Hallo geschätztes Trojaner-Board!

Habe mir gestern den störenden BKA-Trojaner eingefangen und hoffe das auch ich ihn mit eurer Hilfe loswerde.

Win7 64bit

Trojaner: "Der Computer ist für die Verletzung der Gesetze der Bundesrepublik Deutschland wurde blockiert"

Im Folgenden die Logs von Malwarebytes und OTL.
Den ersten Scan mit Malwarebytes habe ich als quick scan gemacht und leider den log vergessen zu speichern (4 Funde).
Den zweiten scan habe ich als full scan gemacht (weitere 4 Funde, siehe nachfolgender Log)

Malwarebytes Log:

Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.21.12

Windows 7 x64 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 8.0.7600.16385
Patrick :: PATRICK-PC [Administrator]

22-Jul-12 01:41:42
mbam-log-2012-07-22 (01-41-42).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|Z:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 819048
Laufzeit: 1 Stunde(n), 42 Minute(n), 25 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 5
C:\Program Files (x86)\Cryptload_1.1.8\cl1.1.8\router\FRITZ!Box\nc.exe (PUP.Netcat) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Patrick\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\6c0d50cf-79be6c7d (Trojan.Zbot.CBCGen) -> Erfolgreich gelöscht und in Quarantäne gestellt.
Z:\CryptLoad_1.1.6\router\FRITZ!Box\nc.exe (PUP.Netcat) -> Erfolgreich gelöscht und in Quarantäne gestellt.
Z:\Treiber & Programme Acer Spire 6930 W7\OODefrag15Professional64Ger\keygen.exe (RiskWare.Tool.CK) -> Erfolgreich gelöscht und in Quarantäne gestellt.
Z:\Treiber & Programme Acer Spire 6930 W7\TuneUp.Utilities.2012.v12.0.2120.5.IuP\TuneUp.Utilities.2012.v12.0.2120.5.IuP\CORE\keygen.exe (Malware.Packer) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
         

OTL-Log

OTL logfile created on: 23-Jul-12 08:43:48 - Run 1
OTL by OldTimer - Version 3.2.54.0     Folder = C:\Users\Patrick\Desktop
64bit- Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: dd-MMM-yy
 
3.97 Gb Total Physical Memory | 2.70 Gb Available Physical Memory | 68.13% Memory free
7.93 Gb Paging File | 6.76 Gb Available in Paging File | 85.28% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 48.73 Gb Total Space | 1.96 Gb Free Space | 4.03% Space Free | Partition Type: NTFS
Drive Z: | 249.26 Gb Total Space | 117.69 Gb Free Space | 47.22% Space Free | Partition Type: NTFS
 
Computer Name: PATRICK-PC | User Name: Patrick | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Patrick\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Users\Patrick\Desktop\OTH.scr (OldTimer Tools)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Opera\opera.exe (Opera Software)
PRC - C:\Program Files (x86)\Opera\pluginwrapper\opera_plugin_wrapper.exe (Opera Software)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (OODefragAgent) -- C:\Program Files\OO Software\Defrag\oodag.exe (O&O Software GmbH)
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe (TuneUp Software)
SRV - (MotoHelper) -- C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe ()
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (Macromedia Licensing Service) -- C:\Program Files (x86)\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe ()
SRV - (Connectify) -- C:\Program Files (x86)\Connectify\Connectifyd.exe (Connectify)
SRV - (NAUpdate) @C:\Program Files (x86) -- C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG)
SRV - (Creative ALchemy AL6 Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe (Creative Labs)
SRV - (Creative Audio Engine Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs)
SRV - (CTAudSvcService) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (ssadmdm) -- C:\Windows\SysNative\drivers\ssadmdm.sys (MCCI Corporation)
DRV:64bit: - (ssadserd) SAMSUNG Android USB Diagnostic Serial Port (WDM) -- C:\Windows\SysNative\drivers\ssadserd.sys (MCCI Corporation)
DRV:64bit: - (ssadbus) SAMSUNG Android USB Composite Device driver (WDM) -- C:\Windows\SysNative\drivers\ssadbus.sys (MCCI Corporation)
DRV:64bit: - (androidusb) -- C:\Windows\SysNative\drivers\ssadadb.sys (Google Inc)
DRV:64bit: - (ssadmdfl) SAMSUNG Android USB Modem (Filter) -- C:\Windows\SysNative\drivers\ssadmdfl.sys (MCCI Corporation)
DRV:64bit: - (ElbyCDIO) -- C:\Windows\SysNative\drivers\ElbyCDIO.sys (Elaborate Bytes AG)
DRV:64bit: - (connctfyMP) -- C:\Windows\SysNative\drivers\connctfy.sys (Connectify)
DRV:64bit: - (connctfy) -- C:\Windows\SysNative\drivers\connctfy.sys (Connectify)
DRV:64bit: - (ksaud) -- C:\Windows\SysNative\drivers\ksaud.sys (Creative Technology Ltd.)
DRV:64bit: - (NETw5s64) Intel(R) -- C:\Windows\SysNative\drivers\NETw5s64.sys (Intel Corporation)
DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (L1E) -- C:\Windows\SysNative\drivers\L1E62x64.sys (Atheros Communications, Inc.)
DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ROOTMODEM) -- C:\Windows\SysNative\drivers\rootmdm.sys (Microsoft Corporation)
DRV:64bit: - (SrvHsfV92) -- C:\Windows\SysNative\drivers\VSTDPV6.SYS (Conexant Systems, Inc.)
DRV:64bit: - (SrvHsfWinac) -- C:\Windows\SysNative\drivers\VSTCNXT6.SYS (Conexant Systems, Inc.)
DRV:64bit: - (SrvHsfHDA) -- C:\Windows\SysNative\drivers\VSTAZL6.SYS (Conexant Systems, Inc.)
DRV:64bit: - (netw5v64) Intel(R) -- C:\Windows\SysNative\drivers\netw5v64.sys (Intel Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (LUMDriver) -- C:\Windows\SysNative\drivers\LUMDriver.sys (IBM)
DRV:64bit: - (winbondcir) -- C:\Windows\SysNative\drivers\winbondcir.sys (Winbond Electronics Corporation)
DRV:64bit: - (ElbyCDFL) -- C:\Windows\SysNative\drivers\ElbyCDFL.sys (SlySoft, Inc.)
DRV:64bit: - (RimVSerPort) -- C:\Windows\SysNative\drivers\RimSerial_AMD64.sys (Research in Motion Ltd)
DRV:64bit: - (Razerlow) -- C:\Windows\SysNative\drivers\DB3G.sys (Razer (Asia-Pacific) Pte Ltd)
DRV - (TuneUpUtilitiesDrv) -- C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys (TuneUp Software)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (UnlockerDriver5) -- C:\Program Files (x86)\Unlocker\UnlockerDriver5.sys ()
DRV - (ElbyCDFL) -- C:\Windows\SysWOW64\drivers\ElbyCDFL.sys (SlySoft, Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\URLSearchHook: {cd90bf73-20f6-44ef-993d-bb920303bd2e} - C:\Program Files (x86)\Veoh_Web_Player\prxtbVeo0.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2653012
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2653012
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/iat/us_de.aspx
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = F6 A9 7F 71 4C 5B CB 01  [binary data]
IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - No CLSID value found
IE - HKCU\..\URLSearchHook: {cd90bf73-20f6-44ef-993d-bb920303bd2e} - C:\Program Files (x86)\Veoh_Web_Player\prxtbVeo0.dll (Conduit Ltd.)
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2653012
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.2.1.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065}:3.2.1.3
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_265.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.5.17\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011-03-14 16:04:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.5.17\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011-03-14 16:04:59 | 000,000,000 | ---D | M]
 
[2010-01-20 18:15:47 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Patrick\AppData\Roaming\mozilla\Extensions
[2012-07-02 11:55:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\a5yp3qmn.default\extensions
[2010-11-08 20:38:51 | 000,000,000 | ---D | M] (softonic-de3 Community Toolbar) -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\a5yp3qmn.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}
[2010-11-08 20:38:50 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\Patrick\AppData\Roaming\mozilla\Firefox\Profiles\a5yp3qmn.default\extensions\engine@conduit.com
[2012-05-30 14:51:11 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2010-04-19 16:05:36 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010-09-21 21:06:28 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010-07-17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011-03-10 16:54:18 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011-03-10 16:54:18 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011-03-10 16:54:18 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011-03-10 16:54:18 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011-03-10 16:54:18 | 000,000,801 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009-06-10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (CmjBrowserHelperObject Object) - {6FE6A929-59D1-4763-91AD-29B61CFFB35B} - C:\Program Files (x86)\Mindjet\MindManager 8\Mm8InternetExplorer.dll (Mindjet)
O2 - BHO: (Veoh Web Player Toolbar) - {cd90bf73-20f6-44ef-993d-bb920303bd2e} - C:\Program Files (x86)\Veoh_Web_Player\prxtbVeo0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) -  - No CLSID value found.
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Veoh Web Player Toolbar) - {cd90bf73-20f6-44ef-993d-bb920303bd2e} - C:\Program Files (x86)\Veoh_Web_Player\prxtbVeo0.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Veoh Web Player Toolbar) - {CD90BF73-20F6-44EF-993D-BB920303BD2E} - C:\Program Files (x86)\Veoh_Web_Player\prxtbVeo0.dll (Conduit Ltd.)
O4:64bit: - HKLM..\Run: [OODefragTray] C:\Program Files\OO Software\Defrag\oodtray.exe (O&O Software GmbH)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [VaultCredProvider] C:\Users\Patrick\AppData\Local\Microsoft\Windows\2145\VaultCredProvider.exe ()
O4 - HKLM..\Run: [VolPanel] C:\Program Files (x86)\Creative\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
O4 - HKCU..\Run: [Rainlendar2] C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe ()
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware  (cleanup)] rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: An Mindjet MindManager senden - {2F72393D-2472-4F82-B600-ED77F354B7FF} - C:\Program Files (x86)\Mindjet\MindManager 8\Mm8InternetExplorer.dll (Mindjet)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: apemap.com ([]http in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15111/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 217.0.43.33 217.0.43.17 217.237.150.97
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EF220527-25EF-4580-9D93-D15904667586}: DhcpNameServer = 217.0.43.33 217.0.43.17 217.237.150.97
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{04530ea9-e7f5-11df-8064-00238b8f6b1d}\Shell - "" = AutoRun
O33 - MountPoints2\{04530ea9-e7f5-11df-8064-00238b8f6b1d}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\{0f863e57-e161-11e0-bba3-00238b8f6b1d}\Shell - "" = AutoRun
O33 - MountPoints2\{0f863e57-e161-11e0-bba3-00238b8f6b1d}\Shell\AutoRun\command - "" = F:\setup.exe -a
O33 - MountPoints2\{5374fc82-1a7e-11e0-a59e-00238b8f6b1d}\Shell - "" = AutoRun
O33 - MountPoints2\{5374fc82-1a7e-11e0-a59e-00238b8f6b1d}\Shell\AutoRun\command - "" = F:\setup.exe -a
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\setup.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (OODBS)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012-07-23 08:36:09 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Patrick\Desktop\OTL.exe
[2012-07-22 01:42:53 | 000,259,584 | ---- | C] (OldTimer Tools) -- C:\Users\Patrick\Desktop\OTH.scr
[2012-07-22 01:08:36 | 000,000,000 | ---D | C] -- C:\Users\Patrick\AppData\Roaming\Malwarebytes
[2012-07-22 01:08:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012-07-22 01:08:22 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012-07-22 01:08:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012-07-22 01:08:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012-07-22 01:07:39 | 010,652,120 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\Patrick\Desktop\mbam-setup-1.62.0.1300.exe
[2012-07-21 23:56:34 | 000,000,000 | ---D | C] -- C:\Users\Patrick\AppData\Roaming\hellomoto
[2012-07-16 15:23:31 | 000,000,000 | ---D | C] -- C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SplitCam
[2012-07-16 15:15:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SplitCam
[2012-07-16 15:04:44 | 051,827,296 | ---- | C] (SplitCam Co.) -- C:\Users\Patrick\Desktop\SplitCamSetup.exe
[2012-07-15 18:34:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAVID-LASERSCANNER 3
[2012-07-15 18:34:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DAVID-LASERSCANNER3
[2012-07-13 16:54:16 | 000,000,000 | ---D | C] -- C:\Users\Patrick\AppData\Roaming\Mobile Atlas Creator
[2012-07-13 16:49:06 | 000,000,000 | ---D | C] -- C:\Users\Patrick\AppData\Local\Macromedia
[2012-07-11 08:07:14 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll
[2012-07-11 08:07:12 | 001,460,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll
[2012-07-11 08:07:11 | 000,140,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll
[2012-07-10 20:33:11 | 000,000,000 | ---D | C] -- C:\Users\Patrick\Desktop\tribute von panem
[2012-07-10 07:54:22 | 000,000,000 | ---D | C] -- C:\Users\Patrick\Desktop\Edward Simoni - Magie Der Ferne (1997)
[2012-06-29 14:56:18 | 000,000,000 | R--D | C] -- C:\Users\Patrick\Dropbox
[2012-06-29 14:53:24 | 000,000,000 | ---D | C] -- C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
[2012-06-29 14:50:55 | 000,000,000 | ---D | C] -- C:\Users\Patrick\AppData\Roaming\Dropbox
[2012-06-23 13:15:29 | 002,622,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll
[2012-06-23 13:15:29 | 000,057,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuauclt.exe
[2012-06-23 13:15:29 | 000,044,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll
[2012-06-23 13:15:12 | 000,701,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapi.dll
[2012-06-23 13:15:12 | 000,099,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wudriver.dll
[2012-06-23 13:15:12 | 000,038,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups.dll
[2012-06-23 13:14:57 | 000,186,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuwebv.dll
[2012-06-23 13:14:57 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapp.exe
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\Users\Patrick\AppData\Roaming\*.tmp files -> C:\Users\Patrick\AppData\Roaming\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012-07-23 08:36:09 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Patrick\Desktop\OTL.exe
[2012-07-23 08:03:26 | 001,480,602 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012-07-23 08:03:26 | 000,644,978 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012-07-23 08:03:26 | 000,618,026 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012-07-23 08:03:26 | 000,126,866 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012-07-23 08:03:26 | 000,104,340 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012-07-23 07:59:13 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012-07-23 07:59:10 | 3193,593,856 | -HS- | M] () -- C:\hiberfil.sys
[2012-07-23 07:59:09 | 000,154,275 | ---- | M] () -- C:\Windows\SysNative\oodbs.lor
[2012-07-22 08:56:55 | 000,000,896 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012-07-22 01:42:54 | 000,259,584 | ---- | M] (OldTimer Tools) -- C:\Users\Patrick\Desktop\OTH.scr
[2012-07-22 01:08:23 | 000,001,105 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012-07-22 01:08:03 | 010,652,120 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\Patrick\Desktop\mbam-setup-1.62.0.1300.exe
[2012-07-22 01:00:59 | 000,016,848 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012-07-22 01:00:59 | 000,016,848 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012-07-21 23:50:00 | 000,000,900 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012-07-21 23:34:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012-07-16 15:38:46 | 000,001,431 | ---- | M] () -- C:\Windows\SplitCam.INI
[2012-07-16 15:23:30 | 000,001,003 | ---- | M] () -- C:\Users\Patrick\Desktop\SplitCam.lnk
[2012-07-16 15:13:42 | 051,827,296 | ---- | M] (SplitCam Co.) -- C:\Users\Patrick\Desktop\SplitCamSetup.exe
[2012-07-16 08:28:02 | 005,670,083 | ---- | M] () -- C:\Users\Patrick\Desktop\AngelScan.zip
[2012-07-14 17:16:00 | 000,000,016 | ---- | M] () -- C:\Users\Patrick\Desktop.ins
[2012-07-13 18:52:06 | 002,413,732 | ---- | M] () -- C:\Users\Patrick\Desktop\nvf.ogg
[2012-07-13 11:37:06 | 357,930,383 | ---- | M] () -- C:\Users\Patrick\Desktop\germany_north.map.7z
[2012-07-13 06:34:45 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012-07-13 06:34:45 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012-07-13 06:13:05 | 005,009,912 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012-07-03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012-06-29 15:20:09 | 003,042,194 | ---- | M] () -- C:\Users\Patrick\Documents\ASA PM.pdf
[2012-06-23 14:15:41 | 001,049,803 | ---- | M] () -- C:\Users\Patrick\Desktop\Freie Projektarbeit 230612.pdf
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\Users\Patrick\AppData\Roaming\*.tmp files -> C:\Users\Patrick\AppData\Roaming\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012-07-22 01:08:23 | 000,001,105 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012-07-16 15:38:46 | 000,001,431 | ---- | C] () -- C:\Windows\SplitCam.INI
[2012-07-16 15:23:30 | 000,001,003 | ---- | C] () -- C:\Users\Patrick\Desktop\SplitCam.lnk
[2012-07-16 15:18:15 | 000,810,496 | ---- | C] () -- C:\Windows\SysNative\xvidcore.dll
[2012-07-16 15:18:15 | 000,183,808 | ---- | C] () -- C:\Windows\SysNative\xvidvfw.dll
[2012-07-16 15:18:15 | 000,080,896 | ---- | C] () -- C:\Windows\SysNative\ff_vfw.dll
[2012-07-16 15:18:11 | 000,389,120 | ---- | C] () -- C:\Windows\SysWow64\actskn43.ocx
[2012-07-16 15:18:11 | 000,389,120 | ---- | C] () -- C:\Windows\SysNative\actskn43.ocx
[2012-07-16 08:27:47 | 005,670,083 | ---- | C] () -- C:\Users\Patrick\Desktop\AngelScan.zip
[2012-07-14 17:12:52 | 000,000,016 | ---- | C] () -- C:\Users\Patrick\Desktop.ins
[2012-07-14 17:07:18 | 007,618,067 | ---- | C] () -- C:\Users\Patrick\Desktop\vi3dim_demo_v1_2.exe
[2012-07-13 18:50:43 | 002,413,732 | ---- | C] () -- C:\Users\Patrick\Desktop\nvf.ogg
[2012-07-13 16:25:35 | 527,398,590 | ---- | C] () -- C:\Users\Patrick\Desktop\germany_north.map
[2012-07-13 10:20:43 | 357,930,383 | ---- | C] () -- C:\Users\Patrick\Desktop\germany_north.map.7z
[2012-06-29 15:20:00 | 003,042,194 | ---- | C] () -- C:\Users\Patrick\Documents\ASA PM.pdf
[2012-06-23 14:14:49 | 001,049,803 | ---- | C] () -- C:\Users\Patrick\Desktop\Freie Projektarbeit 230612.pdf
[2012-06-15 11:32:43 | 000,002,048 | ---- | C] () -- C:\Users\Patrick\AppData\Roaming\a5yp3qmn.default.dat
[2011-10-18 11:35:43 | 000,000,000 | ---- | C] () -- C:\Users\Patrick\AppData\Roaming\chrtmp
[2011-06-01 14:27:39 | 000,000,000 | ---- | C] () -- C:\Users\Patrick\AppData\Local\{C4C1237F-F2F9-46A1-B989-1C74189E0057}
[2011-03-02 23:25:03 | 000,028,672 | ---- | C] () -- C:\Windows\SysWow64\NSREG.DLL
[2010-12-30 12:51:18 | 000,000,126 | -HS- | C] () -- C:\ProgramData\.zreglib
[2010-10-05 15:26:23 | 000,000,034 | ---- | C] () -- C:\Windows\cdplayer.ini
[2010-03-30 00:26:08 | 000,000,918 | ---- | C] () -- C:\Users\Patrick\AppData\Roaming\coreavc.ini
[2010-01-22 15:13:28 | 000,001,352 | ---- | C] () -- C:\ProgramData\cfSB1090.ini
[2010-01-22 15:13:28 | 000,001,352 | ---- | C] () -- C:\ProgramData\cfSB0910.ini
[2010-01-22 15:13:28 | 000,001,346 | ---- | C] () -- C:\ProgramData\cfSB1100.ini
[2010-01-22 15:13:28 | 000,001,302 | ---- | C] () -- C:\ProgramData\cfSB0300.ini
[2010-01-22 15:13:28 | 000,001,282 | ---- | C] () -- C:\ProgramData\cfSB0471.ini
[2010-01-22 15:13:28 | 000,001,208 | ---- | C] () -- C:\ProgramData\cfSB0490.ini
[2010-01-22 15:13:28 | 000,001,027 | ---- | C] () -- C:\ProgramData\cfSB0560.ini
[2010-01-22 15:13:28 | 000,001,026 | ---- | C] () -- C:\ProgramData\cfSB0271.ini
[2010-01-22 15:13:28 | 000,001,026 | ---- | C] () -- C:\ProgramData\cfSB0270.ini
[2010-01-22 15:13:28 | 000,000,590 | ---- | C] () -- C:\ProgramData\cfSB0950.ini
[2009-12-08 22:35:52 | 000,001,352 | ---- | C] () -- C:\ProgramData\cfgks150plus.ini
[2009-12-08 22:35:52 | 000,001,352 | ---- | C] () -- C:\ProgramData\CfgBennu.ini
[2009-12-08 22:35:52 | 000,001,302 | ---- | C] () -- C:\ProgramData\cfgks500.ini
[2009-12-08 22:35:52 | 000,001,282 | ---- | C] () -- C:\ProgramData\cfgks550.ini
[2009-12-08 22:35:52 | 000,001,208 | ---- | C] () -- C:\ProgramData\cfgks150.ini
[2009-12-08 22:35:52 | 000,001,027 | ---- | C] () -- C:\ProgramData\cfgks200.ini
[2009-12-08 22:35:52 | 000,001,026 | ---- | C] () -- C:\ProgramData\cfgks50.ini
[2009-12-08 22:35:52 | 000,001,026 | ---- | C] () -- C:\ProgramData\cfgks100.ini
 
========== LOP Check ==========
 
[2010-10-22 22:13:16 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\Alien Skin
[2011-03-01 12:42:26 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\Autodesk
[2011-06-20 12:03:04 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\Canon
[2009-12-09 16:41:41 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\DassaultSystemes
[2012-07-07 11:11:54 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\Dropbox
[2012-07-17 07:58:14 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\foobar2000
[2012-02-12 17:37:04 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\Fuyp
[2011-01-11 16:02:14 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\Gmote
[2012-07-21 23:56:48 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\hellomoto
[2009-12-08 22:08:50 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\KeePass
[2012-06-15 12:02:51 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\kock
[2010-11-03 22:54:31 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\Microsys
[2009-12-09 19:08:19 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\Miranda
[2012-07-13 16:54:16 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\Mobile Atlas Creator
[2012-05-17 20:14:20 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\NAVIGON Fresh
[2010-12-22 20:57:14 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\ooVoo Details
[2010-04-16 16:10:57 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\OpenOffice.org
[2011-10-28 18:16:51 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\Opera
[2011-01-19 15:26:01 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\SpeedProject
[2010-11-08 20:44:59 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\streamWriter
[2011-12-13 09:31:02 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\TuneUp Software
[2012-03-16 13:42:32 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\Ubole
[2011-01-21 15:28:12 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\UDC Profiles
[2011-02-10 14:13:47 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\Unigraphics Solutions
[2010-11-16 21:10:34 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\XericDesign
[2012-06-15 12:02:51 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\xmldm
[2012-06-21 08:05:47 | 000,032,558 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 24 bytes -> C:\Windows:5ECA7A887621E257
@Alternate Data Stream - 214 bytes -> C:\ProgramData\TEMP:D282699C

< End of report >
         

OTL-Extra-Log:

OTL Extras logfile created on: 23-Jul-12 08:43:48 - Run 1
OTL by OldTimer - Version 3.2.54.0     Folder = C:\Users\Patrick\Desktop
64bit- Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: dd-MMM-yy
 
3.97 Gb Total Physical Memory | 2.70 Gb Available Physical Memory | 68.13% Memory free
7.93 Gb Paging File | 6.76 Gb Available in Paging File | 85.28% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 48.73 Gb Total Space | 1.96 Gb Free Space | 4.03% Space Free | Partition Type: NTFS
Drive Z: | 249.26 Gb Total Space | 117.69 Gb Free Space | 47.22% Space Free | Partition Type: NTFS
 
Computer Name: PATRICK-PC | User Name: Patrick | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L"
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L"
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02516596-D978-491E-B0B0-B9B45AC712BC}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{04E12529-C3F0-46F4-9C55-689DF51190D0}" = lport=68 | protocol=17 | dir=in | app=c:\program files (x86)\connectify\connectifynetservices.exe | 
"{103F91F9-A264-47FD-9235-60C4D3731C63}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{18813ADB-1EEA-4BE1-8880-4226CB6AAF55}" = rport=138 | protocol=17 | dir=out | app=system | 
"{1A40AB60-F55C-45AD-9A76-38C26A042BF2}" = lport=445 | protocol=6 | dir=in | app=system | 
"{2536BA54-5861-4F4E-87CD-EEF47CE50ABB}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{456C493A-75C9-4DDA-B01B-69AD1B0E515F}" = rport=137 | protocol=17 | dir=out | app=system | 
"{67EC5A8D-4104-4A57-A11E-6968E10D8690}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{7A75D2A1-D71D-45F0-A598-9D039646A1F8}" = lport=1317 | protocol=17 | dir=in | app=c:\program files (x86)\connectify\connectifynetservices.exe | 
"{80809B75-CF6D-404E-BBFB-29E96A50D806}" = lport=3389 | protocol=6 | dir=in | app=system | 
"{85357376-5B0C-44CD-9E02-B6B5453A77C7}" = lport=67 | protocol=17 | dir=in | app=c:\program files (x86)\connectify\connectifynetservices.exe | 
"{87192CFB-5D0B-4AD4-A9C6-A90E881D51A4}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{8A45B4D3-3F7A-412B-B3FB-EE968A1E4FE3}" = lport=139 | protocol=6 | dir=in | app=system | 
"{8AA78021-1276-4EE3-BB98-135002DE17D6}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\outlook.exe | 
"{90CFC361-3610-4CB5-99E1-45AB5160451B}" = lport=547 | protocol=17 | dir=in | app=c:\windows\system32\svchost.exe | 
"{92E44096-98E4-4C58-A78E-BBC7F8036464}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{935645DD-424F-4EEE-8800-12E5F0785C82}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{95994A4A-9456-4A46-9ED3-2A10FCC70E4C}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{9BF56196-5F4F-4AFD-9E66-A927ED25F22C}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{A7470B1E-3059-4D72-B6B7-1510CCF1493B}" = rport=1900 | protocol=17 | dir=out | app=c:\windows\system32\svchost.exe | 
"{AA1164A7-78B1-476A-B27A-D8F23EBE0B58}" = lport=1303 | protocol=17 | dir=in | app=c:\program files (x86)\connectify\connectifynetservices.exe | 
"{B3717767-139D-48BA-97AB-86925F525C88}" = rport=445 | protocol=6 | dir=out | app=system | 
"{B5ED5C14-9AC6-44D2-A87A-D6A21AA4E33F}" = lport=53 | protocol=17 | dir=in | app=c:\program files (x86)\connectify\connectifynetservices.exe | 
"{CC03C02D-DB12-4CB3-95C7-186DA6967166}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{D012EC41-6F7D-4163-9281-A9AF7DC4B0A2}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{D08681F9-213B-4CB3-8C5F-69D745FEF4B1}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{D52E9E95-9ED9-4448-9586-1E591D986500}" = rport=139 | protocol=6 | dir=out | app=system | 
"{E5DDFB0B-AE18-4E66-B605-4C561D811605}" = lport=138 | protocol=17 | dir=in | app=system | 
"{E9D9CC84-53BF-4AB0-AADC-EBF4A9203EA1}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{EA8926F9-0E4D-4F99-B540-AD798277364D}" = lport=137 | protocol=17 | dir=in | app=system | 
"{EB5FFF9D-43EF-41A9-AE74-09E2BB8EC05C}" = lport=1900 | protocol=17 | dir=in | app=c:\windows\system32\svchost.exe | 
"{F7780A5F-F1A4-4B98-A083-E7FDAB540FEB}" = rport=2869 | protocol=6 | dir=out | app=system | 
"{FD1D4FA2-257C-436E-85E4-9199D6D94460}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{FF90576F-3101-4516-B59F-AB7608291D7E}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{013479D1-A09D-4145-BC7C-B0009A9E314E}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{02D7C028-1C29-4B17-AE95-59E151247A86}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{0524E331-95AE-4FEC-92E3-F38F87D7193D}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{05E2F17D-4EA6-4F15-A162-25CDC7E12AD2}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{06A7FA72-4329-45F6-8ED0-0E7C695E4ED4}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\pluginwrapper\opera_plugin_wrapper.exe | 
"{0795F148-0E02-40F3-99C3-CB41AB4E2BC0}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe | 
"{08297BFB-885A-4E05-A5DA-180AD04EE9F2}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{0B2E4BB9-DB97-48A9-A0C5-A2E9DAD870B5}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{0B4296CC-D7DA-4BB6-B4EA-BAC0B9123361}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{0D2EE979-BC25-4A1E-B811-F8AF24064B85}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{0E3120BC-E4DE-4E0C-98DD-211FF915F118}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{13450A43-03A4-4044-AF02-D71E08CE1C46}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{1BDE7E61-1A8F-46FF-9CB4-CF393CB98A46}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{215B5375-3DED-4C91-94E4-48A039F2FC50}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\punisher2k\counter-strike\hl.exe | 
"{2554B6F6-B30C-47E1-8627-176B401EC9EF}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{27B6F074-0F12-4436-B67E-1FDF3A5BC4FA}" = dir=out | app=c:\windows\system32\svchost.exe | 
"{29BBDCDF-4830-4FCD-9A25-AEF5E6299095}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{2B0C6F1C-CC3A-40B9-B09D-AE4B0ECF1C90}" = protocol=17 | dir=in | app=c:\users\patrick\appdata\roaming\dropbox\bin\dropbox.exe | 
"{2E5A7DB0-EA53-45A6-A8BA-3CD937386B4E}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{2F8F76C8-5722-4B14-B59A-A1069FC6DEDF}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{390A8AF4-6F33-47FA-942D-5C47292612F2}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{4234AEF0-88E1-4EAC-AADD-D35B02B5017C}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{43B03251-89A3-4F66-AE05-FD5324B97DD1}" = protocol=6 | dir=in | app=c:\program files (x86)\veoh networks\veohwebplayer\veohwebplayer.exe | 
"{444CCF38-5BBD-43AC-96BA-C8F47E777F38}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{4C8A71E2-26DC-4433-9063-9459F9238E07}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe | 
"{5214273D-22E6-429F-82CF-85F443E797D1}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{59760346-40AB-4FAB-BFD2-B7618C36160C}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{59B4D029-DBCB-40F8-BCC2-0B4B77B84419}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{5A352D4B-C5C1-43AF-931A-828420AB9427}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{5DE73E49-E02C-4F8C-BA35-EF3BBAC55536}" = protocol=17 | dir=in | app=c:\program files (x86)\google\google earth\client\googleearth.exe | 
"{5E83995B-1C97-4A6B-8585-5613CF43A140}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{60825CF1-5662-4ED6-B7F1-6D4BAB7E7FEF}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{62AF8718-342D-47BA-B733-81800D22380C}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe | 
"{630BB660-3582-4E43-AAE7-EB04B1AFE4E5}" = protocol=17 | dir=in | app=c:\program files (x86)\veoh networks\veohwebplayer\veohwebplayer.exe | 
"{66243C00-A6B8-4E28-BE20-C874D6471697}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{66428CAF-C61F-46A8-9571-73CB2FD15E73}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{6648AF55-893A-4F79-AEAF-DB64792AFFC7}" = protocol=17 | dir=in | app=c:\program files (x86)\skype\plugin manager\skypepm.exe | 
"{689EBDC8-5152-4231-A6D2-5B3B4A877545}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\pluginwrapper\opera_plugin_wrapper.exe | 
"{69A899A5-78DC-4CCD-8588-CBAF51915911}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe | 
"{771265A1-FC21-4151-B176-1306D7E5031D}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{7872E60C-26AF-42F8-A7FA-51A8735A3A8A}" = protocol=58 | dir=in | name=internet connection sharing (router solicitation-in) | 
"{7A810D82-060F-42CD-853C-F3313A3CA750}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{7B647995-5D6E-4666-98DF-B6064BC6B243}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{880CE1B4-B5D3-4413-97AC-EA74FCAE70DC}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{893D46B2-E373-4A11-8BF5-94C251A0A927}" = protocol=6 | dir=in | app=c:\users\patrick\appdata\roaming\dropbox\bin\dropbox.exe | 
"{8ABEAC0B-FF17-4E50-ABB9-32650FCB8DAC}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{92FA9FA2-532B-4660-91ED-100DA62B3A15}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{93514A50-23D5-43A4-9DF2-0A49439C1AA7}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{93C12F62-2A64-4BF3-9D6A-DABACF22B9BB}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{98116B4F-52B5-44D8-88F0-1C77A66481AD}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe | 
"{98BF35B8-BF69-4754-AB75-6821EF403FCE}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{995BAF09-61C9-4FB8-B321-D80459C4F858}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\punisher2k\counter-strike\hl.exe | 
"{99A8CF54-BFCB-4CE1-AC96-86A22298A0B4}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{9B5A1248-E33F-407F-B868-D89F42028712}" = protocol=17 | dir=in | app=c:\program files (x86)\skype\plugin manager\skypepm.exe | 
"{9C751DF7-AEA9-4132-BADC-1AE3715FA4CE}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{9D3FD772-C451-470C-8E20-2057B94A2CC2}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{A5F3A837-BBC2-4B39-9F9A-A15FBA7A3AF8}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{A61565D6-5B52-4B85-95E8-D736389AB625}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{A820FED0-4107-47D5-8212-96D52595B951}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{AA07D586-2D33-4E57-93AD-7449952EE39E}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{AB99B49A-2FBD-4A73-B296-F3320F2D304C}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{ADAB168D-CE46-40A1-BEE7-15C894724D74}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{AFF92C7B-A009-4627-9C1C-DBDA5C18AF7A}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{B0D69F09-25BB-4235-A9F0-D2752AEF54C2}" = protocol=6 | dir=in | app=c:\program files (x86)\skype\plugin manager\skypepm.exe | 
"{B19B5D27-0996-4C8F-AF64-742D31491272}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{B56600AD-407C-4897-B4ED-286AF1865EB6}" = protocol=6 | dir=in | app=c:\program files (x86)\google\google earth\client\googleearth.exe | 
"{B6B9AEFC-13E0-45BA-8E12-B6C0B3628289}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{B70429B7-1AF5-456C-BAA5-FF0DCCB70BFE}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{C0B71256-92EF-42B3-AC06-AA682D9ABDC8}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{C2945AEA-DB5D-4363-8916-42DC0DDC365A}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{C32AD588-3715-48F3-915F-30B1C6B6BC35}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{C4811D32-8DEA-4340-AF82-D47BD584DEC0}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe | 
"{C4C61801-E97D-4940-B3FA-EE70A37EB87A}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{C7486DDB-8E8F-44E4-9F94-95EDE63CC50C}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{CD3704B5-F682-4922-9286-62655E904AC9}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{CD4C3FE9-034D-4244-A07D-AF0A4D19766A}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{D91DF91A-A9B7-4C60-8146-3295267A8C9F}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{E161CAA0-4278-44AE-974C-D095D1FEBA8C}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{E45A0C12-0152-481F-8CC8-F1ED061471BC}" = protocol=6 | dir=out | app=c:\windows\system32\svchost.exe | 
"{E4C22C68-054B-45EC-85D0-1A7AC2A60879}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe | 
"{E66A5113-7975-4144-9CC1-ACB4A862AEE1}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{E6E5F7BA-8612-45CE-A98A-A03CEBE0BB5A}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{E9223D47-C01B-48AF-A41F-35D92F44494A}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{EACE3823-2435-4B07-ABA0-5617F9C030AF}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{EBD4C5CD-35BC-43B8-A07F-0BB9FFC7E9D5}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{ED22EAC4-A3D8-44C6-9B54-678E1F64D792}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe | 
"{EF37797D-B77F-4236-8C66-69BB032DB8EE}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{F8E0DA4B-FB9E-4C58-80A2-3425B4B09995}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{FDADFDAE-B510-4E12-8D87-09CDD46E08B3}" = protocol=6 | dir=in | app=c:\program files (x86)\skype\plugin manager\skypepm.exe | 
"TCP Query User{13C9CE9D-4FAC-43D3-A309-CEB6FF61E7C5}C:\program files (x86)\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe | 
"TCP Query User{1A869ABE-7B6D-4838-88B7-C9E93A61271F}Z:\spiele\ipcurve\ipcurve.exe" = protocol=6 | dir=in | app=z:\spiele\ipcurve\ipcurve.exe | 
"TCP Query User{1D88363F-9EC4-42EB-AD22-C4547179A128}C:\program files (x86)\foobar2000\foobar2000.exe" = protocol=6 | dir=in | app=c:\program files (x86)\foobar2000\foobar2000.exe | 
"TCP Query User{1F695A10-1E85-4617-B0B9-28D985C7711F}C:\program files (x86)\miranda im\miranda32.exe" = protocol=6 | dir=in | app=c:\program files (x86)\miranda im\miranda32.exe | 
"TCP Query User{20F2B93C-DCE9-4198-A7CB-6B03B624E921}C:\program files (x86)\valve\hl.exe" = protocol=6 | dir=in | app=c:\program files (x86)\valve\hl.exe | 
"TCP Query User{400F7C11-F86A-4583-9EE7-F22FF949E0D0}C:\program files (x86)\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files (x86)\google\google earth\client\googleearth.exe | 
"TCP Query User{92CF9C54-2959-4C3F-BC42-5FD030F23A38}C:\program files (x86)\oovoo\oovoo.exe" = protocol=6 | dir=in | app=c:\program files (x86)\oovoo\oovoo.exe | 
"TCP Query User{9D78CA7C-FAC7-421D-A1BA-DE5099199C09}C:\program files (x86)\valve\hl.exe" = protocol=6 | dir=in | app=c:\program files (x86)\valve\hl.exe | 
"TCP Query User{9E80D3E7-E49D-433F-9899-9D36AB288EA6}C:\program files (x86)\veoh networks\veohwebplayer\veohwebplayer.exe" = protocol=6 | dir=in | app=c:\program files (x86)\veoh networks\veohwebplayer\veohwebplayer.exe | 
"TCP Query User{A506BB8C-CBF5-4600-8EE6-6C51161E341D}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"TCP Query User{C22ED3DD-A195-4D02-A0E9-02E6D4ED4970}C:\program files (x86)\foobar2000\foobar2000.exe" = protocol=6 | dir=in | app=c:\program files (x86)\foobar2000\foobar2000.exe | 
"TCP Query User{C396C53E-BBAB-4E6A-AD2F-D3ED26855A32}C:\program files (x86)\oovoo\oovoo.exe" = protocol=6 | dir=in | app=c:\program files (x86)\oovoo\oovoo.exe | 
"TCP Query User{CED7B1CF-150C-4433-8DE6-6C0362B314A4}C:\program files (x86)\opera\opera.exe" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe | 
"TCP Query User{CF7E48E3-5F49-478D-AEF4-CC620CFCB23B}C:\program files (x86)\miranda im\miranda32.exe" = protocol=6 | dir=in | app=c:\program files (x86)\miranda im\miranda32.exe | 
"UDP Query User{09F0503A-C929-46E2-B0A6-559A8AAC70C6}C:\program files (x86)\veoh networks\veohwebplayer\veohwebplayer.exe" = protocol=17 | dir=in | app=c:\program files (x86)\veoh networks\veohwebplayer\veohwebplayer.exe | 
"UDP Query User{19737F27-E707-4571-8CDF-1E11C036BC77}C:\program files (x86)\miranda im\miranda32.exe" = protocol=17 | dir=in | app=c:\program files (x86)\miranda im\miranda32.exe | 
"UDP Query User{311B0811-252A-4FAA-A268-D02773F0F37B}C:\program files (x86)\oovoo\oovoo.exe" = protocol=17 | dir=in | app=c:\program files (x86)\oovoo\oovoo.exe | 
"UDP Query User{369DABAD-B7E6-4E53-BB81-E99E7ED76EE8}C:\program files (x86)\foobar2000\foobar2000.exe" = protocol=17 | dir=in | app=c:\program files (x86)\foobar2000\foobar2000.exe | 
"UDP Query User{37EB9FBD-6764-4769-947C-BD487D96BE71}C:\program files (x86)\foobar2000\foobar2000.exe" = protocol=17 | dir=in | app=c:\program files (x86)\foobar2000\foobar2000.exe | 
"UDP Query User{4226AE58-DD08-4F1C-A6DE-3B946800A7F8}C:\program files (x86)\opera\opera.exe" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe | 
"UDP Query User{4B8E095C-F04D-4491-AA22-0101BA8E6701}Z:\spiele\ipcurve\ipcurve.exe" = protocol=17 | dir=in | app=z:\spiele\ipcurve\ipcurve.exe | 
"UDP Query User{700B9EF4-B95A-4944-B8F9-EA35209AA642}C:\program files (x86)\miranda im\miranda32.exe" = protocol=17 | dir=in | app=c:\program files (x86)\miranda im\miranda32.exe | 
"UDP Query User{7E269C50-CF9D-4EE9-A96B-3E3BE7486DFA}C:\program files (x86)\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe | 
"UDP Query User{8194BAD6-7A4E-4232-B21F-3C7507F2E555}C:\program files (x86)\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files (x86)\google\google earth\client\googleearth.exe | 
"UDP Query User{A3F5AF69-7B05-4F56-9555-18393EF0459F}C:\program files (x86)\valve\hl.exe" = protocol=17 | dir=in | app=c:\program files (x86)\valve\hl.exe | 
"UDP Query User{A9612DD1-ACCB-4794-888D-76BCA874AA75}C:\program files (x86)\oovoo\oovoo.exe" = protocol=17 | dir=in | app=c:\program files (x86)\oovoo\oovoo.exe | 
"UDP Query User{CCF63F9B-7E70-442A-91D6-68DC29991C36}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"UDP Query User{E524ED3A-20C6-42B5-B4F9-BA41CD25F34F}C:\program files (x86)\valve\hl.exe" = protocol=17 | dir=in | app=c:\program files (x86)\valve\hl.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00CE7326-01AA-44C5-A323-45E52C5D4D0D}" = O&O Defrag Professional
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP610_series" = Canon MP610 series
"{1CCF1727-A817-4FEE-A028-5466FB542934}" = Motorola Mobile Drivers Installation 5.2.0
"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5D492FFA-C816-57FD-10F6-4742329EED76}" = ccc-utility64
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{CE04D80B-ECEA-3228-4901-78CF0E480CA4}" = ATI Catalyst Install Manager
"{F84D9B9F-3A33-4115-981F-8FDDBF42ED4D}" = PDF-XChange Viewer
"Connectify" = Connectify
"PDF-XChange 3_is1" = PDF-XChange 3
"SpeedCommander 13 (x64)" = SpeedCommander 13 (x64)
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"WinRAR archiver" = WinRAR
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{09298F26-A95C-31E2-9D95-2C60F586F075}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{0C7BCCCA-F9F3-82A6-FE6A-1160F7E14745}" = CCC Help Italian
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0D707A04-9C3B-D735-1169-2C36A02EC1FD}" = Catalyst Control Center Core Implementation
"{0E0AA7EF-A847-3C08-ABF9-EDA7936DAFC5}" = Catalyst Control Center Graphics Full New
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{13B792AA-C078-43A4-8A3A-8B12D629940D}" = Counter-Strike 1.6
"{164965E8-4BB0-4EEB-AFBA-75785A2A2A7F}" = Adobe Fireworks CS5
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2217B0B4-35CB-48C6-B640-864DF2F30F99}" = OpenOffice.org 3.2
"{228B5714-9E6F-B9AE-6B6D-E8FF31C2A6D0}" = CCC Help German
"{2436F2A8-4B7E-4B6C-AE4E-604C84AA6A4F}" = Nero Core Components 10
"{25D90A06-E086-614F-203C-9ADB3A83709C}" = CCC Help French
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 21
"{2CDC3BD6-CA3D-F3FE-9700-FCBDB7CFA4C0}" = ccc-core-static
"{32364CEA-7855-4A3C-B674-53D8E9B97936}" = TuneUp Utilities 2012
"{3A6631D2-7523-5046-ACF3-EC6FAD28FBA5}" = CCC Help Portuguese
"{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{409ECFF1-9CC7-43A8-B28A-B7F0B7CB04D1}_is1" = Classic Menu 3.9x for Office 2007
"{40DE7141-333D-8D31-97FF-5C0ED5F3B552}" = CCC Help Polish
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4AB67DB6-6A3C-4755-854F-21AA50429875}" = ape@map
"{4E7101FC-D19E-717B-F5F1-05DFAE4DC7CE}" = CCC Help Dutch
"{523B2B1B-D8DB-4B41-90FF-C4D799E2758A}" = Nero ControlCenter 10 Help (CHM)
"{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update
"{668B9FC5-9FA8-5C47-4AB5-E59D6D6E2123}" = CCC Help Greek
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6A154072-2009-7396-1B4F-1BBBEADD4895}" = CCC Help Swedish
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6DFB899F-17A2-48F0-A533-ED8D6866CF38}" = Nero Control Center 10
"{6E0D5213-BD75-A091-4162-C6311745C23B}" = Catalyst Control Center Graphics Previews Common
"{6F3D2F66-F050-45E3-BEB1-6523FE6D6690}" = MotoHelper MergeModules
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{829E7CC4-A239-40a8-9332-F247D5366D01}_is1" = DAVID-LASERSCANNER 3.4.0.3008
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{84194016-CDFE-FD7D-017E-6FDDDEBF9888}" = CCC Help Danish
"{842BEE12-CCCB-43F4-ABAF-CBA6DFE2583D}" = Nero BurnLite 10
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-002A-0407-1000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-00A7-0407-0000-0000000FF1CE}" = Kalenderdruck-Assistent für Microsoft Office Outlook 2007
"{90120000-00B2-0409-0000-0000000FF1CE}" = Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{942FB97A-B829-0371-5C91-74DAEAFF6900}" = CCC Help Turkish
"{94CAC2F1-C856-47F4-AF24-65A1E75AEDB9}" = MotoHelper MergeModules
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9841591-47F4-7E49-0F1E-7E2ED014E248}" = CCC Help English
"{AB627AF2-9C7E-4DBD-816B-3B2646B81E89}" = Nero BurnLite 10
"{AB82ED30-1B6F-8B9A-2835-E4141A88BB6F}" = CCC Help Norwegian
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.4 - Deutsch
"{B01ED126-67BD-4878-863C-FE1207CF0949}" = Mindjet MindManager 8
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B3D12C7E-6E25-D407-074D-931D66023EAE}" = CCC Help Czech
"{B8ED984C-54AF-5705-EF5C-2739262F113F}" = CCC Help Japanese
"{BD8A0C60-1AEB-11D6-B8E1-00025521AE60}" = VBA (3821b)
"{C121C592-D8AB-8F29-309B-EA85483D6C51}" = CCC Help Chinese Standard
"{C53CFB2A-B76B-4C8E-842F-9961EFE760EB}" = RSDLite
"{CE026CFE-73FE-4FED-9D5F-2C8D4DB512B0}" = TuneUp Utilities Language Pack (de-DE)
"{CF929EEB-CE39-4F06-B1BF-F51FC617A2B2}" = Catalyst Control Center - Branding
"{D028B96F-8C9F-63DA-83EB-0F00D87700DA}" = CCC Help Finnish
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D311066E-6530-CEA2-7BCF-A665416AF11C}" = CCC Help Thai
"{D7BF3B76-EEF9-4868-9B2B-42ABF60B279A}" = Microsoft_VC80_CRT_x86
"{D8E0E80A-E5CA-9F64-2E46-CE694830507B}" = Catalyst Control Center Localization All
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DC24D41C-022A-29DC-E4D4-F9C871F76DD4}" = CCC Help Russian
"{E0631725-6F53-0BFB-5C02-CA8DEF14C7B2}" = Catalyst Control Center Graphics Full Existing
"{E20B2BBD-28B8-4378-97AD-C30F40ED13D2}" = Motorola Software Update
"{E5470B21-CA46-8BDD-247F-8717536DCFEB}" = CCC Help Chinese Traditional
"{E583ED6F-BD99-4066-A420-C815BF692B69}" = Macromedia Fireworks MX 2004
"{EB47C52F-CE56-1066-5FB4-0B7663410A7C}" = Catalyst Control Center HydraVision Full
"{EFC1B35C-FFF2-41D8-A70A-CE6037F8040B}" = AGEIA PhysX v7.07.24
"{EFC47A05-3212-F334-EDA5-C5D2907419FE}" = CCC Help Hungarian
"{F09DA254-8879-1E7F-C14D-FFE8626F804B}" = Catalyst Control Center Graphics Previews Vista
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F404F36C-8FEF-5EA8-6D92-8B64F186D2C0}" = CCC Help Korean
"{FAA7F8FF-3C05-4A61-8F14-D8A6E9ED6623}" = ooVoo
"{FBFBDF43-D184-2AC4-A566-3DDF155979D3}" = CCC Help Spanish
"{FE8F944C-5209-8EEB-604D-0BAB9B2A4540}" = Catalyst Control Center Graphics Light
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"AC3Filter_is1" = AC3Filter 1.63b
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"ALchemy" = Creative ALchemy
"AP Tuner 3.08" = AP Tuner 3.08
"AudioCS" = Creative Audio-Systemsteuerung
"Audiograbber" = Audiograbber 1.83 SE 
"Audiograbber-Lame" = Audiograbber MP3-Plugin
"Bass Audio Decoder" = Bass Audio Decoder (remove only)
"BrainWave Generator" = BrainWave Generator
"CanonMyPrinter" = Canon Utilities My Printer
"CD Audio Reader Filter" = CD Audio Reader Filter (remove only)
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"CloneCD" = CloneCD
"CloneDVD2" = CloneDVD2
"conduitEngine" = Conduit Engine
"Console Launcher" = Creative Konsole Starter
"CoreAVC Professional Edition" = CoreAVC Professional Edition (remove only)
"Creative Software AutoUpdate" = Creative Software AutoUpdate
"Creative Sound Blaster Properties x64 Edition" = Creative Sound Blaster Properties x64 Edition
"Creative Volume Panel" = Lautstärkefenster
"DCoder Image Source" = DCoder Image Source (remove only)
"DDA23392-9C73-4909-A221-BC12C6D2664D" = GmoteServer
"DirectVobSub" = DirectVobSub (remove only)
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup.divx.com" = DivX-Setup
"DScaler 5 Mpeg Decoders_is1" = DScaler 5 Mpeg Decoders
"ENTERPRISE" = Microsoft Office Enterprise 2007
"ffdshow_is1" = ffdshow [rev 2527] [2008-12-19]
"foobar2000" = foobar2000 v0.9.6.9
"Gabest MPEG Splitter" = Gabest MPEG Splitter (remove only)
"HaaliMkx" = Haali Media Splitter
"Host OpenAL" = Host OpenAL
"JDownloader" = JDownloader
"KeePass Password Safe_is1" = KeePass Password Safe 1.17
"KeyFinder_is1" = Magical Jelly Bean KeyFinder
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Miranda IM" = Miranda IM 0.8.10
"MONOGRAM AMR Splitter/Decoder" = MONOGRAM AMR Splitter/Decoder (remove only)
"MotoHelper" = MotoHelper 2.0.51 Driver 5.2.0
"Mozilla Firefox (3.5.17)" = Mozilla Firefox (3.5.17)
"MP Navigator EX 1.0" = Canon MP Navigator EX 1.0
"NAVIGON Fresh" = NAVIGON Fresh 3.4.1
"Notebook Hardware Control" = Notebook Hardware Control 2.0 Pre-Release-06 Bugfix
"OpenAL" = OpenAL
"OpenSource DTS/AC3/DD+ Source Filter" = OpenSource DTS/AC3/DD+ Source Filter (remove only)
"OpenSource Flash Video Splitter" = OpenSource Flash Video Splitter (remove only)
"Opera 12.00.1467" = Opera 12.00
"Pflanzen gegen Zombies" = Pflanzen gegen Zombies
"Rainlendar2" = Rainlendar2 (remove only)
"RealMedia" = RealMedia (remove only)
"RouterControl" = RouterControl 2.0
"SHOUTcast Source" = SHOUTcast Source (remove only)
"SopCast" = SopCast 3.4.8
"SpeedFan" = SpeedFan (remove only)
"SplitCam" = SplitCam
"Steam App 10" = Counter-Strike
"streamWriter_is1" = streamWriter
"TuneUp Utilities 2012" = TuneUp Utilities 2012
"Unlocker" = Unlocker 1.8.7
"Veoh_Web_Player Toolbar" = Veoh Web Player Toolbar
"VLC media player" = VLC media player 1.0.5
"Winamp" = Winamp
"ZoomPlayer" = Zoom Player (remove only)
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 14-Jul-12 09:40:12 | Computer Name = Patrick-PC | Source = Software Protection Platform Service | ID = 8193
Description = Fehler beim Lizenzaktivierungsplaner (sppuinotify.dll). Fehlercode:
0x80070005
 
Error - 14-Jul-12 10:40:12 | Computer Name = Patrick-PC | Source = Software Protection Platform Service | ID = 8193
Description = Fehler beim Lizenzaktivierungsplaner (sppuinotify.dll). Fehlercode:
0x80070005
 
Error - 14-Jul-12 20:37:32 | Computer Name = Patrick-PC | Source = Winlogon | ID = 4103
Description = Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
 
Error - 15-Jul-12 12:23:56 | Computer Name = Patrick-PC | Source = Winlogon | ID = 4103
Description = Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
 
Error - 16-Jul-12 02:11:56 | Computer Name = Patrick-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: iexplore.exe, Version: 8.0.7600.17006,
 Zeitstempel: 0x4f90d722  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00000000  ID des fehlerhaften
 Prozesses: 0xd5c  Startzeit der fehlerhaften Anwendung: 0x01cd6319e3dd92d7  Pfad der
 fehlerhaften Anwendung: C:\program files (x86)\internet explorer\iexplore.exe  Pfad
 des fehlerhaften Moduls: unknown  Berichtskennung: 247ee765-cf0d-11e1-8e7b-00238b8f6b1d
 
Error - 16-Jul-12 09:58:05 | Computer Name = Patrick-PC | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files
 (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll". Fehler in Manifest- oder
 Richtliniendatei "C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe
 AIR.dll" in Zeile 3.  Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR"
 des "version"-Attributs im assemblyIdentity-Element ist ungültig.
 
Error - 19-Jul-12 19:25:54 | Computer Name = Patrick-PC | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files
 (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll". Fehler in Manifest- oder
 Richtliniendatei "C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe
 AIR.dll" in Zeile 3.  Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR"
 des "version"-Attributs im assemblyIdentity-Element ist ungültig.
 
Error - 21-Jul-12 16:31:37 | Computer Name = Patrick-PC | Source = Software Protection Platform Service | ID = 8193
Description = Fehler beim Lizenzaktivierungsplaner (sppuinotify.dll). Fehlercode:
0x80070005
 
Error - 21-Jul-12 17:31:36 | Computer Name = Patrick-PC | Source = Software Protection Platform Service | ID = 8193
Description = Fehler beim Lizenzaktivierungsplaner (sppuinotify.dll). Fehlercode:
0x80070005
 
Error - 21-Jul-12 18:20:52 | Computer Name = Patrick-PC | Source = Winlogon | ID = 4103
Description = Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
 
Error - 21-Jul-12 19:33:39 | Computer Name = Patrick-PC | Source = Microsoft-Windows-CAPI2 | ID = 512
Description = Vom Kryptografiedienst konnte das VSS-Sicherungsobjekt "System Writer"
 nicht initialisiert werden.  Details: Could not query the status of the EventSystem
 service.  System Error: A system shutdown is in progress.  .
 
Error - 22-Jul-12 02:55:19 | Computer Name = Patrick-PC | Source = Microsoft-Windows-CAPI2 | ID = 512
Description = Vom Kryptografiedienst konnte das VSS-Sicherungsobjekt "System Writer"
 nicht initialisiert werden.  Details: Could not query the status of the EventSystem
 service.  System Error: A system shutdown is in progress.  .
 
[ Media Center Events ]
Error - 08-Jul-10 07:53:27 | Computer Name = Patrick-PC | Source = MCUpdate | ID = 0
Description = 1:53:25 PM - Error connecting to the internet.  1:53:25 PM -     Unable
 to contact server..  
 
Error - 09-Jul-10 05:01:13 | Computer Name = Patrick-PC | Source = MCUpdate | ID = 0
Description = 11:01:13 AM - Error connecting to the internet.  11:01:13 AM -     Unable
 to contact server..  
 
Error - 09-Jul-10 05:01:27 | Computer Name = Patrick-PC | Source = MCUpdate | ID = 0
Description = 11:01:19 AM - Error connecting to the internet.  11:01:19 AM -     Unable
 to contact server..  
 
Error - 09-Jul-10 06:03:30 | Computer Name = Patrick-PC | Source = MCUpdate | ID = 0
Description = 12:03:30 PM - Error connecting to the internet.  12:03:30 PM -     Unable
 to contact server..  
 
Error - 09-Jul-10 06:03:36 | Computer Name = Patrick-PC | Source = MCUpdate | ID = 0
Description = 12:03:35 PM - Error connecting to the internet.  12:03:35 PM -     Unable
 to contact server..  
 
Error - 09-Jul-10 07:03:41 | Computer Name = Patrick-PC | Source = MCUpdate | ID = 0
Description = 1:03:41 PM - Error connecting to the internet.  1:03:41 PM -     Unable
 to contact server..  
 
Error - 09-Jul-10 07:03:48 | Computer Name = Patrick-PC | Source = MCUpdate | ID = 0
Description = 1:03:46 PM - Error connecting to the internet.  1:03:46 PM -     Unable
 to contact server..  
 
Error - 09-Jul-10 08:04:04 | Computer Name = Patrick-PC | Source = MCUpdate | ID = 0
Description = 2:04:04 PM - Error connecting to the internet.  2:04:04 PM -     Unable
 to contact server..  
 
Error - 09-Jul-10 08:04:15 | Computer Name = Patrick-PC | Source = MCUpdate | ID = 0
Description = 2:04:09 PM - Error connecting to the internet.  2:04:09 PM -     Unable
 to contact server..  
 
Error - 09-Jul-10 15:34:54 | Computer Name = Patrick-PC | Source = MCUpdate | ID = 0
Description = 9:34:54 PM - Failed to retrieve SportsSchedule (Error: The underlying
 connection was closed: Could not establish trust relationship for the SSL/TLS secure
 channel.)  
 
[ OSession Events ]
Error - 24-May-11 05:01:54 | Computer Name = Patrick-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 516
 seconds with 480 seconds of active time.  This session ended with a crash.
 
Error - 24-May-11 05:04:09 | Computer Name = Patrick-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 106
 seconds with 60 seconds of active time.  This session ended with a crash.
 
Error - 24-May-11 05:05:25 | Computer Name = Patrick-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 32
 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error - 24-May-11 05:07:03 | Computer Name = Patrick-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 78
 seconds with 60 seconds of active time.  This session ended with a crash.
 
Error - 24-May-11 05:08:44 | Computer Name = Patrick-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 94
 seconds with 60 seconds of active time.  This session ended with a crash.
 
Error - 26-Sep-11 02:29:17 | Computer Name = Patrick-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 4334
 seconds with 480 seconds of active time.  This session ended with a crash.
 
Error - 05-Dec-11 02:57:07 | Computer Name = Patrick-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application 
Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session 
lasted 702 seconds with 480 seconds of active time.  This session ended with a crash.
 
Error - 26-Dec-11 17:06:16 | Computer Name = Patrick-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 5887
 seconds with 660 seconds of active time.  This session ended with a crash.
 
Error - 11-May-12 10:35:00 | Computer Name = Patrick-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6612.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 59
 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error - 11-May-12 11:47:08 | Computer Name = Patrick-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6612.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 3072
 seconds with 1440 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 23-Jul-12 02:25:35 | Computer Name = Patrick-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "HomeGroup Provider" ist vom Dienst "Function Discovery
 Provider Host" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
  %%1068
 
Error - 23-Jul-12 02:25:35 | Computer Name = Patrick-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computer Browser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 23-Jul-12 02:25:35 | Computer Name = Patrick-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computer Browser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 23-Jul-12 02:25:35 | Computer Name = Patrick-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computer Browser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 23-Jul-12 02:25:35 | Computer Name = Patrick-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computer Browser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 23-Jul-12 02:25:35 | Computer Name = Patrick-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computer Browser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 23-Jul-12 02:25:35 | Computer Name = Patrick-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computer Browser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 23-Jul-12 02:25:36 | Computer Name = Patrick-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computer Browser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 23-Jul-12 02:25:36 | Computer Name = Patrick-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computer Browser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 23-Jul-12 02:25:36 | Computer Name = Patrick-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computer Browser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
 
< End of report >
         

Vielen Dank im Vorraus für eure Hilfe!

Gruß

Patrick

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

• Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
• Starte die OTL.exe.
  Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
• Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:

:OTL
SRV - (MotoHelper) -- C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe () 
SRV - (Macromedia Licensing Service) -- C:\Program Files (x86)\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe () 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC 
IE - HKLM\..\URLSearchHook: {cd90bf73-20f6-44ef-993d-bb920303bd2e} - C:\Program Files (x86)\Veoh_Web_Player\prxtbVeo0.dll (Conduit Ltd.) 
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b} 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC 
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2653012 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT2653012 
IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - No CLSID value found 
IE - HKCU\..\URLSearchHook: {cd90bf73-20f6-44ef-993d-bb920303bd2e} - C:\Program Files (x86)\Veoh_Web_Player\prxtbVeo0.dll (Conduit Ltd.) 
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC 
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2653012 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.2.1.3 
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 
FF - prefs.js..extensions.enabledItems: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065}:3.2.1.3 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_265.dll File not found 
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found 
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found 
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) 
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) 
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll (Conduit Ltd.) 
O2 - BHO: (Veoh Web Player Toolbar) - {cd90bf73-20f6-44ef-993d-bb920303bd2e} - C:\Program Files (x86)\Veoh_Web_Player\prxtbVeo0.dll (Conduit Ltd.) 
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll (Conduit Ltd.) 
O3 - HKLM\..\Toolbar: (Veoh Web Player Toolbar) - {cd90bf73-20f6-44ef-993d-bb920303bd2e} - C:\Program Files (x86)\Veoh_Web_Player\prxtbVeo0.dll (Conduit Ltd.) 
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - No CLSID value found. 
O3 - HKCU\..\Toolbar\WebBrowser: (Veoh Web Player Toolbar) - {CD90BF73-20F6-44EF-993D-BB920303BD2E} - C:\Program Files (x86)\Veoh_Web_Player\prxtbVeo0.dll (Conduit Ltd.) 
O4:64bit: - HKLM..\Run: [VaultCredProvider] C:\Users\Patrick\AppData\Local\Microsoft\Windows\2145\VaultCredProvider.exe () 
O4 - HKCU..\Run: [Rainlendar2] C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe () 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 
O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found 
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found 
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found 
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O32 - HKLM CDRom: AutoRun - 1 
O33 - MountPoints2\{04530ea9-e7f5-11df-8064-00238b8f6b1d}\Shell - "" = AutoRun 
O33 - MountPoints2\{04530ea9-e7f5-11df-8064-00238b8f6b1d}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a 
O33 - MountPoints2\{0f863e57-e161-11e0-bba3-00238b8f6b1d}\Shell - "" = AutoRun 
O33 - MountPoints2\{0f863e57-e161-11e0-bba3-00238b8f6b1d}\Shell\AutoRun\command - "" = F:\setup.exe -a 
O33 - MountPoints2\{5374fc82-1a7e-11e0-a59e-00238b8f6b1d}\Shell - "" = AutoRun 
O33 - MountPoints2\{5374fc82-1a7e-11e0-a59e-00238b8f6b1d}\Shell\AutoRun\command - "" = F:\setup.exe -a 
O33 - MountPoints2\F\Shell - "" = AutoRun 
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\setup.exe -a 
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] 
@Alternate Data Stream - 24 bytes -> C:\Windows:5ECA7A887621E257 
@Alternate Data Stream - 214 bytes -> C:\ProgramData\TEMP:D282699C 

[2012-07-21 23:56:34 | 000,000,000 | ---D | C] -- C:\Users\Patrick\AppData\Roaming\hellomoto 
[2012-07-21 23:56:48 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\hellomoto 
[2012-07-22 08:56:55 | 000,000,896 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job 
[2012-07-21 23:50:00 | 000,000,900 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job 
[2012-07-21 23:34:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job 
[2012-06-15 12:02:51 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\kock 
[2012-06-15 12:02:51 | 000,000,000 | ---D | M] -- C:\Users\Patrick\AppData\Roaming\xmldm 
:Files

C:\Users\Patrick\AppData\Local\Microsoft\Windows\2145\VaultCredProvider.exe

ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[emptyflash]
         

• Schließe alle Programme.
• Klicke auf den Fix Button.
• Wenn OTL einen Neustart verlangt, bitte zulassen.
• Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
  Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

Z:\Treiber & Programme Acer Spire 6930 W7\OODefrag15Professional64Ger\keygen.exe
         

Übersehen?

herzlichen Dank t'john!

hier das logfile nach dem fix und reboot (popup taucht nicht mehr auf)

All processes killed
========== OTL ==========
Service MotoHelper stopped successfully!
Service MotoHelper deleted successfully!
C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe moved successfully.
Service Macromedia Licensing Service stopped successfully!
Service Macromedia Licensing Service deleted successfully!
C:\Program Files (x86)\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe moved successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{cd90bf73-20f6-44ef-993d-bb920303bd2e} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cd90bf73-20f6-44ef-993d-bb920303bd2e}\ deleted successfully.
C:\Program Files (x86)\Veoh_Web_Player\prxtbVeo0.dll moved successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\ not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{cd90bf73-20f6-44ef-993d-bb920303bd2e} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cd90bf73-20f6-44ef-993d-bb920303bd2e}\ not found.
File C:\Program Files (x86)\Veoh_Web_Player\prxtbVeo0.dll not found.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
Prefs.js: engine@conduit.com:3.2.1.3 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 removed from extensions.enabledItems
Prefs.js: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065}:3.2.1.3 removed from extensions.enabledItems
64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@adobe.com/FlashPlayer\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@microsoft.com/GENUINE\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@microsoft.com/GENUINE\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=3\ deleted successfully.
C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=9\ deleted successfully.
File C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ deleted successfully.
C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cd90bf73-20f6-44ef-993d-bb920303bd2e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cd90bf73-20f6-44ef-993d-bb920303bd2e}\ not found.
File C:\Program Files (x86)\Veoh_Web_Player\prxtbVeo0.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{30F9B915-B755-4826-820B-08FBA6BD249D} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ not found.
File C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{cd90bf73-20f6-44ef-993d-bb920303bd2e} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cd90bf73-20f6-44ef-993d-bb920303bd2e}\ not found.
File C:\Program Files (x86)\Veoh_Web_Player\prxtbVeo0.dll not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{CD90BF73-20F6-44EF-993D-BB920303BD2E} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CD90BF73-20F6-44EF-993D-BB920303BD2E}\ not found.
File C:\Program Files (x86)\Veoh_Web_Player\prxtbVeo0.dll not found.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\VaultCredProvider deleted successfully.
C:\Users\Patrick\AppData\Local\Microsoft\Windows\2145\VaultCredProvider.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Rainlendar2 deleted successfully.
C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLUA deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\PromptOnSecureDesktop deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Add to Google Photos Screensa&ver\ deleted successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft E&xel exportieren\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft E&xel exportieren\ not found.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{04530ea9-e7f5-11df-8064-00238b8f6b1d}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{04530ea9-e7f5-11df-8064-00238b8f6b1d}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{04530ea9-e7f5-11df-8064-00238b8f6b1d}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{04530ea9-e7f5-11df-8064-00238b8f6b1d}\ not found.
File F:\LaunchU3.exe -a not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0f863e57-e161-11e0-bba3-00238b8f6b1d}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f863e57-e161-11e0-bba3-00238b8f6b1d}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0f863e57-e161-11e0-bba3-00238b8f6b1d}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f863e57-e161-11e0-bba3-00238b8f6b1d}\ not found.
File F:\setup.exe -a not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5374fc82-1a7e-11e0-a59e-00238b8f6b1d}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5374fc82-1a7e-11e0-a59e-00238b8f6b1d}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5374fc82-1a7e-11e0-a59e-00238b8f6b1d}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5374fc82-1a7e-11e0-a59e-00238b8f6b1d}\ not found.
File F:\setup.exe -a not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\ not found.
File F:\setup.exe -a not found.
C:\Windows\SysWow64\tmp4894.tmp deleted successfully.
C:\Windows\SysWow64\tmp496F.tmp deleted successfully.
ADS C:\Windows:5ECA7A887621E257 deleted successfully.
ADS C:\ProgramData\TEMP:D282699C deleted successfully.
C:\Users\Patrick\AppData\Roaming\hellomoto folder moved successfully.
Folder C:\Users\Patrick\AppData\Roaming\hellomoto\ not found.
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job moved successfully.
C:\Windows\Tasks\Adobe Flash Player Updater.job moved successfully.
C:\Users\Patrick\AppData\Roaming\kock folder moved successfully.
C:\Users\Patrick\AppData\Roaming\xmldm folder moved successfully.
========== FILES ==========
File\Folder C:\Users\Patrick\AppData\Local\Microsoft\Windows\2145\VaultCredProvider.exe not found.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\Patrick\Desktop\cmd.bat deleted successfully.
C:\Users\Patrick\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrator
->Temp folder emptied: 296491 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Opera cache emptied: 2686723 bytes
->Flash cache emptied: 456 bytes
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 41620 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Patrick
->Temp folder emptied: 86666434 bytes
->Temporary Internet Files folder emptied: 922849130 bytes
->Java cache emptied: 63969374 bytes
->FireFox cache emptied: 112018408 bytes
->Opera cache emptied: 41470445 bytes
->Flash cache emptied: 254112 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1471360 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67764 bytes
RecycleBin emptied: 641983216 bytes
 
Total Files Cleaned = 1,787.00 mb
 
 
[EMPTYFLASH]
 
User: Administrator
->Flash cache emptied: 0 bytes
 
User: All Users
 
User: Default
->Flash cache emptied: 0 bytes
 
User: Default User
->Flash cache emptied: 0 bytes
 
User: Patrick
->Flash cache emptied: 0 bytes
 
User: Public
 
Total Flash Files Cleaned = 0.00 mb
 
 
OTL by OldTimer - Version 3.2.54.0 log created on 07232012_215444

Files\Folders moved on Reboot...
C:\Users\Patrick\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...
File C:\Users\Patrick\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!

Registry entries deleted on Reboot...
         

Gibt es einen Grund, warum du gecrackte Sftware nutzt?




Wie laeuft der Rechner?

1. Schritt

Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".

danach:

2. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Starte die adwcleaner.exe mit einem Doppelklick.
• Klicke auf Search.
• Nach Ende des Suchlaufs öffnet sich eine Textdatei.
• Poste mir den Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

Hi (sorry für meine späte Antwort)

O&O Defrag habe ich einmal ausprobiert, deshalb die keygen.exe.
Der PC läuft nun wieder normal.

hier der Log von ADWCleaner:

# AdwCleaner v1.703 - Logfile created 07/25/2012 at 12:03:57
# Updated 20/07/2012 by Xplode
# Operating system : Windows 7 Ultimate  (64 bits)
# User : Patrick - PATRICK-PC
# Running from : C:\Users\Patrick\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****

Folder Found : C:\Users\Patrick\AppData\Local\Conduit
Folder Found : C:\Users\Patrick\AppData\LocalLow\Conduit
Folder Found : C:\Users\Patrick\AppData\LocalLow\ConduitEngine
Folder Found : C:\Users\Patrick\AppData\LocalLow\PriceGong
Folder Found : C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\a5yp3qmn.default\Conduit
Folder Found : C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\a5yp3qmn.default\ConduitEngine
Folder Found : C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\a5yp3qmn.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}
Folder Found : C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\a5yp3qmn.default\extensions\engine@conduit.com
Folder Found : C:\ProgramData\boost_interprocess
Folder Found : C:\Program Files (x86)\ConduitEngine
File Found : C:\Program Files (x86)\Mozilla Firefox\.autoreg

***** [Registry] *****
[*] Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT2431245[*] Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT2653012
Key Found : HKCU\Software\AppDataLow\Software\Conduit
Key Found : HKCU\Software\AppDataLow\Software\conduitEngine
Key Found : HKCU\Software\AppDataLow\Software\PriceGong
Key Found : HKCU\Software\AppDataLow\Toolbar
Key Found : HKCU\Software\Conduit
Key Found : HKCU\Software\Softonic
Key Found : HKLM\SOFTWARE\Classes\Conduit.Engine
Key Found : HKLM\SOFTWARE\Conduit
Key Found : HKLM\SOFTWARE\conduitEngine
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
[x64] Key Found : HKCU\Software\AppDataLow\Software\Conduit
[x64] Key Found : HKCU\Software\AppDataLow\Software\conduitEngine
[x64] Key Found : HKCU\Software\AppDataLow\Software\PriceGong
[x64] Key Found : HKCU\Software\AppDataLow\Toolbar
[x64] Key Found : HKCU\Software\Conduit
[x64] Key Found : HKCU\Software\Softonic
[x64] Key Found : HKLM\SOFTWARE\Classes\Conduit.Engine

***** [Registre - GUID] *****

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{30F9B915-B755-4826-820B-08FBA6BD249D}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{30F9B915-B755-4826-820B-08FBA6BD249D}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
[x64] Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.7600.16385

[OK] Registry is clean.

-\\ Mozilla Firefox v3.5.17 (de)

Profile name : default 
File : C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\a5yp3qmn.default\prefs.js

Found : user_pref("CT2431245..clientLogIsEnabled", false);
Found : user_pref("CT2431245..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]
Found : user_pref("CT2431245..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]
Found : user_pref("CT2431245.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Found : user_pref("CT2431245.CTID", "CT2431245");
Found : user_pref("CT2431245.CurrentServerDate", "23-7-2012");
Found : user_pref("CT2431245.DialogsAlignMode", "LTR");
Found : user_pref("CT2431245.DownloadReferralCookieData", "");
Found : user_pref("CT2431245.EMailNotifierPollDate", "Mon Jul 23 2012 08:14:29 GMT+0200");
Found : user_pref("CT2431245.FeedLastCount129009402595187825", 1192);
Found : user_pref("CT2431245.FeedPollDate7470634014180506963", "Mon Dec 19 2011 23:12:20 GMT+0100");
Found : user_pref("CT2431245.FeedPollDate7470634014269327586", "Mon Dec 19 2011 23:12:19 GMT+0100");
Found : user_pref("CT2431245.FeedPollDate7470634014329599698", "Mon Dec 19 2011 23:12:19 GMT+0100");
Found : user_pref("CT2431245.FeedPollDate7470634014537505092", "Mon Dec 19 2011 23:12:19 GMT+0100");
Found : user_pref("CT2431245.FeedPollDate7470634014970726540", "Mon Dec 19 2011 23:12:20 GMT+0100");
Found : user_pref("CT2431245.FeedPollDate7470634015410831318", "Mon Dec 19 2011 23:12:21 GMT+0100");
Found : user_pref("CT2431245.FeedPollDate7470634015483395460", "Mon Dec 19 2011 23:12:20 GMT+0100");
Found : user_pref("CT2431245.FeedPollDate7470634015636754705", "Mon Dec 19 2011 23:12:20 GMT+0100");
Found : user_pref("CT2431245.FeedPollDate7470634015768347545", "Mon Dec 19 2011 23:12:20 GMT+0100");
Found : user_pref("CT2431245.FeedPollDate7470634015855543602", "Mon Dec 19 2011 23:12:19 GMT+0100");
Found : user_pref("CT2431245.FeedPollDate7470634016030710453", "Mon Dec 19 2011 23:12:19 GMT+0100");
Found : user_pref("CT2431245.FeedPollDate7470634016114705611", "Mon Dec 19 2011 23:12:21 GMT+0100");
Found : user_pref("CT2431245.FeedPollDate7470634016129205152", "Mon Dec 19 2011 23:12:21 GMT+0100");
Found : user_pref("CT2431245.FeedPollDate7470634016143724791", "Mon Dec 19 2011 23:12:21 GMT+0100");
Found : user_pref("CT2431245.FeedPollDate7470634016271239162", "Mon Dec 19 2011 23:12:21 GMT+0100");
Found : user_pref("CT2431245.FeedPollDate7470634016568520719", "Mon Dec 19 2011 23:12:20 GMT+0100");
Found : user_pref("CT2431245.FeedPollDate7470634016726993788", "Mon Dec 19 2011 23:12:19 GMT+0100");
Found : user_pref("CT2431245.FeedPollDate7470634017109031809", "Mon Dec 19 2011 23:12:20 GMT+0100");
Found : user_pref("CT2431245.FeedPollDate7470634017132743740", "Mon Dec 19 2011 23:12:20 GMT+0100");
Found : user_pref("CT2431245.FeedPollDate7470634017299547668", "Mon Dec 19 2011 23:12:21 GMT+0100");
Found : user_pref("CT2431245.FeedPollDate7470634017302327846", "Mon Dec 19 2011 23:12:20 GMT+0100");
Found : user_pref("CT2431245.FeedPollDate7470634017344111490", "Mon Dec 19 2011 23:12:19 GMT+0100");
Found : user_pref("CT2431245.FeedPollDate7470634017478360748", "Mon Dec 19 2011 23:12:21 GMT+0100");
Found : user_pref("CT2431245.FeedPollDate7470634017732797593", "Mon Dec 19 2011 23:12:19 GMT+0100");
Found : user_pref("CT2431245.FeedPollDate7470634017821686064", "Mon Dec 19 2011 23:12:21 GMT+0100");
Found : user_pref("CT2431245.FeedPollDate7470634018090228721", "Mon Dec 19 2011 23:12:20 GMT+0100");
Found : user_pref("CT2431245.FeedTTL7470634014269327586", 5);
Found : user_pref("CT2431245.FeedTTL7470634014537505092", 5);
Found : user_pref("CT2431245.FeedTTL7470634014970726540", 2);
Found : user_pref("CT2431245.FeedTTL7470634015636754705", 5);
Found : user_pref("CT2431245.FeedTTL7470634015855543602", 30);
Found : user_pref("CT2431245.FeedTTL7470634016568520719", 30);
Found : user_pref("CT2431245.FeedTTL7470634017109031809", 2);
Found : user_pref("CT2431245.FeedTTL7470634017299547668", 2);
Found : user_pref("CT2431245.FirstServerDate", "10-11-2010");
Found : user_pref("CT2431245.FirstTime", true);
Found : user_pref("CT2431245.FirstTimeFF3", true);
Found : user_pref("CT2431245.FixPageNotFoundErrors", true);
Found : user_pref("CT2431245.GroupingServerCheckInterval", 1440);
Found : user_pref("CT2431245.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Found : user_pref("CT2431245.HasUserGlobalKeys", true);
Found : user_pref("CT2431245.Initialize", true);
Found : user_pref("CT2431245.InitializeCommonPrefs", true);
Found : user_pref("CT2431245.InstallationAndCookieDataSentCount", 3);
Found : user_pref("CT2431245.InstallationId", "integrated_CT2431245 .exe");
Found : user_pref("CT2431245.InstallationType", "ConduitIntegration");
Found : user_pref("CT2431245.InstalledDate", "Tue Nov 09 2010 23:56:05 GMT+0100");
Found : user_pref("CT2431245.InvalidateCache", false);
Found : user_pref("CT2431245.IsGrouping", false);
Found : user_pref("CT2431245.IsMulticommunity", false);
Found : user_pref("CT2431245.IsOpenThankYouPage", false);
Found : user_pref("CT2431245.IsOpenUninstallPage", true);
Found : user_pref("CT2431245.LanguagePackLastCheckTime", "Mon Jul 23 2012 08:14:33 GMT+0200");
Found : user_pref("CT2431245.LanguagePackReloadIntervalMM", 1440);
Found : user_pref("CT2431245.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Found : user_pref("CT2431245.LastLogin_3.2.1.3", "Mon Jul 23 2012 08:14:33 GMT+0200");
Found : user_pref("CT2431245.LatestVersion", "3.13.0.6");
Found : user_pref("CT2431245.Locale", "de-de");
Found : user_pref("CT2431245.MCDetectTooltipHeight", "83");
Found : user_pref("CT2431245.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Found : user_pref("CT2431245.MCDetectTooltipWidth", "295");
Found : user_pref("CT2431245.RadioIsPodcast", false);
Found : user_pref("CT2431245.RadioLastCheckTime", "Mon Jul 23 2012 08:14:30 GMT+0200");
Found : user_pref("CT2431245.RadioLastUpdateIPServer", "3");
Found : user_pref("CT2431245.RadioLastUpdateServer", "129167771525870000");
Found : user_pref("CT2431245.RadioMediaID", "20503672");
Found : user_pref("CT2431245.RadioMediaType", "Media Player");
Found : user_pref("CT2431245.RadioMenuSelectedID", "EBRadioMenu_CT243124520503672");
Found : user_pref("CT2431245.RadioStationName", "Team%20Radio%20Deutschland");
Found : user_pref("CT2431245.RadioStationURL", "hxxp://trd.stream.w-u-s.org:6666/dsl.m3u");
Found : user_pref("CT2431245.SearchFromAddressBarIsInit", true);
Found : user_pref("CT2431245.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT243[...]
Found : user_pref("CT2431245.SearchInNewTabEnabled", true);
Found : user_pref("CT2431245.SearchInNewTabIntervalMM", 1440);
Found : user_pref("CT2431245.SearchInNewTabLastCheckTime", "Mon Jul 23 2012 08:14:29 GMT+0200");
Found : user_pref("CT2431245.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
Found : user_pref("CT2431245.SearchInNewTabUsageUrl", "hxxp://usage.hosting.toolbar.conduit-services.com/usa[...]
Found : user_pref("CT2431245.SearchInNewTabUserEnabled", false);
Found : user_pref("CT2431245.ServiceMapLastCheckTime", "Mon Jul 23 2012 08:14:33 GMT+0200");
Found : user_pref("CT2431245.SettingsLastCheckTime", "Mon Jul 23 2012 08:14:28 GMT+0200");
Found : user_pref("CT2431245.SettingsLastUpdate", "1339926569");
Found : user_pref("CT2431245.ThirdPartyComponentsInterval", 504);
Found : user_pref("CT2431245.ThirdPartyComponentsLastCheck", "Tue Jul 03 2012 09:53:26 GMT+0200");
Found : user_pref("CT2431245.ThirdPartyComponentsLastUpdate", "1331806000");
Found : user_pref("CT2431245.TrusteLinkUrl", "hxxp://trust.conduit.com/EB_ORIGINAL_CTID");
Found : user_pref("CT2431245.UserID", "UN31653509154106132");
Found : user_pref("CT2431245.ValidationData_Toolbar", 2);
Found : user_pref("CT2431245.WeatherNetwork", "");
Found : user_pref("CT2431245.WeatherPollDate", "Mon Jul 23 2012 08:14:31 GMT+0200");
Found : user_pref("CT2431245.WeatherUnit", "C");
Found : user_pref("CT2431245.alertChannelId", "825452");
Found : user_pref("CT2431245.backendstorage./9b+7e+x305", "247E27413334363379453A3D2A722C797A7E7A3128333B4D4[...]
Found : user_pref("CT2431245.backendstorage./9b+7e,x305", "247E28412F3F3E3779453A3D2A722C797B787D3128333C474[...]
Found : user_pref("CT2431245.backendstorage./9b+7e-x305", "247E2936303C363679453A3D2A722C797A207B3128333D462[...]
Found : user_pref("CT2431245.backendstorage./9b+7e.:2z527", "247E707571777278333228702A7B797B7B7E30273224262[...]
Found : user_pref("CT2431245.backendstorage./9b+7e.x305", "247E2A4137374434337A463B3E2B732D7A7D7C213229343F5[...]
Found : user_pref("CT2431245.backendstorage./9b+7e/x305", "247E2B413536327844393C29712B787C7B773027323E4C434[...]
Found : user_pref("CT2431245.backendstorage./9b+7e06cg5el8:", "6E6D6D70726B756D7374");
Found : user_pref("CT2431245.backendstorage./9b+7e06cg5el;8i:k", "247E2D2F226A7473737678717B73797A242F4B4947[...]
Found : user_pref("CT2431245.backendstorage./9b+7e0x305", "247E2C403A407743383B28702A777C757D2F26313E4129554[...]
Found : user_pref("CT2431245.backendstorage./9b+7e1x305", "247E2D41313D403279453A3D2A722C7A77797E31283341473[...]
Found : user_pref("CT2431245.backendstorage./9b+7e2x305", "247E2E3542313D3D393A7B473C3F2C742E79207D322934435[...]
Found : user_pref("CT2431245.backendstorage./9b+7e31;cjc<=fbj#mm", "247E61393F236B257576737A2A212C6E414F444D[...]
Found : user_pref("CT2431245.backendstorage./9b+7e31;cjc<=fbj#ncf", "247E61393F236B25757677712A212C6E414F444[...]
Found : user_pref("CT2431245.backendstorage./9b+7e3x305", "247E2F413F3B36333F47463F7D493E412E76307E222421352[...]
Found : user_pref("CT2431245.backendstorage./9b+7e4x305", "247E302C407642373A276F29777B74762E2530413E4F494A5[...]
Found : user_pref("CT2431245.backendstorage./9b+7e5x305", "247E3136422B7743383B28702A79757A772F2631434B3D495[...]
Found : user_pref("CT2431245.backendstorage./9b+7e6x305", "247E322C3E32323238453E7C483D402D752F7E7B2424342B3[...]
Found : user_pref("CT2431245.backendstorage./9b+7e7x305", "247E333D2C3F3E3F79453A3D2A722C7B7A797A31283347474[...]
Found : user_pref("CT2431245.backendstorage./9b+7e8x305", "247E343D3F3B35373B3F367C47472C742E7E7823322934495[...]
Found : user_pref("CT2431245.backendstorage./9b+7e9x305", "247E35332C3F327844393C29712B7B757979302732484C4F4[...]
Found : user_pref("CT2431245.backendstorage./9b+7e:x305", "247E36333B38327844393C29712B7B76797A3027324948554[...]
Found : user_pref("CT2431245.backendstorage./9b+7e;x305", "247E373F333F3738422F7B473C3F2C742E7E7A7A22332A354[...]
Found : user_pref("CT2431245.backendstorage./9b+7e<x305", "247E38343030442F463644377D493E412E7630217D2426352[...]
Found : user_pref("CT2431245.backendstorage./9b+7e=x305", "247E3933363F41413739357C483D402D752F207E2022342B3[...]
Found : user_pref("CT2431245.backendstorage./9b+7e>x305", "247E3A41363F323238387B473C3F2C742E7E20217C332A355[...]
Found : user_pref("CT2431245.backendstorage./9b+7e?x305", "247E3B2D2F2F334134403A3A7D494C2D752F2023207E342B3[...]
Found : user_pref("CT2431245.backendstorage./9b+7e@x305", "247E3C40422B7743383B28702A7B767E782F26314E52543D2[...]
Found : user_pref("CT2431245.backendstorage./9b+7eax305", "247E3D3D37387743383B28702A7B7A757E2F26314F4F544A5[...]
Found : user_pref("CT2431245.backendstorage./9b+7ebe3g=;d9n9=d", "372C2D326975762E3A3C7B3A39434A494841434B26[...]
Found : user_pref("CT2431245.backendstorage./9b+7ebx305", "247E3E393141303D33454036327E4A3F422F77317B7D23352[...]
Found : user_pref("CT2431245.backendstorage./9b+7ecx305", "247E3F3D303043312E7A463B3E2B732D7B207E31283353515[...]
Found : user_pref("CT2431245.backendstorage./9b+7edx305", "247E4035422A363879453A3D2A722C7D202F26315247543C4[...]
Found : user_pref("CT2431245.backendstorage./9b+7etx305", "247E6E2F2E3B323342357B44392B732D7A7B7B7C322934215[...]
Found : user_pref("CT2431245.backendstorage./9b-0?3g>d", "6F676E6C6A6F72757A6F484979207A7E764C25212053242A56[...]
Found : user_pref("CT2431245.backendstorage./9b-0?3g@6:5;", "");
Found : user_pref("CT2431245.backendstorage./9b-0?3gfa7ef", "2B2E2C3D");
Found : user_pref("CT2431245.backendstorage./9b-3=3eccja=f>", "247E333D2C452F4135276F292A212C393D44307832332[...]
Found : user_pref("CT2431245.backendstorage./9b/>01=9a6k6<im;krie@pdawm", "6A696B7273747576");
Found : user_pref("CT2431245.backendstorage./9b3=>@44i48?", "372C2D326975763342363341484776213F3E484F4E4D464[...]
Found : user_pref("CT2431245.backendstorage./9b5ba==9cjag", "676D3E3D3E7240757A477748497B7A767B4E7D504F");
Found : user_pref("CT2431245.backendstorage./9b6b11g4c56b>f;p;anr@p", "6E6D6D70726B756D7470747576");
Found : user_pref("CT2431245.backendstorage./9b9643g3/9e", "6A");
Found : user_pref("CT2431245.backendstorage./9b<:222h64<", "393F352F3E");
Found : user_pref("CT2431245.backendstorage./9b=+03eh8h8j?:", "4443");
Found : user_pref("CT2431245.backendstorage./9b?+e2a52d8", "372C2D326975762E3A3C7B3A39434A494841434B26514649[...]
Found : user_pref("CT2431245.backendstorage./9b?b0d:8aj62<h", "6D");
Found : user_pref("CT2431245.backendstorage./9ba@0<0bi6a7gn:6@l?", "6E6B");
Found : user_pref("CT2431245.backendstorage._fb_dailyactivity", "31333032333535333538353032");
Found : user_pref("CT2431245.backendstorage._fb_lifetimesent", "54525545");
Found : user_pref("CT2431245.backendstorage.ct2431245ads1", "25374225323261647325323225334125354225374225323[...]
Found : user_pref("CT2431245.backendstorage.ct2431245current_term", "");
Found : user_pref("CT2431245.backendstorage.ct2431245isadsdisabled", "66616C7365");
Found : user_pref("CT2431245.backendstorage.ct2431245sdate", "3330");
Found : user_pref("CT2431245.backendstorage.ctid", "435432343331323435");
Found : user_pref("CT2431245.backendstorage.eule_tb_id", "46393538323631363130333730353431395447383737393931[...]
Found : user_pref("CT2431245.backendstorage.facebook_ctid_connect_send", "73656E646564");
Found : user_pref("CT2431245.backendstorage.firstinstall", "796573");
Found : user_pref("CT2431245.backendstorage.for_aoi", "31333038353533333038");
Found : user_pref("CT2431245.backendstorage.for_ccid", "6E756C6C");
Found : user_pref("CT2431245.backendstorage.for_cdtr5", "31333038353533333038");
Found : user_pref("CT2431245.backendstorage.for_cid", "4445");
Found : user_pref("CT2431245.backendstorage.for_ip", "38342E3133332E3233302E36");
Found : user_pref("CT2431245.backendstorage.for_lcut", "31333135343731383134");
Found : user_pref("CT2431245.backendstorage.for_pid", "31303130");
Found : user_pref("CT2431245.backendstorage.for_rid", "3037");
Found : user_pref("CT2431245.backendstorage.for_zoneid", "39353933");
Found : user_pref("CT2431245.backendstorage.gsdomain", "");
Found : user_pref("CT2431245.backendstorage.hxxp://cmg1_conduit-widgets_com/pitsi.state", "4F50454E");
Found : user_pref("CT2431245.backendstorage.lastrun", "31333131333238353034313036");
Found : user_pref("CT2431245.backendstorage.li_dailyactivity", "31333030333936373835303235");
Found : user_pref("CT2431245.backendstorage.li_lifetimesent", "54525545");
Found : user_pref("CT2431245.backendstorage.partner_id", "3937346665643236");
Found : user_pref("CT2431245.backendstorage.printitgreenstatus", "74727565");
Found : user_pref("CT2431245.backendstorage.shoppingapp.gk.exipres", "576564204A756C20313820323031322031363A[...]
Found : user_pref("CT2431245.backendstorage.shoppingapp.gk.geolocation", "6765726D616E79");
Found : user_pref("CT2431245.backendstorage.tbready", "74727565");
Found : user_pref("CT2431245.myStuffEnabled", true);
Found : user_pref("CT2431245.myStuffPublihserMinWidth", 400);
Found : user_pref("CT2431245.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
Found : user_pref("CT2431245.myStuffServiceIntervalMM", 1440);
Found : user_pref("CT2431245.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Found : user_pref("CT2431245.testingCtid", "");
Found : user_pref("CT2431245.toolbarAppMetaDataLastCheckTime", "Mon Jul 23 2012 08:14:33 GMT+0200");
Found : user_pref("CT2431245.toolbarContextMenuLastCheckTime", "Tue Nov 09 2010 23:56:06 GMT+0100");
Found : user_pref("CT2431245.usagesFlag", 2);
Found : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT2431245/CT2431245[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/?aid=825452&fid=821260", "\"0\""[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/?aid=909619&fid=905414", "\"0\""[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/825452/821260/DE", "\"0\"")[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/909619/905414/DE", "\"0\"")[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2431245", [...]
Found : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/toolbar/", "\"c912886ea3ba02[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=0", "63[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=1/11/20[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=11/8/20[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=12/30/2[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=2/22/20[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=3/13/20[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.conduit-services.com/?ctid=CT2431245&octid=[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.search.conduit.com/root/CT2431245/CT2431245[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Bluenote/equalizer[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Bluenote/minimize.[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Bluenote/play.gif"[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Bluenote/stop.gif"[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Bluenote/vol.gif",[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/Newtab/Softonic/CT2431245.xml", "\"07ba0[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=de-de", "\"[...]
Found : user_pref("CommunityToolbar.EngineOwner", "CT2431245");
Found : user_pref("CommunityToolbar.EngineOwnerGuid", "{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}");
Found : user_pref("CommunityToolbar.EngineOwnerToolbarId", "softonic-de3");
Found : user_pref("CommunityToolbar.IsMyStuffImportedToEngine", true);
Found : user_pref("CommunityToolbar.MiniIPageGadgetSize.hxxp://pgcff.pricegong.com/agreement/agree.html#pg_e[...]
Found : user_pref("CommunityToolbar.OriginalEngineOwner", "CT2431245");
Found : user_pref("CommunityToolbar.OriginalEngineOwnerGuid", "{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}");
Found : user_pref("CommunityToolbar.OriginalEngineOwnerToolbarId", "softonic-de3");
Found : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "chrome://browser-region/locale/region.pr[...]
Found : user_pref("CommunityToolbar.ToolbarsList", "ConduitEngine,CT2431245");
Found : user_pref("CommunityToolbar.ToolbarsList2", "CT2431245");
Found : user_pref("CommunityToolbar.alert.alertInfoInterval", 1440);
Found : user_pref("CommunityToolbar.alert.alertInfoLastCheckTime", "Mon Jul 23 2012 08:14:28 GMT+0200");
Found : user_pref("CommunityToolbar.alert.clientsServerUrl", "hxxp://alert.client.conduit.com");
Found : user_pref("CommunityToolbar.alert.firstTimeAlertShown", true);
Found : user_pref("CommunityToolbar.alert.locale", "en");
Found : user_pref("CommunityToolbar.alert.loginIntervalMin", 1440);
Found : user_pref("CommunityToolbar.alert.loginLastCheckTime", "Mon Jul 23 2012 08:14:28 GMT+0200");
Found : user_pref("CommunityToolbar.alert.loginLastUpdateTime", "1313487611");
Found : user_pref("CommunityToolbar.alert.messageShowTimeSec", 20);
Found : user_pref("CommunityToolbar.alert.servicesServerUrl", "hxxp://alert.services.conduit.com");
Found : user_pref("CommunityToolbar.alert.showTrayIcon", false);
Found : user_pref("CommunityToolbar.alert.userCloseIntervalMin", 300);
Found : user_pref("CommunityToolbar.alert.userId", "c26d390a-97c4-4f63-b5cf-6a8711048aa0");
Found : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Fri Dec 31 2010 16:48:24 GMT+0100");
Found : user_pref("ConduitEngine.FirstServerDate", "11/10/2010 01");
Found : user_pref("ConduitEngine.FirstTime", true);
Found : user_pref("ConduitEngine.FirstTimeFF3", true);
Found : user_pref("ConduitEngine.HasUserGlobalKeys", true);
Found : user_pref("ConduitEngine.Initialize", true);
Found : user_pref("ConduitEngine.InitializeCommonPrefs", true);
Found : user_pref("ConduitEngine.InstalledDate", "Tue Nov 09 2010 23:56:05 GMT+0100");
Found : user_pref("ConduitEngine.IsMulticommunity", false);
Found : user_pref("ConduitEngine.IsOpenThankYouPage", false);
Found : user_pref("ConduitEngine.IsOpenUninstallPage", true);
Found : user_pref("ConduitEngine.LanguagePackLastCheckTime", "Mon Jul 23 2012 08:14:33 GMT+0200");
Found : user_pref("ConduitEngine.LastLogin_3.2.1.3", "Mon Jul 23 2012 08:14:33 GMT+0200");
Found : user_pref("ConduitEngine.PublisherContainerWidth", 0);
Found : user_pref("ConduitEngine.SearchFromAddressBarIsInit", true);
Found : user_pref("ConduitEngine.SettingsLastCheckTime", "Mon Jul 23 2012 08:14:33 GMT+0200");
Found : user_pref("ConduitEngine.UserID", "UN84127801060290411");
Found : user_pref("ConduitEngine.engineLocale", "de");
Found : user_pref("ConduitEngine.enngineContextMenuLastCheckTime", "Mon Jul 23 2012 08:14:33 GMT+0200");
Found : user_pref("ConduitEngine.initDone", true);

-\\ Opera v12.0.1467.0

File : C:\Users\Patrick\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] File is clean.

File : C:\Users\Administrator\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [26257 octets] - [23/07/2012 22:22:29]
AdwCleaner[R2].txt - [26211 octets] - [25/07/2012 12:03:57]

########## EOF - C:\AdwCleaner[R2].txt - [26340 octets] ##########
         

Sehr gut!

• Schließe alle offenen Programme und Browser.
• Starte die adwcleaner.exe mit einem Doppelklick.
• Klicke auf Delete.
• Bestätige jeweils mit Ok.
• Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
• Poste mir den Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

danach:


Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html

Hi,

sorry die letzten Tage nicht oft am PC, deswegen die längeren Reaktionszeiten meinerseits.

ADW-Log:

# AdwCleaner v1.703 - Logfile created 07/26/2012 at 18:01:43
# Updated 20/07/2012 by Xplode
# Operating system : Windows 7 Ultimate  (64 bits)
# User : Patrick - PATRICK-PC
# Running from : C:\Users\Patrick\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Folder Deleted : C:\Users\Patrick\AppData\Local\Conduit
Folder Deleted : C:\Users\Patrick\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\Patrick\AppData\LocalLow\ConduitEngine
Folder Deleted : C:\Users\Patrick\AppData\LocalLow\PriceGong
Folder Deleted : C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\a5yp3qmn.default\Conduit
Folder Deleted : C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\a5yp3qmn.default\ConduitEngine
Folder Deleted : C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\a5yp3qmn.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}
Folder Deleted : C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\a5yp3qmn.default\extensions\engine@conduit.com
Folder Deleted : C:\ProgramData\boost_interprocess
Folder Deleted : C:\Program Files (x86)\ConduitEngine
File Deleted : C:\Program Files (x86)\Mozilla Firefox\.autoreg

***** [Registry] *****
[*] Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2431245[*] Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2653012
Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software\conduitEngine
Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong
Key Deleted : HKCU\Software\AppDataLow\Toolbar
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKLM\SOFTWARE\Classes\Conduit.Engine
Key Deleted : HKLM\SOFTWARE\Conduit
Key Deleted : HKLM\SOFTWARE\conduitEngine
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine

***** [Registre - GUID] *****

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{30F9B915-B755-4826-820B-08FBA6BD249D}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.7600.16385

[OK] Registry is clean.

-\\ Mozilla Firefox v3.5.17 (de)

Profile name : default 
File : C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\a5yp3qmn.default\prefs.js

C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\a5yp3qmn.default\user.js ... Deleted !

Deleted : user_pref("CT2431245..clientLogIsEnabled", false);
Deleted : user_pref("CT2431245..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]
Deleted : user_pref("CT2431245..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]
Deleted : user_pref("CT2431245.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Deleted : user_pref("CT2431245.CTID", "CT2431245");
Deleted : user_pref("CT2431245.CurrentServerDate", "23-7-2012");
Deleted : user_pref("CT2431245.DialogsAlignMode", "LTR");
Deleted : user_pref("CT2431245.DownloadReferralCookieData", "");
Deleted : user_pref("CT2431245.EMailNotifierPollDate", "Mon Jul 23 2012 08:14:29 GMT+0200");
Deleted : user_pref("CT2431245.FeedLastCount129009402595187825", 1192);
Deleted : user_pref("CT2431245.FeedPollDate7470634014180506963", "Mon Dec 19 2011 23:12:20 GMT+0100");
Deleted : user_pref("CT2431245.FeedPollDate7470634014269327586", "Mon Dec 19 2011 23:12:19 GMT+0100");
Deleted : user_pref("CT2431245.FeedPollDate7470634014329599698", "Mon Dec 19 2011 23:12:19 GMT+0100");
Deleted : user_pref("CT2431245.FeedPollDate7470634014537505092", "Mon Dec 19 2011 23:12:19 GMT+0100");
Deleted : user_pref("CT2431245.FeedPollDate7470634014970726540", "Mon Dec 19 2011 23:12:20 GMT+0100");
Deleted : user_pref("CT2431245.FeedPollDate7470634015410831318", "Mon Dec 19 2011 23:12:21 GMT+0100");
Deleted : user_pref("CT2431245.FeedPollDate7470634015483395460", "Mon Dec 19 2011 23:12:20 GMT+0100");
Deleted : user_pref("CT2431245.FeedPollDate7470634015636754705", "Mon Dec 19 2011 23:12:20 GMT+0100");
Deleted : user_pref("CT2431245.FeedPollDate7470634015768347545", "Mon Dec 19 2011 23:12:20 GMT+0100");
Deleted : user_pref("CT2431245.FeedPollDate7470634015855543602", "Mon Dec 19 2011 23:12:19 GMT+0100");
Deleted : user_pref("CT2431245.FeedPollDate7470634016030710453", "Mon Dec 19 2011 23:12:19 GMT+0100");
Deleted : user_pref("CT2431245.FeedPollDate7470634016114705611", "Mon Dec 19 2011 23:12:21 GMT+0100");
Deleted : user_pref("CT2431245.FeedPollDate7470634016129205152", "Mon Dec 19 2011 23:12:21 GMT+0100");
Deleted : user_pref("CT2431245.FeedPollDate7470634016143724791", "Mon Dec 19 2011 23:12:21 GMT+0100");
Deleted : user_pref("CT2431245.FeedPollDate7470634016271239162", "Mon Dec 19 2011 23:12:21 GMT+0100");
Deleted : user_pref("CT2431245.FeedPollDate7470634016568520719", "Mon Dec 19 2011 23:12:20 GMT+0100");
Deleted : user_pref("CT2431245.FeedPollDate7470634016726993788", "Mon Dec 19 2011 23:12:19 GMT+0100");
Deleted : user_pref("CT2431245.FeedPollDate7470634017109031809", "Mon Dec 19 2011 23:12:20 GMT+0100");
Deleted : user_pref("CT2431245.FeedPollDate7470634017132743740", "Mon Dec 19 2011 23:12:20 GMT+0100");
Deleted : user_pref("CT2431245.FeedPollDate7470634017299547668", "Mon Dec 19 2011 23:12:21 GMT+0100");
Deleted : user_pref("CT2431245.FeedPollDate7470634017302327846", "Mon Dec 19 2011 23:12:20 GMT+0100");
Deleted : user_pref("CT2431245.FeedPollDate7470634017344111490", "Mon Dec 19 2011 23:12:19 GMT+0100");
Deleted : user_pref("CT2431245.FeedPollDate7470634017478360748", "Mon Dec 19 2011 23:12:21 GMT+0100");
Deleted : user_pref("CT2431245.FeedPollDate7470634017732797593", "Mon Dec 19 2011 23:12:19 GMT+0100");
Deleted : user_pref("CT2431245.FeedPollDate7470634017821686064", "Mon Dec 19 2011 23:12:21 GMT+0100");
Deleted : user_pref("CT2431245.FeedPollDate7470634018090228721", "Mon Dec 19 2011 23:12:20 GMT+0100");
Deleted : user_pref("CT2431245.FeedTTL7470634014269327586", 5);
Deleted : user_pref("CT2431245.FeedTTL7470634014537505092", 5);
Deleted : user_pref("CT2431245.FeedTTL7470634014970726540", 2);
Deleted : user_pref("CT2431245.FeedTTL7470634015636754705", 5);
Deleted : user_pref("CT2431245.FeedTTL7470634015855543602", 30);
Deleted : user_pref("CT2431245.FeedTTL7470634016568520719", 30);
Deleted : user_pref("CT2431245.FeedTTL7470634017109031809", 2);
Deleted : user_pref("CT2431245.FeedTTL7470634017299547668", 2);
Deleted : user_pref("CT2431245.FirstServerDate", "10-11-2010");
Deleted : user_pref("CT2431245.FirstTime", true);
Deleted : user_pref("CT2431245.FirstTimeFF3", true);
Deleted : user_pref("CT2431245.FixPageNotFoundErrors", true);
Deleted : user_pref("CT2431245.GroupingServerCheckInterval", 1440);
Deleted : user_pref("CT2431245.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Deleted : user_pref("CT2431245.HasUserGlobalKeys", true);
Deleted : user_pref("CT2431245.Initialize", true);
Deleted : user_pref("CT2431245.InitializeCommonPrefs", true);
Deleted : user_pref("CT2431245.InstallationAndCookieDataSentCount", 3);
Deleted : user_pref("CT2431245.InstallationId", "integrated_CT2431245 .exe");
Deleted : user_pref("CT2431245.InstallationType", "ConduitIntegration");
Deleted : user_pref("CT2431245.InstalledDate", "Tue Nov 09 2010 23:56:05 GMT+0100");
Deleted : user_pref("CT2431245.InvalidateCache", false);
Deleted : user_pref("CT2431245.IsGrouping", false);
Deleted : user_pref("CT2431245.IsMulticommunity", false);
Deleted : user_pref("CT2431245.IsOpenThankYouPage", false);
Deleted : user_pref("CT2431245.IsOpenUninstallPage", true);
Deleted : user_pref("CT2431245.LanguagePackLastCheckTime", "Mon Jul 23 2012 08:14:33 GMT+0200");
Deleted : user_pref("CT2431245.LanguagePackReloadIntervalMM", 1440);
Deleted : user_pref("CT2431245.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Deleted : user_pref("CT2431245.LastLogin_3.2.1.3", "Mon Jul 23 2012 08:14:33 GMT+0200");
Deleted : user_pref("CT2431245.LatestVersion", "3.13.0.6");
Deleted : user_pref("CT2431245.Locale", "de-de");
Deleted : user_pref("CT2431245.MCDetectTooltipHeight", "83");
Deleted : user_pref("CT2431245.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Deleted : user_pref("CT2431245.MCDetectTooltipWidth", "295");
Deleted : user_pref("CT2431245.RadioIsPodcast", false);
Deleted : user_pref("CT2431245.RadioLastCheckTime", "Mon Jul 23 2012 08:14:30 GMT+0200");
Deleted : user_pref("CT2431245.RadioLastUpdateIPServer", "3");
Deleted : user_pref("CT2431245.RadioLastUpdateServer", "129167771525870000");
Deleted : user_pref("CT2431245.RadioMediaID", "20503672");
Deleted : user_pref("CT2431245.RadioMediaType", "Media Player");
Deleted : user_pref("CT2431245.RadioMenuSelectedID", "EBRadioMenu_CT243124520503672");
Deleted : user_pref("CT2431245.RadioStationName", "Team%20Radio%20Deutschland");
Deleted : user_pref("CT2431245.RadioStationURL", "hxxp://trd.stream.w-u-s.org:6666/dsl.m3u");
Deleted : user_pref("CT2431245.SearchFromAddressBarIsInit", true);
Deleted : user_pref("CT2431245.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT243[...]
Deleted : user_pref("CT2431245.SearchInNewTabEnabled", true);
Deleted : user_pref("CT2431245.SearchInNewTabIntervalMM", 1440);
Deleted : user_pref("CT2431245.SearchInNewTabLastCheckTime", "Mon Jul 23 2012 08:14:29 GMT+0200");
Deleted : user_pref("CT2431245.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
Deleted : user_pref("CT2431245.SearchInNewTabUsageUrl", "hxxp://usage.hosting.toolbar.conduit-services.com/usa[...]
Deleted : user_pref("CT2431245.SearchInNewTabUserEnabled", false);
Deleted : user_pref("CT2431245.ServiceMapLastCheckTime", "Mon Jul 23 2012 08:14:33 GMT+0200");
Deleted : user_pref("CT2431245.SettingsLastCheckTime", "Mon Jul 23 2012 08:14:28 GMT+0200");
Deleted : user_pref("CT2431245.SettingsLastUpdate", "1339926569");
Deleted : user_pref("CT2431245.ThirdPartyComponentsInterval", 504);
Deleted : user_pref("CT2431245.ThirdPartyComponentsLastCheck", "Tue Jul 03 2012 09:53:26 GMT+0200");
Deleted : user_pref("CT2431245.ThirdPartyComponentsLastUpdate", "1331806000");
Deleted : user_pref("CT2431245.TrusteLinkUrl", "hxxp://trust.conduit.com/EB_ORIGINAL_CTID");
Deleted : user_pref("CT2431245.UserID", "UN31653509154106132");
Deleted : user_pref("CT2431245.ValidationData_Toolbar", 2);
Deleted : user_pref("CT2431245.WeatherNetwork", "");
Deleted : user_pref("CT2431245.WeatherPollDate", "Mon Jul 23 2012 08:14:31 GMT+0200");
Deleted : user_pref("CT2431245.WeatherUnit", "C");
Deleted : user_pref("CT2431245.alertChannelId", "825452");
Deleted : user_pref("CT2431245.backendstorage./9b+7e+x305", "247E27413334363379453A3D2A722C797A7E7A3128333B4D4[...]
Deleted : user_pref("CT2431245.backendstorage./9b+7e,x305", "247E28412F3F3E3779453A3D2A722C797B787D3128333C474[...]
Deleted : user_pref("CT2431245.backendstorage./9b+7e-x305", "247E2936303C363679453A3D2A722C797A207B3128333D462[...]
Deleted : user_pref("CT2431245.backendstorage./9b+7e.:2z527", "247E707571777278333228702A7B797B7B7E30273224262[...]
Deleted : user_pref("CT2431245.backendstorage./9b+7e.x305", "247E2A4137374434337A463B3E2B732D7A7D7C213229343F5[...]
Deleted : user_pref("CT2431245.backendstorage./9b+7e/x305", "247E2B413536327844393C29712B787C7B773027323E4C434[...]
Deleted : user_pref("CT2431245.backendstorage./9b+7e06cg5el8:", "6E6D6D70726B756D7374");
Deleted : user_pref("CT2431245.backendstorage./9b+7e06cg5el;8i:k", "247E2D2F226A7473737678717B73797A242F4B4947[...]
Deleted : user_pref("CT2431245.backendstorage./9b+7e0x305", "247E2C403A407743383B28702A777C757D2F26313E4129554[...]
Deleted : user_pref("CT2431245.backendstorage./9b+7e1x305", "247E2D41313D403279453A3D2A722C7A77797E31283341473[...]
Deleted : user_pref("CT2431245.backendstorage./9b+7e2x305", "247E2E3542313D3D393A7B473C3F2C742E79207D322934435[...]
Deleted : user_pref("CT2431245.backendstorage./9b+7e31;cjc<=fbj#mm", "247E61393F236B257576737A2A212C6E414F444D[...]
Deleted : user_pref("CT2431245.backendstorage./9b+7e31;cjc<=fbj#ncf", "247E61393F236B25757677712A212C6E414F444[...]
Deleted : user_pref("CT2431245.backendstorage./9b+7e3x305", "247E2F413F3B36333F47463F7D493E412E76307E222421352[...]
Deleted : user_pref("CT2431245.backendstorage./9b+7e4x305", "247E302C407642373A276F29777B74762E2530413E4F494A5[...]
Deleted : user_pref("CT2431245.backendstorage./9b+7e5x305", "247E3136422B7743383B28702A79757A772F2631434B3D495[...]
Deleted : user_pref("CT2431245.backendstorage./9b+7e6x305", "247E322C3E32323238453E7C483D402D752F7E7B2424342B3[...]
Deleted : user_pref("CT2431245.backendstorage./9b+7e7x305", "247E333D2C3F3E3F79453A3D2A722C7B7A797A31283347474[...]
Deleted : user_pref("CT2431245.backendstorage./9b+7e8x305", "247E343D3F3B35373B3F367C47472C742E7E7823322934495[...]
Deleted : user_pref("CT2431245.backendstorage./9b+7e9x305", "247E35332C3F327844393C29712B7B757979302732484C4F4[...]
Deleted : user_pref("CT2431245.backendstorage./9b+7e:x305", "247E36333B38327844393C29712B7B76797A3027324948554[...]
Deleted : user_pref("CT2431245.backendstorage./9b+7e;x305", "247E373F333F3738422F7B473C3F2C742E7E7A7A22332A354[...]
Deleted : user_pref("CT2431245.backendstorage./9b+7e<x305", "247E38343030442F463644377D493E412E7630217D2426352[...]
Deleted : user_pref("CT2431245.backendstorage./9b+7e=x305", "247E3933363F41413739357C483D402D752F207E2022342B3[...]
Deleted : user_pref("CT2431245.backendstorage./9b+7e>x305", "247E3A41363F323238387B473C3F2C742E7E20217C332A355[...]
Deleted : user_pref("CT2431245.backendstorage./9b+7e?x305", "247E3B2D2F2F334134403A3A7D494C2D752F2023207E342B3[...]
Deleted : user_pref("CT2431245.backendstorage./9b+7e@x305", "247E3C40422B7743383B28702A7B767E782F26314E52543D2[...]
Deleted : user_pref("CT2431245.backendstorage./9b+7eax305", "247E3D3D37387743383B28702A7B7A757E2F26314F4F544A5[...]
Deleted : user_pref("CT2431245.backendstorage./9b+7ebe3g=;d9n9=d", "372C2D326975762E3A3C7B3A39434A494841434B26[...]
Deleted : user_pref("CT2431245.backendstorage./9b+7ebx305", "247E3E393141303D33454036327E4A3F422F77317B7D23352[...]
Deleted : user_pref("CT2431245.backendstorage./9b+7ecx305", "247E3F3D303043312E7A463B3E2B732D7B207E31283353515[...]
Deleted : user_pref("CT2431245.backendstorage./9b+7edx305", "247E4035422A363879453A3D2A722C7D202F26315247543C4[...]
Deleted : user_pref("CT2431245.backendstorage./9b+7etx305", "247E6E2F2E3B323342357B44392B732D7A7B7B7C322934215[...]
Deleted : user_pref("CT2431245.backendstorage./9b-0?3g>d", "6F676E6C6A6F72757A6F484979207A7E764C25212053242A56[...]
Deleted : user_pref("CT2431245.backendstorage./9b-0?3g@6:5;", "");
Deleted : user_pref("CT2431245.backendstorage./9b-0?3gfa7ef", "2B2E2C3D");
Deleted : user_pref("CT2431245.backendstorage./9b-3=3eccja=f>", "247E333D2C452F4135276F292A212C393D44307832332[...]
Deleted : user_pref("CT2431245.backendstorage./9b/>01=9a6k6<im;krie@pdawm", "6A696B7273747576");
Deleted : user_pref("CT2431245.backendstorage./9b3=>@44i48?", "372C2D326975763342363341484776213F3E484F4E4D464[...]
Deleted : user_pref("CT2431245.backendstorage./9b5ba==9cjag", "676D3E3D3E7240757A477748497B7A767B4E7D504F");
Deleted : user_pref("CT2431245.backendstorage./9b6b11g4c56b>f;p;anr@p", "6E6D6D70726B756D7470747576");
Deleted : user_pref("CT2431245.backendstorage./9b9643g3/9e", "6A");
Deleted : user_pref("CT2431245.backendstorage./9b<:222h64<", "393F352F3E");
Deleted : user_pref("CT2431245.backendstorage./9b=+03eh8h8j?:", "4443");
Deleted : user_pref("CT2431245.backendstorage./9b?+e2a52d8", "372C2D326975762E3A3C7B3A39434A494841434B26514649[...]
Deleted : user_pref("CT2431245.backendstorage./9b?b0d:8aj62<h", "6D");
Deleted : user_pref("CT2431245.backendstorage./9ba@0<0bi6a7gn:6@l?", "6E6B");
Deleted : user_pref("CT2431245.backendstorage._fb_dailyactivity", "31333032333535333538353032");
Deleted : user_pref("CT2431245.backendstorage._fb_lifetimesent", "54525545");
Deleted : user_pref("CT2431245.backendstorage.ct2431245ads1", "25374225323261647325323225334125354225374225323[...]
Deleted : user_pref("CT2431245.backendstorage.ct2431245current_term", "");
Deleted : user_pref("CT2431245.backendstorage.ct2431245isadsdisabled", "66616C7365");
Deleted : user_pref("CT2431245.backendstorage.ct2431245sdate", "3330");
Deleted : user_pref("CT2431245.backendstorage.ctid", "435432343331323435");
Deleted : user_pref("CT2431245.backendstorage.eule_tb_id", "46393538323631363130333730353431395447383737393931[...]
Deleted : user_pref("CT2431245.backendstorage.facebook_ctid_connect_send", "73656E646564");
Deleted : user_pref("CT2431245.backendstorage.firstinstall", "796573");
Deleted : user_pref("CT2431245.backendstorage.for_aoi", "31333038353533333038");
Deleted : user_pref("CT2431245.backendstorage.for_ccid", "6E756C6C");
Deleted : user_pref("CT2431245.backendstorage.for_cdtr5", "31333038353533333038");
Deleted : user_pref("CT2431245.backendstorage.for_cid", "4445");
Deleted : user_pref("CT2431245.backendstorage.for_ip", "38342E3133332E3233302E36");
Deleted : user_pref("CT2431245.backendstorage.for_lcut", "31333135343731383134");
Deleted : user_pref("CT2431245.backendstorage.for_pid", "31303130");
Deleted : user_pref("CT2431245.backendstorage.for_rid", "3037");
Deleted : user_pref("CT2431245.backendstorage.for_zoneid", "39353933");
Deleted : user_pref("CT2431245.backendstorage.gsdomain", "");
Deleted : user_pref("CT2431245.backendstorage.hxxp://cmg1_conduit-widgets_com/pitsi.state", "4F50454E");
Deleted : user_pref("CT2431245.backendstorage.lastrun", "31333131333238353034313036");
Deleted : user_pref("CT2431245.backendstorage.li_dailyactivity", "31333030333936373835303235");
Deleted : user_pref("CT2431245.backendstorage.li_lifetimesent", "54525545");
Deleted : user_pref("CT2431245.backendstorage.partner_id", "3937346665643236");
Deleted : user_pref("CT2431245.backendstorage.printitgreenstatus", "74727565");
Deleted : user_pref("CT2431245.backendstorage.shoppingapp.gk.exipres", "576564204A756C20313820323031322031363A[...]
Deleted : user_pref("CT2431245.backendstorage.shoppingapp.gk.geolocation", "6765726D616E79");
Deleted : user_pref("CT2431245.backendstorage.tbready", "74727565");
Deleted : user_pref("CT2431245.myStuffEnabled", true);
Deleted : user_pref("CT2431245.myStuffPublihserMinWidth", 400);
Deleted : user_pref("CT2431245.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
Deleted : user_pref("CT2431245.myStuffServiceIntervalMM", 1440);
Deleted : user_pref("CT2431245.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Deleted : user_pref("CT2431245.testingCtid", "");
Deleted : user_pref("CT2431245.toolbarAppMetaDataLastCheckTime", "Mon Jul 23 2012 08:14:33 GMT+0200");
Deleted : user_pref("CT2431245.toolbarContextMenuLastCheckTime", "Tue Nov 09 2010 23:56:06 GMT+0100");
Deleted : user_pref("CT2431245.usagesFlag", 2);
Deleted : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT2431245/CT2431245[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/?aid=825452&fid=821260", "\"0\""[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/?aid=909619&fid=905414", "\"0\""[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/825452/821260/DE", "\"0\"")[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/909619/905414/DE", "\"0\"")[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2431245", [...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/toolbar/", "\"c912886ea3ba02[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=0", "63[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=1/11/20[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=11/8/20[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=12/30/2[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=2/22/20[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=3/13/20[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.conduit-services.com/?ctid=CT2431245&octid=[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.search.conduit.com/root/CT2431245/CT2431245[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Bluenote/equalizer[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Bluenote/minimize.[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Bluenote/play.gif"[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Bluenote/stop.gif"[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Bluenote/vol.gif",[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/Newtab/Softonic/CT2431245.xml", "\"07ba0[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=de-de", "\"[...]
Deleted : user_pref("CommunityToolbar.EngineOwner", "CT2431245");
Deleted : user_pref("CommunityToolbar.EngineOwnerGuid", "{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}");
Deleted : user_pref("CommunityToolbar.EngineOwnerToolbarId", "softonic-de3");
Deleted : user_pref("CommunityToolbar.IsMyStuffImportedToEngine", true);
Deleted : user_pref("CommunityToolbar.MiniIPageGadgetSize.hxxp://pgcff.pricegong.com/agreement/agree.html#pg_e[...]
Deleted : user_pref("CommunityToolbar.OriginalEngineOwner", "CT2431245");
Deleted : user_pref("CommunityToolbar.OriginalEngineOwnerGuid", "{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}");
Deleted : user_pref("CommunityToolbar.OriginalEngineOwnerToolbarId", "softonic-de3");
Deleted : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "chrome://browser-region/locale/region.pr[...]
Deleted : user_pref("CommunityToolbar.ToolbarsList", "ConduitEngine,CT2431245");
Deleted : user_pref("CommunityToolbar.ToolbarsList2", "CT2431245");
Deleted : user_pref("CommunityToolbar.alert.alertInfoInterval", 1440);
Deleted : user_pref("CommunityToolbar.alert.alertInfoLastCheckTime", "Mon Jul 23 2012 08:14:28 GMT+0200");
Deleted : user_pref("CommunityToolbar.alert.clientsServerUrl", "hxxp://alert.client.conduit.com");
Deleted : user_pref("CommunityToolbar.alert.firstTimeAlertShown", true);
Deleted : user_pref("CommunityToolbar.alert.locale", "en");
Deleted : user_pref("CommunityToolbar.alert.loginIntervalMin", 1440);
Deleted : user_pref("CommunityToolbar.alert.loginLastCheckTime", "Mon Jul 23 2012 08:14:28 GMT+0200");
Deleted : user_pref("CommunityToolbar.alert.loginLastUpdateTime", "1313487611");
Deleted : user_pref("CommunityToolbar.alert.messageShowTimeSec", 20);
Deleted : user_pref("CommunityToolbar.alert.servicesServerUrl", "hxxp://alert.services.conduit.com");
Deleted : user_pref("CommunityToolbar.alert.showTrayIcon", false);
Deleted : user_pref("CommunityToolbar.alert.userCloseIntervalMin", 300);
Deleted : user_pref("CommunityToolbar.alert.userId", "c26d390a-97c4-4f63-b5cf-6a8711048aa0");
Deleted : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Fri Dec 31 2010 16:48:24 GMT+0100");
Deleted : user_pref("ConduitEngine.FirstServerDate", "11/10/2010 01");
Deleted : user_pref("ConduitEngine.FirstTime", true);
Deleted : user_pref("ConduitEngine.FirstTimeFF3", true);
Deleted : user_pref("ConduitEngine.HasUserGlobalKeys", true);
Deleted : user_pref("ConduitEngine.Initialize", true);
Deleted : user_pref("ConduitEngine.InitializeCommonPrefs", true);
Deleted : user_pref("ConduitEngine.InstalledDate", "Tue Nov 09 2010 23:56:05 GMT+0100");
Deleted : user_pref("ConduitEngine.IsMulticommunity", false);
Deleted : user_pref("ConduitEngine.IsOpenThankYouPage", false);
Deleted : user_pref("ConduitEngine.IsOpenUninstallPage", true);
Deleted : user_pref("ConduitEngine.LanguagePackLastCheckTime", "Mon Jul 23 2012 08:14:33 GMT+0200");
Deleted : user_pref("ConduitEngine.LastLogin_3.2.1.3", "Mon Jul 23 2012 08:14:33 GMT+0200");
Deleted : user_pref("ConduitEngine.PublisherContainerWidth", 0);
Deleted : user_pref("ConduitEngine.SearchFromAddressBarIsInit", true);
Deleted : user_pref("ConduitEngine.SettingsLastCheckTime", "Mon Jul 23 2012 08:14:33 GMT+0200");
Deleted : user_pref("ConduitEngine.UserID", "UN84127801060290411");
Deleted : user_pref("ConduitEngine.engineLocale", "de");
Deleted : user_pref("ConduitEngine.enngineContextMenuLastCheckTime", "Mon Jul 23 2012 08:14:33 GMT+0200");
Deleted : user_pref("ConduitEngine.initDone", true);

-\\ Opera v12.0.1467.0

File : C:\Users\Patrick\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] File is clean.

File : C:\Users\Administrator\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [26257 octets] - [23/07/2012 22:22:29]
AdwCleaner[R2].txt - [26318 octets] - [25/07/2012 12:03:57]
AdwCleaner[S1].txt - [25937 octets] - [26/07/2012 18:01:43]

########## EOF - C:\AdwCleaner[S1].txt - [26066 octets] ##########
         

EmsiSoft-Log:

Emsisoft Anti-Malware - Version 6.6
Letztes Update: 28-Jul-12 15:09:20

Scan Einstellungen:

Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\, Z:\
Archiv Scan: An
ADS Scan: An

Scan Beginn:	28-Jul-12 15:09:31

c:\users\patrick\appdata\roaming\chrtmp 	gefunden: Trace.File.injector!E1
Z:\Treiber & Programme Acer Spire 6930 W7\TuneUp.Utilities.2012.v12.0.2120.5.IuP\TuneUp.Utilities.2012.v12.0.2120.5.IuP\Lz0\Lz0\KeyMaker.exe 	gefunden: Riskware.Keygen.TuneUp2012!E2
Z:\Defy\DEFY UPDATE\SuperOneClickv1.9.1-ShortFuse.zip -> Exploits\GingerBreak 	gefunden: Exploit.Linux.Lotoor!E2
Z:\Defy\DEFY UPDATE\SuperOneClickv1.9.1-ShortFuse\Exploits\GingerBreak 	gefunden: Exploit.Linux.Lotoor.p!E1

Gescannt	984085
Gefunden	4

Scan Ende:	28-Jul-12 16:38:38
Scan Zeit:	1:29:07
         

Die Defy-Update-files sind ok. Da diese für ein Android-Update sind, brauchen sie Rechte für das Smartphone. Daher werden diese wohl als Malware eingestuft...

Gruß

Patrick

Sehr gut!


Deinstalliere:
Emsisoft Anti-Malware


ESET Online Scanner

Vorbereitung

• Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an.
• Bitte während des Online-Scans Anti-Virus-Programm und Firewall deaktivieren.
• Vista/Win7-User: Bitte den Browser unbedingt als Administrator starten.

Los geht's

• Lade und starte Eset Smartinstaller
• Haken setzen bei YES, I accept the Terms of Use.
• Klick auf Start.
• Haken setzen bei Remove found threads und Scan archives.
• Klick auf Start.
• Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Finish drücken.
• Browser schließen.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (manchmal auch C:\Programme\Eset\log.txt) suchen und mit Deinem Editor öffnen.
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

ESET-Log:

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=19b78e812507884daa03890192a2b6ee
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-07-29 12:36:53
# local_time=2012-07-29 02:36:53 (+0100, Mitteleuropäische Sommerzeit)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 113557 95189435 0 0
# compatibility_mode=8192 67108863 100 0 249 249 0 0
# scanned=547662
# found=3
# cleaned=3
# scan_time=5828
Z:\Defy\DEFY UPDATE\SuperOneClickv1.9.1-ShortFuse.zip	multiple threats (deleted - quarantined)	00000000000000000000000000000000	C
Z:\Defy\DEFY UPDATE\SuperOneClickv1.9.1-ShortFuse\Exploits\GingerBreak	Android/Exploit.Lotoor.AF trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
Z:\Defy\DEFY UPDATE\SuperOneClickv1.9.1-ShortFuse\Exploits\psneuter	Android/Exploit.Lotoor.AK trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
         

Java aktualisieren

Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.

• Downloade dir bitte die neueste Java-Version von hier
• Speichere die jxpiinstall.exe
• Schließe alle laufenden Programme. Speziell deinen Browser.
• Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 5 ) herunter laden.
• Wenn die Installation beendet wurde
  Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
• Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.

Nach dem Neustart

• Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
• Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
• Klicke auf Dateien löschen....
• Gehe sicher das überall ein Hacken gesetzt ist und klicke OK.
• Klicke erneut OK.

Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html

Alles klaro,

Java ist aktualisiert. Ist es geschafft?

Ich danke Dir vielmals für Deine Unterstützung!

Sehr gut!

damit bist Du sauber und entlassen!


Tool-Bereinigung mit OTL


Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.

• Bitte lade Dir (falls noch nicht vorhanden) OTL von OldTimer herunter.
• Speichere es auf Deinem Desktop.
• Doppelklick auf OTL.exe um das Programm auszuführen.
  Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
• Klicke auf den Button "Bereinigung"
• OTL fragt eventuell nach einem Neustart.
  Sollte es dies tun, so lasse dies bitte zu.

Anmerkung: Nach dem Neustart werden OTL und andere Helferprogramme, die Du im Laufe der Bereinigung heruntergeladen hast, nicht mehr vorhanden sein. Sie wurden entfernt. Es ist daher Ok, wenn diese Programme nicht mehr vorhanden sind. Sollten noch welche übrig geblieben sein, lösche sie manuell.


Zurücksetzen der Sicherheitszonen

Lasse die Sicherheitszonen wieder zurücksetzen, da diese manipuliert wurden um den Browser für weitere Angriffe zu öffnen.
Gehe dabei so vor: http://www.trojaner-board.de/111805-...ecksetzen.html


Aufräumen mit CCleaner

Lasse mit CCleaner (Download) (Anleitung) Fehler in der

• Registry beheben (mehrmals, solange bis keine Fehler mehr gefunden werden) und
• temporäre Dateien löschen.

Lektuere zum abarbeiten:
http://www.trojaner-board.de/90880-d...tallation.html
http://www.trojaner-board.de/105213-...tellungen.html
PluginCheck
http://www.trojaner-board.de/96344-a...-rechners.html
Secunia Online Software Inspector
http://www.trojaner-board.de/71715-k...iendungen.html
http://www.trojaner-board.de/83238-a...sschalten.html