-40AC-BECC-4943A02FC757}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{A076B43D-9A6E-431A-AF18-655623892043}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{A0BB84B4-A828-4DC5-82D9-13A0687D8E92}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpoews01.exe | 
"{A62779BA-E25D-4152-86CA-A5EBE94E322F}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe | 
"{ABB27922-C568-4640-B30A-5C768643FF5F}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe | 
"{AE42203B-94F8-4A94-8AC4-A4F96A3F70B0}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\schedulersvc.exe | 
"{BCB591CC-09DE-4151-8C84-15BB4707E3F8}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpiscnapp.exe | 
"{C04FC2F2-05BF-4BEC-995A-2B5D27CB7E06}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgm.exe | 
"{DAE47B87-9A55-4A92-9719-4D940E7157C7}" = protocol=17 | dir=in | app=c:\users\henni\appdata\roaming\dropbox\bin\dropbox.exe | 
"{E384990D-3785-4058-B6DE-7197150551B3}" = dir=in | app=c:\program files\acer\acer vcm\rs_service.exe | 
"{E4C8EA79-A63C-4533-894C-07125B23E5E3}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqste08.exe | 
"{EF0249C1-BD71-4C50-B690-34A9B21BB0B9}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{EF71D745-E655-4156-9955-A74FBFC2082B}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\backupsvc.exe | 
"{F7D92ACC-3877-4C2B-8B30-8AAE1E69F244}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"TCP Query User{22BE0831-4714-449B-B657-3B1E6F29139E}C:\program files\sopcast\adv\sopadver.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | 
"TCP Query User{6CF9BF5A-E6BF-45B9-92CB-7B480A43D8AC}C:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe" = protocol=6 | dir=in | app=c:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe | 
"TCP Query User{6D7F1D27-305F-4D88-A159-3E96024FA7E4}C:\users\henni\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\henni\appdata\roaming\dropbox\bin\dropbox.exe | 
"TCP Query User{9EF3F505-B473-4C22-8372-A9715B40F7DA}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"TCP Query User{A5A4AA13-C4D6-43F6-BF92-85ADD28B5177}C:\program files\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\sopcast.exe | 
"TCP Query User{BE8FABD3-CC98-465C-9A47-8F03E7C8BA60}C:\program files\itunes\itunes.exe" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe | 
"TCP Query User{EAF06CBD-3764-4E3E-B18E-24ABB191D34A}C:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe" = protocol=6 | dir=in | app=c:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe | 
"UDP Query User{0D2BC406-9524-4A31-958A-D2911BE92D3D}C:\program files\itunes\itunes.exe" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe | 
"UDP Query User{25781395-F27D-410A-A7FE-04F096E4DF9D}C:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe" = protocol=17 | dir=in | app=c:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe | 
"UDP Query User{3747CD39-6239-4491-8EBB-2B4EFE60165D}C:\program files\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\sopcast.exe | 
"UDP Query User{B4D5580B-6F54-41E9-BEC5-48FA52E6C51A}C:\users\henni\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\henni\appdata\roaming\dropbox\bin\dropbox.exe | 
"UDP Query User{D7BE7D79-6171-466F-A94A-112912732FB3}C:\program files\sopcast\adv\sopadver.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | 
"UDP Query User{EBDEA50E-A6EB-4A13-9697-762E70328551}C:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe" = protocol=17 | dir=in | app=c:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe | 
"UDP Query User{FA141F20-B8FC-439D-BBFE-0AE4D75E5CC7}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{03D1988F-469F-4843-8E6E-E5FE9D17889D}" = WIDCOMM Bluetooth Software 6.0.1.6400
"{047F790A-7A2A-4B6A-AD02-38092BA63DAC}" = Acer VCM
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{06A1D88C-E102-4527-AF70-29FFD7AF215A}" = Scan
"{097CDB1E-07C9-40F1-9972-F0F9F3A287E4}" = Network
"{0AFFEA39-60AF-4C4F-BB47-4A1F7CB12129}" = HP Deskjet F4500 All-in-One Driver Software 14.0 Rel. 6
"{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now Standard
"{1458BB78-1DC5-4BC0-B9A3-2B644F5A8105}" = DeviceDiscovery
"{150B6201-E9E6-4DFB-960E-CCBD53FBDDED}" = HPProductAssistant
"{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2376AAB2-F4D9-48D7-A42B-4E80B8967A8B}" = F4500
"{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"{292F0F52-B62D-4E71-921B-89A682402201}" = Toolbox
"{2A697B53-0DE3-42DA-B41D-C3F804B1C538}" = iTunes
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{2DC94AFD-A6E2-4AB4-9132-4A3F8E07B386}" = Apple Application Support
"{2FB9EA69-51D4-4913-9AD5-762C034DE811}" = Status
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
"{332CC6BF-E6C7-48EE-BA3D-435E576AD67F}" = PaperPort Image Printer
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3DB0448D-AD82-4923-B305-D001E521A964}" = Acer PowerSmart Manager
"{4AB8B41B-3AF1-46BE-99B0-0ACD3B300C0A}" = Junk Mail filter update
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5A166C0B-9557-4364-A057-F946D674E6AC}" = Windows Live Mail
"{5B63A470-9334-44D1-AF61-6CE2DB565AE9}" = Orion
"{5DCF0E4B-F8EA-4229-A0BD-5CA6D4AFB749}" = SolutionCenter
"{60FFB3E0-6D5B-4D73-AE5B-07E58B83AF0C}" = 32 Bit HP CIO Components Installer
"{62F7DA7E-CCCB-439C-A760-00C3926E761F}" = Microsoft Works
"{63B9BAB5-F36A-4A3B-9E5C-68A7F212BFB9}" = TerraTec Home Cinema
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{68301905-2DEA-41CE-A4D4-E8B443B099BA}" = MyWinLocker
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6B96DADA-1A27-4A04-8CB2-CC45168D05FA}" = Windows Live Fotogalerie
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71C2828F-2678-4675-BDEC-895424861262}_is1" = C:\Program Files\Acer GameZone\GameConsole
"{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Backup Manager Basic
"{74DC0593-6BC6-4001-AD5F-D810AFB68D86}" = HP Update
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7EE873AF-46BB-4B5D-BA6F-CFE4B0566E22}" = TuneUp Utilities Language Pack (de-DE)
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{81821BF8-DA20-4F8C-AA87-F70A274828D4}" = Windows Live Writer
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110111700}" = Zuma Deluxe
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110184263}" = Puzzle Express
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11037623}" = Tradewinds 2
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111205743}" = Tri-Peaks Solitaire To Go
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111232687}" = Ocean Express
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111252743}" = Mahjong Escape Ancient China
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111307457}" = Galapago
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11170417}" = Luxor 2
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111771833}" = Jewel Quest Solitaire
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11219217}" = Cradle of Rome
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112270203}" = Dream Day Wedding
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113009953}" = Turbo Pizza
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113056167}" = Dream Day Honeymoon
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113297350}" = Cake Mania 2
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113494430}" = Wedding Dash
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11505173}" = Airport Mania First Flight
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115053100}" = Dairy Dash
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115443300}" = Cooking Dash
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11551977}" = Parking Dash
"{835686C5-8650-49EB-8CA0-4528B4035495}" = Windows Live Call
"{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}" = Windows Live Anmelde-Assistent
"{85498904-0748-45AA-9482-6DB8EA971B91}" = DJ_AIO_06_F4500_SW_MIN
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{87441A59-5E64-4096-A170-14EFE67200C3}" = Picture Control Utility
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8C1E2925-14F8-45AA-B999-1E2A74BF5607}" = Windows Live Sync
"{8D1E61D1-1395-4E97-997F-D002DB3A5074}" = OpenOffice.org 3.2
"{8EE94FD8-5F52-4463-A340-185D16328158}" = WebReg
"{8FF6F5CA-4E30-4E3B-B951-204CAAA2716A}" = SmartWebPrinting
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE466FF-70B7-4DA8-807C-DB4C3610FDAA}" = Copy
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A3FEC306-FBFF-4B0D-95B9-F9C67C65079E}" = Brother MFL-Pro Suite
"{A77255C4-AFCB-44A3-BF0F-2091A71FFD9E}" = Acer Crystal Eye Webcam
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC35A885-0F8F-4857-B7DA-6E8DFB43E6B3}" = HPSSupply
"{AC76BA86-7AD7-1031-7B44-A90000000001}" = Adobe Reader 9 - Deutsch
"{AE09C972-EEB2-4DA5-8090-0FCF54576854}" = Optical Drive Power Management
"{B014EE44-9197-4513-9613-71E6EB1B514E}" = Nikon Message Center 2
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B6C89654-A6A2-477C-873B-724EC1C56407}" = ScanSoft PaperPort 11
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BB3447F6-9553-4AA9-960E-0DB5310C5779}" = GPBaseService2
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support
"{CAE4213F-F797-439D-BD9E-79B71D115BE3}" = HPPhotoGadget
"{CD31E63D-47FD-491C-8117-CF201D0AFAB5}" = TrayApp
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D1E7142C-6BC3-49EB-A71A-E5D7ADAC7599}" = Nikon File Uploader 2
"{D360FA88-17C8-4F14-B67F-13AAF9607B12}" = MarketResearch
"{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}" = TuneUp Utilities
"{D9F4A9F8-92C5-4289-9D04-F0F8F02D580A}" = iPod for Windows 2005-10-12
"{DA20E1A8-07CB-4EE7-9B72-A7E28C953F0E}" = Acer Product Registration
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{DDD62492-32A7-412B-8AF1-2CF032AD42E3}" = ViewNX 2
"{DF5F687F-8018-4542-9F98-7084E9022917}" = Windows Live Essentials
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F69E83CF-B440-43F8-89E6-6EA80712109B}" = Windows Live Communications Platform
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FA0FF682-CC70-4C57-93CD-E276F3E7537E}" = BufferChm
"7-Zip" = 7-Zip 9.20
"Acer Screensaver" = Acer ScreenSaver
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"BabylonToolbar" = Babylon toolbar on IE
"Cinergy T-Stick MKII" = Cinergy T-Stick MKII V9.06.3.01
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"GridVista" = Acer GridVista
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"HP Imaging Device Functions" = HP Imaging Device Functions 14.0
"HP Smart Web Printing" = HP Smart Web Printing 4.60
"HP Solution Center & Imaging Support Tools" = HP Solution Center 14.0
"HPExtendedCapabilities" = HP Customer Participation Program 14.0
"I Want This" = I Want This
"InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now 5
"InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Acer Backup Manager
"InstallShield_{D9F4A9F8-92C5-4289-9D04-F0F8F02D580A}" = iPod for Windows 2005-10-12
"LManager" = Launch Manager
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox (3.6.28)" = Mozilla Firefox (3.6.28)
"Shop for HP Supplies" = Shop for HP Supplies
"SopCast" = SopCast 3.3.2
"Surf & E-Mail-Stick" = Surf & E-Mail-Stick
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TuneUp Utilities" = TuneUp Utilities
"Veetle TV" = Veetle TV 0.9.18
"WinLiveSuite_Wave3" = Windows Live Essentials
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Uncompressor" = Uncompressor
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 06.12.2011 13:46:42 | Computer Name = Henni-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 06.12.2011 13:47:43 | Computer Name = Henni-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 06.12.2011 15:51:15 | Computer Name = Henni-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 07.12.2011 10:37:31 | Computer Name = Henni-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 07.12.2011 10:37:31 | Computer Name = Henni-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 07.12.2011 10:38:40 | Computer Name = Henni-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 07.12.2011 11:06:19 | Computer Name = Henni-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 07.12.2011 17:24:39 | Computer Name = Henni-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung mDNSResponder.exe, Version 2.0.4.0, Zeitstempel
 0x4cae1be1, fehlerhaftes Modul mDNSResponder.exe, Version 2.0.4.0, Zeitstempel 
0x4cae1be1, Ausnahmecode 0xc0000005, Fehleroffset 0x0000110a,  Prozess-ID 0x770, Anwendungsstartzeit
 01ccb5269d668800.
 
Error - 07.12.2011 17:24:54 | Computer Name = Henni-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 07.12.2011 17:24:54 | Computer Name = Henni-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
[ System Events ]
Error - 02.04.2012 19:17:18 | Computer Name = Henni-PC | Source = Service Control Manager | ID = 7024
Description = 
 
Error - 03.04.2012 08:39:44 | Computer Name = Henni-PC | Source = iaStor | ID = 262153
Description = Das Gerät \Device\Ide\iaStor0 hat innerhalb der Fehlerwartezeit nicht
 geantwortet.
 
Error - 03.04.2012 09:01:21 | Computer Name = Henni-PC | Source = Service Control Manager | ID = 7024
Description = 
 
Error - 03.04.2012 13:12:01 | Computer Name = Henni-PC | Source = bowser | ID = 8003
Description = 
 
Error - 03.04.2012 15:37:49 | Computer Name = Henni-PC | Source = Service Control Manager | ID = 7024
Description = 
 
Error - 03.04.2012 16:57:24 | Computer Name = Henni-PC | Source = bowser | ID = 8003
Description = 
 
Error - 03.04.2012 17:17:31 | Computer Name = Henni-PC | Source = DCOM | ID = 10010
Description = 
 
Error - 03.04.2012 17:40:57 | Computer Name = Henni-PC | Source = iaStor | ID = 262153
Description = Das Gerät \Device\Ide\iaStor0 hat innerhalb der Fehlerwartezeit nicht
 geantwortet.
 
Error - 03.04.2012 18:00:59 | Computer Name = Henni-PC | Source = DCOM | ID = 10010
Description = 
 
Error - 04.04.2012 11:06:04 | Computer Name = Henni-PC | Source = Service Control Manager | ID = 7024
Description = 
 
 
< End of report >

--- --- ---

markusg · 04.04.2012, 17:00

hi

dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.

• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

[CODE]
:OTL
O4 - HKCU..\Run: [Upgrade] C:\Users\Henni\AppData\Roaming\Dropbox\{24730F59-148A-4E6E-8093-19582F366F12}\Upgrade.exe File not found
:Files
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

hewu · 04.04.2012, 17:06

OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 04.04.2012 17:57:47 - Run 2
OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\Henni\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,93 Gb Total Physical Memory | 1,88 Gb Available Physical Memory | 64,27% Memory free
6,06 Gb Paging File | 4,85 Gb Available in Paging File | 79,98% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455,99 Gb Total Space | 320,43 Gb Free Space | 70,27% Space Free | Partition Type: NTFS
 
Computer Name: HENNI-PC | User Name: Henni | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Henni\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Users\Henni\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe (TuneUp Software)
PRC - C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe (TuneUp Software)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Launch Manager\dsiwmis.exe (Dritek System Inc.)
PRC - C:\Programme\Acer\Optical Drive Power Management\ODDPWRSvc.exe (Acer Incorporated)
PRC - C:\Programme\Acer\Acer PowerSmart Manager\ePowerSvc.exe (Acer Incorporated)
PRC - C:\Programme\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (NewTech Infosystems, Inc.)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Programme\Acer\Acer VCM\RS_Service.exe (Acer Incorporated)
PRC - C:\Programme\EgisTec\MyWinLocker 3\x86\MWLService.exe (EgisTec Inc.)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Users\Henni\AppData\Local\Temp\wpbt0.dll ()
MOD - C:\Programme\Mozilla Firefox\js3250.dll ()
MOD - C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (odserv) -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (TuneUp.Defrag) -- C:\Programme\TuneUp Utilities 2010\TuneUpDefragService.exe (TuneUp Software)
SRV - (TuneUp.UtilitiesSvc) -- C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\Windows\System32\uxtuneup.dll (TuneUp Software)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (DsiWMIService) -- C:\Programme\Launch Manager\dsiwmis.exe (Dritek System Inc.)
SRV - (ODDPwrSvc) -- C:\Programme\Acer\Optical Drive Power Management\ODDPWRSvc.exe (Acer Incorporated)
SRV - (ePowerSvc) -- C:\Programme\Acer\Acer PowerSmart Manager\ePowerSvc.exe (Acer Incorporated)
SRV - (NTI IScheduleSvc) -- C:\Programme\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (NewTech Infosystems, Inc.)
SRV - (IAANTMON) Intel(R) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (RS_Service) -- C:\Programme\Acer\Acer VCM\RS_Service.exe (Acer Incorporated)
SRV - (MWLService) -- C:\Program Files\EgisTec\MyWinLocker 3\x86\\MWLService.exe ()
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found
DRV - (TuneUpUtilitiesDrv) -- C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys (TuneUp Software)
DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (AF15BDA) -- C:\Windows\System32\drivers\AF15BDA.sys (ITETech                  )
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (L1C) -- C:\Windows\System32\drivers\L1C60x86.sys (Atheros Communications, Inc.)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (mwlPSDVDisk) -- C:\Windows\System32\drivers\mwlPSDVDisk.sys (Egis Incorporated.)
DRV - (mwlPSDFilter) -- C:\Windows\System32\drivers\mwlPSDFilter.sys (Egis Incorporated.)
DRV - (mwlPSDNServ) -- C:\Windows\System32\drivers\mwlPSDNserv.sys (Egis Incorporated.)
DRV - (NETw5v32) Intel(R) -- C:\Windows\System32\drivers\NETw5v32.sys (Intel Corporation)
DRV - (IntcHdmiAddService) Intel(R) -- C:\Windows\System32\drivers\IntcHdmi.sys (Intel(R) Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = iGoogle Redirect
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = iGoogle Redirect
IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = iGoogle Redirect
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = Acer.com Worldwide - Select your local country or region [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = Acer.com Worldwide - Select your local country or region [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Babylon Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=109986&babsrc=SP_ss&mntrId=0e0e6d960000000000000022fb3d61b8
IE - HKCU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE337
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.startup.homepage: "hxxp://search.babylon.com/?affID=109986&babsrc=HP_ss&mntrId=0e0e6d960000000000000022fb3d61b8"
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..extensions.enabledItems: crossriderapp2258@crossrider.com:0.80.26
FF - prefs.js..extensions.enabledItems: ffxtlbr@babylon.com:1.2.0
FF - prefs.js..keyword.URL: "hxxp://search.babylon.com/?affID=109986&babsrc=KW_ss&mntrId=0e0e6d960000000000000022fb3d61b8&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8051.1204: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.09.25 13:49:32 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.28\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.03.21 20:26:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.28\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.03.21 20:26:33 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.09.25 13:49:32 | 000,000,000 | ---D | M]
 
[2010.03.10 16:04:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Henni\AppData\Roaming\mozilla\Extensions
[2012.04.04 07:35:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Henni\AppData\Roaming\mozilla\Firefox\Profiles\ls5kuqzb.default\extensions
[2010.07.04 13:28:30 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Henni\AppData\Roaming\mozilla\Firefox\Profiles\ls5kuqzb.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.07.21 20:44:22 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\Henni\AppData\Roaming\mozilla\Firefox\Profiles\ls5kuqzb.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2012.04.03 23:33:47 | 000,000,000 | ---D | M] ("I Want This") -- C:\Users\Henni\AppData\Roaming\mozilla\Firefox\Profiles\ls5kuqzb.default\extensions\crossriderapp2258@crossrider.com
[2012.04.03 23:33:51 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\Henni\AppData\Roaming\mozilla\Firefox\Profiles\ls5kuqzb.default\extensions\ffxtlbr@babylon.com
[2010.07.21 20:44:25 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.06.20 21:22:00 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010.06.20 21:22:00 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{AB2CE124-6272-4B12-94A9-7303C7397BD1}
[2011.09.15 17:16:45 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.04.03 23:33:45 | 000,002,313 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2011.09.15 17:16:45 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.09.15 17:16:45 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.09.15 17:16:45 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.09.15 17:16:45 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (I Want This) - {11111111-1111-1111-1111-110011221158} - C:\Programme\I Want This\I Want This.dll (215 Apps)
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (TerraTec Home Cinema) - {AD6E6555-FB2C-47D4-8339-3E2965509877} - C:\Programme\TerraTec\TerraTec Home Cinema\ThcDeskBand.dll (TerraTec Electronic GmbH)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [IAAnotif] C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [Nikon Message Center 2] C:\Program Files\Nikon\Nikon Message Center 2\NkMC2.exe (Nikon Corporation)
O4 - HKLM..\Run: [Skytel] C:\Programme\Realtek\Audio\HDA\SkyTel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Upgrade] C:\Users\Henni\AppData\Roaming\Dropbox\{24730F59-148A-4E6E-8093-19582F366F12}\Upgrade.exe File not found
O4 - Startup: C:\Users\Henni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Henni\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\Henni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx (WRC Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EBBD3128-A8FD-48A7-A09D-361622CA09D5}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Public\Pictures\Sample Pictures\Dock.jpg
O24 - Desktop BackupWallPaper: C:\Users\Public\Pictures\Sample Pictures\Dock.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{50b80cdf-0643-11e1-8ed7-0022fb3d61b8}\Shell - "" = AutoRun
O33 - MountPoints2\{50b80cdf-0643-11e1-8ed7-0022fb3d61b8}\Shell\AutoRun\command - "" = D:\AutoRun.exe
O33 - MountPoints2\D\Shell - "" = AutoRun
O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\AutoRun.exe
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\start.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.04.04 17:41:04 | 000,593,920 | ---- | C] (OldTimer Tools) -- C:\Users\Henni\Desktop\OTL.exe
[2012.04.03 23:39:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
[2012.04.03 23:38:59 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip
[2012.04.03 23:33:51 | 000,000,000 | ---D | C] -- C:\Program Files\BabylonToolbar
[2012.04.03 23:33:47 | 000,000,000 | ---D | C] -- C:\Users\Henni\AppData\Local\I Want This
[2012.04.03 23:33:44 | 000,000,000 | ---D | C] -- C:\Program Files\I Want This
[2012.04.03 23:33:43 | 000,000,000 | ---D | C] -- C:\Users\Henni\AppData\Local\Babylon
[2012.04.03 23:33:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon
[2012.04.03 23:33:42 | 000,000,000 | ---D | C] -- C:\Users\Henni\AppData\Roaming\Babylon
[2012.04.03 23:33:40 | 000,000,000 | ---D | C] -- C:\Users\Henni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Uncompressor
[2012.04.03 23:33:40 | 000,000,000 | ---D | C] -- C:\Program Files\Uncompressor
[2012.04.03 23:17:48 | 000,607,260 | R--- | C] (Swearware) -- C:\Users\Henni\Desktop\dds.com
[2012.03.14 13:47:42 | 002,044,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012.03.14 13:47:41 | 001,172,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll
[2012.03.14 13:47:41 | 001,068,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll
[2012.03.14 13:47:41 | 000,683,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll
[2012.03.14 13:47:41 | 000,219,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll
[2012.03.14 13:47:41 | 000,160,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll
[2012.03.14 13:47:04 | 000,613,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpencom.dll
[2012.03.05 22:48:07 | 000,000,000 | ---D | C] -- C:\Users\Henni\AppData\Roaming\Help
[2012.03.05 22:44:01 | 000,000,000 | ---D | C] -- C:\Users\Henni\AppData\Roaming\TeamViewer
 
========== Files - Modified Within 30 Days ==========
 
[2012.04.04 17:57:26 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\Henni\Desktop\OTL.exe
[2012.04.04 17:34:09 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.04.04 17:32:44 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.04.04 17:19:15 | 000,644,136 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.04.04 17:19:15 | 000,598,554 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.04.04 17:19:15 | 000,131,388 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.04.04 17:19:15 | 000,106,436 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.04.04 17:13:57 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.04.04 17:13:56 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.04.04 17:12:55 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.04.04 17:12:09 | 3145,523,200 | -HS- | M] () -- C:\hiberfil.sys
[2012.04.04 17:10:05 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2012.04.03 23:57:43 | 000,007,765 | ---- | M] () -- C:\Users\Henni\Desktop\Desktop.zip
[2012.04.03 23:56:23 | 000,006,979 | ---- | M] () -- C:\Users\Henni\Desktop\Desktop.7z
[2012.04.03 23:38:13 | 001,110,476 | ---- | M] () -- C:\Users\Henni\Desktop\7z920.exe
[2012.04.03 23:33:53 | 000,000,237 | ---- | M] () -- C:\user.js
[2012.04.03 23:33:40 | 000,000,858 | ---- | M] () -- C:\Users\Henni\Desktop\Uncompressor.lnk
[2012.04.03 23:31:29 | 000,560,648 | ---- | M] () -- C:\Users\Henni\Desktop\ADLSoft_UnCompressor.exe
[2012.04.03 23:17:49 | 000,607,260 | R--- | M] (Swearware) -- C:\Users\Henni\Desktop\dds.com
[2012.04.03 23:14:21 | 000,000,000 | ---- | M] () -- C:\Users\Henni\defogger_reenable
[2012.04.03 21:33:20 | 000,000,870 | ---- | M] () -- C:\Users\Henni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpbt0.dll.lnk
[2012.03.30 15:00:36 | 000,025,471 | ---- | M] () -- C:\Users\Henni\Desktop\AC-Protokoll 15.odt
[2012.03.29 17:36:12 | 000,114,882 | ---- | M] () -- C:\Users\Henni\Documents\Matheübung7 (2).ods
[2012.03.29 17:25:37 | 000,063,270 | ---- | M] () -- C:\Users\Henni\Documents\Matheübung7.ods
[2012.03.29 16:38:01 | 000,074,819 | ---- | M] () -- C:\Users\Henni\Documents\Übungsklausur 2.ods
[2012.03.29 16:36:07 | 000,495,771 | ---- | M] () -- C:\Users\Henni\Documents\Übungsklausur.ods
[2012.03.29 13:50:06 | 000,041,994 | ---- | M] () -- C:\Users\Henni\Documents\Matheübung11.1.ods
[2012.03.29 13:04:19 | 000,066,221 | ---- | M] () -- C:\Users\Henni\Documents\Matheübung 10.1.ods
[2012.03.28 14:31:40 | 000,045,328 | ---- | M] () -- C:\Users\Henni\Documents\Matheübung 9.1.ods
[2012.03.27 17:57:08 | 000,027,528 | ---- | M] () -- C:\Users\Henni\Documents\Matheübung6.ods
[2012.03.27 17:38:01 | 000,025,113 | ---- | M] () -- C:\Users\Henni\Desktop\AC-Protokoll 11.odt
[2012.03.27 17:10:33 | 000,069,757 | ---- | M] () -- C:\Users\Henni\Documents\Matheübung 5.ods
[2012.03.27 16:01:32 | 000,023,080 | ---- | M] () -- C:\Users\Henni\Documents\Matheübung4.ods
[2012.03.27 16:00:36 | 000,032,673 | ---- | M] () -- C:\Users\Henni\Documents\Matheübung3.ods
[2012.03.27 16:00:11 | 000,029,106 | ---- | M] () -- C:\Users\Henni\Documents\Matheübung3,1.ods
[2012.03.27 14:49:02 | 000,014,969 | ---- | M] () -- C:\Users\Henni\Documents\Matheübung 2.ods
[2012.03.27 14:31:21 | 000,068,043 | ---- | M] () -- C:\Users\Henni\Documents\Mathe übung 1.ods
[2012.03.25 20:14:44 | 000,022,723 | ---- | M] () -- C:\Users\Henni\Desktop\AC-Protokoll 6.odt
[2012.03.16 15:33:20 | 000,320,504 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
 
========== Files Created - No Company Name ==========
 
[2012.04.04 17:12:09 | 3145,523,200 | -HS- | C] () -- C:\hiberfil.sys
[2012.04.03 23:57:43 | 000,007,765 | ---- | C] () -- C:\Users\Henni\Desktop\Desktop.zip
[2012.04.03 23:41:11 | 000,006,979 | ---- | C] () -- C:\Users\Henni\Desktop\Desktop.7z
[2012.04.03 23:38:11 | 001,110,476 | ---- | C] () -- C:\Users\Henni\Desktop\7z920.exe
[2012.04.03 23:33:52 | 000,000,237 | ---- | C] () -- C:\user.js
[2012.04.03 23:33:40 | 000,000,858 | ---- | C] () -- C:\Users\Henni\Desktop\Uncompressor.lnk
[2012.04.03 23:31:28 | 000,560,648 | ---- | C] () -- C:\Users\Henni\Desktop\ADLSoft_UnCompressor.exe
[2012.04.03 23:14:21 | 000,000,000 | ---- | C] () -- C:\Users\Henni\defogger_reenable
[2012.04.03 21:33:20 | 000,000,870 | ---- | C] () -- C:\Users\Henni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpbt0.dll.lnk
[2012.03.29 13:50:05 | 000,041,994 | ---- | C] () -- C:\Users\Henni\Documents\Matheübung11.1.ods
[2012.03.29 12:32:42 | 000,066,221 | ---- | C] () -- C:\Users\Henni\Documents\Matheübung 10.1.ods
[2012.03.28 14:09:56 | 000,045,328 | ---- | C] () -- C:\Users\Henni\Documents\Matheübung 9.1.ods
[2012.03.27 16:19:19 | 000,069,757 | ---- | C] () -- C:\Users\Henni\Documents\Matheübung 5.ods
[2012.03.27 16:01:31 | 000,023,080 | ---- | C] () -- C:\Users\Henni\Documents\Matheübung4.ods
[2012.03.27 15:38:04 | 000,029,106 | ---- | C] () -- C:\Users\Henni\Documents\Matheübung3,1.ods
[2012.03.27 14:49:28 | 000,032,673 | ---- | C] () -- C:\Users\Henni\Documents\Matheübung3.ods
[2012.03.27 14:49:01 | 000,014,969 | ---- | C] () -- C:\Users\Henni\Documents\Matheübung 2.ods
[2012.03.25 20:16:05 | 000,025,471 | ---- | C] () -- C:\Users\Henni\Desktop\AC-Protokoll 15.odt
[2012.03.18 18:44:47 | 000,495,771 | ---- | C] () -- C:\Users\Henni\Documents\Übungsklausur.ods
[2012.03.18 18:44:47 | 000,114,882 | ---- | C] () -- C:\Users\Henni\Documents\Matheübung7 (2).ods
[2012.03.18 18:44:47 | 000,074,819 | ---- | C] () -- C:\Users\Henni\Documents\Übungsklausur 2.ods
[2012.03.18 18:44:47 | 000,068,043 | ---- | C] () -- C:\Users\Henni\Documents\Mathe übung 1.ods
[2012.03.18 18:44:47 | 000,063,270 | ---- | C] () -- C:\Users\Henni\Documents\Matheübung7.ods
[2012.03.18 18:44:47 | 000,048,173 | ---- | C] () -- C:\Users\Henni\Documents\Übungsaufgabe 9.ots
[2012.03.18 18:44:47 | 000,046,926 | ---- | C] () -- C:\Users\Henni\Documents\Matheübung8.ods
[2012.03.18 18:44:47 | 000,041,875 | ---- | C] () -- C:\Users\Henni\Documents\Übungsaufgabe 10.ots
[2012.03.18 18:44:47 | 000,031,023 | ---- | C] () -- C:\Users\Henni\Documents\Übungsaufgabe 11.ots
[2012.03.18 18:44:47 | 000,028,815 | ---- | C] () -- C:\Users\Henni\Documents\Übung 11.ods
[2012.03.18 18:44:47 | 000,027,528 | ---- | C] () -- C:\Users\Henni\Documents\Matheübung6.ods
[2012.03.18 18:40:52 | 000,025,113 | ---- | C] () -- C:\Users\Henni\Desktop\AC-Protokoll 11.odt
[2012.03.12 17:45:03 | 000,022,723 | ---- | C] () -- C:\Users\Henni\Desktop\AC-Protokoll 6.odt
[2011.11.21 22:33:05 | 000,400,691 | ---- | C] () -- C:\Users\Henni\AppData\Local\Genetik vortrag.pdf
[2011.11.21 22:31:22 | 000,436,930 | ---- | C] () -- C:\Users\Henni\AppData\Local\Genetik vortrag.odp
[2011.11.04 14:02:06 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Definition Bundle
[2011.11.04 14:02:06 | 000,000,268 | RH-- | C] () -- C:\Users\Henni\AppData\Roaming\CustomDataViews
[2011.11.04 14:02:06 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLev.DAT
[2011.11.04 14:02:06 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Drums
[2011.11.04 14:02:05 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Database
[2011.11.04 14:02:05 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Dance Kit
[2011.11.04 14:02:05 | 000,000,268 | RH-- | C] () -- C:\Users\Henni\AppData\Roaming\Core Data Application
[2011.11.04 14:02:05 | 000,000,268 | RH-- | C] () -- C:\Users\Henni\AppData\Roaming\Contextual Menu Items
[2011.11.04 14:02:05 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLet.DAT
[2011.11.04 14:02:05 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLes.DAT
[2011.11.04 14:02:05 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Documents
[2011.11.04 14:02:05 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Distortion
[2010.09.25 13:40:53 | 000,230,166 | ---- | C] () -- C:\Windows\hpoins46.dat
[2010.08.25 20:30:02 | 000,439,308 | ---- | C] () -- C:\Windows\System32\igcompkrng500.bin
[2010.08.25 20:30:00 | 000,982,240 | ---- | C] () -- C:\Windows\System32\igkrng500.bin
[2010.08.25 20:30:00 | 000,092,356 | ---- | C] () -- C:\Windows\System32\igfcg500m.bin
[2010.08.25 19:59:08 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll
[2010.08.25 19:57:00 | 000,000,151 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config
[2010.08.25 19:52:00 | 000,208,896 | ---- | C] () -- C:\Windows\System32\iglhsip32.dll
[2010.08.25 19:52:00 | 000,143,360 | ---- | C] () -- C:\Windows\System32\iglhcp32.dll
[2010.06.20 21:24:57 | 000,000,048 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.05.06 14:04:53 | 000,000,560 | ---- | C] () -- C:\Users\Henni\AppData\Roaming\wklnhst.dat
 
========== LOP Check ==========
 
[2009.04.08 20:21:40 | 000,000,000 | ---D | M] -- C:\Users\Henni\AppData\Roaming\Acer GameZone Console
[2012.04.03 23:33:42 | 000,000,000 | ---D | M] -- C:\Users\Henni\AppData\Roaming\Babylon
[2012.04.04 17:13:48 | 000,000,000 | ---D | M] -- C:\Users\Henni\AppData\Roaming\Dropbox
[2011.11.04 14:12:04 | 000,000,000 | ---D | M] -- C:\Users\Henni\AppData\Roaming\Nikon
[2010.11.02 12:36:38 | 000,000,000 | ---D | M] -- C:\Users\Henni\AppData\Roaming\OpenOffice.org
[2009.10.25 13:20:39 | 000,000,000 | ---D | M] -- C:\Users\Henni\AppData\Roaming\ScanSoft
[2012.03.05 22:44:01 | 000,000,000 | ---D | M] -- C:\Users\Henni\AppData\Roaming\TeamViewer
[2010.05.06 14:37:15 | 000,000,000 | ---D | M] -- C:\Users\Henni\AppData\Roaming\Template
[2011.07.03 18:37:30 | 000,000,000 | ---D | M] -- C:\Users\Henni\AppData\Roaming\TerraTec
[2010.07.21 19:54:14 | 000,000,000 | ---D | M] -- C:\Users\Henni\AppData\Roaming\TuneUp Software
[2012.04.04 17:10:05 | 000,032,586 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >

--- --- ---
OTL Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 04.04.2012 17:57:47 - Run 2
OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\Henni\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,93 Gb Total Physical Memory | 1,88 Gb Available Physical Memory | 64,27% Memory free
6,06 Gb Paging File | 4,85 Gb Available in Paging File | 79,98% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455,99 Gb Total Space | 320,43 Gb Free Space | 70,27% Space Free | Partition Type: NTFS
 
Computer Name: HENNI-PC | User Name: Henni | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~3\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1EE6F855-478D-4BC1-9700-0CDF42377CE8}" = lport=445 | protocol=6 | dir=in | app=system | 
"{1FF870A8-CBBD-439A-9619-A4A7789350E9}" = lport=137 | protocol=17 | dir=in | app=system | 
"{2C5FA19D-1A7F-46C7-9233-FADA78453C49}" = rport=139 | protocol=6 | dir=out | app=system | 
"{3183DC0D-3AAD-4CEA-9667-63874A416782}" = lport=139 | protocol=6 | dir=in | app=system | 
"{32AC4EBE-4921-4E51-86F9-54CCB508831C}" = lport=138 | protocol=17 | dir=in | app=system | 
"{44EAD10F-DE1B-4353-8EF2-54DD09D8DDC0}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{58C6E89D-A0E5-4C07-BD8D-53040F1EE062}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{8A1DADF3-96D0-4505-A7DE-C8E137A6B945}" = rport=445 | protocol=6 | dir=out | app=system | 
"{CACA05BC-0732-4E7E-9A4A-8322D83E5094}" = rport=138 | protocol=17 | dir=out | app=system | 
"{EE456E5F-DFC1-4E76-8F28-D7D6D4298AF0}" = rport=137 | protocol=17 | dir=out | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{06AC56F8-D6CA-4556-93FB-C3FDC9D619B8}" = protocol=6 | dir=in | app=c:\program files\terratec\terratec home cinema\cinergydvr.exe | 
"{0DC6E385-BA07-4AA3-B8CA-AED76642D0B8}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{11257F36-E3B8-45A9-AC81-34E23FC4444C}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgpc01.exe | 
"{1213B9CB-AA9E-4520-AA8C-0410E4EB3401}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\schedulersvc.exe | 
"{172B75C8-1920-4C5D-BDB0-9F43FE08AB86}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{1C0C3D0A-86F7-43EE-9689-693FEF231110}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe | 
"{2563E0C9-6F24-47BE-A4D3-9C6F15E8C464}" = protocol=17 | dir=in | app=c:\program files\terratec\terratec home cinema\tvtvsetup\tvtv_wizard.exe | 
"{26E17B6C-5EC4-45BA-BFEF-DA5934148146}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{2AA2CD78-C714-4878-BCD5-EDE5948CF13C}" = dir=in | app=c:\program files\cyberlink\powerdvd\powerdvd.exe | 
"{2D29E058-87EE-481B-A13F-CCF8F6589714}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgplgtupl.exe | 
"{2DCB8C26-A974-4599-9EE4-81A981F99CC0}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe | 
"{357BD2C4-A961-4E37-A38F-B1C05903B622}" = dir=in | app=c:\program files\hp\digital imaging\bin\hposid01.exe | 
"{3AB24AAA-49D8-4790-9134-98417746E747}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqcopy2.exe | 
"{3DAC0E72-436A-4404-BED5-CF2C7D341547}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{3FAD6E5C-C8B8-46B8-B817-E93EB4BBAD9F}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\backupsvc.exe | 
"{4955F302-8CD6-488B-B1F2-E020D7B1D920}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{54F3CBF4-FDE0-432A-81A7-D80AE76DD03E}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqtra08.exe | 
"{57BF3B60-8391-4A9B-8AB3-EBC2D065EBF6}" = dir=in | app=c:\program files\acer\acer vcm\vc.exe | 
"{57F70972-813E-4EB0-A48D-0414D2B537C5}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpfccopy.exe | 
"{58E6D034-2002-4D63-968B-41E585AAC97E}" = protocol=6 | dir=in | app=c:\users\henni\appdata\roaming\dropbox\bin\dropbox.exe | 
"{6431F151-3429-44E3-9318-4F6ADE30090B}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqkygrp.exe | 
"{661D9833-DE3C-48CE-81A9-2C86369E569E}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{6629C92B-7CF8-4880-8608-9A7C9384BABB}" = protocol=17 | dir=in | app=c:\program files\terratec\terratec home cinema\cinergydvr.exe | 
"{82C31A43-AD14-4A76-9AEB-08F18A59E0D3}" = protocol=6 | dir=in | app=c:\program files\terratec\terratec home cinema\tvtvsetup\tvtv_wizard.exe | 
"{88AB9911-382F-4474-AD32-11D5EE32A8EC}" = protocol=6 | dir=in | app=c:\program files\terratec\terratec home cinema\insttool.exe | 
"{8B452A8A-B927-4A34-858D-3E322EF3E989}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{8C5E83C7-F549-41D6-9D3C-9C4F63CCF558}" = protocol=17 | dir=in | app=c:\program files\terratec\terratec home cinema\insttool.exe | 
"{96D4DE68-F65E-40AC-BECC-4943A02FC757}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{A076B43D-9A6E-431A-AF18-655623892043}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{A0BB84B4-A828-4DC5-82D9-13A0687D8E92}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpoews01.exe | 
"{A62779BA-E25D-4152-86CA-A5EBE94E322F}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe | 
"{ABB27922-C568-4640-B30A-5C768643FF5F}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe | 
"{AE42203B-94F8-4A94-8AC4-A4F96A3F70B0}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\schedulersvc.exe | 
"{BCB591CC-09DE-4151-8C84-15BB4707E3F8}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpiscnapp.exe | 
"{C04FC2F2-05BF-4BEC-995A-2B5D27CB7E06}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgm.exe | 
"{DAE47B87-9A55-4A92-9719-4D940E7157C7}" = protocol=17 | dir=in | app=c:\users\henni\appdata\roaming\dropbox\bin\dropbox.exe | 
"{E384990D-3785-4058-B6DE-7197150551B3}" = dir=in | app=c:\program files\acer\acer vcm\rs_service.exe | 
"{E4C8EA79-A63C-4533-894C-07125B23E5E3}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqste08.exe | 
"{EF0249C1-BD71-4C50-B690-34A9B21BB0B9}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{EF71D745-E655-4156-9955-A74FBFC2082B}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\backupsvc.exe | 
"{F7D92ACC-3877-4C2B-8B30-8AAE1E69F244}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"TCP Query User{22BE0831-4714-449B-B657-3B1E6F29139E}C:\program files\sopcast\adv\sopadver.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | 
"TCP Query User{6CF9BF5A-E6BF-45B9-92CB-7B480A43D8AC}C:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe" = protocol=6 | dir=in | app=c:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe | 
"TCP Query User{6D7F1D27-305F-4D88-A159-3E96024FA7E4}C:\users\henni\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\henni\appdata\roaming\dropbox\bin\dropbox.exe | 
"TCP Query User{9EF3F505-B473-4C22-8372-A9715B40F7DA}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"TCP Query User{A5A4AA13-C4D6-43F6-BF92-85ADD28B5177}C:\program files\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\sopcast.exe | 
"TCP Query User{BE8FABD3-CC98-465C-9A47-8F03E7C8BA60}C:\program files\itunes\itunes.exe" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe | 
"TCP Query User{EAF06CBD-3764-4E3E-B18E-24ABB191D34A}C:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe" = protocol=6 | dir=in | app=c:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe | 
"UDP Query User{0D2BC406-9524-4A31-958A-D2911BE92D3D}C:\program files\itunes\itunes.exe" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe | 
"UDP Query User{25781395-F27D-410A-A7FE-04F096E4DF9D}C:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe" = protocol=17 | dir=in | app=c:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe | 
"UDP Query User{3747CD39-6239-4491-8EBB-2B4EFE60165D}C:\program files\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\sopcast.exe | 
"UDP Query User{B4D5580B-6F54-41E9-BEC5-48FA52E6C51A}C:\users\henni\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\henni\appdata\roaming\dropbox\bin\dropbox.exe | 
"UDP Query User{D7BE7D79-6171-466F-A94A-112912732FB3}C:\program files\sopcast\adv\sopadver.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | 
"UDP Query User{EBDEA50E-A6EB-4A13-9697-762E70328551}C:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe" = protocol=17 | dir=in | app=c:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe | 
"UDP Query User{FA141F20-B8FC-439D-BBFE-0AE4D75E5CC7}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{03D1988F-469F-4843-8E6E-E5FE9D17889D}" = WIDCOMM Bluetooth Software 6.0.1.6400
"{047F790A-7A2A-4B6A-AD02-38092BA63DAC}" = Acer VCM
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{06A1D88C-E102-4527-AF70-29FFD7AF215A}" = Scan
"{097CDB1E-07C9-40F1-9972-F0F9F3A287E4}" = Network
"{0AFFEA39-60AF-4C4F-BB47-4A1F7CB12129}" = HP Deskjet F4500 All-in-One Driver Software 14.0 Rel. 6
"{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now Standard
"{1458BB78-1DC5-4BC0-B9A3-2B644F5A8105}" = DeviceDiscovery
"{150B6201-E9E6-4DFB-960E-CCBD53FBDDED}" = HPProductAssistant
"{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2376AAB2-F4D9-48D7-A42B-4E80B8967A8B}" = F4500
"{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"{292F0F52-B62D-4E71-921B-89A682402201}" = Toolbox
"{2A697B53-0DE3-42DA-B41D-C3F804B1C538}" = iTunes
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{2DC94AFD-A6E2-4AB4-9132-4A3F8E07B386}" = Apple Application Support
"{2FB9EA69-51D4-4913-9AD5-762C034DE811}" = Status
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
"{332CC6BF-E6C7-48EE-BA3D-435E576AD67F}" = PaperPort Image Printer
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3DB0448D-AD82-4923-B305-D001E521A964}" = Acer PowerSmart Manager
"{4AB8B41B-3AF1-46BE-99B0-0ACD3B300C0A}" = Junk Mail filter update
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5A166C0B-9557-4364-A057-F946D674E6AC}" = Windows Live Mail
"{5B63A470-9334-44D1-AF61-6CE2DB565AE9}" = Orion
"{5DCF0E4B-F8EA-4229-A0BD-5CA6D4AFB749}" = SolutionCenter
"{60FFB3E0-6D5B-4D73-AE5B-07E58B83AF0C}" = 32 Bit HP CIO Components Installer
"{62F7DA7E-CCCB-439C-A760-00C3926E761F}" = Microsoft Works
"{63B9BAB5-F36A-4A3B-9E5C-68A7F212BFB9}" = TerraTec Home Cinema
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{68301905-2DEA-41CE-A4D4-E8B443B099BA}" = MyWinLocker
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6B96DADA-1A27-4A04-8CB2-CC45168D05FA}" = Windows Live Fotogalerie
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71C2828F-2678-4675-BDEC-895424861262}_is1" = C:\Program Files\Acer GameZone\GameConsole
"{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Backup Manager Basic
"{74DC0593-6BC6-4001-AD5F-D810AFB68D86}" = HP Update
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7EE873AF-46BB-4B5D-BA6F-CFE4B0566E22}" = TuneUp Utilities Language Pack (de-DE)
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{81821BF8-DA20-4F8C-AA87-F70A274828D4}" = Windows Live Writer
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110111700}" = Zuma Deluxe
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110184263}" = Puzzle Express
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11037623}" = Tradewinds 2
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111205743}" = Tri-Peaks Solitaire To Go
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111232687}" = Ocean Express
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111252743}" = Mahjong Escape Ancient China
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111307457}" = Galapago
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11170417}" = Luxor 2
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111771833}" = Jewel Quest Solitaire
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11219217}" = Cradle of Rome
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112270203}" = Dream Day Wedding
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113009953}" = Turbo Pizza
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113056167}" = Dream Day Honeymoon
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113297350}" = Cake Mania 2
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113494430}" = Wedding Dash
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11505173}" = Airport Mania First Flight
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115053100}" = Dairy Dash
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115443300}" = Cooking Dash
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11551977}" = Parking Dash
"{835686C5-8650-49EB-8CA0-4528B4035495}" = Windows Live Call
"{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}" = Windows Live Anmelde-Assistent
"{85498904-0748-45AA-9482-6DB8EA971B91}" = DJ_AIO_06_F4500_SW_MIN
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{87441A59-5E64-4096-A170-14EFE67200C3}" = Picture Control Utility
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8C1E2925-14F8-45AA-B999-1E2A74BF5607}" = Windows Live Sync
"{8D1E61D1-1395-4E97-997F-D002DB3A5074}" = OpenOffice.org 3.2
"{8EE94FD8-5F52-4463-A340-185D16328158}" = WebReg
"{8FF6F5CA-4E30-4E3B-B951-204CAAA2716A}" = SmartWebPrinting
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE466FF-70B7-4DA8-807C-DB4C3610FDAA}" = Copy
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A3FEC306-FBFF-4B0D-95B9-F9C67C65079E}" = Brother MFL-Pro Suite
"{A77255C4-AFCB-44A3-BF0F-2091A71FFD9E}" = Acer Crystal Eye Webcam
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC35A885-0F8F-4857-B7DA-6E8DFB43E6B3}" = HPSSupply
"{AC76BA86-7AD7-1031-7B44-A90000000001}" = Adobe Reader 9 - Deutsch
"{AE09C972-EEB2-4DA5-8090-0FCF54576854}" = Optical Drive Power Management
"{B014EE44-9197-4513-9613-71E6EB1B514E}" = Nikon Message Center 2
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B6C89654-A6A2-477C-873B-724EC1C56407}" = ScanSoft PaperPort 11
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BB3447F6-9553-4AA9-960E-0DB5310C5779}" = GPBaseService2
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support
"{CAE4213F-F797-439D-BD9E-79B71D115BE3}" = HPPhotoGadget
"{CD31E63D-47FD-491C-8117-CF201D0AFAB5}" = TrayApp
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D1E7142C-6BC3-49EB-A71A-E5D7ADAC7599}" = Nikon File Uploader 2
"{D360FA88-17C8-4F14-B67F-13AAF9607B12}" = MarketResearch
"{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}" = TuneUp Utilities
"{D9F4A9F8-92C5-4289-9D04-F0F8F02D580A}" = iPod for Windows 2005-10-12
"{DA20E1A8-07CB-4EE7-9B72-A7E28C953F0E}" = Acer Product Registration
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{DDD62492-32A7-412B-8AF1-2CF032AD42E3}" = ViewNX 2
"{DF5F687F-8018-4542-9F98-7084E9022917}" = Windows Live Essentials
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F69E83CF-B440-43F8-89E6-6EA80712109B}" = Windows Live Communications Platform
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FA0FF682-CC70-4C57-93CD-E276F3E7537E}" = BufferChm
"7-Zip" = 7-Zip 9.20
"Acer Screensaver" = Acer ScreenSaver
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"BabylonToolbar" = Babylon toolbar on IE
"Cinergy T-Stick MKII" = Cinergy T-Stick MKII V9.06.3.01
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"GridVista" = Acer GridVista
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"HP Imaging Device Functions" = HP Imaging Device Functions 14.0
"HP Smart Web Printing" = HP Smart Web Printing 4.60
"HP Solution Center & Imaging Support Tools" = HP Solution Center 14.0
"HPExtendedCapabilities" = HP Customer Participation Program 14.0
"I Want This" = I Want This
"InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now 5
"InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Acer Backup Manager
"InstallShield_{D9F4A9F8-92C5-4289-9D04-F0F8F02D580A}" = iPod for Windows 2005-10-12
"LManager" = Launch Manager
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox (3.6.28)" = Mozilla Firefox (3.6.28)
"Shop for HP Supplies" = Shop for HP Supplies
"SopCast" = SopCast 3.3.2
"Surf & E-Mail-Stick" = Surf & E-Mail-Stick
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TuneUp Utilities" = TuneUp Utilities
"Veetle TV" = Veetle TV 0.9.18
"WinLiveSuite_Wave3" = Windows Live Essentials
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Uncompressor" = Uncompressor
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 06.12.2011 13:46:42 | Computer Name = Henni-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 06.12.2011 13:47:43 | Computer Name = Henni-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 06.12.2011 15:51:15 | Computer Name = Henni-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 07.12.2011 10:37:31 | Computer Name = Henni-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 07.12.2011 10:37:31 | Computer Name = Henni-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 07.12.2011 10:38:40 | Computer Name = Henni-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 07.12.2011 11:06:19 | Computer Name = Henni-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 07.12.2011 17:24:39 | Computer Name = Henni-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung mDNSResponder.exe, Version 2.0.4.0, Zeitstempel
 0x4cae1be1, fehlerhaftes Modul mDNSResponder.exe, Version 2.0.4.0, Zeitstempel 
0x4cae1be1, Ausnahmecode 0xc0000005, Fehleroffset 0x0000110a,  Prozess-ID 0x770, Anwendungsstartzeit
 01ccb5269d668800.
 
Error - 07.12.2011 17:24:54 | Computer Name = Henni-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 07.12.2011 17:24:54 | Computer Name = Henni-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
[ System Events ]
Error - 02.04.2012 19:17:18 | Computer Name = Henni-PC | Source = Service Control Manager | ID = 7024
Description = 
 
Error - 03.04.2012 08:39:44 | Computer Name = Henni-PC | Source = iaStor | ID = 262153
Description = Das Gerät \Device\Ide\iaStor0 hat innerhalb der Fehlerwartezeit nicht
 geantwortet.
 
Error - 03.04.2012 09:01:21 | Computer Name = Henni-PC | Source = Service Control Manager | ID = 7024
Description = 
 
Error - 03.04.2012 13:12:01 | Computer Name = Henni-PC | Source = bowser | ID = 8003
Description = 
 
Error - 03.04.2012 15:37:49 | Computer Name = Henni-PC | Source = Service Control Manager | ID = 7024
Description = 
 
Error - 03.04.2012 16:57:24 | Computer Name = Henni-PC | Source = bowser | ID = 8003
Description = 
 
Error - 03.04.2012 17:17:31 | Computer Name = Henni-PC | Source = DCOM | ID = 10010
Description = 
 
Error - 03.04.2012 17:40:57 | Computer Name = Henni-PC | Source = iaStor | ID = 262153
Description = Das Gerät \Device\Ide\iaStor0 hat innerhalb der Fehlerwartezeit nicht
 geantwortet.
 
Error - 03.04.2012 18:00:59 | Computer Name = Henni-PC | Source = DCOM | ID = 10010
Description = 
 
Error - 04.04.2012 11:06:04 | Computer Name = Henni-PC | Source = Service Control Manager | ID = 7024
Description = 
 
 
< End of report >

--- --- ---

markusg · 04.04.2012, 17:07

kannst du wieder mit internet verbindung im normalen modus arbeiten?

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

hewu · 04.04.2012, 17:24

Soweit alles klar, aber wenn ich das beides kopiere und hier bei Antworten posten will, läd es ganz lange bis zur Hälfte und dann geht nix mehr. Also ich bekomme es nicht in meine threat hinein. Was tun?
Noch etwas:Seid diesem Virus, habe ich im Sicherheitsmodus zwar Internet, aber es ist so eine komische Form von Mozilla, die sich Babylon nennt. Muss ich mir da sorgen machen, oder ist das in Ordnung?

markusg · 05.04.2012, 13:46

ich hab ja gefragt, ob du wieder in den normalen modus kommst?
und was meinst du, mit du bekommst beides nicht kopiert? ist doch nur ein log was combofix erstellt.
evtl. ists zu groß, dann aufteilen

Bundespolizei Trojaner 100 euro

Plagegeister aller Art und deren Bekämpfung: Bundespolizei Trojaner 100 euro