Hi liebes Trojaner-Board Team,

ich habe mir beim Surfen gestern auch den Bundespolizei Sperrtrojaner eingefangen ("Der Computer ist für die Verletzung der Gesetze der Bundesrepublik Deutschland wurde blockiert"). Bin mit Opera unterwegs und auf einmal ging gar nichts mehr.
Habe wie in einem anderen Thread empfohlen im abgesicherten Modus Malwarebytes' Anti-Malware und OTL drüberlaufen lassen. Die Dateien habe ich erst mal zum Aushungern in Quarantäne gesteckt. Die Logs der Scans sind unten. PC läuft momentan flüssig.

Ich hoffe jemand mit etwas Sacherverstand kann mal auf die Logs schauen und mir ggf sagen wie ich weiter vorzugehen habe.
Habt ihr zusätzliche eine Meinung zur Sicherheit von Opera oder mit welchem Scanner ich so etwas in Zukunft vorbeugen kann?

Vielen Dank
Erik

PS: Die Files "Bruellbacke Witzsammlung...exe" sind schon lange auf meinem Rechner - ich habe sie noch nie angerührt.

Malwarebytes' Anti-Malware

Malwarebytes Anti-Malware (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.26.04

Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 9.0.8112.16421
Erik :: ERIKPC [Administrator]

Schutz: Deaktiviert

26.07.2012 09:12:56
mbam-log-2012-07-26 (09-24-59).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 392729
Laufzeit: 10 Minute(n), 53 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 1
HKLM\SYSTEM\CurrentControlSet\Services\SVKP (Trojan.Agent) -> Keine Aktion durchgeführt.

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|SNTSearch (Trojan.Agent.2D) -> Daten: C:\Users\Erik\AppData\Local\Microsoft\Windows\2879\SNTSearch.exe -> Keine Aktion durchgeführt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 8
C:\Users\Erik\AppData\Local\Microsoft\Windows\2879\SNTSearch.exe (Trojan.Agent.2D) -> Keine Aktion durchgeführt.
C:\Users\Erik\Documents\PDF-Archiv\Lustiges\Bruellbacke Witzsammlung 1.exe (Trojan.PWS) -> Keine Aktion durchgeführt.
C:\Users\Erik\Documents\PDF-Archiv\Lustiges\Bruellbacke Witzsammlung 2.exe (Trojan.PWS) -> Keine Aktion durchgeführt.
C:\Users\Erik\Documents\PDF-Archiv\Lustiges\Bruellbacke Witzsammlung 3.exe (Trojan.PWS) -> Keine Aktion durchgeführt.
C:\Users\Erik\Documents\PDF-Archiv\Lustiges\Bruellbacke Witzsammlung 4.exe (Trojan.PWS) -> Keine Aktion durchgeführt.
C:\Users\Erik\Documents\PDF-Archiv\Lustiges\Bruellbacke Witzsammlung 5.exe (Trojan.PWS) -> Keine Aktion durchgeführt.
C:\Windows\System32\SVKP.sys (Trojan.Agent) -> Keine Aktion durchgeführt.
C:\Windows\SysWOW64\SVKP.sys (Trojan.Agent) -> Keine Aktion durchgeführt.

(Ende)



OTL Standard-LOGOTL Logfile:

OTL logfile created on: 26.07.2012 09:30:45 - Run 1
OTL by OldTimer - Version 3.2.54.1     Folder = C:\Users\Erik\Downloads
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,68 Gb Total Physical Memory | 5,56 Gb Available Physical Memory | 72,39% Memory free
15,35 Gb Paging File | 13,21 Gb Available in Paging File | 86,03% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 238,37 Gb Total Space | 80,40 Gb Free Space | 33,73% Space Free | Partition Type: NTFS
 
Computer Name: ERIKPC | User Name: Erik | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Erik\Downloads\OTL Oldtimer Malware Scanner.exe (OldTimer Tools)
PRC - C:\Programme_neu\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Programme_neu\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
PRC - C:\Programme_neu\Opera\opera.exe (Opera Software)
PRC - C:\Programme_neu\Opera\pluginwrapper\opera_plugin_wrapper.exe (Opera Software)
PRC - C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe (Cisco Systems, Inc.)
PRC - C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe (Cisco Systems, Inc.)
PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\Hotkey\Hotkey.exe ()
PRC - C:\Program Files (x86)\Hotkey\PowerBiosServer.exe ()
PRC - C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG)
PRC - C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (NEC Electronics Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Programme_neu\Opera\gstreamer\plugins\gstwebmdec.dll ()
MOD - C:\Programme_neu\Opera\gstreamer\plugins\gstwavparse.dll ()
MOD - C:\Programme_neu\Opera\gstreamer\plugins\gstautodetect.dll ()
MOD - C:\Programme_neu\Opera\gstreamer\plugins\gstwaveform.dll ()
MOD - C:\Programme_neu\Opera\gstreamer\plugins\gsttypefindfunctions.dll ()
MOD - C:\Programme_neu\Opera\gstreamer\gstreamer.dll ()
MOD - C:\Programme_neu\Opera\gstreamer\plugins\gstoggdec.dll ()
MOD - C:\Programme_neu\Opera\gstreamer\plugins\gstffmpegcolorspace.dll ()
MOD - C:\Programme_neu\Opera\gstreamer\plugins\gstcoreplugins.dll ()
MOD - C:\Programme_neu\Opera\gstreamer\plugins\gstaudioresample.dll ()
MOD - C:\Programme_neu\Opera\gstreamer\plugins\gstaudioconvert.dll ()
MOD - C:\Programme_neu\Opera\gstreamer\plugins\gstdirectsound.dll ()
MOD - C:\Programme_neu\Opera\gstreamer\plugins\gstdecodebin2.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\69ca4a43ba14b66689715ad62aed70e6\System.ServiceProcess.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\9b2f17fb61b7197f2a04108f5d1a1cc6\System.Management.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\2ec98ab0193d64e95b7d09d094deed97\Accessibility.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll ()
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
MOD - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf ()
MOD - C:\Program Files (x86)\Hotkey\Hotkey.exe ()
MOD - C:\Program Files (x86)\Hotkey\Audiodll.dll ()
MOD - C:\Program Files (x86)\Hotkey\AudioControlDLL.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV:64bit: - (dlcg_device) -- C:\Windows\SysNative\dlcgcoms.exe ( )
SRV - (MBAMService) -- C:\Programme_neu\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (SkypeUpdate) -- C:\Programme_neu\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (Skype C2C Service) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (NisSrv) -- c:\Programme\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)
SRV - (MsMpSvc) -- c:\Programme\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (vpnagent) -- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe (Cisco Systems, Inc.)
SRV - (Microsoft SharePoint Workspace Audit Service) -- C:\Programme_neu\Microsoft Office\Office14\GROOVE.EXE (Microsoft Corporation)
SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
SRV - (MSCamSvc) -- C:\Programme\Microsoft LifeCam\MSCamS64.exe (Microsoft Corporation)
SRV - (ipsecd) -- C:\Programme_neu\VPN Client\Shrew Soft\ipsecd.exe ()
SRV - (dtpd) -- C:\Programme_neu\VPN Client\Shrew Soft\dtpd.exe ()
SRV - (iked) -- C:\Programme_neu\VPN Client\Shrew Soft\iked.exe ()
SRV - (PowerBiosServer) -- C:\Program Files (x86)\Hotkey\PowerBiosServer.exe ()
SRV - (NAUpdate) -- C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (EvtEng) -- C:\Programme\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation)
SRV - (MyWiFiDHCPDNS) -- C:\Programme\Intel\WiFi\bin\PanDhcpDns.exe ()
SRV - (RegSrvc) -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation)
SRV - (osppsvc) -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (ose64) -- C:\Programme\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (CECFLPKT) -- C:\Program Files (x86)\ChiconyCam\CECPLFKT.exe (Chicony Electronics Co., Ltd.)
SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (DAUpdaterSvc) -- C:\Games\Dragon Age\bin_ship\daupdatersvc.service.exe (BioWare)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys ()
DRV:64bit: - (atksgt) -- C:\Windows\SysNative\drivers\atksgt.sys ()
DRV:64bit: - (lirsgt) -- C:\Windows\SysNative\drivers\lirsgt.sys ()
DRV:64bit: - (NisDrv) -- C:\Windows\SysNative\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (vpnva) -- C:\Windows\SysNative\drivers\vpnva64.sys (Cisco Systems, Inc.)
DRV:64bit: - (acsock) -- C:\Windows\SysNative\drivers\acsock64.sys (Cisco Systems, Inc.)
DRV:64bit: - (dc3d) -- C:\Windows\SysNative\drivers\dc3d.sys (Microsoft Corporation)
DRV:64bit: - (nvpciflt) -- C:\Windows\SysNative\drivers\nvpciflt.sys (NVIDIA Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (MSHUSBVideo) -- C:\Windows\SysNative\drivers\nx6000.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (vflt) -- C:\Windows\SysNative\drivers\vfilter.sys (Shrew Soft Inc)
DRV:64bit: - (vnet) -- C:\Windows\SysNative\drivers\virtualnet.sys (Shrew Soft Inc)
DRV:64bit: - (JMCR) -- C:\Windows\SysNative\drivers\jmcr.sys (JMicron Technology Corporation)
DRV:64bit: - (VIAHdAudAddService) -- C:\Windows\SysNative\drivers\viahduaa.sys (VIA Technologies, Inc.)
DRV:64bit: - (JME) -- C:\Windows\SysNative\drivers\JME.sys (JMicron Technology Corp.)
DRV:64bit: - (IntcDAud) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel(R) Corporation)
DRV:64bit: - (nusb3xhc) -- C:\Windows\SysNative\drivers\nusb3xhc.sys (NEC Electronics Corporation)
DRV:64bit: - (nusb3hub) -- C:\Windows\SysNative\drivers\nusb3hub.sys (NEC Electronics Corporation)
DRV:64bit: - (NETw5s64) -- C:\Windows\SysNative\drivers\NETw5s64.sys (Intel Corporation)
DRV:64bit: - (Impcd) -- C:\Windows\SysNative\drivers\Impcd.sys (Intel Corporation)
DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (S6000KNT) -- C:\Windows\SysNative\drivers\S6000KNT.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (HECIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (BthAvrcp) -- C:\Windows\SysNative\drivers\BthAvrcp.sys (CSR, plc)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://maps.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 41 58 AA 82 AC EB CB 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
========== FireFox ==========
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme_neu\Java_64bit\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PRF625~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme_neu\Java_32bit\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@mozilla.zeniko.ch/SumatraPDF_Browser_Plugin: C:\Programme_neu\SumatraPDF\npPdfViewer.dll (Simon Bünzli)
FF - HKCU\Software\MozillaPlugins\@mozilla.zeniko.ch/SumatraPDF_Browser_Plugin: C:\Programme_neu\SumatraPDF\npPdfViewer.dll (Simon Bünzli)
 
 
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme_neu\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme_neu\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme_neu\Java_64bit\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme_neu\Java_32bit\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme_neu\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme_neu\Java_32bit\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O4:64bit: - HKLM..\Run: [BCSSync] C:\Programme_neu\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation)
O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\Windows\SysNative\LogiLDA.dll (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (VIA)
O4 - HKLM..\Run: [LifeCam] C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Programme_neu\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (NEC Electronics Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: An OneNote s&enden - C:\Programme_neu\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme_neu\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: An OneNote s&enden - C:\Programme_neu\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme_neu\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme_neu\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme_neu\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme_neu\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme_neu\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme_neu\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme_neu\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2A25ED67-3525-4AF0-A532-F2564DA4761B}: NameServer = 0.0.0.0
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A4CD41F0-6432-4BBD-9E40-EA40355B16C2}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{ADAD7AAF-35A9-45C0-BFED-9200EFA26AC1}: DhcpNameServer = 202.106.195.68 202.106.46.151
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D043B3FA-40AC-4966-8E8F-5A4EC7753D77}: Domain = ethz.ch
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D043B3FA-40AC-4966-8E8F-5A4EC7753D77}: NameServer = 129.132.98.12,129.132.250.2
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\ms-help - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme_neu\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation)
O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) - C:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme_neu\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{81b971e4-75eb-11e1-ae62-0090f5ad910c}\Shell - "" = AutoRun
O33 - MountPoints2\{81b971e4-75eb-11e1-ae62-0090f5ad910c}\Shell\AutoRun\command - "" = E:\autorun.exe -auto
O33 - MountPoints2\{b3f2483d-3e54-11e1-82c7-001e101f36d9}\Shell - "" = AutoRun
O33 - MountPoints2\{b3f2483d-3e54-11e1-82c7-001e101f36d9}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{cc367764-3dfc-11e1-badc-0090f5ad910c}\Shell - "" = AutoRun
O33 - MountPoints2\{cc367764-3dfc-11e1-badc-0090f5ad910c}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{cc367795-3dfc-11e1-badc-0090f5ad910c}\Shell - "" = AutoRun
O33 - MountPoints2\{cc367795-3dfc-11e1-badc-0090f5ad910c}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{ef4b6c40-4034-11e1-bd6e-001e101f7f74}\Shell - "" = AutoRun
O33 - MountPoints2\{ef4b6c40-4034-11e1-bd6e-001e101f7f74}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.07.26 09:11:40 | 000,000,000 | ---D | C] -- C:\Users\Erik\AppData\Roaming\Malwarebytes
[2012.07.26 09:11:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.07.26 09:11:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.07.26 09:11:25 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.07.25 22:29:32 | 000,000,000 | ---D | C] -- C:\Users\Erik\AppData\Roaming\hellomoto
[2012.07.17 22:43:55 | 000,000,000 | ---D | C] -- C:\Users\Erik\Documents\BioWare
[2012.07.17 22:43:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Media Center Programs
[2012.07.17 22:43:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dragon Age Origins
[2012.07.17 22:33:56 | 000,000,000 | ---D | C] -- C:\Games
[2012.07.17 22:33:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\BioWare
[2012.07.17 17:52:11 | 000,000,000 | ---D | C] -- C:\Users\Erik\Desktop\Dragon Age
[2012.07.12 02:27:18 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012.07.12 02:27:18 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012.07.12 02:27:17 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012.07.12 02:27:17 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012.07.12 02:27:16 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012.07.12 02:27:16 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012.07.12 02:27:16 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2012.07.12 02:27:16 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2012.07.12 02:27:15 | 002,311,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2012.07.12 02:27:15 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2012.07.12 02:27:15 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012.07.12 02:27:15 | 000,818,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2012.07.12 02:27:15 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012.07.12 01:04:50 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml3r.dll
[2012.07.12 01:04:50 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msxml3r.dll
[2012.07.12 01:04:45 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll
[2012.07.12 01:04:43 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cdosys.dll
[2012.07.12 01:04:41 | 001,133,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdosys.dll
[2012.06.30 12:09:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft LifeCam
[2012.06.30 12:09:29 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft LifeCam
[2012.06.30 12:09:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft LifeCam
[2012.06.30 12:09:26 | 001,974,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_42.dll
[2012.06.30 12:09:26 | 001,892,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_42.dll
[2012.06.28 11:07:37 | 000,000,000 | ---D | C] -- C:\Users\Erik\Desktop\McK
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.07.26 09:31:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.07.26 09:29:21 | 001,514,150 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.07.26 09:29:21 | 000,660,076 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.07.26 09:29:21 | 000,621,312 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.07.26 09:29:21 | 000,132,316 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.07.26 09:29:21 | 000,108,532 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.07.26 09:27:53 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.26 09:27:48 | 1886,642,175 | -HS- | M] () -- C:\hiberfil.sys
[2012.07.25 19:38:29 | 000,017,120 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.25 19:38:29 | 000,017,120 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.23 19:56:48 | 000,009,949 | ---- | M] () -- C:\Users\Erik\Desktop\Department of Homeland Security - Form I-901 Application - Receipt Confirmation.pdf
[2012.07.23 12:24:25 | 000,019,579 | ---- | M] () -- C:\Users\Erik\Desktop\Canyon _ Ihre Bestellung.pdf
[2012.07.19 09:30:25 | 000,174,113 | ---- | M] () -- C:\Users\Erik\Desktop\SANY0371.JPG
[2012.07.16 19:28:15 | 257,636,290 | ---- | M] () -- C:\Users\Erik\Desktop\Beirut 2012.zip
[2012.07.16 18:02:22 | 351,190,798 | ---- | M] () -- C:\Users\Erik\Desktop\Fag Attack.zip
[2012.07.12 09:07:30 | 002,342,752 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.07.12 01:03:12 | 000,385,225 | ---- | M] () -- C:\Users\Erik\Desktop\Jbeil.jpg
[2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.07.23 19:56:47 | 000,009,949 | ---- | C] () -- C:\Users\Erik\Desktop\Department of Homeland Security - Form I-901 Application - Receipt Confirmation.pdf
[2012.07.23 12:24:25 | 000,019,579 | ---- | C] () -- C:\Users\Erik\Desktop\Canyon _ Ihre Bestellung.pdf
[2012.07.19 09:30:04 | 000,174,113 | ---- | C] () -- C:\Users\Erik\Desktop\SANY0371.JPG
[2012.07.16 18:39:22 | 257,636,290 | ---- | C] () -- C:\Users\Erik\Desktop\Beirut 2012.zip
[2012.07.16 16:58:25 | 351,190,798 | ---- | C] () -- C:\Users\Erik\Desktop\Fag Attack.zip
[2012.07.12 01:01:54 | 000,385,225 | ---- | C] () -- C:\Users\Erik\Desktop\Jbeil.jpg
[2012.02.29 02:54:17 | 000,007,168 | ---- | C] () -- C:\Users\Erik\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.03.28 21:22:51 | 005,657,764 | ---- | C] () -- C:\Users\Erik\Manual.pdf
[2011.03.24 23:49:29 | 001,527,912 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.02.11 19:15:08 | 000,874,048 | ---- | C] () -- C:\Windows\SysWow64\igkrng575.bin
[2011.02.11 15:41:02 | 000,000,413 | ---- | C] () -- C:\Users\Erik\AppData\Roaming\ceccam11.ini
[2011.02.11 15:34:07 | 000,000,226 | R--- | C] () -- C:\Windows\OEM.ini
[2011.02.11 15:33:43 | 000,015,190 | ---- | C] () -- C:\Windows\S6000Twn.ini
[2011.02.11 15:14:47 | 000,127,868 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng575.bin
[2011.02.11 15:14:47 | 000,104,796 | ---- | C] () -- C:\Windows\SysWow64\igfcg575m.bin
 
========== LOP Check ==========
 
[2012.03.24 13:26:12 | 000,000,000 | ---D | M] -- C:\Users\Erik\AppData\Roaming\DAEMON Tools Lite
[2012.07.19 16:04:09 | 000,000,000 | ---D | M] -- C:\Users\Erik\AppData\Roaming\foobar2000
[2012.07.25 22:29:40 | 000,000,000 | ---D | M] -- C:\Users\Erik\AppData\Roaming\hellomoto
[2011.05.06 22:42:41 | 000,000,000 | ---D | M] -- C:\Users\Erik\AppData\Roaming\Opera
[2011.09.29 10:41:27 | 000,000,000 | ---D | M] -- C:\Users\Erik\AppData\Roaming\pdfforge
[2011.07.19 14:23:26 | 000,000,000 | ---D | M] -- C:\Users\Erik\AppData\Roaming\SumatraPDF
[2011.02.22 14:12:54 | 000,000,000 | ---D | M] -- C:\Users\Erik\AppData\Roaming\think-cell
[2012.07.17 22:27:47 | 000,000,000 | ---D | M] -- C:\Users\Erik\AppData\Roaming\uTorrent
[2012.07.12 09:07:29 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >
         

--- --- ---



OTL ExtrasOTL Logfile:

OTL Extras logfile created on: 26.07.2012 09:30:45 - Run 1
OTL by OldTimer - Version 3.2.54.1     Folder = C:\Users\Erik\Downloads
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,68 Gb Total Physical Memory | 5,56 Gb Available Physical Memory | 72,39% Memory free
15,35 Gb Paging File | 13,21 Gb Available in Paging File | 86,03% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 238,37 Gb Total Space | 80,40 Gb Free Space | 33,73% Space Free | Partition Type: NTFS
 
Computer Name: ERIKPC | User Name: Erik | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = Opera.HTML] -- C:\Programme_neu\Opera\Opera.exe (Opera Software)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = Opera.HTML] -- C:\Programme_neu\Opera\Opera.exe (Opera Software)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Programme_neu\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Programme_neu\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Programme_neu\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Programme_neu\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{05838DF3-9E6B-415C-BA37-7B685D0AA4B5}" = rport=139 | protocol=6 | dir=out | app=system | 
"{062109FB-804E-435E-8A2A-68A38F8147A0}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{0F77984F-1E16-453B-8CB9-B83225ECDB83}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{1A464928-998D-4E80-9134-72BED1D2DA1A}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{24C567C2-879C-48AE-A94D-76B5B0E9D148}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{25856EF0-5B34-4BD7-B944-2EC0A2138DF8}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{2F4E5ACD-F5DC-49A7-818C-34A38A09B91F}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{44D882C2-21FD-4658-B425-1AC6F6F10C34}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{4DC8B257-2790-4E50-8912-D4CAA34BB995}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{4E99C56F-BAA0-4434-A5B9-F43EE11129A7}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{508E1393-8D84-4D70-98A1-0273CB775797}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{5C7CACAE-BF11-4283-A8CE-59D274BA89A0}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{7FAD7DB4-0697-4CF0-98DF-A5DA67F2949C}" = rport=137 | protocol=17 | dir=out | app=system | 
"{85312C9F-E51B-4896-B718-80AFA2CD13CD}" = rport=138 | protocol=17 | dir=out | app=system | 
"{89F81DDE-6587-4670-9F3E-31CBF426E60D}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{8BC49477-2352-481F-9D3E-1A357FDEE20B}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{96348BC2-BEBC-45E9-8D4B-4A6D0464B68F}" = lport=139 | protocol=6 | dir=in | app=system | 
"{A57684E2-4608-4D2F-823A-4C6C6848ECF2}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{A90FDDF2-6C70-4078-A4D8-AEE470A0460B}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{B623F7DB-CBF5-45EA-B056-7BBA474615C8}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{B6BCCAB6-1220-43E4-967A-77CF11CFDF1A}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{BC5E4F6F-F455-4F3E-90C2-FEC8275E7526}" = lport=6004 | protocol=17 | dir=in | app=c:\programme_neu\microsoft office\office14\outlook.exe | 
"{C0AB0CB0-CD90-41ED-83CC-9A15B1895BFD}" = rport=445 | protocol=6 | dir=out | app=system | 
"{C7F5EE12-D7DC-4634-9CFF-3A3B98193053}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{CDA0E0DE-25B4-4E70-B22F-15FFBCF59A78}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{CE6A9E45-9DB3-42E8-A748-EA56CCB63319}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{D62E77FC-245C-4290-A9A9-DAD26C368B8E}" = lport=138 | protocol=17 | dir=in | app=system | 
"{DF11DFF7-25AB-4DF8-97CE-04A81C8BC971}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{E467EBF2-BDB3-4FA8-8A1A-28542CC98ABA}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{E6E5692F-9280-4FD6-997F-9449683F5447}" = rport=2869 | protocol=6 | dir=out | app=system | 
"{EE0105E7-4727-41AE-B6C3-644CC7B19DAB}" = lport=445 | protocol=6 | dir=in | app=system | 
"{EEB1353A-2DC3-4A26-AADF-4BACCC59870C}" = lport=137 | protocol=17 | dir=in | app=system | 
"{F7D1C8CE-EAC8-485C-AD9B-EF138748105D}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{FBE50BB7-FBD4-426C-BDA2-7006A5651C77}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0349F3F5-AAB9-4270-BACB-ED08177F2929}" = dir=in | app=c:\programme_neu\skype\phone\skype.exe | 
"{0BA44910-A812-4EDA-B04A-1557FBED8AED}" = protocol=6 | dir=in | app=c:\games\dragon age\bin_ship\daorigins.exe | 
"{0EDA6469-124C-40E9-9CDD-47D456FF44AA}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{11D8AFCA-7F24-4A34-9061-F5FAE00E7B7C}" = protocol=17 | dir=in | app=c:\programme_neu\microsoft office\office14\onenote.exe | 
"{18F0F8FA-31DB-4E3F-9FFD-D693846582B9}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{20A1C22B-8C86-4CC1-98AF-160A824833C2}" = protocol=6 | dir=in | app=c:\games\dragon age\daoriginslauncher.exe | 
"{21530B61-2235-4B00-B5E8-D11971F63D67}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{21DB4AD5-3ECC-4A04-B391-49DAE51F5F0D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{27BA5DA0-68B6-47E9-8EB1-2D7C7D5D8B50}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{284DFF59-BBF7-4E3A-95F0-5A8364BD3E07}" = protocol=6 | dir=in | app=c:\users\erik\desktop\pdfconvertersetup.exe | 
"{2A853699-49BA-41B7-BF90-0183A7D01E38}" = protocol=6 | dir=in | app=c:\programme_neu\opera\opera.exe | 
"{2E48CB0C-8F08-4173-94DD-00535328DB0A}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifeexp.exe | 
"{2F2CBA4F-9885-4A0C-98C7-166EE9841B80}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{33D6528D-436D-444B-BFDE-650DD62F7C6E}" = protocol=17 | dir=in | app=c:\programme_neu\opera\opera.exe | 
"{37CA5FA2-CF3C-42C6-B336-960DF91F27AB}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifeenc2.exe | 
"{4B6A7080-5E70-48EC-81BF-00C6BC928058}" = protocol=6 | dir=in | app=c:\windows\system32\dlcgcoms.exe | 
"{53509D39-484A-478E-B932-6EADC6050F59}" = protocol=17 | dir=in | app=c:\programme_neu\utorrent\utorrent.exe | 
"{551E7EC1-71D1-45D1-AA06-0149CA1DB1C6}" = protocol=6 | dir=in | app=c:\programme_neu\microsoft office\office14\groove.exe | 
"{55B836B0-3566-40EE-9DBE-5BDAC9CE3B25}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{56776C83-08B7-447B-9B6E-F9BADC4E1F4A}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{5863FF6A-6F52-479E-8717-A6681E42FC52}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{5C082657-9BB8-46F4-8CFE-1BE4E5BF6F1B}" = protocol=6 | dir=in | app=c:\programme_neu\microsoft office\office14\onenote.exe | 
"{6E203D54-F55E-41FC-AFC8-86B4FB41E43A}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{73CC7FD6-09A4-4037-B2CC-493E105F183D}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifetray.exe | 
"{73E2F40C-F0D7-4DDF-9013-9E6C63EECFC1}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{73F2178A-7FC1-4704-B6F6-6B9B1329A12E}" = protocol=6 | dir=in | app=c:\program files (x86)\nvidia corporation\nvidia updatus\daemonu.exe | 
"{762088FC-5141-4FDF-AB67-AAB29409C5F8}" = protocol=17 | dir=in | app=c:\games\dragon age\bin_ship\daupdatersvc.service.exe | 
"{7657D7E3-35E5-4D42-9BE6-7EC328E7182B}" = protocol=17 | dir=in | app=c:\programme_neu\microsoft office\office14\groove.exe | 
"{7AFF16D7-B3EF-4DB8-859A-286E76E5B392}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifecam.exe | 
"{7D46D658-EE5C-4DA1-A454-6B254E96BC1D}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 | 
"{83CF4FB1-21C9-43BE-8DD7-4BF9D003975C}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{841C6394-4AA6-4E76-AFFE-7C7ED09F8216}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{85C6E0D0-92BE-480E-877C-1AD87FF5390E}" = protocol=6 | dir=in | app=c:\programme_neu\opera\pluginwrapper\opera_plugin_wrapper.exe | 
"{900D28CD-EA2E-49E6-963D-6C038663422A}" = protocol=17 | dir=in | app=c:\programme_neu\opera\pluginwrapper\opera_plugin_wrapper.exe | 
"{92CCACB9-FF12-45AB-A626-3FC0F902A6C5}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{93163588-2EFA-4DF0-BE6F-E9AC14022919}" = protocol=6 | dir=out | app=system | 
"{9B5294BD-EB11-4A8E-930D-D4ECBDE11CA0}" = protocol=6 | dir=in | app=c:\games\dragon age\bin_ship\daupdatersvc.service.exe | 
"{A41BEA31-A2DE-4F32-A6AC-3DFC7C0B9EA8}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{A4556D46-6B14-456D-9B03-96F8EE824F9F}" = protocol=17 | dir=in | app=c:\users\erik\desktop\pdfconvertersetup.exe | 
"{AAB816F2-2393-49E2-9D97-28AD01AEB321}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifeenc2.exe | 
"{B74BD0A7-CF08-49CF-B860-410A70561478}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{BA229606-9F94-403F-ACE1-35D8FD078B75}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{BF952D03-291A-4093-881A-E1685C9F767D}" = protocol=17 | dir=in | app=c:\programme_neu\opera\opera.exe | 
"{C0DA19D9-5488-4396-9471-0DB184463008}" = protocol=17 | dir=in | app=c:\windows\system32\dlcgcoms.exe | 
"{CB5DD359-371F-4932-8D3C-299599579C7F}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifeexp.exe | 
"{CC3F35B5-F47E-4D9E-9936-DF922011F268}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | 
"{D3F34338-C156-4ECB-BB7E-FF07F1B5B7FF}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{D48717CA-9204-413F-9F52-EC7E668D5F82}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{D9009B95-1061-4F5C-B501-0E3CBDBBFA3A}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{DCAA2586-97AE-4A32-B8FE-2D16D0214849}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{DE0252A8-1FC3-4C92-9D38-B971AB74420B}" = protocol=17 | dir=in | app=c:\games\dragon age\bin_ship\daorigins.exe | 
"{E33374EB-5413-47A6-A45A-C2F0FF052329}" = protocol=17 | dir=in | app=c:\games\dragon age\daoriginslauncher.exe | 
"{E45E080A-CA82-4B3B-A441-E2163AC570E2}" = protocol=6 | dir=in | app=c:\programme_neu\utorrent\utorrent.exe | 
"{E65B47F8-9340-4086-9488-5ECACE67B25D}" = dir=in | app=c:\program files\intel\wifi\bin\pandhcpdns.exe | 
"{EDCA1F9A-637E-404F-9B90-9D25874E256F}" = protocol=6 | dir=in | app=c:\programme_neu\opera\opera.exe | 
"{EE264F98-D1F5-465B-BC39-42893F8435EF}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifecam.exe | 
"{F0D53FC2-1F1D-41B3-A94A-9CBAA21DB779}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{F2AC1210-5C49-45F7-AB09-A83A97F746C1}" = protocol=17 | dir=in | app=c:\program files (x86)\nvidia corporation\nvidia updatus\daemonu.exe | 
"{FD73295E-964A-4A6C-9100-7F40803DF1EC}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft lifecam\lifetray.exe | 
"TCP Query User{2D39AD7D-0767-44CD-95AA-6563881992C0}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
"TCP Query User{E2595E07-BDEB-427D-987F-B11D06CCD2E3}C:\programme_neu\java_32bit\bin\java.exe" = protocol=6 | dir=in | app=c:\programme_neu\java_32bit\bin\java.exe | 
"UDP Query User{47A8483B-6AAF-4657-BAA1-5E58DEBF9C94}C:\programme_neu\java_32bit\bin\java.exe" = protocol=17 | dir=in | app=c:\programme_neu\java_32bit\bin\java.exe | 
"UDP Query User{CE9CA6CD-B27E-47D7-89D0-70A1F1AED7B3}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1280E900-35DA-4E08-A700-B79A5B2B8532}" = Microsoft Antimalware Service DE-DE Language Pack
"{180C8888-50F1-426B-A9DC-AB83A1989C65}" = Windows Live Language Selector
"{1A8BA6CE-822D-4888-89E2-ACBF4308F271}" = Intel(R) PROSet/Wireless WiFi-Software
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{26A24AE4-039D-4CA4-87B4-2F86416027FF}" = Java(TM) 6 Update 27 (64-bit)
"{5CE7E3F5-9803-4F32-AA89-2D8848A80109}" = Microsoft LifeCam
"{90140000-0015-0407-1000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-1000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-1000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-1000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-1000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-1000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-1000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{70A3169E-288F-454F-A08D-20DF66639B50}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-1000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{0242505C-4E90-407F-9299-B5B275F50D86}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-1000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-1000-0000000FF1CE}_Office14.PROPLUSR_{B51389C8-2890-4633-81D8-47D2A7402274}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-1000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-1000-0000000FF1CE}_Office14.PROPLUSR_{3013A793-10A7-4D1F-B8B4-2FAA82F4D259}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-1000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{98782D5D-A9EE-43C6-88AD-B50AD8530E78}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0043-0000-1000-0000000FF1CE}" = Microsoft Office Office 32-bit Components 2010
"{90140000-0043-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{E8B6D35B-0B6F-4DCE-9493-859BF3809A7F}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0043-0407-1000-0000000FF1CE}" = Microsoft Office Shared 32-bit MUI (German) 2010
"{90140000-0043-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{8DFD91C7-66AE-4E54-9901-5D5F401AD329}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0407-1000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-0044-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-1000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{8299B64F-1537-4081-974C-033EAB8F098E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-1000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0407-1000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{90140000-00BA-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{91140000-0011-0000-1000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{91140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{7BC9B5EB-125A-4E9B-97E1-8D85B5E960B8}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9C5A08BF-BB99-4998-81BD-F6CC32483B34}" = Microsoft Corporation
"{9D046B26-7978-47CD-91E6-AC3C1DFBC3D0}" = Microsoft Security Client
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 267.76
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 267.76
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Optimus" = NVIDIA Optimus 1.0.11
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.10.0514
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{DC911ADF-7B60-40F2-A112-FB1EB6402D07}" = Microsoft Security Client DE-DE Language Pack
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX 64-bit
"Adobe Flash Player ActiveX 64" = Adobe Flash Player 10 ActiveX 64-bit
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit
"Adobe Flash Player Plugin 64" = Adobe Flash Player 10 Plugin 64-bit
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft Security Client" = Microsoft Security Essentials
"Office14.PROPLUSR" = Microsoft Office Professional Plus 2010
"ProInst" = Intel PROSet Wireless
"Shrew Soft VPN Client" = Shrew Soft VPN Client
"SynTPDeinstKey" = Synaptics Pointing Device Driver
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{164714B6-46BC-4649-9A30-A6ED32F03B5A}" = Hotkey 3.3005
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F7FB68F-52F6-46A3-B42F-38CE46295AE5}" = Nero MediaHub 10
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{2436F2A8-4B7E-4B6C-AE4E-604C84AA6A4F}" = Nero Core Components 10
"{26604C7E-A313-4D12-867F-7C6E7820BE4C}" = JMicron Flash Media Controller Driver
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34490F4E-48D0-492E-8249-B48BECF0537C}" = Nero DiscSpeed 10
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3D7E3EC9-46CF-4359-9289-39CE01DFB82F}" = Adobe Photoshop CS3
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4BB1DCED-84D3-47F9-B718-5947E904593E}" = BisonCam
"{51846830-E7B2-4218-8968-B77F0FF475B8}" = Adobe Color EU Extra Settings
"{523B2B1B-D8DB-4B41-90FF-C4D799E2758A}" = Nero ControlCenter 10 Help (CHM)
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{555868C6-49FB-484F-BB43-8980651A1B00}" = Nero BurnRights 10 Help (CHM)
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update
"{66049135-9659-4AAD-9169-9CCA269EBB3E}" = Nero InfoTool 10 Help (CHM)
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6DFB899F-17A2-48F0-A533-ED8D6866CF38}" = Nero Control Center 10
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{93C987F5-6563-4D29-A7C0-7DC85471D7C3}" = Nero Multimedia Suite 10 Essentials
"{943CFD7D-5336-47AF-9418-E02473A5A517}" = Nero BurnRights 10
"{95655ED4-7CA5-46DF-907F-7144877A32E5}" = Adobe Color NA Recommended Settings
"{96DCEE2F-98EE-4F80-8C0F-7C04D1FB9D7F}" = JMicron Ethernet Adapter NDIS Driver
"{99A17B9E-3901-400B-BCD7-2ACD8FFE328B}" = System Requirements Lab for Intel
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{A2201542-DA80-457F-8BD9-6C9C90196481}" = ChiconyCam
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAE521B6-2F19-447F-8CB6-6D1E3A19F3ED}" = WebCam Installer
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
"{AEC81925-9C76-4707-84A9-40696C613ED3}" = Dragon Age: Origins
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B3BC9DB1-0B0A-48B0-B86B-EA77CAA7F800}" = Microsoft Corporation
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}" = NVIDIA PhysX
"{C18A0418-442A-4186-AF98-D08F5054A2FC}" = Nero DiscSpeed 10 Help (CHM)
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D7BF9739-8A68-4335-BBEE-37752AD9E86B}" = NEC Electronics USB 3.0 Host Controller Driver
"{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}" = Adobe Color Common Settings
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{E69BD802-57A2-428F-9CA6-9C006E5F8DFA}" = Cisco AnyConnect Secure Mobility Client
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Graphics Media Accelerator Driver
"{F412B4AF-388C-4FF5-9B2F-33DB1C536953}" = Nero InfoTool 10
"{F467862A-D9CA-47ED-8D81-B4B3C9399272}" = Nero MediaHub 10 Help (CHM)
"{F5CB822F-B365-43D1-BCC0-4FDA1A2017A7}" = Nero 10 Movie ThemePack Basic
"{F6117F9C-ADB5-4590-9BE4-12C7BEC28702}" = Nero StartSmart 10 Help (CHM)
"{F61D489E-6C44-49AC-AD02-7DA8ACA73A65}" = Nero StartSmart 10
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FF11004C-F42A-4A31-9BCF-7F5C8FDBE53C}" = Adobe Setup
"Adobe_719d6f144d0c086a0dfa7ff76bb9ac1" = Adobe Photoshop CS3
"Cisco AnyConnect Secure Mobility Client" = Cisco AnyConnect Secure Mobility Client 
"CrystalDiskInfo_is1" = CrystalDiskInfo 3.10.0
"DAEMON Tools Toolbar" = DAEMON Tools Toolbar
"foobar2000" = foobar2000 v1.1.7
"InstallShield_{164714B6-46BC-4649-9A30-A6ED32F03B5A}" = Hotkey 3.3005
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Plattform-Geräte-Manager
"InstallShield_{D7BF9739-8A68-4335-BBEE-37752AD9E86B}" = NEC Electronics USB 3.0 Host Controller Driver
"IrfanView" = IrfanView (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"NVIDIA.Updatus" = NVIDIA Updatus
"Opera 12.00.1467" = Opera 12.00
"pdfsam" = pdfsam
"SumatraPDF" = SumatraPDF
"uTorrent" = µTorrent
"VLC media player" = VLC media player 1.1.7
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Translator" = Google Translator
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 21.07.2012 05:11:56 | Computer Name = ErikPC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: CECPLFKT.exe, Version: 0.9.1.1030,
 Zeitstempel: 0x4aefec4e  Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725,
 Zeitstempel: 0x4ec49b8f  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00039343  ID des fehlerhaften
 Prozesses: 0x734  Startzeit der fehlerhaften Anwendung: 0x01cd6720de6a21a3  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\ChiconyCam\CECPLFKT.exe  Pfad des 
fehlerhaften Moduls: C:\Windows\SysWOW64\ntdll.dll  Berichtskennung: 1e2a5a14-d314-11e1-9e9a-0024d77eb150
 
Error - 22.07.2012 10:11:29 | Computer Name = ErikPC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: CECPLFKT.exe, Version: 0.9.1.1030,
 Zeitstempel: 0x4aefec4e  Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725,
 Zeitstempel: 0x4ec49b8f  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00039343  ID des fehlerhaften
 Prozesses: 0x744  Startzeit der fehlerhaften Anwendung: 0x01cd6813e1751bdb  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\ChiconyCam\CECPLFKT.exe  Pfad des 
fehlerhaften Moduls: C:\Windows\SysWOW64\ntdll.dll  Berichtskennung: 2150cb8e-d407-11e1-a260-0024d77eb150
 
Error - 22.07.2012 17:49:00 | Computer Name = ErikPC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: CECPLFKT.exe, Version: 0.9.1.1030,
 Zeitstempel: 0x4aefec4e  Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725,
 Zeitstempel: 0x4ec49b8f  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00039343  ID des fehlerhaften
 Prozesses: 0x744  Startzeit der fehlerhaften Anwendung: 0x01cd6853cb7d48da  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\ChiconyCam\CECPLFKT.exe  Pfad des 
fehlerhaften Moduls: C:\Windows\SysWOW64\ntdll.dll  Berichtskennung: 0b73d3c0-d447-11e1-ab6f-0024d77eb150
 
Error - 23.07.2012 05:11:59 | Computer Name = ErikPC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: CECPLFKT.exe, Version: 0.9.1.1030,
 Zeitstempel: 0x4aefec4e  Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725,
 Zeitstempel: 0x4ec49b8f  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00039343  ID des fehlerhaften
 Prozesses: 0x754  Startzeit der fehlerhaften Anwendung: 0x01cd68b3350d123e  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\ChiconyCam\CECPLFKT.exe  Pfad des 
fehlerhaften Moduls: C:\Windows\SysWOW64\ntdll.dll  Berichtskennung: 74d539fc-d4a6-11e1-ab43-0024d77eb150
 
Error - 24.07.2012 04:08:18 | Computer Name = ErikPC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: CECPLFKT.exe, Version: 0.9.1.1030,
 Zeitstempel: 0x4aefec4e  Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725,
 Zeitstempel: 0x4ec49b8f  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00039343  ID des fehlerhaften
 Prozesses: 0x740  Startzeit der fehlerhaften Anwendung: 0x01cd697379fbd920  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\ChiconyCam\CECPLFKT.exe  Pfad des 
fehlerhaften Moduls: C:\Windows\SysWOW64\ntdll.dll  Berichtskennung: b9bc5fbd-d566-11e1-a23f-0024d77eb150
 
Error - 25.07.2012 08:10:43 | Computer Name = ErikPC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: CECPLFKT.exe, Version: 0.9.1.1030,
 Zeitstempel: 0x4aefec4e  Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725,
 Zeitstempel: 0x4ec49b8f  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00039343  ID des fehlerhaften
 Prozesses: 0x74c  Startzeit der fehlerhaften Anwendung: 0x01cd6a5e81c602bb  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\ChiconyCam\CECPLFKT.exe  Pfad des 
fehlerhaften Moduls: C:\Windows\SysWOW64\ntdll.dll  Berichtskennung: c197040e-d651-11e1-8773-0024d77eb150
 
Error - 25.07.2012 13:31:27 | Computer Name = ErikPC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: CECPLFKT.exe, Version: 0.9.1.1030,
 Zeitstempel: 0x4aefec4e  Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725,
 Zeitstempel: 0x4ec49b8f  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00039343  ID des fehlerhaften
 Prozesses: 0x74c  Startzeit der fehlerhaften Anwendung: 0x01cd6a8b500b1c1a  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\ChiconyCam\CECPLFKT.exe  Pfad des 
fehlerhaften Moduls: C:\Windows\SysWOW64\ntdll.dll  Berichtskennung: 8fff74d7-d67e-11e1-ab47-0024d77eb150
 
Error - 25.07.2012 16:57:08 | Computer Name = ErikPC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: CECPLFKT.exe, Version: 0.9.1.1030,
 Zeitstempel: 0x4aefec4e  Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725,
 Zeitstempel: 0x4ec49b8f  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00039343  ID des fehlerhaften
 Prozesses: 0x758  Startzeit der fehlerhaften Anwendung: 0x01cd6aa80be57f9c  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\ChiconyCam\CECPLFKT.exe  Pfad des 
fehlerhaften Moduls: C:\Windows\SysWOW64\ntdll.dll  Berichtskennung: 4bbb14cf-d69b-11e1-a132-0024d77eb150
 
Error - 25.07.2012 16:59:54 | Computer Name = ErikPC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: CECPLFKT.exe, Version: 0.9.1.1030,
 Zeitstempel: 0x4aefec4e  Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725,
 Zeitstempel: 0x4ec49b8f  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00039343  ID des fehlerhaften
 Prozesses: 0x754  Startzeit der fehlerhaften Anwendung: 0x01cd6aa86ec12d39  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\ChiconyCam\CECPLFKT.exe  Pfad des 
fehlerhaften Moduls: C:\Windows\SysWOW64\ntdll.dll  Berichtskennung: aeaf2c6e-d69b-11e1-ab57-0024d77eb150
 
Error - 26.07.2012 03:27:58 | Computer Name = ErikPC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: CECPLFKT.exe, Version: 0.9.1.1030,
 Zeitstempel: 0x4aefec4e  Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725,
 Zeitstempel: 0x4ec49b8f  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00039343  ID des fehlerhaften
 Prozesses: 0x738  Startzeit der fehlerhaften Anwendung: 0x01cd6b002c280319  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\ChiconyCam\CECPLFKT.exe  Pfad des 
fehlerhaften Moduls: C:\Windows\SysWOW64\ntdll.dll  Berichtskennung: 6bc6a9c7-d6f3-11e1-b486-0024d77eb150
 
[ Cisco AnyConnect Secure Mobility Client Events ]
Error - 26.07.2012 03:28:01 | Computer Name = ErikPC | Source = acvpnui | ID = 67108866
Description = Function: PluginLoader::QuickCreatePlugin File: c:\temp\build\thehoff\DaVinci_MR30.459670239829\DaVinci_MR3\vpn\Common\Utility/PluginLoader.h
Line:
 145 Invoked Function: PluginLoader::CreateInstance Return Code: -29294580 (0xFE41000C)
Description:
 PLUGINLOADER_ERROR_COULD_NOT_CREATE 
 
Error - 26.07.2012 03:28:01 | Computer Name = ErikPC | Source = acvpnui | ID = 67108866
Description = Function: PluginLoader::QuickCreatePlugin File: c:\temp\build\thehoff\DaVinci_MR30.459670239829\DaVinci_MR3\vpn\Common\Utility/PluginLoader.h
Line:
 145 Invoked Function: PluginLoader::CreateInstance Return Code: -29294580 (0xFE41000C)
Description:
 PLUGINLOADER_ERROR_COULD_NOT_CREATE 
 
Error - 26.07.2012 03:28:01 | Computer Name = ErikPC | Source = acvpnui | ID = 67108866
Description = Function: CMainFrame::getDARTInstallDir File: .\mainfrm.cpp Line: 4214
Invoked
 Function: MsiEnumProductsExW Return Code: 259 (0x00000103) Description: Es sind keine
 Daten mehr verfügbar.   
 
Error - 26.07.2012 03:28:01 | Computer Name = ErikPC | Source = acvpnui | ID = 67108865
Description = Function: ConnectMgr::activateConnectEvent File: .\ConnectMgr.cpp Line:
 1058 NULL object. Cannot establish a connection at this time.
 
Error - 26.07.2012 03:28:10 | Computer Name = ErikPC | Source = acvpnagent | ID = 67108866
Description = Function: CIPv4ChangeRouteHelper::FindBestRoute File: .\IPv4ChangeRouteHelper.cpp
Line:
 2664 Invoked Function: CIPv4RouteTable::FindMatchingRoute Return Code: -33095647 
(0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED 
 
Error - 26.07.2012 03:28:10 | Computer Name = ErikPC | Source = acvpnagent | ID = 67108866
Description = Function: CRouteMgr::UpdatePublicAddress File: .\RouteMgr.cpp Line: 
2186 Invoked Function: CChangeRouteTable::FindBestRouteInterface Return Code: -33095647
 (0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED 
 
Error - 26.07.2012 03:28:10 | Computer Name = ErikPC | Source = acvpnagent | ID = 67108866
Description = Function: CMainThread::applyHostConfigForNoVpn File: .\MainThread.cpp
Line:
 8419 Invoked Function: CHostConfigMgr::DeterminePublicInterface Return Code: -33161196
 (0xFE060014) Description: ROUTEMGR_ERROR_PUBLIC_ADDRESS_UNAVAILABLE 
 
Error - 26.07.2012 03:28:10 | Computer Name = ErikPC | Source = acvpnagent | ID = 67108866
Description = Function: CMainThread::OnTimerExpired File: .\MainThread.cpp Line: 4776
Invoked
 Function: CMainThread::applyHostConfigForNoVpn Return Code: -33161196 (0xFE060014)
Description:
 ROUTEMGR_ERROR_PUBLIC_ADDRESS_UNAVAILABLE 
 
Error - 26.07.2012 03:28:10 | Computer Name = ErikPC | Source = acvpnagent | ID = 67108866
Description = Function: CIPv4ChangeRouteHelper::FindBestRoute File: .\IPv4ChangeRouteHelper.cpp
Line:
 2664 Invoked Function: CIPv4RouteTable::FindMatchingRoute Return Code: -33095647 
(0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED 
 
Error - 26.07.2012 03:28:10 | Computer Name = ErikPC | Source = acvpnagent | ID = 67108866
Description = Function: CRouteMgr::UpdatePublicAddress File: .\RouteMgr.cpp Line: 
2186 Invoked Function: CChangeRouteTable::FindBestRouteInterface Return Code: -33095647
 (0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED 
 
[ System Events ]
Error - 26.07.2012 03:26:44 | Computer Name = ErikPC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 26.07.2012 03:26:44 | Computer Name = ErikPC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 26.07.2012 03:26:44 | Computer Name = ErikPC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 26.07.2012 03:26:54 | Computer Name = ErikPC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 26.07.2012 03:26:54 | Computer Name = ErikPC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 26.07.2012 03:26:54 | Computer Name = ErikPC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 26.07.2012 03:27:58 | Computer Name = ErikPC | Source = Service Control Manager | ID = 7034
Description = Dienst "CECFLPKT" wurde unerwartet beendet. Dies ist bereits 1 Mal
 passiert.
 
Error - 26.07.2012 03:28:04 | Computer Name = ErikPC | Source = ipnathlp | ID = 31004
Description = 
 
Error - 26.07.2012 03:28:04 | Computer Name = ErikPC | Source = ipnathlp | ID = 31004
Description = 
 
Error - 26.07.2012 03:28:10 | Computer Name = ErikPC | Source = ipnathlp | ID = 31004
Description = 
 
 
< End of report >
         

--- --- ---

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

• Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
• Starte die OTL.exe.
  Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
• Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:

:Processes
killallprocesses

:OTL
SRV - (ipsecd) -- C:\Programme_neu\VPN Client\Shrew Soft\ipsecd.exe () 
SRV - (dtpd) -- C:\Programme_neu\VPN Client\Shrew Soft\dtpd.exe () 
SRV - (iked) -- C:\Programme_neu\VPN Client\Shrew Soft\iked.exe () 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC 
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () 
O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\Windows\SysNative\LogiLDA.dll (Logitech, Inc.) 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 
O32 - HKLM CDRom: AutoRun - 1 
O33 - MountPoints2\{81b971e4-75eb-11e1-ae62-0090f5ad910c}\Shell - "" = AutoRun 
O33 - MountPoints2\{81b971e4-75eb-11e1-ae62-0090f5ad910c}\Shell\AutoRun\command - "" = E:\autorun.exe -auto 
O33 - MountPoints2\{b3f2483d-3e54-11e1-82c7-001e101f36d9}\Shell - "" = AutoRun 
O33 - MountPoints2\{b3f2483d-3e54-11e1-82c7-001e101f36d9}\Shell\AutoRun\command - "" = E:\AutoRun.exe 
O33 - MountPoints2\{cc367764-3dfc-11e1-badc-0090f5ad910c}\Shell - "" = AutoRun 
O33 - MountPoints2\{cc367764-3dfc-11e1-badc-0090f5ad910c}\Shell\AutoRun\command - "" = E:\AutoRun.exe 
O33 - MountPoints2\{cc367795-3dfc-11e1-badc-0090f5ad910c}\Shell - "" = AutoRun 
O33 - MountPoints2\{cc367795-3dfc-11e1-badc-0090f5ad910c}\Shell\AutoRun\command - "" = E:\AutoRun.exe 
O33 - MountPoints2\{ef4b6c40-4034-11e1-bd6e-001e101f7f74}\Shell - "" = AutoRun 
O33 - MountPoints2\{ef4b6c40-4034-11e1-bd6e-001e101f7f74}\Shell\AutoRun\command - "" = E:\AutoRun.exe 

[2012.07.25 22:29:32 | 000,000,000 | ---D | C] -- C:\Users\Erik\AppData\Roaming\hellomoto 
 

[2012.07.26 09:31:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job 
:Files
C:\Users\Erik\AppData\Local\Microsoft\Windows\2879
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
         

• Schließe alle Programme.
• Klicke auf den Fix Button.
• Wenn OTL einen Neustart verlangt, bitte zulassen.
• Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
  Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

T'john,

danke vielmals für die schnelle Antwort. OTL-Fix mit deinem Script durchgeführt. Hier ist das Ergebnis:

All processes killed
========== PROCESSES ==========
========== OTL ==========
Service ipsecd stopped successfully!
Service ipsecd deleted successfully!
C:\Programme_neu\VPN Client\Shrew Soft\ipsecd.exe moved successfully.
Service dtpd stopped successfully!
Service dtpd deleted successfully!
C:\Programme_neu\VPN Client\Shrew Soft\dtpd.exe moved successfully.
Service iked stopped successfully!
Service iked deleted successfully!
C:\Programme_neu\VPN Client\Shrew Soft\iked.exe moved successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@adobe.com/FlashPlayer\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@adobe.com/FlashPlayer\ deleted successfully.
C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll moved successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Logitech Download Assistant deleted successfully.
C:\Windows\SysNative\LogiLDA.DLL moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{81b971e4-75eb-11e1-ae62-0090f5ad910c}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{81b971e4-75eb-11e1-ae62-0090f5ad910c}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{81b971e4-75eb-11e1-ae62-0090f5ad910c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{81b971e4-75eb-11e1-ae62-0090f5ad910c}\ not found.
File E:\autorun.exe -auto not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b3f2483d-3e54-11e1-82c7-001e101f36d9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b3f2483d-3e54-11e1-82c7-001e101f36d9}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b3f2483d-3e54-11e1-82c7-001e101f36d9}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b3f2483d-3e54-11e1-82c7-001e101f36d9}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cc367764-3dfc-11e1-badc-0090f5ad910c}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc367764-3dfc-11e1-badc-0090f5ad910c}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cc367764-3dfc-11e1-badc-0090f5ad910c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc367764-3dfc-11e1-badc-0090f5ad910c}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cc367795-3dfc-11e1-badc-0090f5ad910c}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc367795-3dfc-11e1-badc-0090f5ad910c}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cc367795-3dfc-11e1-badc-0090f5ad910c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc367795-3dfc-11e1-badc-0090f5ad910c}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ef4b6c40-4034-11e1-bd6e-001e101f7f74}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ef4b6c40-4034-11e1-bd6e-001e101f7f74}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ef4b6c40-4034-11e1-bd6e-001e101f7f74}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ef4b6c40-4034-11e1-bd6e-001e101f7f74}\ not found.
File E:\AutoRun.exe not found.
C:\Users\Erik\AppData\Roaming\hellomoto folder moved successfully.
C:\Windows\Tasks\Adobe Flash Player Updater.job moved successfully.
========== FILES ==========
C:\Users\Erik\AppData\Local\Microsoft\Windows\2879 folder moved successfully.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\Erik\Desktop\cmd.bat deleted successfully.
C:\Users\Erik\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Erik
->Temp folder emptied: 199395926 bytes
->Temporary Internet Files folder emptied: 876442979 bytes
->Java cache emptied: 5233662 bytes
->Opera cache emptied: 2396620 bytes
->Flash cache emptied: 233133 bytes
 
User: Public
 
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 1734093 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 350460789 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67832 bytes
RecycleBin emptied: 447348792 bytes
 
Total Files Cleaned = 1.796,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
 
User: Default User
 
User: Erik
->Flash cache emptied: 0 bytes
 
User: Public
 
User: UpdatusUser
 
Total Flash Files Cleaned = 0,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.54.1 log created on 07262012_165134

Files\Folders moved on Reboot...
File\Folder C:\Users\Erik\AppData\Local\Temp\OICE_D95697D4-70CF-462C-9379-D37CED82BA8F.0\B1BE053B. not found!
C:\Users\Erik\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...
File C:\Users\Erik\AppData\Local\Temp\OICE_D95697D4-70CF-462C-9379-D37CED82BA8F.0\B1BE053B. not found!
File C:\Users\Erik\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!

Registry entries deleted on Reboot...
         

Sehr gut!

Wie laeuft der Rechner?

1. Schritt

Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".

danach:

2. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Starte die adwcleaner.exe mit einem Doppelklick.
• Klicke auf Search.
• Nach Ende des Suchlaufs öffnet sich eine Textdatei.
• Poste mir den Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

T'john,

Rechner läuft soweit rund, kein Unterschied feststellbar. Hier sind die Logfiles von Malbytes' Anti-Malware und AdwCleaner:

 Malwarebytes Anti-Malware  (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.26.12

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Erik :: ERIKPC [Administrator]

Schutz: Aktiviert

26.07.2012 17:24:16
mbam-log-2012-07-26 (17-24-16).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 378547
Laufzeit: 11 Minute(n), 42 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
         

# AdwCleaner v1.703 - Logfile created 07/26/2012 at 17:41:53
# Updated 20/07/2012 by Xplode
# Operating system : Windows 7 Professional Service Pack 1 (64 bits)
# User : Erik - ERIKPC
# Running from : C:\Users\Erik\Downloads\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****

Folder Found : C:\Users\Erik\AppData\Roaming\pdfforge
Folder Found : C:\Program Files (x86)\DAEMON Tools Toolbar

***** [Registry] *****

Key Found : HKLM\SOFTWARE\DT Soft
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DAEMON Tools Toolbar

***** [Registre - GUID] *****

[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Opera v [Unable to get version]

File : C:\Users\Erik\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [1114 octets] - [26/07/2012 17:20:31]
AdwCleaner[R2].txt - [1048 octets] - [26/07/2012 17:41:53]

########## EOF - C:\AdwCleaner[R2].txt - [1176 octets] ##########
         

Sehr gut!

• Schließe alle offenen Programme und Browser.
• Starte die adwcleaner.exe mit einem Doppelklick.
• Klicke auf Delete.
• Bestätige jeweils mit Ok.
• Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
• Poste mir den Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

danach:


Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html

Danke schon mal für die weitere Hilfe. Hier die Logs von AdwCleaner und Emsisoft (ich habe die Setup-Datei vom Pdf Creator behalten):

# AdwCleaner v1.703 - Logfile created 07/26/2012 at 17:47:20
# Updated 20/07/2012 by Xplode
# Operating system : Windows 7 Professional Service Pack 1 (64 bits)
# User : Erik - ERIKPC
# Running from : C:\Users\Erik\Downloads\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Folder Deleted : C:\Users\Erik\AppData\Roaming\pdfforge
Folder Deleted : C:\Program Files (x86)\DAEMON Tools Toolbar

***** [Registry] *****

Key Deleted : HKLM\SOFTWARE\DT Soft
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DAEMON Tools Toolbar

***** [Registre - GUID] *****

[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Opera v [Unable to get version]

File : C:\Users\Erik\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [1114 octets] - [26/07/2012 17:20:31]
AdwCleaner[R2].txt - [1175 octets] - [26/07/2012 17:41:53]
AdwCleaner[R3].txt - [1235 octets] - [26/07/2012 17:47:08]
AdwCleaner[S1].txt - [1178 octets] - [26/07/2012 17:47:20]

########## EOF - C:\AdwCleaner[S1].txt - [1306 octets] ##########
         

Emsisoft Anti-Malware - Version 6.6
Letztes Update: 26.07.2012 18:04:23

Scan Einstellungen:

Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\
Archiv Scan: An
ADS Scan: An

Scan Beginn:	26.07.2012 18:05:19

C:\Users\Erik\Downloads\PDFCreator-1_2_3_setup.exe 	gefunden: Riskware.Win32.Toolbar.Widgi.AMN!E1
C:\Programme_neu\PDFCreator\Toolbar\pdfforge Toolbar_setup.exe 	gefunden: Adware.Win32.Toolbar.Dealio.AMN!E1

Gescannt	658341
Gefunden	2

Scan Ende:	26.07.2012 18:23:56
Scan Zeit:	0:18:37

C:\Programme_neu\PDFCreator\Toolbar\pdfforge Toolbar_setup.exe	Quarantäne Adware.Win32.Toolbar.Dealio.AMN!E1

Quarantäne	1
         

Sehr gut!

Lasse die Funde loeschen, dann:

Deinstalliere:
Emsisoft Anti-Malware


ESET Online Scanner

Vorbereitung

• Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an.
• Bitte während des Online-Scans Anti-Virus-Programm und Firewall deaktivieren.
• Vista/Win7-User: Bitte den Browser unbedingt als Administrator starten.

Los geht's

• Lade und starte Eset Smartinstaller
• Haken setzen bei YES, I accept the Terms of Use.
• Klick auf Start.
• Haken setzen bei Remove found threads und Scan archives.
• Klick auf Start.
• Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Finish drücken.
• Browser schließen.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (manchmal auch C:\Programme\Eset\log.txt) suchen und mit Deinem Editor öffnen.
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Klasse! Hier die Log-File. Bei den Rar-Files handelt es sich um PDF-Sammlungen, die ich noch nicht angerührt hatte. Wie weiter?

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=cbf3006155ae1c4689d002f77781d735
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-07-26 10:08:50
# local_time=2012-07-27 12:08:50 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 100 94 41171780 94967379 0 0
# compatibility_mode=8192 67108863 100 0 182 182 0 0
# scanned=185920
# found=9
# cleaned=9
# scan_time=3001
C:\Users\Erik\Documents\Traveling\***\***.rar	JS/Trackware.ReadNotify.A application (deleted - quarantined)	00000000000000000000000000000000	C
C:\Users\Erik\Documents\Traveling\***\***.rar	JS/Trackware.ReadNotify.A application (deleted - quarantined)	00000000000000000000000000000000	C
C:\Users\Erik\Documents\Traveling\***\***.rar	JS/Trackware.ReadNotify.A application (deleted - quarantined)	00000000000000000000000000000000	C
C:\Users\Erik\Documents\Traveling\***\***.rar	JS/Trackware.ReadNotify.A application (deleted - quarantined)	00000000000000000000000000000000	C
C:\Users\Erik\Documents\Traveling\***\***.rar	JS/Trackware.ReadNotify.A application (deleted - quarantined)	00000000000000000000000000000000	C
C:\Users\Erik\Documents\Traveling\***\***.rar	JS/Trackware.ReadNotify.A application (deleted - quarantined)	00000000000000000000000000000000	C
C:\Users\Erik\Documents\Traveling\***\***.rar	JS/Trackware.ReadNotify.A application (deleted - quarantined)	00000000000000000000000000000000	C
C:\Users\Erik\Documents\Traveling\***\***.rar	JS/Trackware.ReadNotify.A application (deleted - quarantined)	00000000000000000000000000000000	C
C:\Users\Erik\Downloads\PDFCreator-1_2_3_setup.exe	Win32/Toolbar.Widgi application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
         

Java aktualisieren

Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.

• Downloade dir bitte die neueste Java-Version von hier
• Speichere die jxpiinstall.exe
• Schließe alle laufenden Programme. Speziell deinen Browser.
• Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 5 ) herunter laden.
• Wenn die Installation beendet wurde
  Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
• Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.

Nach dem Neustart

• Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
• Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
• Klicke auf Dateien löschen....
• Gehe sicher das überall ein Hacken gesetzt ist und klicke OK.
• Klicke erneut OK.

Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html

Soweit so gut. Habe ich wie beschrieben durchgeführt. Sonst noch Vorschläge?

Sehr gut!

damit bist Du sauber und entlassen!


Tool-Bereinigung mit OTL


Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.

• Bitte lade Dir (falls noch nicht vorhanden) OTL von OldTimer herunter.
• Speichere es auf Deinem Desktop.
• Doppelklick auf OTL.exe um das Programm auszuführen.
  Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
• Klicke auf den Button "Bereinigung"
• OTL fragt eventuell nach einem Neustart.
  Sollte es dies tun, so lasse dies bitte zu.

Anmerkung: Nach dem Neustart werden OTL und andere Helferprogramme, die Du im Laufe der Bereinigung heruntergeladen hast, nicht mehr vorhanden sein. Sie wurden entfernt. Es ist daher Ok, wenn diese Programme nicht mehr vorhanden sind. Sollten noch welche übrig geblieben sein, lösche sie manuell.


Zurücksetzen der Sicherheitszonen

Lasse die Sicherheitszonen wieder zurücksetzen, da diese manipuliert wurden um den Browser für weitere Angriffe zu öffnen.
Gehe dabei so vor: http://www.trojaner-board.de/111805-...ecksetzen.html


Aufräumen mit CCleaner

Lasse mit CCleaner (Download) (Anleitung) Fehler in der

• Registry beheben (mehrmals, solange bis keine Fehler mehr gefunden werden) und
• temporäre Dateien löschen.

Lektuere zum abarbeiten:
http://www.trojaner-board.de/90880-d...tallation.html
http://www.trojaner-board.de/105213-...tellungen.html
PluginCheck
http://www.trojaner-board.de/96344-a...-rechners.html
Secunia Online Software Inspector
http://www.trojaner-board.de/71715-k...iendungen.html
http://www.trojaner-board.de/83238-a...sschalten.html

Danke vielmals für deine Hilfe. Das ist mir ne kleine Spende wert. Das mit der Registry habe ich erst mal auf Anraten der Anleitung im Link gelassen. Alles Gute euch noch!

Die Anleitung soll davon abhalten es mal so zu machen. Deshalb verlinke ich die Anleitung auch.
Hier ist es aber geboten!

Danke für die Aufklärung, dann mache ich das auch noch!