hallo, ich habe das problem das ich meine daten nicht entschlüßelt bekomme. hatte den trojaner drauf wo nach dem start des rechners windowos gespert war. habe dann im gesichertem modus gestartet und mit sys-wiederherstellung den rechner ans laufen gebracht. mußte aber feststellen das alle dateien von mir (bilder, musik vidios) verschlüßelt sind. wie bekomme ich die wieder frei??? habe schon die hier angegebenen tool versucht. nix geht. ich bin echt nur anwender und wie man bestimmt aus der schreibweise erkennen kann habe ich keinerlei ahnung was ich tun soll. bitte helft mir.....

hier mal das ergebnis
Malwarebytes Anti-Malware (Test) 1.62.0.1300
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: v2012.07.14.03

Windows 7 x86 NTFS
Internet Explorer 8.0.7600.16385
1_Sascha :: SASCHAHP [Administrator]

Schutz: Deaktiviert

14.07.2012 12:43:59
mbam-log-2012-07-14 (12-43-59).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 342369
Laufzeit: 45 Minute(n), 40 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 1
HKCR\.fsharproj (Trojan.BHO) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 4
C:\Windows\System32\020000008bfe8d1a1111C.manifest (Malware.Trace) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\System32\020000008bfe8d1a1111O.manifest (Malware.Trace) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\System32\020000008bfe8d1a1111P.manifest (Malware.Trace) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\System32\020000008bfe8d1a1111S.manifest (Malware.Trace) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

hi
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

• Starte bitte die
  OTL.exe
  .
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Kopiere nun den Inhalt in die
  Textbox.

activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
         

• Schliesse bitte nun alle Programme. (Wichtig)
• Klicke nun bitte auf den Quick Scan Button.
• Kopiere
  nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

PM - Run 1
OTL by OldTimer - Version 3.2.53.1 Folder = C:\1_internet\Download
Professional (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3.00 Gb Total Physical Memory | 1.63 Gb Available Physical Memory | 54.41% Memory free
6.00 Gb Paging File | 4.59 Gb Available in Paging File | 76.55% Paging File free
Paging file location(s): c:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455.86 Gb Total Space | 306.39 Gb Free Space | 67.21% Space Free | Partition Type: NTFS
Drive D: | 9.80 Gb Total Space | 1.20 Gb Free Space | 12.28% Space Free | Partition Type: NTFS

Computer Name: SASCHAHP | User Name: 1_Sascha | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\programme_1\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\programme_1\Office_2003\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\programme_1\Office_2003\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\programme_1\vlc player\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\programme_1\vlc player\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{060FC726-52CF-4CC6-8CB6-32C313013FE3}" = lport=10243 | protocol=6 | dir=in | app=system |
"{0C6168CF-DBBB-437C-BA4A-7139FF21712E}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{0E5C005E-4006-421D-82CB-5FC466D050D6}" = lport=2869 | protocol=6 | dir=in | app=system |
"{190A0678-C413-4F3A-AD42-62D11B6C839A}" = lport=139 | protocol=6 | dir=in | app=system |
"{2FD84458-3BBA-4819-B7E6-AF41FBE2BF07}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{366F75F8-657F-4E42-8424-8E2D2BDE545D}" = rport=138 | protocol=17 | dir=out | app=system |
"{41B320FF-5839-4197-8F58-24C7135F1A1C}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{44753531-C96C-485A-BDAC-1BB38D8CD31A}" = rport=445 | protocol=6 | dir=out | app=system |
"{47D26CEC-4514-419E-8BC5-DDCC244D809D}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{4EC48E33-C11A-4C94-BD34-469B0F49D8C1}" = rport=137 | protocol=17 | dir=out | app=system |
"{55800334-A651-443D-A16B-69DA468361AB}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{6BD884DE-E7F5-4B4F-A00A-DE6398FF4780}" = rport=139 | protocol=6 | dir=out | app=system |
"{8843BDEB-E763-4256-B9B5-31415A9D4A61}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{8DC837E8-7543-46A7-8C3A-BCE68A9725F7}" = lport=445 | protocol=6 | dir=in | app=system |
"{93F3D1F5-3CDB-4B96-BFF8-A1770F5E8170}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{9B74E38B-4BF4-4486-989C-166631047D79}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{BA78E729-1C5F-479F-BD31-BAC4E24F2FCD}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{C9068ADC-E372-4C96-9AD8-B17BC8D2E2CE}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{DA0B046D-FABB-49F3-8A78-AEF2E3847A79}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{EB3FCA22-2B92-44F5-B241-D04E99BBC732}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework\v4.0.30319\smsvchost.exe |
"{ED9942D7-C8CC-4562-A20C-B52E7EE05E0D}" = rport=10243 | protocol=6 | dir=out | app=system |
"{EEEB38CA-13F8-46B3-B248-7A6ED7955F57}" = lport=138 | protocol=17 | dir=in | app=system |
"{F2123DF4-452F-4D57-A170-864B9CD07CE5}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{F5BDF41B-27E7-4966-A458-6F46CC049084}" = lport=137 | protocol=17 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{009FDABC-577B-4AD9-AF89-6FDEC0E56927}" = dir=in | app=c:\windows\usbceipwow.exe |
"{00CA1109-68F6-4479-8EF0-D6959B9FEEBA}" = dir=in | app=c:\windows\api-ms-win-core-fibers-l1-1-032wow.exe |
"{021CC107-E49A-4111-886E-2025A04C638E}" = dir=in | app=c:\programdata\api-ms-win-core-fibers-l1-1-032.exe |
"{0243BB65-63D2-4C63-839D-9FE000FEEED2}" = dir=in | app=c:\windows\api-ms-win-core-fibers-l1-1-0wow.exe |
"{02AA839E-78AC-4C0A-B672-F55C4FE49CF3}" = dir=in | app=c:\windows\perftrackwow.exe |
"{03034271-8702-4B21-B229-8847BC96E0A0}" = dir=in | app=c:\windows\snmpapiwow.exe |
"{0423C034-A227-426D-87CE-90E5329E8450}" = dir=in | app=c:\windows\rdpd3dwow.exe |
"{043CC49B-A67E-481B-9558-2A33F262BE4F}" = dir=in | app=c:\windows\amxreadwow.exe |
"{049E8DD4-BCE0-48CB-86C3-A45639779CDA}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{0510646D-CB64-4630-AD59-D2D05E46B192}" = dir=in | app=c:\windows\bitsprx5wow.exe |
"{057605B1-D9A9-4342-B31F-ACAE573683EC}" = dir=in | app=c:\windows\amxreadwow.exe |
"{076E67B1-93C3-4B95-9978-AF3824814D79}" = dir=in | app=c:\windows\rtmwow.exe |
"{09939E62-426D-43C9-B9A0-BFC48BB4AD64}" = dir=in | app=c:\windows\difxapiwow.exe |
"{0AF99692-DA0A-45B5-ACF5-1598F34B1E74}" = dir=in | app=c:\windows\drtprovwow.exe |
"{0C9D4F86-3422-43FD-906B-7BAE84A0EA07}" = dir=in | app=c:\windows\dpxwow.exe |
"{0D25E5B3-2EE7-46BA-B95C-EA9F9B51D864}" = dir=in | app=c:\windows\fxstiffwow.exe |
"{0E1D8D02-5ED2-45CF-AF5C-7A6E00DDFF21}" = dir=in | app=c:\windows\wmadmodwow.exe |
"{0EF18DDB-9BC4-4346-BC30-FC0415A55D2D}" = dir=in | app=c:\windows\msscntrswow.exe |
"{0F9F1F4F-1E00-42C6-8486-693A1F04D69D}" = dir=in | app=c:\windows\d3d10_1corewow.exe |
"{10B37A98-1004-4000-B4BD-FF081390B735}" = dir=in | app=c:\windows\kbda1wow.exe |
"{10EEBB32-9F57-4821-8834-2BF02D27DCB7}" = dir=in | app=c:\windows\iglhcp32wow.exe |
"{12D80F7D-9EE0-471A-9500-22FD9BB11CB9}" = dir=in | app=c:\windows\snmpapiwow.exe |
"{1447C417-B739-4E16-937A-3AD072D1071B}" = dir=in | app=c:\windows\rdpd3dwow.exe |
"{145326E2-06A4-4E13-AEDA-2A8BBE0F35C0}" = dir=in | app=c:\windows\msprpdewow.exe |
"{151CF45D-D831-44BB-A0C3-FA8D3381FB0A}" = dir=in | app=c:\windows\iprtrmgrwow.exe |
"{16835C89-B243-4F73-B1FA-41E49C088C3A}" = dir=in | app=c:\programdata\shellwow.exe |
"{17643BF0-D2C5-4C4B-B197-F52B77565173}" = dir=in | app=c:\windows\api-ms-win-core-misc-l1-1-0wow.exe |
"{1815DE83-8555-4F1A-8173-3BAAC0026BBC}" = dir=in | app=c:\windows\msacmwow.exe |
"{19ADFD0A-FC1A-46B8-9041-0C445775EC7A}" = dir=in | app=c:\windows\iglhcp32wow.exe |
"{1ADB188E-E2A3-4DA6-B038-F7E573C549EE}" = dir=in | app=c:\windows\mssip32wow.exe |
"{1CE47FCC-AE7D-4D4B-AFE6-906059560D98}" = dir=in | app=c:\windows\iglhcp32wow.exe |
"{1D15BEC6-1CC5-4FF9-883D-4F6A1926879D}" = dir=in | app=c:\windows\msscntrswow.exe |
"{1D6A4DD0-1514-49AA-A8F8-3C8716E8B057}" = dir=in | app=c:\windows\azroleuiwow.exe |
"{1D91DBD8-E0CF-4524-B834-7982128A9ED7}" = dir=in | app=c:\windows\usbceipwow.exe |
"{1E7F578E-F033-457C-9371-463EFAA69091}" = dir=in | app=c:\windows\wlanhlpwow.exe |
"{1EEFACC5-B62B-4C90-A4C0-A6AC52E4710C}" = dir=in | app=c:\windows\difxapiwow.exe |
"{202BBF0A-B6F2-491E-8BA4-53511BFA3EE4}" = dir=in | app=c:\windows\amxreadwow.exe |
"{203F00C6-D918-4957-80FE-B1655FBCCA84}" = dir=in | app=c:\windows\api-ms-win-core-misc-l1-1-0wow.exe |
"{21431522-3B74-4A2E-AD0F-D332290101FF}" = dir=in | app=c:\windows\msscntrswow.exe |
"{2175EBE1-C0F6-4E53-8BAC-711AA764D17F}" = dir=in | app=c:\windows\api-ms-win-core-fibers-l1-1-032wow.exe |
"{21D0392C-B673-4ED0-B8D2-7A215994793D}" = dir=in | app=c:\windows\vdsbaswow.exe |
"{23335475-014A-46A5-BFF7-8B5BF58CC389}" = dir=in | app=c:\windows\msscntrswow.exe |
"{234234EC-FDB6-4C61-BC0B-72FCACC7FEDE}" = dir=in | app=c:\windows\provsvcwow.exe |
"{2419CFAD-AD9A-480F-844D-96A322545B4D}" = dir=in | app=c:\windows\sdrsvcwow.exe |
"{263363AF-22D9-4C81-BED3-1343F5909547}" = dir=in | app=c:\windows\localsecwow.exe |
"{268859C1-FB63-4CFF-A44B-58C488272ADF}" = dir=in | app=c:\windows\msacmwow.exe |
"{2833CCA6-99AB-4460-B2CE-5AAA1D19E59F}" = dir=in | app=c:\programdata\adsnt32.exe |
"{28FADACE-484D-4AD3-8C5F-8D56C1C99BC9}" = dir=in | app=c:\windows\trkwkswow.exe |
"{2962A70E-0391-481E-8FE0-BFF0E51DBE23}" = dir=in | app=c:\windows\displaywow.exe |
"{2B2FCE4F-0C06-4A3A-950A-9E046D4A4553}" = dir=in | app=c:\windows\kernelceipwow.exe |
"{2C0BEEC0-CA0D-4F84-AE4B-43780224139F}" = dir=in | app=c:\windows\naphlprwow.exe |
"{2C6CDF0D-A85C-4CA7-9C96-4DDF3972860E}" = dir=in | app=c:\programdata\wmadmoe32.exe |
"{2C9E2874-B957-4B20-BE01-115503C231D8}" = dir=in | app=c:\windows\drtprovwow.exe |
"{2EC900D2-C852-4B88-96CD-E38BB53747B4}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{2F77E0CD-0253-4D6B-83F2-B73036ECADF9}" = dir=in | app=c:\windows\vdsbaswow.exe |
"{30B301E6-A075-4AF4-AA90-638E12CEB3BA}" = dir=in | app=c:\windows\hpbmiapiwow.exe |
"{317884AC-47DC-4BF3-9836-B49E48538911}" = dir=in | app=c:\windows\difxapiwow.exe |
"{31CD70BB-E0B9-4D0C-B527-715CE2E33E81}" = dir=in | app=c:\windows\untfswow.exe |
"{32CF1C8A-14E3-449B-8780-C82AD6122FB4}" = dir=in | app=c:\windows\msscntrswow.exe |
"{3305D8EE-4B83-4F05-9779-34B7154D5B8D}" = dir=in | app=c:\windows\wintrustwow.exe |
"{330B29AF-019D-4583-9CCD-F27D6F88C6B8}" = dir=in | app=c:\windows\usbceipwow.exe |
"{33E2768B-2193-4A20-BECD-2832AB11FC2A}" = dir=in | app=c:\windows\iasmigpluginwow.exe |
"{33F3E751-4965-478E-8DF2-68DDAFC1F194}" = dir=in | app=c:\windows\bitsprx5wow.exe |
"{36A15F91-FB72-4B59-87C1-E24AAB2D0B9D}" = dir=in | app=c:\windows\wmadmodwow.exe |
"{377FCE5A-088A-487F-8B15-A8FD6AACF777}" = dir=in | app=c:\windows\avifilewow.exe |
"{38232804-41ED-4383-B349-955A60B472BF}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{382E338A-77CC-4236-8E7C-1C3B3A63DF95}" = dir=in | app=c:\windows\snmpapiwow.exe |
"{38AB983A-60E3-4CD7-B1A8-870CDB4A044A}" = dir=in | app=c:\windows\perftrackwow.exe |
"{396455D5-5540-4F27-AF24-91A004C147D9}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{3B3CA830-1397-43D1-A36A-1EFC827A897A}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{3BD5E4CE-AE39-454A-872C-0D7EE2AFB576}" = dir=in | app=c:\windows\msscntrswow.exe |
"{3BEECB12-A204-4E44-ADD0-842F75F796B0}" = dir=in | app=c:\windows\wmipropwow.exe |
"{3D73FBAD-A733-4772-9957-1AA9868FAA27}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{3D932CDF-F6A4-4B2A-BCFC-1A33767C963F}" = dir=in | app=c:\windows\msprpdewow.exe |
"{3DA74DDD-9240-4CAE-B418-4BFA38D2F26D}" = dir=in | app=c:\windows\iglhcp32wow.exe |
"{3E1724E1-BB48-4728-B5D8-CBCA72D3FBED}" = dir=in | app=c:\windows\rdpd3dwow.exe |
"{3E332DA7-DCCD-4579-B1A5-1217F591DB06}" = protocol=6 | dir=out | app=system |
"{3EE7AF9F-D173-4FB1-AF3F-F5917AE9E839}" = dir=in | app=c:\windows\iprtrmgrwow.exe |
"{3F3668A5-2DC9-4E4C-AF47-2BDF8E070203}" = dir=in | app=c:\windows\pidwow.exe |
"{3F51D86F-454A-432C-96F4-CB912876D34D}" = dir=in | app=c:\windows\sdrsvcwow.exe |
"{3F69E673-EBD2-424C-8787-B3C3074916F8}" = dir=in | app=c:\windows\cmipnpinstallwow.exe |
"{413103B5-8D35-4ECD-95AA-825B54223D90}" = dir=in | app=c:\programdata\xwizards32.exe |
"{41AE8C8D-EDF0-49B3-A205-672A092DE2C9}" = dir=in | app=c:\windows\snmpapiwow.exe |
"{43D7170D-674C-4E93-848F-31F00152FF31}" = dir=in | app=c:\windows\kbdnec95wow.exe |
"{442CE4C4-5961-4C44-A603-E5CD997BD0BA}" = dir=in | app=c:\windows\msprpdewow.exe |
"{44701039-5EC1-473C-8CB4-78BF62119C02}" = dir=in | app=c:\windows\iprtrmgrwow.exe |
"{44CFA98E-8D0F-4244-A9D0-DDE32892CA99}" = dir=in | app=c:\windows\amxreadwow.exe |
"{45F61917-C15C-4AF8-A4AB-1C99B6912843}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{46E8916D-A4D5-4E92-9029-ED21528F44B7}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{46FCF906-33F8-4F26-82A4-8268F67B6EA3}" = dir=in | app=c:\windows\iglhcp32wow.exe |
"{47372A17-66D7-478E-8B35-38F8921D1FAA}" = dir=in | app=c:\windows\iscsiumwow.exe |
"{4773F0BF-B4F9-4E9B-85EB-5AE0F1BBA26D}" = dir=in | app=c:\windows\provsvcwow.exe |
"{4829CC13-0DC1-480B-8A32-2AFFFB4D7BE5}" = dir=in | app=c:\windows\comdlg32wow.exe |
"{49145F63-96C0-4CDB-B100-7513420F8535}" = dir=in | app=c:\windows\snmpapiwow.exe |
"{49CC05FF-B846-42A1-9648-FD6AE9535515}" = dir=in | app=c:\windows\api-ms-win-core-fibers-l1-1-032wow.exe |
"{4AC15F42-E410-4B0F-889E-503DB65792A6}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{4AE5B782-173B-4308-9015-9E87B80019EA}" = dir=in | app=c:\windows\kbda1wow.exe |
"{4B175B4E-0EE4-4A8D-8669-094D0349634C}" = dir=in | app=c:\windows\bitsprx5wow.exe |
"{4BC3EF09-6E43-483F-9233-7B4374314335}" = dir=in | app=c:\windows\kbda1wow.exe |
"{4C550E77-1D74-4442-A1E4-B4DE7EFF6081}" = dir=in | app=c:\windows\d3d10_1corewow.exe |
"{4C72570A-B65B-40FF-B8D8-1DB105D877D4}" = dir=in | app=c:\windows\azroleuiwow.exe |
"{4D03FFFD-3AB7-406B-BD80-04B2676AA0F5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{4EB5CAA3-F9D5-438A-A0F2-7C21DE787AA0}" = dir=in | app=c:\windows\vdsbaswow.exe |
"{4F04FA4C-538F-4855-A9E1-DB9758E989A9}" = dir=in | app=c:\windows\drtprovwow.exe |
"{507D61CB-1616-4DE9-9124-F7973DD50DB3}" = dir=in | app=c:\windows\firewallcontrolpanelwow.exe |
"{51563F94-03B4-4A27-954C-63EC42A9FE2D}" = dir=in | app=c:\windows\iasmigpluginwow.exe |
"{562B50F2-AC48-484C-8250-139BC976332B}" = dir=in | app=c:\windows\msprpdewow.exe |
"{56D8EE1C-E8B8-4FAF-BB5F-107E0A99D5D9}" = dir=in | app=c:\windows\kbdtiprcwow.exe |
"{574CEFF6-1C60-4E9A-85FB-53D02CA7B9DE}" = dir=in | app=c:\windows\usbceipwow.exe |
"{577DEF6B-B757-49A7-9C9E-3B48A789BEBC}" = dir=in | app=c:\windows\rdpd3dwow.exe |
"{58A0CCAE-7029-4E68-9A21-4C78C8CC6058}" = dir=in | app=c:\windows\wlanhlpwow.exe |
"{58A72812-87FC-4035-9F9E-D594BAE10C3A}" = dir=in | app=c:\windows\winrnrwow.exe |
"{5B445AFE-8D73-4C55-98EC-FCBA65D37D6F}" = dir=in | app=c:\windows\iscsiumwow.exe |
"{5C0EB712-0105-4C90-88AD-9D52A47E8D49}" = dir=in | app=c:\windows\msprpdewow.exe |
"{5C36D0E7-0493-490F-82B1-269B66602CCF}" = dir=in | app=c:\programdata\xwizards32.exe |
"{5C667C32-9A29-4C76-A884-A387F8656F4D}" = dir=in | app=c:\windows\bitsprx5wow.exe |
"{5C871E1E-D140-4F23-A2A1-ACC56428F6E6}" = dir=in | app=c:\windows\winrnrwow.exe |
"{5D3F1750-B401-4A34-A43D-631B3951E8B6}" = dir=in | app=c:\windows\imagereswow.exe |
"{5E96D639-1C6B-4739-AE2E-4524E1D43B11}" = dir=in | app=c:\windows\wmipropwow.exe |
"{5EB515BB-78DF-4D6D-8DA4-A365C545D26A}" = dir=in | app=c:\windows\odbccu32wow.exe |
"{5EC04B35-41B5-4E3A-81A6-90A33BC8288C}" = dir=in | app=c:\windows\cmipnpinstallwow.exe |
"{5F7B1831-605B-4859-A68E-6DC86EB85CA5}" = dir=in | app=c:\windows\azroleuiwow.exe |
"{5FBB7BD5-8651-44A3-A6E0-55E46012F050}" = dir=in | app=c:\windows\kernelceipwow.exe |
"{60B37B43-F1DF-4BDF-B9E6-1EB88E5FE101}" = dir=in | app=c:\programdata\wmadmoe32.exe |
"{615E36B5-BB1B-48A9-BC0D-2EE99C6C764C}" = dir=in | app=c:\windows\kbda1wow.exe |
"{622A65E1-A28B-4D3D-B0FC-3770074CCB37}" = dir=in | app=c:\windows\hpbmiapiwow.exe |
"{62565260-32BC-4197-A108-2E424A6ABF3F}" = dir=in | app=c:\programdata\api-ms-win-core-fibers-l1-1-032.exe |
"{62EFAE22-4C46-42CE-B41D-791E71A086C0}" = dir=in | app=c:\windows\provsvcwow.exe |
"{62FF4717-7643-4C4F-B01D-2A8F995D4E79}" = dir=in | app=c:\programdata\api-ms-win-core-fibers-l1-1-032.exe |
"{6396442B-D230-4F66-B3A6-AA9AA262EB41}" = dir=in | app=c:\windows\displaywow.exe |
"{64CC5DFD-94BF-44FC-9451-C65070C61AB6}" = dir=in | app=c:\windows\msprpdewow.exe |
"{66671D98-151B-4FE0-B629-96364B3C741A}" = dir=in | app=c:\windows\kbdnec95wow.exe |
"{675C1301-32D4-4DF5-8C4D-967BBE58F1E6}" = dir=in | app=c:\windows\azroleuiwow.exe |
"{679104D2-E6F6-4254-94EE-43A67F726BD7}" = dir=in | app=c:\windows\setbcdlocalewow.exe |
"{684678A0-C2BB-4F1B-B790-0F981B959019}" = dir=in | app=c:\programdata\shellwow.exe |
"{685D3137-AA82-4740-A1CF-06A37B233A4A}" = dir=in | app=c:\windows\oleaccrcwow.exe |
"{68EE9E65-2482-4A2B-BF06-110AB8600279}" = dir=in | app=c:\windows\mssip32wow.exe |
"{69016619-A6F7-4A1F-9066-500427F8AC7E}" = dir=in | app=c:\windows\api-ms-win-core-fibers-l1-1-032wow.exe |
"{6D8861EA-93E9-4C17-82A1-43980B66AA46}" = dir=in | app=c:\windows\dpxwow.exe |
"{6EB22242-CD33-4335-870F-56726F604BA7}" = dir=in | app=c:\windows\firewallcontrolpanelwow.exe |
"{6F8D5AED-AD27-4046-AF50-ED4B80A98F96}" = dir=in | app=c:\windows\iprtrmgrwow.exe |
"{718C5CEE-048D-43D7-A499-6FB3B6B0B032}" = dir=in | app=c:\windows\setbcdlocalewow.exe |
"{72352C41-4BF0-4974-8E58-6B3A7CE19FCF}" = dir=in | app=c:\programdata\olewin.exe |
"{7498CE2D-C1B3-405E-BFA5-5940D59D7D5D}" = dir=in | app=c:\windows\firewallcontrolpanelwow.exe |
"{74F6767D-84CF-44D0-A026-8816D57B659F}" = dir=in | app=c:\windows\hpbmiapiwow.exe |
"{74FE1477-3C2E-4DD7-9E71-34C9C9E82B40}" = dir=in | app=c:\windows\rtmwow.exe |
"{751EAF91-0912-4FA6-99DE-6930E64B139C}" = dir=in | app=c:\windows\winrnrwow.exe |
"{761ACD17-6DFF-41BC-AE8A-47985C704E54}" = dir=in | app=c:\windows\dmdlgswow.exe |
"{76EB76A3-686A-4749-A1AB-0C062B12E453}" = dir=in | app=c:\windows\lpksetupproxyservwow.exe |
"{77042E63-77E2-4E13-BCF4-C0598E9F6B9C}" = dir=in | app=c:\windows\wlanhlpwow.exe |
"{772004AF-6083-4FC8-B1BD-054AD6E70BBD}" = dir=in | app=c:\windows\avifilewow.exe |
"{774C45F2-4DF2-49A2-89AD-9D8F2ABF8FB8}" = dir=in | app=c:\windows\firewallcontrolpanelwow.exe |
"{79195ABD-3EC5-4B71-9F7B-92B98EA36CC1}" = dir=in | app=c:\windows\system32\odbcjt3232.exe |
"{797D50AC-8CC9-4E09-88D9-463511C2E582}" = dir=in | app=c:\windows\provsvcwow.exe |
"{79B66F01-2CD0-41F8-98E1-836412FC2915}" = dir=in | app=c:\windows\d3d10_1corewow.exe |
"{79D8D82E-1F47-46BF-A8F9-AAA94C75AE16}" = dir=in | app=c:\windows\api-ms-win-core-fibers-l1-1-032wow.exe |
"{7A616ECE-29EE-488E-B002-B07940894728}" = dir=in | app=c:\windows\iscsiumwow.exe |
"{7B74722B-CCE8-405F-8E90-3A1077B10401}" = dir=in | app=c:\windows\iscsiumwow.exe |
"{7BF69D3F-B12D-4CA8-9B64-818AEA948D03}" = dir=in | app=c:\windows\vdsbaswow.exe |
"{7C517983-B1C8-4E7A-B29D-5764453A95F9}" = dir=in | app=c:\windows\trkwkswow.exe |
"{7C838F01-3B4C-452C-B75F-5FA6DAFAFB7B}" = dir=in | app=c:\windows\bitsprx5wow.exe |
"{7CAE47CB-0B3F-4BA9-BD38-B219BFF36B78}" = dir=in | app=c:\windows\firewallcontrolpanelwow.exe |
"{7E4ED3BB-E217-4390-9E99-AC65A5670142}" = dir=in | app=c:\windows\uudfwow.exe |
"{7FDC7EBC-7236-4838-ACAD-3F7777F0C23F}" = dir=in | app=c:\windows\system32\odbcjt3232.exe |
"{8025173B-DFF1-45C6-9506-835E2F611540}" = dir=in | app=c:\windows\sdrsvcwow.exe |
"{80EFC137-5B27-4A1F-9CBD-F3867A677F4F}" = dir=in | app=c:\windows\displaywow.exe |
"{827DB6B6-EF22-40A5-A73E-8902A1212E0E}" = dir=in | app=c:\windows\usbceipwow.exe |
"{83CC3A3D-0D72-4212-B843-AD20563A1CD3}" = dir=in | app=c:\windows\fxstiffwow.exe |
"{853C84CD-1991-4C18-8AF7-51753E454241}" = dir=in | app=c:\windows\untfswow.exe |
"{858A9567-555D-4C9E-9236-933BAFFBFD93}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{866C4E59-16B9-474A-9211-38C1F0A3F080}" = dir=in | app=c:\windows\win32splwow.exe |
"{88DA6C58-8760-4379-8E1A-6D6C1EBEDD19}" = dir=in | app=c:\windows\imagereswow.exe |
"{88EBE9B5-9CD6-4F70-8505-FD22EB881981}" = dir=in | app=c:\windows\kbdnec95wow.exe |
"{8AAAC8E2-46AD-4FA1-97A7-5797034E3E01}" = dir=in | app=c:\windows\api-ms-win-core-fibers-l1-1-0wow.exe |
"{8AEC7FB7-B0EA-4648-A7BF-6286D033071B}" = dir=in | app=c:\windows\winrnrwow.exe |
"{8C0358C8-A204-4F55-8F34-4E056DFAB0C1}" = dir=in | app=c:\windows\setbcdlocalewow.exe |
"{8CE3D90B-6E53-498C-A334-71483AD5EBDB}" = dir=in | app=c:\windows\imagereswow.exe |
"{8EE42271-B4F7-44C9-8C0F-40613C33D59B}" = dir=in | app=c:\programdata\wmadmoe32.exe |
"{901A44D8-F76A-48E1-9252-5C8FD9AF7F24}" = dir=in | app=c:\windows\difxapiwow.exe |
"{930C4732-74B9-4B8A-936D-24065E0EED26}" = dir=in | app=c:\windows\firewallcontrolpanelwow.exe |
"{93953430-37CB-4E5D-BCB8-5CE0D10AAB76}" = dir=in | app=c:\windows\win32splwow.exe |
"{93D9D9BB-AC07-4F4F-872F-EEE68FCC8539}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{94527443-0926-4B5E-8B8E-6CFF0AB2C528}" = dir=in | app=c:\windows\untfswow.exe |
"{945CC633-1871-43F6-A251-B68FF29ECA30}" = dir=in | app=c:\windows\vdsbaswow.exe |
"{95FE9811-BF4E-4558-BF6C-8FB747E93348}" = dir=in | app=c:\windows\imagereswow.exe |
"{96D0E022-065E-4F2A-9FB8-CE2850D59000}" = dir=in | app=c:\windows\pidwow.exe |
"{96F1E7BC-C3E0-4E0C-8A3C-C793E840ADC3}" = dir=in | app=c:\programdata\olewin.exe |
"{988DDAD4-1CDC-47EE-ADE6-1E0EAE47CAF2}" = dir=in | app=c:\windows\d3d10_1corewow.exe |
"{9B04C0F6-00D3-4A06-B2FE-B7940DE50068}" = dir=in | app=c:\windows\dmscriptwow.exe |
"{9B6453A5-1F24-4CD3-9674-C2C1E79C9071}" = dir=in | app=c:\windows\cmipnpinstallwow.exe |
"{9C830F2B-72DE-421A-A297-9DF7C295ADD1}" = dir=in | app=c:\windows\winrnrwow.exe |
"{9D0210E0-B453-4814-AC25-C370238D8722}" = dir=in | app=c:\windows\difxapiwow.exe |
"{A06D4BDB-B22E-4FC4-89F9-20B5678D3D4F}" = dir=in | app=c:\windows\difxapiwow.exe |
"{A0E12599-67B3-4DE4-BA69-19FD934CEB3E}" = dir=in | app=c:\programdata\batt32.exe |
"{A10FFACA-EB18-45AD-8FAA-8D346C9CB434}" = dir=in | app=c:\windows\api-ms-win-core-fibers-l1-1-0wow.exe |
"{A11C37BA-BDCA-4135-9134-BEC1380D5E05}" = dir=in | app=c:\programdata\shellwow.exe |
"{A1622998-F704-4EA7-BA5F-69147ED33682}" = dir=in | app=c:\windows\wintrustwow.exe |
"{A3BF874D-8E6B-42E1-880D-ADBF234DF281}" = dir=in | app=c:\windows\odbccu32wow.exe |
"{A45C0001-5134-4354-A38C-E59FB53C81D4}" = dir=in | app=c:\windows\kbdtiprcwow.exe |
"{A45DD038-23F2-4333-8505-8679CF1DA7E9}" = dir=in | app=c:\windows\fntcachewow.exe |
"{A6656D33-25E9-4472-B55A-B89D53195E2D}" = dir=in | app=c:\windows\kernelceipwow.exe |
"{A6805E5F-D580-4EFD-A53A-4A67BCC6D3C1}" = dir=in | app=c:\windows\displaywow.exe |
"{A6A2A99E-14C8-4D9B-B897-E48EF9789FFD}" = dir=in | app=c:\windows\dmdlgswow.exe |
"{A75250FF-8DEF-4FFC-AF25-0262D46C1EE7}" = dir=in | app=c:\windows\dmdlgswow.exe |
"{A92D3C40-9C8B-449F-9E7C-9EF5F265E1F0}" = dir=in | app=c:\windows\kernelceipwow.exe |
"{AC250382-7CEC-4E21-BCE2-A03D4E8AD8BD}" = dir=in | app=c:\windows\trkwkswow.exe |
"{ACEEE0BE-8C27-4406-9229-E00E276BFDA6}" = dir=in | app=c:\windows\iglhcp32wow.exe |
"{AE681016-1944-4163-BFEA-7F600F4287FE}" = dir=in | app=c:\programdata\olewin.exe |
"{AFEA4699-4DE5-45DC-9A5A-803E4B20F2A7}" = dir=in | app=c:\windows\provsvcwow.exe |
"{B2B1605B-3D07-4BCE-BBBD-DE2D94A9E068}" = dir=in | app=c:\windows\winrnrwow.exe |
"{B32513BA-9A10-4394-8CB1-F1E116BA5C49}" = dir=in | app=c:\windows\sdrsvcwow.exe |
"{B450BF79-A1C5-4B2A-9D5E-63829757C64C}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{B509477D-A775-45F1-B82C-7F5015FCF13D}" = dir=in | app=c:\windows\odbccu32wow.exe |
"{B57B6D23-9237-4274-A3AD-369334A21375}" = dir=in | app=c:\windows\iprtrmgrwow.exe |
"{B5FC0199-7994-4F16-BB09-0171CACC66C5}" = dir=in | app=c:\windows\oleaccrcwow.exe |
"{B6FACE27-D36F-4742-86BE-2B063D73B8D8}" = dir=in | app=c:\windows\amxreadwow.exe |
"{B757AB49-8E7A-4A2C-BAAA-4B5BFA9D8A23}" = dir=in | app=c:\programdata\adsnt32.exe |
"{B771CA78-F985-428F-B134-CCF445A1691A}" = dir=in | app=c:\windows\fxstiffwow.exe |
"{B796D5F8-C4E9-4726-BD51-2D9C35394844}" = dir=in | app=c:\programdata\xwizards32.exe |
"{B7A0362E-EEBE-486F-84A1-B18054C8DA6C}" = dir=in | app=c:\windows\drtprovwow.exe |
"{B7D274D8-41F5-4141-B362-596B39D8F7DD}" = dir=in | app=c:\windows\api-ms-win-core-misc-l1-1-0wow.exe |
"{B7DD3BE1-1577-4DB9-A7E4-14ED6C62CEA7}" = dir=in | app=c:\windows\dmscriptwow.exe |
"{B87F2C6A-7F8D-4885-A3D6-600F9B9D08F2}" = dir=in | app=c:\programdata\batt32.exe |
"{BACA52A7-36EF-41FD-A30A-86E4EC90038F}" = dir=in | app=c:\windows\provsvcwow.exe |
"{BB1B3511-2E6C-43A3-86C6-C651EDBFFE01}" = dir=in | app=c:\windows\dmdlgswow.exe |
"{BBD33AE8-89BD-4CF9-98D8-6B39F8D82C2B}" = dir=in | app=c:\windows\kbda1wow.exe |
"{BBD4EF70-C28D-4289-B4CA-6E79C7D28565}" = dir=in | app=c:\windows\lpksetupproxyservwow.exe |
"{BC077A5E-AE0C-45C1-AE47-EBFC9F6DA0EB}" = dir=in | app=c:\windows\mssip32wow.exe |
"{BC10242B-29EE-4D82-AD8F-CAD24E5BD996}" = dir=in | app=c:\windows\iprtrmgrwow.exe |
"{BC870B2A-D0E6-4681-9CFF-547BD516EED3}" = dir=in | app=c:\windows\avifilewow.exe |
"{BDF8A2A4-2121-48EB-9942-7F442FBC5F87}" = dir=in | app=c:\windows\dpxwow.exe |
"{BEC8F0AF-1FDB-41F7-9163-07725D8EF38B}" = dir=in | app=c:\windows\imagereswow.exe |
"{BF265958-FBEA-4887-B70B-B22CAA9CD8FA}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{C11CA15E-7E2F-4A22-80F7-458174929EC9}" = dir=in | app=c:\windows\sdrsvcwow.exe |
"{C1E6280A-92AE-479B-B3FD-BC83F0A0BE2D}" = dir=in | app=c:\windows\dmscriptwow.exe |
"{C359DDB6-32A2-460E-86A2-7702509E3242}" = dir=in | app=c:\windows\oleaccrcwow.exe |
"{C3724C71-72F1-4CAA-B76F-0646B4111244}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{C378965E-9DBE-4884-B736-DFE4D6B1B3ED}" = dir=in | app=c:\windows\msacmwow.exe |
"{C3B8B061-A459-480E-AAFC-F4CB241499AF}" = dir=in | app=c:\windows\lpksetupproxyservwow.exe |
"{C40669E1-3817-48BA-A5C2-8C10E790E2BF}" = dir=in | app=c:\windows\api-ms-win-core-fibers-l1-1-032wow.exe |
"{C50D6A61-1DE0-4523-B895-EAE64BB448C1}" = dir=in | app=c:\windows\fntcachewow.exe |
"{C68BC996-7FEF-49FA-BE27-DCD59535E919}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{C76DD763-6A98-4111-9069-24E0F937CA0E}" = dir=in | app=c:\windows\fntcachewow.exe |
"{C8E3E478-1562-4A30-B27D-1886DD371C49}" = dir=in | app=c:\windows\dmdlgswow.exe |
"{CAD3CD94-26D5-4D06-B392-7C2D9DDA72DC}" = dir=in | app=c:\windows\system32\odbcjt3232.exe |
"{CB087F8B-04B3-4922-AC61-032AA14229DC}" = dir=in | app=c:\windows\drtprovwow.exe |
"{CB9F4201-666E-4E6B-A7C7-6B5BD73CB442}" = dir=in | app=c:\windows\perftrackwow.exe |
"{CCEF8896-97FB-4361-A9A0-71B1ED3F79CF}" = dir=in | app=c:\windows\naphlprwow.exe |
"{CE1D49F1-C8FF-46B3-B0A2-18D20EF3B73F}" = dir=in | app=c:\windows\d3d10_1corewow.exe |
"{D10E2889-4CB0-44D5-AB5C-8A9BC0CA87F1}" = dir=in | app=c:\windows\vdsbaswow.exe |
"{D14E30F5-53EE-41A3-9E42-6A33C3F932F0}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{D1FDB4AA-7739-4233-BFA8-FAFE035433C9}" = dir=in | app=c:\windows\wmipropwow.exe |
"{D2BD5238-C2F2-4711-ACC7-3A89020EE9F0}" = dir=in | app=c:\windows\snmpapiwow.exe |
"{D476300E-3594-4CCF-BE60-011FB4111E63}" = dir=in | app=c:\windows\odbccu32wow.exe |
"{D6243559-B565-46FB-81CB-F780D9848AAB}" = dir=in | app=c:\windows\wintrustwow.exe |
"{D7DD9FD1-D67D-46A8-9A94-7A052ADC1B09}" = dir=in | app=c:\windows\oleaccrcwow.exe |
"{D8C1D12D-0F8B-466A-AA03-42C64185F87D}" = dir=in | app=c:\windows\pidwow.exe |
"{D93069D5-02D5-4C67-A503-20FB4A7D38DE}" = protocol=6 | dir=in | app=c:\program files\sweetim\communicator\sweetpacksupdatemanager.exe |
"{D98209ED-D560-419A-B70A-5CB6EA34647C}" = dir=in | app=c:\windows\iscsiumwow.exe |
"{DB541935-3E4C-4CD7-A446-442201C7DCE0}" = dir=in | app=c:\windows\kbda1wow.exe |
"{DBCD2E6E-D095-4A2E-85BB-1CBE056E1CD9}" = dir=in | app=c:\windows\difxapiwow.exe |
"{DD2ABC13-79A9-4646-9F41-3E38D6F4007F}" = dir=in | app=c:\windows\localsecwow.exe |
"{DE817469-9D18-4F05-A94F-46D0DD3584AE}" = dir=in | app=c:\windows\rtmwow.exe |
"{DFB24E63-5042-4BF6-AF49-DF308B4A4DE7}" = dir=in | app=c:\windows\amxreadwow.exe |
"{E1C288B2-B0D8-4080-AA43-6F3118D3A371}" = dir=in | app=c:\windows\kbdtiprcwow.exe |
"{E254AEE7-CC4D-4C0F-B8A4-EF7A4A835748}" = dir=in | app=c:\windows\oleaccrcwow.exe |
"{E28617A2-332F-458F-9A6A-A92537434A29}" = protocol=17 | dir=in | app=c:\program files\sweetim\communicator\sweetpacksupdatemanager.exe |
"{E4C171B8-A633-4887-97BE-5741801A17AC}" = dir=in | app=c:\windows\oleaccrcwow.exe |
"{E602280D-DF09-4592-A216-2B04B7D03180}" = dir=in | app=c:\windows\usbceipwow.exe |
"{E606B0B8-E972-475A-B924-0EAC4523CE10}" = dir=in | app=c:\windows\displaywow.exe |
"{E72DA7AB-B7DB-4E68-AB52-DF5381E7FEFB}" = dir=in | app=c:\windows\wmadmodwow.exe |
"{E75D00C5-DA77-4DA8-8EE5-17D516BDAC02}" = dir=in | app=c:\windows\sdrsvcwow.exe |
"{E776DCF0-3B35-4CBD-AD1F-D34E54D536F4}" = dir=in | app=c:\windows\lpksetupproxyservwow.exe |
"{E8544291-0352-4ED7-B984-ABF1488ECE8E}" = dir=in | app=c:\programdata\batt32.exe |
"{E870F0C8-1BF0-4813-B9BD-FDC851A225EC}" = dir=in | app=c:\windows\d3d10_1corewow.exe |
"{E873A305-4E16-4FC4-B313-26F42303D553}" = dir=in | app=c:\windows\azroleuiwow.exe |
"{E8C6D26E-953D-4B1C-8B3A-7E0D84571F0B}" = protocol=6 | dir=in | app=c:\windows\system32\msiexec.exe |
"{E9D04736-DAB8-42B5-88EE-AA5A6449C938}" = dir=in | app=c:\programdata\adsnt32.exe |
"{EACA4E06-0596-44FC-877C-5622D2A23DA1}" = dir=in | app=c:\windows\difxapiwow.exe |
"{EC8C63FC-E712-463E-9641-154502EA6CD2}" = dir=in | app=c:\windows\lpksetupproxyservwow.exe |
"{ED477DD6-538F-4AA7-BA15-A253398612E7}" = dir=in | app=c:\windows\naphlprwow.exe |
"{EE4919C7-B755-4E95-8D1A-5B6661F9FE7D}" = dir=in | app=c:\windows\dmdlgswow.exe |
"{F05D63EF-BFF9-4A73-8BEA-7C8AFF90C833}" = dir=in | app=c:\windows\odbccu32wow.exe |
"{F143AE93-2211-4299-A9ED-4E7F549E9F27}" = dir=in | app=c:\windows\azroleuiwow.exe |
"{F2D85E13-DCA8-433F-9FBE-A8D5EF381EA9}" = dir=in | app=c:\windows\localsecwow.exe |
"{F46335BA-44C8-4138-BB35-38582A4244F6}" = dir=in | app=c:\windows\kernelceipwow.exe |
"{F59D8CA8-8E7E-43D8-9DDB-BDA53618DD6D}" = dir=in | app=c:\windows\kernelceipwow.exe |
"{F636FA46-C7E6-4329-B3A3-C3D93BE27234}" = dir=in | app=c:\windows\odbccu32wow.exe |
"{F6B6636A-BC2A-402E-B914-5E824E6312A8}" = dir=in | app=c:\windows\rdpd3dwow.exe |
"{F79500E2-A624-4426-967A-F38AF9FEE7B2}" = dir=in | app=c:\windows\bitsprx5wow.exe |
"{F8753B48-0750-44C8-9D6A-7ED48775BC72}" = dir=in | app=c:\windows\comdlg32wow.exe |
"{F94EEA51-20D4-4E45-827D-2E0C45ECA6E4}" = dir=in | app=c:\windows\iasmigpluginwow.exe |
"{F967D381-E187-416B-A73F-3415A2C43FBE}" = dir=in | app=c:\windows\win32splwow.exe |
"{FB6B881E-0643-42A3-949F-8F4BC7EA3D9B}" = dir=in | app=c:\windows\difxapiwow.exe |
"{FB7519B4-974B-425A-B242-5E772AA3444E}" = dir=in | app=c:\windows\imagereswow.exe |
"{FBA267CC-517B-466D-A84C-70D4AEB33F23}" = dir=in | app=c:\windows\displaywow.exe |
"{FBF1D0C5-842C-47E2-8269-B4685A785017}" = dir=in | app=c:\windows\drtprovwow.exe |
"{FC51568C-5E4F-47FA-BC1A-2CF675F2BA85}" = dir=in | app=c:\windows\lpksetupproxyservwow.exe |
"{FCA91314-A34A-44E2-BD38-756C5BB1D4D0}" = dir=in | app=c:\windows\rdpd3dwow.exe |
"{FCBC3FA9-EDDE-4B5C-9408-F91D74685D1F}" = dir=in | app=c:\windows\uudfwow.exe |
"{FD39E757-71E1-4222-B5FC-09A1F92EC615}" = dir=in | app=c:\windows\iscsiumwow.exe |
"{FED61701-F405-4DE2-B19A-46248822D670}" = dir=in | app=c:\windows\uudfwow.exe |
"{FED8C923-6EE1-4728-B145-31C8EC5E1F6A}" = protocol=17 | dir=in | app=c:\windows\system32\msiexec.exe |
"{FEE59800-D9FD-4DD8-84ED-2A29ED3D97CA}" = dir=in | app=c:\windows\comdlg32wow.exe |
"TCP Query User{2AA9DECA-5A7B-4A5F-9877-509A96747A18}C:\programme_1\grand prix 3\gp3.icd" = protocol=6 | dir=in | app=c:\programme_1\grand prix 3\gp3.icd |
"TCP Query User{3CFCD221-E431-445F-B562-4505147D4392}C:\programme_1\emule\emule.exe" = protocol=6 | dir=in | app=c:\programme_1\emule\emule.exe |
"TCP Query User{601D34F3-56FE-4743-80ED-310C876A8EFF}C:\program files\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |
"TCP Query User{9178615A-8516-4FCB-97A8-68AB9EC84BC0}C:\programme_1\vlc player\vlc\vlc.exe" = protocol=6 | dir=in | app=c:\programme_1\vlc player\vlc\vlc.exe |
"TCP Query User{9516109A-1BF6-4AE6-A11B-5ED31BD077A0}E:\grand prix 3\gp3.icd" = protocol=6 | dir=in | app=e:\grand prix 3\gp3.icd |
"TCP Query User{E0F5282C-F1C4-4093-8C6D-CAE7B39C3AF3}C:\programme_1\emule\emule.exe" = protocol=6 | dir=in | app=c:\programme_1\emule\emule.exe |
"UDP Query User{12011441-65B4-4A74-BE0F-414144E68548}E:\grand prix 3\gp3.icd" = protocol=17 | dir=in | app=e:\grand prix 3\gp3.icd |
"UDP Query User{1B737E48-0EA4-46E0-BF8B-B9B002D9F339}C:\program files\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |
"UDP Query User{2E1FF224-1180-4350-8553-1059DAD68FEE}C:\programme_1\emule\emule.exe" = protocol=17 | dir=in | app=c:\programme_1\emule\emule.exe |
"UDP Query User{360ED211-96A0-4CDB-B55C-093F9EDCD68F}C:\programme_1\vlc player\vlc\vlc.exe" = protocol=17 | dir=in | app=c:\programme_1\vlc player\vlc\vlc.exe |
"UDP Query User{952580C7-4A6A-4078-881C-8D1639E28389}C:\programme_1\emule\emule.exe" = protocol=17 | dir=in | app=c:\programme_1\emule\emule.exe |
"UDP Query User{AAF6A848-AC68-42B9-8FCD-026507B21643}C:\programme_1\grand prix 3\gp3.icd" = protocol=17 | dir=in | app=c:\programme_1\grand prix 3\gp3.icd |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{07FA4960-B038-49EB-891B-9F95930AA544}" = HP Customer Experience Enhancements
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0CA1005F-B640-0354-EC82-F8F7447A8E8A}" = CCC Help Hungarian
"{0FC472C3-6A2A-969F-10E7-E8F61B18117C}" = Catalyst Control Center Localization All
"{12076C90-4A78-7241-F633-4D2B019D5611}" = CCC Help Thai
"{15B2BC56-D179-4450-84B9-7A8D7F4CE1B9}" = Lexware Info Service
"{17E11EC2-3736-10A1-330C-CC7EB6CAC6B3}" = CCC Help Turkish
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{31B75145-DF24-C759-E735-9C129956961E}" = CCC Help Spanish
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{40FB8D7C-6FF8-4AF2-BC8B-0B1DB32AF04B}" = HP Advisor
"{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}" = Recovery Manager
"{4785CED6-73B3-45FA-AFE6-EDEDFDE67842}" = Steuer 2011
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B526075-AF27-47A2-860D-3DA92928A051}" = Steuer 2010
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{59F5C54C-ED39-58B4-42DA-3F20AB440E49}" = CCC Help Czech
"{60F641EA-DFFB-4419-A1A7-4FF575BA87BE}" = HP Setup
"{641C1B16-FD4C-0F97-47AE-76637FC64225}" = CCC Help English
"{64B157C9-C291-2535-8177-237BC2D37EBF}" = CCC Help Korean
"{658DE1DF-D156-DD5A-800E-20C693806F65}" = Catalyst Control Center InstallProxy
"{6F340107-F9AA-47C6-B54C-C3A19F11553F}" = Hewlett-Packard ACLM.NET v1.1.2.0
"{6F44AF95-3CDE-4513-AD3F-6D45F17BF324}" = HP Support Assistant
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71790311-0C42-B5BC-AF01-97BFFEF2A30B}" = ATI Catalyst Install Manager
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{79C2D7F9-3BF8-52C1-6A7A-84C9296171F8}" = CCC Help German
"{7B29E627-71A5-6824-3F85-DBEF19624BD0}" = ccc-core-static
"{7E5C379D-035B-815D-E087-4CEA06C76A08}" = AMD Drag and Drop Transcoding
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{85C3024B-A974-450C-4D46-C031F801F5EC}" = ccc-utility
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{87323561-58BA-4D5B-BADA-A791B69D1705}" = Catalyst Control Center - Branding
"{88B2BB7B-A684-E8E3-65C6-DDC5DC152C2A}" = CCC Help French
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8CB77076-DB66-5D92-7886-807226C9CE4B}" = CCC Help Italian
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{90A455A7-0FC8-4508-B7FA-8F135B8F041A}" = DSL-Manager
"{94F4B1D4-0BCC-E5C6-4EAE-F1A287383D5B}" = CCC Help Finnish
"{98838C21-AD83-77AA-3B09-F437C6F24F8F}" = CCC Help Dutch
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C6F56DA-7051-6677-4E5A-9DC6C573F2B5}" = CCC Help Portuguese
"{9FE051B0-39BC-F5DD-C99B-0D4793184C2A}" = CCC Help Chinese Standard
"{AA6B96C4-7AF5-3F6A-E630-4096508A9C47}" = CCC Help Danish
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{ACFB6965-D714-3786-6B50-58E21223CB96}" = ATI AVIVO Codecs
"{B40D7926-AE5F-41EA-8AC6-56C0E2F00E9D}" = HP MAINSTREAM KEYBOARD
"{B48E87FE-A8D9-EE14-B607-3FA1ACEF218E}" = CCC Help Norwegian
"{B4FA8E67-D299-485A-407B-05A2681BAF47}" = CCC Help Japanese
"{B8AC1A89-FFD1-4F97-8051-E505A160F562}" = HP Odometer
"{B9A03B7B-E0FF-4FB3-BA83-762E58A1B0AA}" = HP Support Information
"{BB05BC7D-BEF8-7A7B-C62E-F1BE381E70BB}" = CCC Help Swedish
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C3FA3CCE-2A88-0976-B875-4B3E9D41204D}" = Catalyst Control Center Graphics Previews Common
"{C611CF88-969D-43E6-A877-D6D6439DD081}" = HP Remote Solution
"{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}" = PlayReady PC Runtime x86
"{D34F0251-1C96-09B3-EE29-2A9148413252}" = CCC Help Chinese Traditional
"{D54A0D86-35B0-BFC8-174B-D991EDF903B8}" = Catalyst Control Center Graphics Previews Vista
"{D5610369-AF78-386F-4985-9822654973A3}" = CCC Help Polish
"{D79A02E9-6713-4335-9668-AAC7474C0C0E}" = HP Vision Hardware Diagnostics
"{D7EC8A27-CDA2-46AE-8A26-4104A04FA5BE}" = 32 Bit HP CIO Components Installer
"{E3723A04-A894-4036-A78E-282E18F43C0A}_is1" = Tinypic 3.17a
"{E937F8DA-8C7F-ADFE-7EA5-7C1CAAB23C05}" = HydraVision
"{ECD129A4-5A21-1977-0849-6913BA6BA29C}" = CCC Help Russian
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Graphics Media Accelerator Driver
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F77D44EB-2A6E-E2EE-7C30-40A5409B2650}" = CCC Help Greek
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"CCleaner" = CCleaner
"DAEMON Tools Toolbar" = DAEMON Tools Toolbar
"HP Keyboard_is1" = HP Desktop Keyboard
"HP Remote Solution" = HP Remote Solution
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Mozilla Firefox 4.0 (x86 de)" = Mozilla Firefox 4.0 (x86 de)
"Mozilla Thunderbird (3.1.4)" = Mozilla Thunderbird (3.1.4)
"My HP Game Console" = HP Game Console
"NAV" = Norton AntiVirus
"PDF Complete" = PDF Complete Special Edition
"VLC media player" = VLC media player 1.1.10
"WildTangent hp Master Uninstall" = HP Games
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
"WT087361" = FATE
"WT087380" = John Deere Drive Green
"WT087394" = Penguins!
"WT087396" = Polar Bowler
"WT087420" = Agatha Christie - Death on the Nile
"WT087428" = Bejeweled 2 Deluxe
"WT087453" = Chuzzle Deluxe
"WT087480" = Insaniquarium Deluxe
"WT087485" = Jewel Quest II
"WT087490" = Jewel Quest Solitaire
"WT087501" = Plants vs. Zombies
"WT087510" = Slingo Deluxe
"WT087513" = Virtual Villagers - The Secret City
"WT087519" = Wedding Dash
"WT087533" = Zuma Deluxe
"WT087536" = Diner Dash 2 Restaurant Rescue
"Yahoo! Messenger" = Yahoo! Messenger

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Mozilla Firefox 13.0.1 (x86 de)" = Mozilla Firefox 13.0.1 (x86 de)
"Mozilla Thunderbird 12.0.1 (x86 de)" = Mozilla Thunderbird 12.0.1 (x86 de)

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 14.07.2012 11:14:04 | Computer Name = Saschahp | Source = MsiInstaller | ID = 10005
Description =

Error - 14.07.2012 11:14:25 | Computer Name = Saschahp | Source = MsiInstaller | ID = 10005
Description =

Error - 14.07.2012 11:14:29 | Computer Name = Saschahp | Source = MsiInstaller | ID = 10005
Description =

Error - 14.07.2012 11:14:33 | Computer Name = Saschahp | Source = MsiInstaller | ID = 10005
Description =

Error - 14.07.2012 11:23:52 | Computer Name = Saschahp | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error - 14.07.2012 11:23:53 | Computer Name = Saschahp | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error - 14.07.2012 11:23:53 | Computer Name = Saschahp | Source = Microsoft-Windows-LoadPerf | ID = 3011
Description = Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren
für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error - 14.07.2012 11:36:09 | Computer Name = Saschahp | Source = MsiInstaller | ID = 1043
Description =

Error - 14.07.2012 11:42:19 | Computer Name = Saschahp | Source = MsiInstaller | ID = 1043
Description =

Error - 14.07.2012 11:43:54 | Computer Name = Saschahp | Source = MsiInstaller | ID = 11706
Description =

[ Hewlett-Packard Events ]
Error - 27.07.2011 02:34:19 | Computer Name = Saschahp | Source = Hewlett-Packard | ID = 0
Description = AAProcessExited() C:\ProgramData\Hewlett-Packard\HP Support Framework\Telemetry\071127083417.xml
File not created by asset agent

Error - 07.09.2011 02:27:15 | Computer Name = Saschahp | Source = Hewlett-Packard | ID = 0
Description = AAProcessExited() C:\ProgramData\Hewlett-Packard\HP Support Framework\Telemetry\091107082712.xml
File not created by asset agent

Error - 26.10.2011 15:18:58 | Computer Name = Saschahp | Source = hpsa_service.exe | ID = 2000
Description = HP Error ID: -2146233088 bei HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateDetail(String
category) bei HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetectCore()

bei HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

bei HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
Boolean localScan) Message: Failed to perform update. StackTrace: bei HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateDetail(String
category) bei HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetectCore()

bei HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

bei HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
Boolean localScan) Source: HP.ActiveCheckLocalMode.SessionManager InnerException.Message:
Das Objekt "/9db6f88f_e877_4068_b98e_90dc92447915/ly9kpdybqohbesarpnhe78us_5.rem"
wurde getrennt oder ist nicht auf dem Server vorhanden. Name: hpsa_service.exe Version:
06.00.01.01 Path: C:\Program Files\Hewlett-Packard\HP Support Framework\hpsa_service.exe
Format:
de-DE RAM: 3071 Ram Utilization: TargetSite: Void UpdateDetail(System.String)

Error - 14.12.2011 11:21:29 | Computer Name = Saschahp | Source = HPSF.exe | ID = 4000
Description =

Error - 04.01.2012 11:07:51 | Computer Name = Saschahp | Source = hpsa_service.exe | ID = 2000
Description = HP Error ID: -2146233088 bei HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

bei HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
Boolean localScan) Message: One HP Active Check Local Mode job already running. StackTrace:
bei HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

bei HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
Boolean localScan) Source: HP.ActiveCheckLocalMode.SessionManager Name: hpsa_service.exe
Version:
06.00.01.01 Path: C:\Program Files\Hewlett-Packard\HP Support Framework\hpsa_service.exe
Format:
de-DE RAM: 3071 Ram Utilization: 30 TargetSite: Void UpdateAndDetect()

Error - 05.01.2012 18:21:37 | Computer Name = Saschahp | Source = hpsa_service.exe | ID = 2000
Description = HP Error ID: -2146233088 bei HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

bei HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
Boolean localScan) Message: One HP Active Check Local Mode job already running. StackTrace:
bei HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

bei HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
Boolean localScan) Source: HP.ActiveCheckLocalMode.SessionManager Name: hpsa_service.exe
Version:
06.00.01.01 Path: C:\Program Files\Hewlett-Packard\HP Support Framework\hpsa_service.exe
Format:
de-DE RAM: 3071 Ram Utilization: 40 TargetSite: Void UpdateAndDetect()

Error - 12.01.2012 15:33:09 | Computer Name = Saschahp | Source = hpsa_service.exe | ID = 2000
Description = HP Error ID: -2146233088 bei HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

bei HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
Boolean localScan) Message: One HP Active Check Local Mode job already running. StackTrace:
bei HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

bei HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
Boolean localScan) Source: HP.ActiveCheckLocalMode.SessionManager Name: hpsa_service.exe
Version:
06.00.01.01 Path: C:\Program Files\Hewlett-Packard\HP Support Framework\hpsa_service.exe
Format:
de-DE RAM: 3071 Ram Utilization: 30 TargetSite: Void UpdateAndDetect()

Error - 18.01.2012 11:20:08 | Computer Name = Saschahp | Source = hpsa_service.exe | ID = 2000
Description = HP Error ID: -2146233088 bei HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

bei HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
Boolean localScan) Message: One HP Active Check Local Mode job already running. StackTrace:
bei HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

bei HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
Boolean localScan) Source: HP.ActiveCheckLocalMode.SessionManager Name: hpsa_service.exe
Version:
06.00.01.01 Path: C:\Program Files\Hewlett-Packard\HP Support Framework\hpsa_service.exe
Format:
de-DE RAM: 3071 Ram Utilization: 60 TargetSite: Void UpdateAndDetect()

Error - 25.01.2012 11:53:45 | Computer Name = Saschahp | Source = hpsa_service.exe | ID = 2000
Description = HP Error ID: -2146233088hpsa_service.exe bei HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

bei HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
Boolean localScan) Message: One HP Active Check Local Mode job already running. StackTrace:
bei HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

bei HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
Boolean localScan) Source: HP.ActiveCheckLocalMode.SessionManager Name: hpsa_service.exe
Version:
06.00.01.01 Path: C:\Program Files\Hewlett-Packard\HP Support Framework\hpsa_service.exe
Format:
de-DE RAM: 3071 Ram Utilization: 60 TargetSite: Void UpdateAndDetect()

Error - 01.02.2012 11:43:53 | Computer Name = Saschahp | Source = hpsa_service.exe | ID = 2000
Description = HP Error ID: -2146233088 bei HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

bei HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
Boolean localScan) Message: One HP Active Check Local Mode job already running. StackTrace:
bei HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

bei HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
Boolean localScan) Source: HP.ActiveCheckLocalMode.SessionManager Name: hpsa_service.exe
Version:
06.00.01.01 Path: C:\Program Files\Hewlett-Packard\HP Support Framework\hpsa_service.exe
Format:
de-DE RAM: 3071 Ram Utilization: 60 TargetSite: Void UpdateAndDetect()

[ Media Center Events ]
Error - 04.01.2012 21:16:20 | Computer Name = Saschahp | Source = MCUpdate | ID = 0
Description = 02:16:20 - Fehler beim Herstellen der Internetverbindung. 02:16:20
- Serververbindung konnte nicht hergestellt werden..

Error - 04.01.2012 21:16:32 | Computer Name = Saschahp | Source = MCUpdate | ID = 0
Description = 02:16:31 - Fehler beim Herstellen der Internetverbindung. 02:16:31
- Serververbindung konnte nicht hergestellt werden..

Error - 05.01.2012 18:49:49 | Computer Name = Saschahp | Source = MCUpdate | ID = 0
Description = 23:49:49 - Fehler beim Herstellen der Internetverbindung. 23:49:49
- Serververbindung konnte nicht hergestellt werden..

Error - 05.01.2012 18:50:04 | Computer Name = Saschahp | Source = MCUpdate | ID = 0
Description = 23:50:01 - Fehler beim Herstellen der Internetverbindung. 23:50:01
- Serververbindung konnte nicht hergestellt werden..

Error - 08.01.2012 04:24:57 | Computer Name = Saschahp | Source = MCUpdate | ID = 0
Description = 09:24:57 - Fehler beim Herstellen der Internetverbindung. 09:24:57
- Serververbindung konnte nicht hergestellt werden..

Error - 08.01.2012 04:25:32 | Computer Name = Saschahp | Source = MCUpdate | ID = 0
Description = 09:25:27 - Fehler beim Herstellen der Internetverbindung. 09:25:27
- Serververbindung konnte nicht hergestellt werden..

Error - 11.01.2012 01:21:23 | Computer Name = Saschahp | Source = MCUpdate | ID = 0
Description = 06:21:23 - Fehler beim Herstellen der Internetverbindung. 06:21:23
- Serververbindung konnte nicht hergestellt werden..

Error - 11.01.2012 01:21:57 | Computer Name = Saschahp | Source = MCUpdate | ID = 0
Description = 06:21:52 - Fehler beim Herstellen der Internetverbindung. 06:21:52
- Serververbindung konnte nicht hergestellt werden..

Error - 12.01.2012 15:25:41 | Computer Name = Saschahp | Source = MCUpdate | ID = 0
Description = 20:25:41 - Fehler beim Herstellen der Internetverbindung. 20:25:41
- Serververbindung konnte nicht hergestellt werden..

Error - 12.01.2012 15:26:15 | Computer Name = Saschahp | Source = MCUpdate | ID = 0
Description = 20:26:10 - Fehler beim Herstellen der Internetverbindung. 20:26:10
- Serververbindung konnte nicht hergestellt werden..

[ System Events ]
Error - 14.07.2012 11:03:57 | Computer Name = Saschahp | Source = SRTSP | ID = 524293
Description = Error loading Symantec real time Anti-Virus driver.

Error - 14.07.2012 11:04:31 | Computer Name = Saschahp | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
BHDrvx86 SRTSP UimBus Uim_IM

Error - 14.07.2012 11:37:53 | Computer Name = Saschahp | Source = DCOM | ID = 10010
Description =

Error - 14.07.2012 11:39:34 | Computer Name = Saschahp | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
UimBus Uim_IM

Error - 14.07.2012 13:56:28 | Computer Name = Saschahp | Source = DCOM | ID = 10010
Description =

Error - 14.07.2012 13:58:20 | Computer Name = Saschahp | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
UimBus Uim_IM

Error - 14.07.2012 14:01:13 | Computer Name = Saschahp | Source = DCOM | ID = 10010
Description =

Error - 14.07.2012 14:02:35 | Computer Name = Saschahp | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
UimBus Uim_IM

Error - 14.07.2012 14:44:15 | Computer Name = Saschahp | Source = DCOM | ID = 10010
Description =

Error - 14.07.2012 14:45:34 | Computer Name = Saschahp | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
UimBus Uim_IM


< End of report >

OTL Logfile:

OTL logfile created on: 7/15/2012 11:19:55 PM - Run 1
OTL by OldTimer - Version 3.2.53.1     Folder = C:\1_internet\Download
 Professional  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 1.63 Gb Available Physical Memory | 54.41% Memory free
6.00 Gb Paging File | 4.59 Gb Available in Paging File | 76.55% Paging File free
Paging file location(s): c:\pagefile.sys 0 0 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455.86 Gb Total Space | 306.39 Gb Free Space | 67.21% Space Free | Partition Type: NTFS
Drive D: | 9.80 Gb Total Space | 1.20 Gb Free Space | 12.28% Space Free | Partition Type: NTFS
 
Computer Name: SASCHAHP | User Name: 1_Sascha | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012/07/15 23:17:54 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\1_internet\Download\OTL.exe
PRC - [2012/07/03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012/07/03 13:46:44 | 000,462,920 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012/03/28 01:14:06 | 000,138,232 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton AntiVirus\Engine\19.7.1.5\ccSvcHst.exe
PRC - [2012/01/03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011/09/09 18:10:28 | 000,086,072 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Hewlett-Packard\HP Support Framework\hpsa_service.exe
PRC - [2011/04/20 04:04:36 | 000,393,216 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe
PRC - [2011/04/20 04:04:06 | 000,176,128 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe
PRC - [2011/03/28 18:07:50 | 000,094,264 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe
PRC - [2011/02/26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010/09/15 11:11:22 | 000,339,312 | ---- | M] (Haufe-Lexware GmbH & Co. KG) -- C:\Program Files\Common Files\Lexware\Update Manager\LxUpdateManager.exe
PRC - [2010/04/01 11:16:20 | 000,357,696 | ---- | M] (DT Soft Ltd) -- C:\programme_1\DAEMON Tools Lite\DTLite.exe
PRC - [2010/02/11 19:07:54 | 000,710,656 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\HP Desktop Keyboard\HPKEYBOARDx.EXE
PRC - [2009/10/15 00:53:20 | 000,635,416 | ---- | M] (PDF Complete Inc) -- C:\Program Files\PDF Complete\pdfsvc.exe
PRC - [2009/08/25 04:11:16 | 000,656,896 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe
PRC - [2009/07/14 03:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009/07/02 23:58:40 | 000,406,016 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Desktop Keyboard\Keystatus.exe
PRC - [2009/05/09 01:39:48 | 002,068,992 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\HP MAINSTREAM KEYBOARD\BATINDICATOR.exe
PRC - [2009/05/09 01:11:00 | 002,068,992 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\HP MAINSTREAM KEYBOARD\CNYHKEY.exe
PRC - [2009/02/28 04:13:04 | 000,053,248 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP MAINSTREAM KEYBOARD\ModLEDKey.exe
PRC - [2008/11/20 19:47:28 | 000,062,768 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\HP Odometer\hpsysdrv.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012/06/14 18:38:37 | 000,593,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Messaging\9023843c5179d58bd814b64f440679a1\System.Messaging.ni.dll
MOD - [2012/06/14 18:33:58 | 011,824,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\84fbf353f91385690a3e4e982aa6930e\System.Web.ni.dll
MOD - [2012/06/14 18:33:38 | 012,433,920 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\009c50fb69919b90fb233cb4c35d0ad7\System.Windows.Forms.ni.dll
MOD - [2012/06/14 18:33:33 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\ebefde27b0ef7f39bb49c493b34a602c\System.Drawing.ni.dll
MOD - [2012/05/10 21:31:46 | 000,220,672 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\1435db5dea878f59191dc112a40e2185\CustomMarshalers.ni.dll
MOD - [2012/05/10 21:27:43 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\0c00b1a8336dd4c1bd1ebce7780f20b4\System.Runtime.Remoting.ni.dll
MOD - [2012/05/10 21:27:03 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\5c85c9c42e1b8a8760de82ecb4c7d582\System.Xml.ni.dll
MOD - [2012/05/10 21:27:01 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cb079eab134fd1a752ad91db13274110\System.Configuration.ni.dll
MOD - [2012/05/10 21:27:00 | 007,952,384 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\2ebb3c259eab50af565e3a8dba6ad20e\System.ni.dll
MOD - [2012/05/10 21:26:54 | 011,490,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\5858678a79aae31262b0214424245d06\mscorlib.ni.dll
MOD - [2010/09/15 05:20:34 | 000,434,176 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll
MOD - [2010/09/15 05:20:33 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010/09/15 05:20:33 | 000,208,896 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.resources\2.0.0.0_de_b77a5c561934e089\System.resources.dll
MOD - [2010/05/27 12:40:48 | 000,270,336 | ---- | M] () -- C:\programme_1\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
MOD - [2010/04/16 14:20:06 | 000,016,384 | R--- | M] () -- C:\programme_1\ATI Technologies\ATI.ACE\Branding\Branding.dll
MOD - [2010/03/15 11:28:22 | 000,141,824 | ---- | M] () -- C:\Program Files\WinRAR\rarext.dll
MOD - [2009/07/02 23:58:40 | 000,406,016 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Desktop Keyboard\Keystatus.exe
MOD - [2009/06/10 23:22:50 | 000,069,120 | ---- | M] () -- C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
MOD - [2009/02/28 04:13:04 | 000,053,248 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP MAINSTREAM KEYBOARD\ModLEDKey.exe
MOD - [2009/02/20 02:22:50 | 000,028,672 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP MAINSTREAM KEYBOARD\WMINPUT.DLL
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] -- C:\ProgramData\WMADMOE32.exe -- (wudfsvc32)
SRV - File not found [Auto | Stopped] -- C:\ProgramData\api-ms-win-core-fibers-l1-1-032.exe -- (W32Time32)
SRV - File not found [Auto | Stopped] -- C:\ProgramData\batt32.exe -- (vds32)
SRV - File not found [Auto | Stopped] -- C:\ProgramData\adsnt32.exe -- (PlugPlay32)
SRV - File not found [Auto | Stopped] -- C:\Windows\system32\odbcjt3232.exe -- (msiserver32)
SRV - File not found [Auto | Stopped] -- C:\ProgramData\xwizards32.exe -- (HomeGroupListener32)
SRV - [2012/07/14 18:31:09 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/07/03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012/03/28 01:14:06 | 000,138,232 | R--- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Norton AntiVirus\Engine\19.7.1.5\ccSvcHst.exe -- (NAV)
SRV - [2012/01/03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011/09/09 18:10:28 | 000,086,072 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files\Hewlett-Packard\HP Support Framework\hpsa_service.exe -- (HP Support Assistant Service)
SRV - [2011/04/20 04:04:06 | 000,176,128 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2011/03/28 18:07:50 | 000,094,264 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe -- (HPDrvMntSvc.exe)
SRV - [2010/04/04 01:01:24 | 000,246,520 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files\HP Games\HP Game Console\GameConsoleService.exe -- (GameConsoleService)
SRV - [2009/10/15 00:53:20 | 000,635,416 | ---- | M] (PDF Complete Inc) [Auto | Running] -- C:\Program Files\PDF Complete\pdfsvc.exe -- (pdfcDispatcher)
SRV - [2009/07/14 03:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009/07/14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009/07/14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2008/10/23 17:45:14 | 000,307,200 | ---- | M] (T-Systems Enterprise Services GmbH) [On_Demand | Stopped] -- C:\programme_1\dsl_speed\DslMgrSvc.exe -- (TDslMgrService)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ew_juwwanecm.sys -- (huawei_wwanecm)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ew_juextctrl.sys -- (huawei_ext_ctrl)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ew_jubusenum.sys -- (huawei_enumerator)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ew_jucdcacm.sys -- (huawei_cdcacm)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ew_usbenumfilter.sys -- (ew_usbenumfilter)
DRV - File not found [Kernel | On_Demand | Unknown] --  -- (a440u290)
DRV - [2012/07/14 17:08:59 | 001,589,752 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_19.5.0.145\Definitions\VirusDefs\20120714.017\NAVEX15.SYS -- (NAVEX15)
DRV - [2012/07/14 17:08:59 | 000,087,928 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_19.5.0.145\Definitions\VirusDefs\20120714.017\NAVENG.SYS -- (NAVENG)
DRV - [2012/07/13 08:31:52 | 000,382,624 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_19.5.0.145\Definitions\IPSDefs\20120713.001_c02\IDSvix86.sys -- (IDSVix86)
DRV - [2012/07/11 01:00:46 | 000,821,920 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_19.5.0.145\Definitions\BASHDefs\20120711.002_be1\BHDrvx86.sys -- (BHDrvx86)
DRV - [2012/07/03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012/05/31 04:24:01 | 000,376,480 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2012/05/31 04:24:01 | 000,106,656 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2012/04/19 06:19:42 | 000,141,944 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2012/03/29 08:28:38 | 000,318,584 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\NAV\1307010.005\symnets.sys -- (SymNetS)
DRV - [2012/03/29 08:28:30 | 000,905,336 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\System32\drivers\NAV\1307010.005\symefa.sys -- (SymEFA)
DRV - [2012/03/29 08:06:25 | 000,149,624 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\NAV\1307010.005\ironx86.sys -- (SymIRON)
DRV - [2012/03/29 08:03:27 | 000,574,072 | ---- | M] (Symantec Corporation) [File_System | System | Running] -- C:\Windows\System32\drivers\NAV\1307010.005\srtsp.sys -- (SRTSP)
DRV - [2012/03/29 08:03:27 | 000,032,888 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\NAV\1307010.005\srtspx.sys -- (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV - [2011/11/30 00:44:14 | 000,132,744 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\NAV\1307010.005\ccsetx86.sys -- (ccSet_NAV)
DRV - [2011/08/16 00:51:40 | 000,340,088 | R--- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\NAV\1307010.005\symds.sys -- (SymDS)
DRV - [2011/07/20 02:54:06 | 000,047,104 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\iBtFltCoex.sys -- (iBtFltCoex)
DRV - [2011/07/19 23:12:22 | 000,225,280 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\btmhsf.sys -- (btmhsf)
DRV - [2011/04/20 04:43:40 | 007,772,160 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag)
DRV - [2011/04/20 03:22:08 | 000,243,712 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)
DRV - [2011/03/03 12:42:16 | 000,381,032 | ---- | M] (Paragon) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\Uim_IM.sys -- (Uim_IM)
DRV - [2011/03/03 12:42:16 | 000,040,824 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\UimBus.sys -- (UimBus)
DRV - [2010/10/05 21:56:28 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2010/05/06 11:21:42 | 000,108,560 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV - [2010/02/26 11:31:22 | 000,132,480 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Impcd.sys -- (Impcd)
DRV - [2009/08/13 08:23:02 | 000,022,528 | ---- | M] (CSR, plc) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BthAvrcp.sys -- (BthAvrcp)
DRV - [2009/07/14 03:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2009/07/14 03:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2009/07/14 03:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2009/07/14 01:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2009/07/14 01:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2008/07/31 13:13:18 | 000,082,048 | ---- | M] (OEM) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\OxPPort.sys -- (OxPPort)
DRV - [2007/08/01 14:49:00 | 000,016,448 | ---- | M] (T-Systems Enterprise Services GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\dslmnlwf.sys -- (DslMNLwf)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = HP | MSN
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = HP | MSN
IE - HKLM\..\SearchScopes,DefaultScope = {94F1E091-7F44-46F5-A4DE-884660542A2B}
IE - HKLM\..\SearchScopes\{89FC8FD0-19CF-4EB2-B64E-46BDFD05F97D}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CMDTDF
IE - HKLM\..\SearchScopes\{94F1E091-7F44-46F5-A4DE-884660542A2B}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=CMDTDF&pc=CMDTDF&src=IE-SearchBox
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = HP | MSN
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = AD E5 D3 01 6F D2 A8 4C A3 37 87 A6 F4 AA CB E1  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {94F1E091-7F44-46F5-A4DE-884660542A2B}
IE - HKCU\..\SearchScopes\{89FC8FD0-19CF-4EB2-B64E-46BDFD05F97D}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CMDTDF
IE - HKCU\..\SearchScopes\{94F1E091-7F44-46F5-A4DE-884660542A2B}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=CMDTDF&pc=CMDTDF&src=IE-SearchBox
IE - HKCU\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: "URL" = hxxp://www.daemon-search.com/search/web?q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "SweetIM Search"
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.selectedEngine: "SweetIM Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: DTToolbar@toolbarnet.com:1.1.6.0143
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0
FF - prefs.js..network.proxy.type: 0
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: ""
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: ""
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_265.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_19.5.0.145\IPSFFPlgn\ [2012/07/14 17:02:47 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0\extensions\\Components: C:\programme_1\Mozilla Firefox\components [2012/06/17 10:58:11 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0\extensions\\Plugins: C:\programme_1\Mozilla Firefox\plugins [2012/07/14 17:02:47 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.4\extensions\\Components: C:\programme_1\Mozilla Thunderbird\components [2012/01/04 23:40:12 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.4\extensions\\Plugins: C:\programme_1\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\programme_1\Mozilla Firefox\components [2012/06/17 10:58:11 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\programme_1\Mozilla Firefox\plugins [2012/07/14 17:02:47 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 12.0.1\extensions\\Components: C:\programme_1\Mozilla Thunderbird\components [2012/01/04 23:40:12 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 12.0.1\extensions\\Plugins: C:\programme_1\Mozilla Thunderbird\plugins
 
[2010/10/05 21:30:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\1_Sascha\AppData\Roaming\mozilla\Extensions
[2010/10/05 21:30:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\1_Sascha\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012/07/14 10:56:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\1_Sascha\AppData\Roaming\mozilla\Firefox\Profiles\4wezsj6v.default\extensions
[2012/07/14 12:09:05 | 000,000,000 | ---D | M] (DealPly) -- C:\Users\1_Sascha\AppData\Roaming\mozilla\Firefox\Profiles\4wezsj6v.default\extensions\{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}
[2012/07/14 12:09:05 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\1_Sascha\AppData\Roaming\mozilla\Firefox\Profiles\4wezsj6v.default\extensions\ffxtlbr@babylon.com
[2012/07/14 12:09:05 | 000,000,000 | ---D | M] (Yontoo) -- C:\Users\1_Sascha\AppData\Roaming\mozilla\Firefox\Profiles\4wezsj6v.default\extensions\plugin@yontoo.com
 
O1 HOSTS File: ([2009/06/10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\19.7.1.5\IPS\IPSBHO.DLL (Symantec Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O4 - HKLM..\Run: [BATINDICATOR] C:\Program Files\Hewlett-Packard\HP MAINSTREAM KEYBOARD\BATINDICATOR.exe (Hewlett-Packard)
O4 - HKLM..\Run: [HP KEYBOARDx] C:\Program Files\Hewlett-Packard\HP Desktop Keyboard\HPKEYBOARDx.EXE (Hewlett-Packard)
O4 - HKLM..\Run: [HP Remote Solution] C:\Program Files\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe (Hewlett-Packard)
O4 - HKLM..\Run: [hpsysdrv] c:\program files\hewlett-packard\HP odometer\hpsysdrv.exe (Hewlett-Packard)
O4 - HKLM..\Run: [LaunchHPOSIAPP] C:\Program Files\Hewlett-Packard\HP MAINSTREAM KEYBOARD\LaunchApp.exe (Hewlett-Packard)
O4 - HKLM..\Run: [LexwareInfoService] C:\Program Files\Common Files\Lexware\Update Manager\LxUpdateManager.exe (Haufe-Lexware GmbH & Co. KG)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [PDF Complete] C:\Program Files\PDF Complete\pdfsty.exe (PDF Complete Inc)
O4 - HKLM..\Run: [StartCCC] C:\programme_1\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\programme_1\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\programme_1\Office_2003\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\programme_1\Office_2003\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKLM\..Trusted Domains: //about.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //Exclude.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //FWEvent.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //LanguageSelection.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //Message.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //MyAgttryCmd.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //MyAgttryNag.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //MyNotification.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //NOCLessUpdate.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //quarantine.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //ScanNow.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //strings.vbs/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //Template.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //Update.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: //VirFound.htm/ ([]myui in Trusted sites)
O15 - HKLM\..Trusted Domains: mcafee.com ([*] http in Trusted sites)
O15 - HKLM\..Trusted Domains: mcafee.com ([*] https in Trusted sites)
O15 - HKLM\..Trusted Domains: mcafeeasap.com ([betavscan] http in Trusted sites)
O15 - HKLM\..Trusted Domains: mcafeeasap.com ([betavscan] https in Trusted sites)
O15 - HKLM\..Trusted Domains: mcafeeasap.com ([vs] http in Trusted sites)
O15 - HKLM\..Trusted Domains: mcafeeasap.com ([vs] https in Trusted sites)
O15 - HKLM\..Trusted Domains: mcafeeasap.com ([www] http in Trusted sites)
O15 - HKLM\..Trusted Domains: mcafeeasap.com ([www] https in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{902A43DE-C8BF-4058-93D9-CEAEFC35637A}: NameServer = 192.168.2.1
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{6787963a-b63e-11e1-b084-00158315a220}\Shell - "" = AutoRun
O33 - MountPoints2\{6787963a-b63e-11e1-b084-00158315a220}\Shell\AutoRun\command - "" = H:\iStudio.exe
O33 - MountPoints2\{72dfa0d5-413a-11e1-b071-00158315a220}\Shell - "" = AutoRun
O33 - MountPoints2\{72dfa0d5-413a-11e1-b071-00158315a220}\Shell\AutoRun\command - "" = H:\AutoRun.exe
O33 - MountPoints2\{72dfa0f1-413a-11e1-b071-00158315a220}\Shell - "" = AutoRun
O33 - MountPoints2\{72dfa0f1-413a-11e1-b071-00158315a220}\Shell\AutoRun\command - "" = H:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - Reg Error: Value error.
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - StartUpReg: Messenger (Yahoo!) - hkey= - key= -  File not found
MsConfig - StartUpReg: Skype - hkey= - key= -  File not found
MsConfig - State: "startup" - 2
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/07/14 17:24:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/07/14 17:24:14 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012/07/14 15:14:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ShadowExplorer
[2012/07/14 15:14:37 | 000,000,000 | ---D | C] -- C:\Program Files\ShadowExplorer
[2012/07/14 14:35:56 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip
[2012/07/14 12:21:11 | 000,000,000 | ---D | C] -- C:\Program Files\Oracle
[2012/07/14 11:02:40 | 000,000,000 | ---D | C] -- C:\Users\1_Sascha\AppData\Roaming\Malwarebytes
[2012/07/14 11:02:24 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012/07/14 11:02:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/07/14 10:56:29 | 000,000,000 | ---D | C] -- C:\Program Files\BabylonToolbar
[2012/07/14 10:56:21 | 000,000,000 | ---D | C] -- C:\Program Files\DownloadManager
[2012/07/14 10:56:19 | 000,000,000 | ---D | C] -- C:\Users\1_Sascha\AppData\Roaming\BabylonToolbar
[2012/07/14 10:55:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Tarma Installer
[2012/07/14 10:55:57 | 000,000,000 | ---D | C] -- C:\Program Files\DealPly
[2012/07/14 10:43:51 | 000,000,000 | ---D | C] -- C:\Users\1_Sascha\AppData\Roaming\Uniblue
[2012/07/14 10:43:48 | 000,000,000 | ---D | C] -- C:\Program Files\Uniblue
[2012/07/14 07:33:39 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2012/06/19 22:46:46 | 000,000,000 | ---D | C] -- C:\Users\1_Sascha\AppData\Local\Macromedia
[4 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/07/15 22:29:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/07/14 20:53:52 | 000,016,768 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/07/14 20:53:52 | 000,016,768 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/07/14 20:45:27 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/07/14 20:45:16 | 2415,321,088 | -HS- | M] () -- C:\hiberfil.sys
[2012/07/14 19:58:06 | 000,285,520 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012/07/14 17:39:29 | 000,000,332 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleFor1_Sascha.job
[2012/07/14 17:24:19 | 000,001,076 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012/07/14 17:23:56 | 001,295,934 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012/07/14 17:23:56 | 000,836,516 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/07/14 17:23:56 | 000,334,762 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012/07/14 17:23:56 | 000,287,806 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/07/14 17:17:33 | 000,000,400 | ---- | M] () -- C:\Windows\ODBC.INI
[2012/07/14 11:14:01 | 000,003,216 | ---- | M] () -- C:\{359C4B7E-4A4B-451F-9C03-451DE82C7652}
[2012/07/03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[4 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/07/14 17:24:19 | 000,001,076 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012/07/14 11:14:00 | 000,003,216 | ---- | C] () -- C:\{359C4B7E-4A4B-451F-9C03-451DE82C7652}
[2012/03/12 10:58:43 | 000,004,096 | -H-- | C] () -- C:\Users\1_Sascha\AppData\Local\keyfile3.drm
[2011/12/28 19:53:23 | 000,000,419 | ---- | C] () -- C:\Windows\wiso.ini
[2011/07/13 22:20:46 | 000,000,197 | ---- | C] () -- C:\Windows\System32\MRT.INI
[2011/03/17 19:51:44 | 000,003,929 | ---- | C] () -- C:\Windows\System32\atipblag.dat
[2011/02/28 23:30:06 | 000,233,012 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2011/02/20 15:32:03 | 000,000,000 | ---- | C] () -- C:\Windows\HPMProp.INI
[2011/01/28 10:51:47 | 000,040,960 | ---- | C] () -- C:\Windows\unVC52Z.dll
[2011/01/16 15:55:09 | 000,000,056 | ---- | C] () -- C:\ProgramData\ezsidmv.dat
[2011/01/16 15:48:46 | 000,000,150 | ---- | C] () -- C:\ProgramData\20ae7cbb
[2010/10/08 21:04:30 | 000,007,605 | ---- | C] () -- C:\Users\1_Sascha\AppData\Local\resmon.resmoncfg
[2010/10/07 20:04:49 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2010/10/07 07:02:42 | 000,033,134 | ---- | C] () -- C:\Users\1_Sascha\AppData\Roaming\UserTile.png
[2010/10/05 20:43:18 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2010/09/15 05:34:06 | 000,208,896 | ---- | C] () -- C:\Windows\System32\iglhsip32.dll
[2010/09/15 05:34:06 | 000,143,360 | ---- | C] () -- C:\Windows\System32\iglhcp32.dll
[2010/09/15 05:34:05 | 000,982,240 | ---- | C] () -- C:\Windows\System32\igkrng500.bin
[2010/09/15 05:34:05 | 000,439,308 | ---- | C] () -- C:\Windows\System32\igcompkrng500.bin
[2010/09/15 05:34:05 | 000,092,356 | ---- | C] () -- C:\Windows\System32\igfcg500m.bin
[2010/09/15 05:34:05 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll
[2010/09/15 05:34:05 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll
[2010/09/15 05:34:05 | 000,000,151 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config
[2010/09/15 05:21:23 | 001,295,934 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2010/09/15 05:21:23 | 000,334,762 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2010/09/15 05:21:23 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2010/09/15 05:21:23 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat
 
========== LOP Check ==========
 
[2012/04/15 10:58:16 | 000,000,000 | ---D | M] -- C:\Users\1_Sascha\AppData\Roaming\Babylon
[2012/07/14 12:09:05 | 000,000,000 | ---D | M] -- C:\Users\1_Sascha\AppData\Roaming\BabylonToolbar
[2011/12/28 19:53:34 | 000,000,000 | ---D | M] -- C:\Users\1_Sascha\AppData\Roaming\Buhl Data Service
[2012/04/15 11:02:52 | 000,000,000 | ---D | M] -- C:\Users\1_Sascha\AppData\Roaming\DAEMON Tools Lite
[2010/12/28 17:01:19 | 000,000,000 | ---D | M] -- C:\Users\1_Sascha\AppData\Roaming\Lexware
[2010/10/07 06:05:19 | 000,000,000 | ---D | M] -- C:\Users\1_Sascha\AppData\Roaming\T-Online
[2011/06/27 20:31:22 | 000,000,000 | ---D | M] -- C:\Users\1_Sascha\AppData\Roaming\TeamViewer
[2010/10/05 21:30:37 | 000,000,000 | ---D | M] -- C:\Users\1_Sascha\AppData\Roaming\Thunderbird
[2012/07/14 10:43:51 | 000,000,000 | ---D | M] -- C:\Users\1_Sascha\AppData\Roaming\Uniblue
[2011/09/14 09:09:36 | 000,000,000 | ---D | M] -- C:\Users\1_Sascha\AppData\Roaming\WinBatch
[2011/11/24 23:26:00 | 000,032,620 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %SYSTEMDRIVE%\*. >
[2012/07/14 17:02:23 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN
[2012/04/03 20:53:13 | 000,000,000 | ---D | M] -- C:\1_internet
[2012/07/14 17:26:44 | 000,000,000 | ---D | M] -- C:\2_daten
[2012/07/14 17:02:31 | 000,000,000 | ---D | M] -- C:\ATI
[2009/07/25 15:42:27 | 000,000,000 | -HSD | M] -- C:\Boot
[2012/07/14 19:57:25 | 000,000,000 | ---D | M] -- C:\Config.Msi
[2009/07/14 06:53:55 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2010/09/15 05:13:03 | 000,000,000 | RHSD | M] -- C:\hp
[2012/07/14 17:02:36 | 000,000,000 | ---D | M] -- C:\HP Universal Print Driver PCL5 32-bit v5.2.5.9108
[2012/07/14 17:02:37 | 000,000,000 | ---D | M] -- C:\HP Universal Print Driver PostScript 32-bit v5.2.5.9108
[2010/10/07 20:01:30 | 000,000,000 | RH-D | M] -- C:\MSOCache
[2012/07/14 18:13:32 | 000,000,000 | R--D | M] -- C:\Program Files
[2012/07/14 18:13:23 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2012/07/14 17:54:04 | 000,000,000 | ---D | M] -- C:\programme_1
[2009/07/25 14:54:41 | 000,000,000 | -HSD | M] -- C:\Recovery
[2012/07/14 17:00:54 | 000,000,000 | ---D | M] -- C:\SWSETUP
[2012/07/15 23:21:17 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2012/07/14 17:02:58 | 000,000,000 | -H-D | M] -- C:\SYSTEM.SAV
[2011/11/17 21:42:39 | 000,000,000 | R--D | M] -- C:\Users
[2011/01/28 08:24:25 | 000,000,000 | ---D | M] -- C:\VQ
[2012/07/14 17:39:07 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2010.09.15 05:27:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=00B0358734CAA32C39D181FE6916B178 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20542_none_523cdab8f40fe558\explorer.exe
[2011.02.26 07:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe
[2009.07.14 03:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe
[2011.02.26 07:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_525b5180f3f95373\explorer.exe
[2010.09.15 05:29:33 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe
[2011.02.26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\explorer.exe
[2011.02.26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_51a3a583dafd0cef\explorer.exe
[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe
[2010.09.15 05:26:13 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe
[2010.09.15 05:26:13 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe
[2010.09.15 05:29:33 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe
[2010.09.15 05:27:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=FC89FACA0473641CB625EDA9277D0885 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16434_none_51c00e6ddae85c4b\explorer.exe
 
< MD5 for: IASTORV.SYS  >
[2010.09.15 05:33:42 | 000,332,168 | ---- | M] (Intel Corporation) MD5=2D2918606673C46769FB516A5ACE958E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16592_none_aed9db9de9265a3a\iaStorV.sys
[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys
[2011.03.11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\System32\drivers\iaStorV.sys
[2011.03.11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0033117673c16921\iaStorV.sys
[2011.03.11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys
[2011.03.11 07:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys
[2011.03.11 07:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys
[2010.09.15 05:33:42 | 000,332,160 | ---- | M] (Intel Corporation) MD5=FE8186428F0AB44F0E500C7AA33E9B51 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20712_none_afb9f9af020317a3\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\System32\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2010.09.15 05:33:42 | 000,143,752 | ---- | M] (NVIDIA Corporation) MD5=1D8B6A440DFF2BDEAA4EB209FCBA21BF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16592_none_39a34c4d205d0412\nvstor.sys
[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys
[2011.03.11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\System32\drivers\nvstor.sys
[2011.03.11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_38e464dbe521cc7f\nvstor.sys
[2011.03.11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys
[2011.03.11 07:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys
[2011.03.11 07:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys
[2010.09.15 05:33:42 | 000,143,752 | ---- | M] (NVIDIA Corporation) MD5=F3596C8A63D3871890B0D3A0DFFEF0D0 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20712_none_3a836a5e3939c17b\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\System32\scecli.dll
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\System32\user32.dll
[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\System32\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010.09.15 05:29:33 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\System32\winlogon.exe
[2010.09.15 05:29:33 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2010.09.15 05:29:33 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2012/07/03 13:46:42 | 000,217,672 | ---- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2010.10.05 21:56:28 | 000,691,696 | ---- | M] () Unable to obtain MD5 -- C:\Windows\system32\drivers\sptd.sys
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\system32\*.dll /lockedfiles >
[4 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]
 
< %USERPROFILE%\*.* >
[2012.07.15 23:31:05 | 002,621,440 | -HS- | M] () -- C:\Users\1_Sascha\ntuser.dat
[2012.07.15 23:31:05 | 000,262,144 | -HS- | M] () -- C:\Users\1_Sascha\ntuser.dat.LOG1
[2010.10.05 20:20:42 | 000,000,000 | -HS- | M] () -- C:\Users\1_Sascha\ntuser.dat.LOG2
[2012.07.14 09:58:54 | 000,065,536 | -HS- | M] () -- C:\Users\1_Sascha\ntuser.dat{109470f9-cd87-11e1-b9a0-c7171a5fd512}.TM.blf
[2012.07.14 09:58:54 | 000,524,288 | -HS- | M] () -- C:\Users\1_Sascha\ntuser.dat{109470f9-cd87-11e1-b9a0-c7171a5fd512}.TMContainer00000000000000000001.regtrans-ms
[2012.07.14 09:58:54 | 000,524,288 | -HS- | M] () -- C:\Users\1_Sascha\ntuser.dat{109470f9-cd87-11e1-b9a0-c7171a5fd512}.TMContainer00000000000000000002.regtrans-ms
[2012.04.15 11:42:51 | 000,065,536 | -HS- | M] () -- C:\Users\1_Sascha\ntuser.dat{1443a74c-86d4-11e1-b0d3-00158315a220}.TM.blf
[2012.04.15 11:42:51 | 000,524,288 | -HS- | M] () -- C:\Users\1_Sascha\ntuser.dat{1443a74c-86d4-11e1-b0d3-00158315a220}.TMContainer00000000000000000001.regtrans-ms
[2012.04.15 11:42:51 | 000,524,288 | -HS- | M] () -- C:\Users\1_Sascha\ntuser.dat{1443a74c-86d4-11e1-b0d3-00158315a220}.TMContainer00000000000000000002.regtrans-ms
[2011.08.25 06:11:28 | 000,065,536 | -HS- | M] () -- C:\Users\1_Sascha\ntuser.dat{39ed5e8d-caf3-11e0-ac38-00158315a220}.TM.blf
[2011.08.25 06:11:25 | 000,524,288 | -HS- | M] () -- C:\Users\1_Sascha\ntuser.dat{39ed5e8d-caf3-11e0-ac38-00158315a220}.TMContainer00000000000000000001.regtrans-ms
[2011.08.25 06:11:28 | 000,524,288 | -HS- | M] () -- C:\Users\1_Sascha\ntuser.dat{39ed5e8d-caf3-11e0-ac38-00158315a220}.TMContainer00000000000000000002.regtrans-ms
[2010.10.05 20:28:14 | 000,065,536 | -HS- | M] () -- C:\Users\1_Sascha\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf
[2010.10.05 20:28:14 | 000,524,288 | -HS- | M] () -- C:\Users\1_Sascha\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms
[2010.10.05 20:28:14 | 000,524,288 | -HS- | M] () -- C:\Users\1_Sascha\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms
[2011.01.04 12:38:38 | 000,065,536 | -HS- | M] () -- C:\Users\1_Sascha\ntuser.dat{95ed8cf4-17ed-11e0-aee1-00158315a220}.TM.blf
[2011.01.04 12:38:38 | 000,524,288 | -HS- | M] () -- C:\Users\1_Sascha\ntuser.dat{95ed8cf4-17ed-11e0-aee1-00158315a220}.TMContainer00000000000000000001.regtrans-ms
[2011.01.04 12:38:38 | 000,524,288 | -HS- | M] () -- C:\Users\1_Sascha\ntuser.dat{95ed8cf4-17ed-11e0-aee1-00158315a220}.TMContainer00000000000000000002.regtrans-ms
[2012.07.14 14:31:26 | 000,065,536 | -HS- | M] () -- C:\Users\1_Sascha\ntuser.dat{dfaabe3f-cd9a-11e1-b0c8-00158315a220}.TM.blf
[2012.07.14 14:31:26 | 000,524,288 | -HS- | M] () -- C:\Users\1_Sascha\ntuser.dat{dfaabe3f-cd9a-11e1-b0c8-00158315a220}.TMContainer00000000000000000001.regtrans-ms
[2012.07.14 14:31:26 | 000,524,288 | -HS- | M] () -- C:\Users\1_Sascha\ntuser.dat{dfaabe3f-cd9a-11e1-b0c8-00158315a220}.TMContainer00000000000000000002.regtrans-ms
[2012.07.14 17:37:54 | 000,065,536 | -HS- | M] () -- C:\Users\1_Sascha\ntuser.dat{eb11dfc7-cdc2-11e1-b0f6-00158315a220}.TM.blf
[2012.07.14 17:37:54 | 000,524,288 | -HS- | M] () -- C:\Users\1_Sascha\ntuser.dat{eb11dfc7-cdc2-11e1-b0f6-00158315a220}.TMContainer00000000000000000001.regtrans-ms
[2012.07.14 17:37:54 | 000,524,288 | -HS- | M] () -- C:\Users\1_Sascha\ntuser.dat{eb11dfc7-cdc2-11e1-b0f6-00158315a220}.TMContainer00000000000000000002.regtrans-ms
[2012.01.04 23:55:33 | 000,065,536 | -HS- | M] () -- C:\Users\1_Sascha\ntuser.dat{f26ab411-3717-11e1-b5af-00158315a220}.TM.blf
[2012.01.04 23:55:33 | 000,524,288 | -HS- | M] () -- C:\Users\1_Sascha\ntuser.dat{f26ab411-3717-11e1-b5af-00158315a220}.TMContainer00000000000000000001.regtrans-ms
[2012.01.04 23:55:33 | 000,524,288 | -HS- | M] () -- C:\Users\1_Sascha\ntuser.dat{f26ab411-3717-11e1-b5af-00158315a220}.TMContainer00000000000000000002.regtrans-ms
[2010.10.05 20:20:43 | 000,000,020 | -HS- | M] () -- C:\Users\1_Sascha\ntuser.ini
 
< %USERPROFILE%\Local Settings\Temp\*.exe >
 
< %USERPROFILE%\Local Settings\Temp\*.dll >
 
< %USERPROFILE%\Application Data\*.exe >
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
 
<           >

< End of report >
         

--- --- ---

sehe doch, dass du schon shadow explorer etc genutzt hast, erfolgreich?

zum teil.... es sind noch einige dateien (bilder) verschlüßelt. ich habe sie auf eine externe platte geschoben. habe hier gelesen das ich was warten soll bis es vieleicht eine rückschlüsselung gibt. ich hoffe ja nur das ich den trojaner los bin.... kann man das auch erkennen aus dem bericht?

mal hier lesen:
http://www.trojaner-board.de/116851-...tml#post851585