Trojaner Searchnu - http://www.searchnu.com/413?tag=newtab

Ninchen911 · 02.08.2012, 17:13

Hallo zusammen,

vor wenigen Tagen habe ich mehrere Videobearbeitungsprogramme bei CHIP runtergeladen. Seitdem erscheint hxxp://www.searchnu.com/413?tag=newtab als Startseite und jedes Mal, sobald ich einen neuen Tab öffne.
Die Startseite habe ich bereits wieder in google umwandeln können.
Die Tabs blieben unverändert.

Sämtliche heruntergeladenen Programme habe ich wieder über die Systemsteuerung deinstalliert.
Ich habe die Add-ons überprüft, da jedoch nichts gefunden.
Anschließend habe ich den PC mit "Trjoan Remover" gescannt. Kein Fund.
Dann einen Scan mit SUPERAntiSpyware free edition durchgeführt. Hier wurden 122 detected Files (Tracking Cookies) gefunden und removed.
Anschließend erschien eine Meldung von Avira, dass ein Virus im Papierkorb gefunden wurde:
ADWARE/Adware.Gen
Dieser befindet sich seitdem in Quarantäne.

Mein Problem mit den Tabs besteht leider weiterhin. Da ich ein totaler Laie bin und wirklich sicher gehen möchte, dass mein LapTop komplett Viren- und Trojanerfrei wird, bitte ich euch um eure Hilfe.

Vielen vielen Dank im Voraus!!!

Hier die OTL.txt:

OTL logfile created on: 02.08.2012 17:25:03 - Run 1
OTL by OldTimer - Version 3.2.55.0 Folder = C:\Users\Ninchen\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

4,00 Gb Total Physical Memory | 2,69 Gb Available Physical Memory | 67,20% Memory free
7,99 Gb Paging File | 5,90 Gb Available in Paging File | 73,78% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 284,56 Gb Total Space | 187,91 Gb Free Space | 66,03% Space Free | Partition Type: NTFS
Drive D: | 13,23 Gb Total Space | 2,21 Gb Free Space | 16,67% Space Free | Partition Type: NTFS

Computer Name: NINCHEN-PC | User Name: Ninchen | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012.08.02 17:22:47 | 000,597,504 | ---- | M] (OldTimer Tools) -- C:\Users\Ninchen\Downloads\OTL.exe
PRC - [2012.07.08 17:11:04 | 001,825,720 | ---- | M] (Bandoo Media, inc) -- C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\datamngrUI.exe
PRC - [2012.05.15 22:07:27 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.15 22:07:26 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.15 22:07:26 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.03.28 17:07:50 | 000,094,264 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
PRC - [2011.01.20 11:20:12 | 001,305,408 | ---- | M] (DT Soft Ltd) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
PRC - [2010.05.08 13:48:36 | 000,229,376 | ---- | M] () -- C:\ProgramData\DatacardService\DCService.exe
PRC - [2010.05.08 13:48:26 | 000,241,664 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\ProgramData\DatacardService\DCSHelper.exe
PRC - [2009.07.24 19:24:02 | 000,427,304 | ---- | M] (CyberLink Corp.) -- c:\Program Files (x86)\Hewlett-Packard\Media\Live TV\TVAgent.exe
PRC - [2009.07.23 21:45:52 | 000,128,296 | ---- | M] (CyberLink Corp.) -- c:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe
PRC - [2009.07.23 12:37:16 | 000,206,120 | ---- | M] (CyberLink) -- c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe

========== Modules (No Company Name) ==========

MOD - [2012.06.14 21:25:58 | 014,340,608 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\e717a230496832656b05b515eb9f3bc5\PresentationFramework.ni.dll
MOD - [2012.06.14 21:25:40 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll
MOD - [2012.06.14 21:25:31 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll
MOD - [2012.06.14 21:25:23 | 012,237,824 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\14a87218ea49639f38097e278b98a3da\PresentationCore.ni.dll
MOD - [2012.05.31 17:14:27 | 000,036,920 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\HP.ActiveSupportLibrary\2.0.0.1__01a974bc1760f423\HP.ActiveSupportLibrary.dll
MOD - [2012.05.24 10:42:43 | 001,051,136 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\9b2f17fb61b7197f2a04108f5d1a1cc6\System.Management.ni.dll
MOD - [2012.05.24 10:21:38 | 000,368,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\8e56489276063ededde74e597a121df3\PresentationFramework.Aero.ni.dll
MOD - [2012.05.24 10:21:15 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll
MOD - [2012.05.24 10:21:13 | 006,611,456 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\f3814b488d9e083cbbc623e01b389f09\System.Data.ni.dll
MOD - [2012.05.24 10:20:29 | 000,185,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationTypes\d8af9a65cf0ed85d47360796e2645a06\UIAutomationTypes.ni.dll
MOD - [2012.05.24 10:20:13 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll
MOD - [2012.05.24 10:20:06 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll
MOD - [2012.05.24 10:20:01 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll
MOD - [2012.05.24 10:20:00 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll
MOD - [2012.05.24 10:19:53 | 011,492,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll
MOD - [2011.09.27 07:23:00 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.09.27 07:22:40 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2010.11.13 02:08:41 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010.11.05 03:58:05 | 002,927,616 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
MOD - [2009.10.02 04:39:04 | 000,249,856 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\PresentationFramework.resources\3.0.0.0_de_31bf3856ad364e35\PresentationFramework.resources.dll
MOD - [2009.10.02 04:39:04 | 000,110,592 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\PresentationCore.resources\3.0.0.0_de_31bf3856ad364e35\PresentationCore.resources.dll
MOD - [2009.07.24 19:24:16 | 000,275,848 | ---- | M] () -- c:\Program Files (x86)\Hewlett-Packard\Media\Live TV\Kernel\TV\CLCapEngine.dll
MOD - [2009.07.24 19:24:16 | 000,124,288 | ---- | M] () -- c:\Program Files (x86)\Hewlett-Packard\Media\Live TV\Kernel\TV\CLSchMgr.dll
MOD - [2009.07.24 19:24:14 | 000,349,480 | ---- | M] () -- c:\Program Files (x86)\Hewlett-Packard\Media\Live TV\Kernel\TV\CLTinyDB.dll
MOD - [2009.07.23 12:37:14 | 000,931,112 | ---- | M] () -- c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMediaLibrary.dll
MOD - [2009.07.15 17:51:04 | 000,061,440 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Pillars\PCAlerts\PCAlertsPillar.dll
MOD - [2009.07.15 17:51:02 | 000,131,072 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Pillars\ECenter\ECLibrary.dll
MOD - [2009.07.15 17:50:58 | 000,040,960 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingServer.dll
MOD - [2009.07.15 17:50:56 | 000,036,864 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingClients.dll
MOD - [2009.07.15 17:50:56 | 000,007,680 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\HP Advisor\RemotingClient.dll
MOD - [2009.07.15 17:50:54 | 000,005,632 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingInterface.dll
MOD - [2009.07.15 17:50:52 | 000,018,944 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingMessages.dll
MOD - [2009.07.15 17:50:44 | 000,028,672 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.Logging.dll
MOD - [2009.06.17 12:40:16 | 007,745,536 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll
MOD - [2009.06.17 12:40:16 | 002,121,728 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll
MOD - [2009.06.17 12:40:16 | 000,135,168 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll

========== Win32 Services (SafeList) ==========

SRV:64bit: - [2009.07.22 03:33:32 | 000,240,128 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\stacsv64.exe -- (STacSV)
SRV:64bit: - [2009.07.08 14:49:02 | 000,030,520 | ---- | M] (Hewlett-Packard) [Auto | Running] -- C:\Windows\SysNative\hpservice.exe -- (hpsrv)
SRV:64bit: - [2009.07.02 20:16:06 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009.03.02 23:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\AESTSr64.exe -- (AESTFilters)
SRV - [2012.07.28 03:12:10 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.07.20 00:20:36 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.07.03 13:19:28 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.05.15 22:07:27 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.15 22:07:26 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.01.18 14:38:28 | 000,155,320 | ---- | M] (Avanquest Software) [On_Demand | Stopped] -- C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe -- (Sony PC Companion)
SRV - [2011.09.09 17:10:28 | 000,086,072 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe -- (HP Support Assistant Service)
SRV - [2011.08.12 01:38:04 | 000,140,672 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Programme\SUPERAntiSpyware\SASCore64.exe -- (!SASCORE)
SRV - [2011.03.28 17:07:50 | 000,094,264 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe -- (HPDrvMntSvc.exe)
SRV - [2010.05.08 13:48:36 | 000,229,376 | ---- | M] () [Auto | Running] -- C:\ProgramData\DatacardService\DCService.exe -- (DCService.exe)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.07.22 03:33:32 | 000,240,128 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\STacSV64.exe -- (STacSV)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.05.22 20:02:20 | 000,250,616 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe -- (GameConsoleService)
SRV - [2009.05.21 22:35:32 | 000,923,136 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL -- (HPSLPSVC)
SRV - [2009.03.02 23:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\AESTSr64.exe -- (AESTFilters)
SRV - [2009.02.22 12:00:00 | 000,129,584 | ---- | M] (EasyBits Sofware AS) [Auto | Running] -- C:\Windows\SysWOW64\ezsvc7.dll -- (ezSharedSvc)

========== Driver Services (SafeList) ==========

DRV:64bit: - [2012.05.15 22:07:27 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.05.15 22:07:27 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.04.25 12:11:36 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.01.24 10:18:06 | 000,027,176 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ggsemc.sys -- (ggsemc)
DRV:64bit: - [2012.01.24 10:18:06 | 000,013,352 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ggflt.sys -- (ggflt)
DRV:64bit: - [2011.10.21 21:01:48 | 000,254,528 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2011.09.16 16:08:07 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011.04.05 17:35:20 | 000,253,528 | ---- | M] (Sunbelt Software, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\SbFw.sys -- (SbFw)
DRV:64bit: - [2011.04.05 17:35:20 | 000,094,296 | ---- | M] (Sunbelt Software, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\sbtis.sys -- (SbTis)
DRV:64bit: - [2011.04.05 17:35:20 | 000,060,504 | ---- | M] (Sunbelt Software, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sbhips.sys -- (sbhips)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.02.08 09:14:20 | 000,084,568 | ---- | M] (Sunbelt Software, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SbFwIm.sys -- (SBFWIMCLMP)
DRV:64bit: - [2011.02.08 09:14:20 | 000,084,568 | ---- | M] (Sunbelt Software, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SbFwIm.sys -- (SBFWIMCL)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.20 11:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2010.04.09 15:24:32 | 000,076,288 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ew_jubusenum.sys -- (huawei_enumerator)
DRV:64bit: - [2010.04.07 17:05:00 | 000,250,368 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbnet.sys -- (ewusbnet)
DRV:64bit: - [2010.03.25 10:08:46 | 000,120,704 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard)
DRV:64bit: - [2010.03.20 11:56:56 | 000,114,560 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_hwusbdev.sys -- (ew_hwusbdev)
DRV:64bit: - [2009.09.22 02:47:14 | 001,484,800 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2009.07.22 03:33:32 | 000,487,936 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA)
DRV:64bit: - [2009.07.21 05:39:22 | 000,140,712 | ---- | M] (JMicron Technology Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\jmcr.sys -- (JMCR)
DRV:64bit: - [2009.07.15 01:16:34 | 000,273,456 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.08 14:49:08 | 000,030,008 | ---- | M] (Hewlett-Packard) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\hpdskflt.sys -- (hpdskflt)
DRV:64bit: - [2009.07.08 14:48:50 | 000,041,272 | ---- | M] (Hewlett-Packard) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Accelerometer.sys -- (Accelerometer)
DRV:64bit: - [2009.07.02 20:51:30 | 006,036,480 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2009.06.29 20:17:00 | 000,070,656 | ---- | M] (ENE TECHNOLOGY INC.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\enecir.sys -- (enecir)
DRV:64bit: - [2009.06.10 23:01:11 | 001,485,312 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTDPV6.SYS -- (SrvHsfV92)
DRV:64bit: - [2009.06.10 23:01:11 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTCNXT6.SYS -- (SrvHsfWinac)
DRV:64bit: - [2009.06.10 23:01:11 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTAZL6.SYS -- (SrvHsfHDA)
DRV:64bit: - [2009.06.10 23:01:06 | 001,146,880 | ---- | M] (LSI Corp) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\agrsm64.sys -- (AgereSoftModem)
DRV:64bit: - [2009.06.10 22:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2009.06.10 22:35:33 | 000,389,120 | ---- | M] (Marvell) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7)
DRV:64bit: - [2009.06.10 22:35:28 | 005,434,368 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netw5v64.sys -- (netw5v64)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.06.05 12:20:26 | 000,114,192 | ---- | M] (ATI Research Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2009.05.23 08:52:30 | 000,215,040 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009.05.18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009.05.05 07:30:28 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie.sys -- (AtiPcie)
DRV:64bit: - [2009.04.29 08:48:32 | 000,018,432 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)
DRV:64bit: - [2009.03.09 07:49:08 | 000,036,408 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbfilter.sys -- (usbfilter)
DRV - [2011.07.22 18:26:56 | 000,014,928 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\sasdifsv64.sys -- (SASDIFSV)
DRV - [2011.07.12 23:55:18 | 000,012,368 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\saskutil64.sys -- (SASKUTIL)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cnnb
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cnnb
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
IE:64bit: - HKLM\..\SearchScopes\{1366F70F-D4B1-41A2-9C50-344E76EADE50}: "URL" = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
IE:64bit: - HKLM\..\SearchScopes\{2C7072CC-3B6A-4D18-856D-F60EF665414F}: "URL" = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcnnbie7-de-de
IE:64bit: - HKLM\..\SearchScopes\{3CA7DAB2-1C99-4C76-88C3-55972FB79B59}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
IE:64bit: - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cnnb
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cnnb
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
IE - HKLM\..\SearchScopes\{1366F70F-D4B1-41A2-9C50-344E76EADE50}: "URL" = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
IE - HKLM\..\SearchScopes\{2C7072CC-3B6A-4D18-856D-F60EF665414F}: "URL" = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcnnbie7-de-de
IE - HKLM\..\SearchScopes\{3CA7DAB2-1C99-4C76-88C3-55972FB79B59}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cnnb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 78 91 C1 30 21 02 CD 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
IE - HKCU\..\SearchScopes\{1366F70F-D4B1-41A2-9C50-344E76EADE50}: "URL" = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
IE - HKCU\..\SearchScopes\{2C7072CC-3B6A-4D18-856D-F60EF665414F}: "URL" = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcnnbie7-de-de
IE - HKCU\..\SearchScopes\{3CA7DAB2-1C99-4C76-88C3-55972FB79B59}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Search Results"
FF - prefs.js..browser.search.order.1: "Search Results"
FF - prefs.js..browser.search.selectedEngine: "Search Results"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..keyword.URL: "hxxp://dts.search-results.com/sr?src=ffb&appid=0&systemid=413&sr=0&q="
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_268.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_268.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@SonyCreativeSoftware.com/Media Go,version=1.0: C:\Program Files (x86)\Sony\Media Go\npmediago.dll (Sony Media Software and Services Inc)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011.12.27 19:47:07 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.20 00:20:36 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.03.28 12:47:50 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011.12.27 19:47:07 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.20 00:20:36 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.03.28 12:47:50 | 000,000,000 | ---D | M]

[2012.07.29 00:31:48 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ninchen\AppData\Roaming\mozilla\Extensions
[2012.08.02 03:42:12 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ninchen\AppData\Roaming\mozilla\Firefox\Profiles\bx65q5dw.default\extensions
[2011.10.17 12:18:33 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Ninchen\AppData\Roaming\mozilla\Firefox\Profiles\bx65q5dw.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.07.29 00:31:33 | 000,002,515 | ---- | M] () -- C:\Users\Ninchen\AppData\Roaming\Mozilla\Firefox\Profiles\bx65q5dw.default\searchplugins\Search_Results.xml
[2012.07.29 00:31:48 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.07.29 00:31:48 | 000,000,000 | ---D | M] (DataMngr) -- C:\PROGRAM FILES (X86)\WINDOWS SEARCHQU TOOLBAR\DATAMNGR\FIREFOXEXTENSION
[2012.07.20 00:20:36 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.02.02 21:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2012.05.02 23:04:01 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.05.02 23:04:01 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.05.02 23:04:01 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.05.02 23:04:01 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.07.29 00:31:33 | 000,002,515 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\Search_Results.xml
[2012.05.02 23:04:01 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.05.02 23:04:01 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (DataMngr) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~2\WIA6EB~1\Datamngr\x64\BROWSE~1.DLL (Bandoo Media, inc)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WIA6EB~1\Datamngr\ToolBar\searchqudtx.dll ()
O2 - BHO: (DataMngr) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~2\WIA6EB~1\Datamngr\BROWSE~1.DLL (Bandoo Media, inc)
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WIA6EB~1\Datamngr\ToolBar\searchqudtx.dll ()
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4:64bit: - HKLM..\Run: [SmartMenu] C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe ()
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray64.exe (IDT, Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [DATAMNGR] C:\PROGRA~2\WIA6EB~1\Datamngr\DATAMN~1.EXE (Bandoo Media, inc)
O4 - HKLM..\Run: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe File not found
O4 - HKLM..\Run: [HPCam_Menu] c:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [TrojanScanner] C:\Program Files (x86)\Trojan Remover\Trjscan.exe (Simply Super Software)
O4 - HKLM..\Run: [UpdatePRCShortCut] C:\Program Files (x86)\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKCU..\Run: [Sony PC Companion] "C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe" /Background File not found
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableLockWorkstation = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableChangePassword = 0
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Ninchen\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Ninchen\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~4\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 209.18.47.61 209.18.47.62
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{001356F1-282B-4474-A508-3CDE2CA5263C}: NameServer = 193.189.244.225 193.189.244.206
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{21DB8336-6CDB-41BC-ABA8-AD59EEBD68BF}: NameServer = 193.189.244.225 193.189.244.206
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5ACF2B2B-E010-4008-89CC-AEB006EEB631}: NameServer = 193.189.244.225 193.189.244.206
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CF27DC44-C0C5-47FC-BB45-E8915C78496B}: NameServer = 193.189.244.225 193.189.244.206
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FA92405A-2AA9-4546-964D-8016BF7078D0}: DhcpNameServer = 209.18.47.61 209.18.47.62
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\WIA6EB~1\Datamngr\x64\datamngr.dll) - C:\PROGRA~2\WIA6EB~1\Datamngr\x64\datamngr.dll (Bandoo Media, inc)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\WIA6EB~1\Datamngr\x64\IEBHO.dll) - C:\PROGRA~2\WIA6EB~1\Datamngr\x64\IEBHO.dll (Bandoo Media, inc)
O20 - AppInit_DLLs: (C:\PROGRA~2\WIA6EB~1\Datamngr\datamngr.dll) - C:\PROGRA~2\WIA6EB~1\Datamngr\datamngr.dll (Bandoo Media, inc)
O20 - AppInit_DLLs: (C:\PROGRA~2\WIA6EB~1\Datamngr\IEBHO.dll) - C:\PROGRA~2\WIA6EB~1\Datamngr\IEBHO.dll (Bandoo Media, inc)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{0564190b-3e3f-11df-844a-00269ea1672c}\Shell - "" = AutoRun
O33 - MountPoints2\{0564190b-3e3f-11df-844a-00269ea1672c}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\{31da5220-fbe6-11e0-865a-001e101fa1f5}\Shell - "" = AutoRun
O33 - MountPoints2\{31da5220-fbe6-11e0-865a-001e101fa1f5}\Shell\AutoRun\command - "" = H:\Installer.exe
O33 - MountPoints2\{3b36dcac-aca4-11e0-8dad-00269ea1672c}\Shell - "" = AutoRun
O33 - MountPoints2\{3b36dcac-aca4-11e0-8dad-00269ea1672c}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{3b36dcbc-aca4-11e0-8dad-00269ea1672c}\Shell - "" = AutoRun
O33 - MountPoints2\{3b36dcbc-aca4-11e0-8dad-00269ea1672c}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{430025b9-1671-11e1-83b4-001e101f2c0e}\Shell - "" = AutoRun
O33 - MountPoints2\{430025b9-1671-11e1-83b4-001e101f2c0e}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{713b3552-fce9-11e0-8632-00269ea1672c}\Shell - "" = AutoRun
O33 - MountPoints2\{713b3552-fce9-11e0-8632-00269ea1672c}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{98698422-2b2d-11e1-8ff5-001e101fa1f5}\Shell - "" = AutoRun
O33 - MountPoints2\{98698422-2b2d-11e1-8ff5-001e101fa1f5}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012.08.02 04:29:51 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\AppData\Roaming\SUPERAntiSpyware.com
[2012.08.02 04:29:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2012.08.02 04:29:30 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2012.08.02 04:29:30 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2012.08.02 04:08:40 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\Documents\Simply Super Software
[2012.08.02 04:08:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trojan Remover
[2012.08.02 04:08:13 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\AppData\Roaming\Simply Super Software
[2012.08.02 04:08:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Simply Super Software
[2012.08.02 04:08:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Trojan Remover
[2012.07.29 02:19:01 | 000,000,000 | ---D | C] -- C:\ProgramData\boost_interprocess
[2012.07.29 01:17:51 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\Documents\Freemake
[2012.07.29 01:17:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Freemake
[2012.07.29 01:17:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Freemake
[2012.07.29 01:17:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\FreemakeVideoConverterTB
[2012.07.29 00:39:36 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\Documents\Video Converter
[2012.07.29 00:39:36 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\AppData\Local\Video Converter
[2012.07.29 00:39:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MPEG4E
[2012.07.29 00:39:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Free Video Converter
[2012.07.29 00:38:29 | 000,000,000 | ---D | C] -- C:\ProgramData\VideoConverter
[2012.07.29 00:31:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Windows Searchqu Toolbar
[2012.07.29 00:31:31 | 000,360,448 | ---- | C] (FLV.com) -- C:\Windows\SysWow64\TubeFinder.exe
[2012.07.29 00:31:29 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\AppData\Roaming\FreeFLVConverter
[2012.07.29 00:31:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Free FLV Converter
[2012.07.29 00:09:15 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\AppData\Roaming\avidemux
[2012.07.16 02:31:11 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\AppData\Roaming\WindSolutions
[2012.07.16 02:30:38 | 000,000,000 | ---D | C] -- C:\ProgramData\WindSolutions
[2012.07.16 02:03:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012.07.16 02:02:36 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2012.07.16 02:02:35 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2012.07.16 02:02:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes
[2012.07.14 23:21:23 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\AppData\Local\Macromedia
[2012.07.14 23:15:29 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee
[2012.07.14 23:15:19 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed
[2012.07.14 03:01:16 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Wat
[2012.07.14 03:01:16 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Wat
[2012.07.12 04:46:34 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\AppData\Roaming\Canneverbe Limited
[2012.07.12 04:46:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Canneverbe Limited
[2012.07.12 04:46:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CDBurnerXP
[2012.07.12 04:40:50 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\AppData\Local\Nero_AG
[2012.07.12 04:40:35 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\AppData\Roaming\Nero
[2012.07.12 04:40:22 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\AppData\Local\Nero
[2012.07.12 04:37:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Nero
[2012.07.12 04:36:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2012.07.12 04:36:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2012.07.12 03:05:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DVDVideoSoftTB_DE
[2012.07.12 03:05:22 | 000,405,144 | ---- | C] (Newtonsoft) -- C:\Windows\SysWow64\Newtonsoft.Json.Net20.dll
[2012.07.12 03:05:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
[2012.07.12 03:05:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DVDVideoSoft
[2012.07.11 23:24:39 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\AppData\Local\LogiShrd
[2012.07.11 23:24:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech
[2012.07.11 23:24:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Logitech

========== Files - Modified Within 30 Days ==========

[2012.08.02 17:23:40 | 000,001,074 | ---- | M] () -- C:\Users\Ninchen\Desktop\Defogger - Verknüpfung.lnk
[2012.08.02 17:23:16 | 000,001,430 | ---- | M] () -- C:\Users\Ninchen\Desktop\OTL - Verknüpfung.lnk
[2012.08.02 17:22:08 | 000,000,168 | ---- | M] () -- C:\Users\Ninchen\defogger_reenable
[2012.08.02 17:19:59 | 000,023,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.02 17:19:59 | 000,023,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.02 17:12:54 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.08.02 17:11:09 | 000,065,536 | ---- | M] () -- C:\Windows\SysNative\Ikeext.etl
[2012.08.02 17:10:59 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.02 17:10:54 | 3218,235,392 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.02 13:13:31 | 000,000,514 | ---- | M] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task 1ddbee62-2b5b-4452-b38a-abcaade39472.job
[2012.08.02 12:55:56 | 000,000,514 | ---- | M] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task d9daa13f-20d9-4414-8e1f-10430e1847dd.job
[2012.08.02 04:29:34 | 000,001,808 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012.08.02 04:08:15 | 000,001,139 | ---- | M] () -- C:\Users\Public\Desktop\Trojan Remover.lnk
[2012.08.02 03:12:50 | 000,000,340 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForNinchen.job
[2012.07.31 00:45:02 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.07.31 00:45:02 | 000,654,400 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.07.31 00:45:02 | 000,616,242 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.07.31 00:45:02 | 000,130,240 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.07.31 00:45:02 | 000,106,622 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.07.29 00:40:24 | 000,004,608 | ---- | M] () -- C:\Users\Ninchen\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.07.22 16:24:11 | 000,001,084 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Antivirus Scheduled Scan.job
[2012.07.16 02:03:37 | 000,001,783 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012.07.12 04:46:28 | 000,001,949 | ---- | M] () -- C:\Users\Public\Desktop\CDBurnerXP.lnk
[2012.07.12 04:36:24 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2012.07.12 03:32:11 | 000,410,736 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.07.12 03:05:23 | 000,001,398 | ---- | M] () -- C:\Users\Ninchen\Desktop\Free YouTube to MP3 Converter.lnk
[2012.07.12 03:05:23 | 000,001,239 | ---- | M] () -- C:\Users\Ninchen\Desktop\DVDVideoSoft Free Studio.lnk
[2012.07.11 23:24:34 | 000,002,005 | ---- | M] () -- C:\Users\Public\Desktop\Logitech Vid HD.lnk

========== Files Created - No Company Name ==========

[2012.08.02 17:23:40 | 000,001,074 | ---- | C] () -- C:\Users\Ninchen\Desktop\Defogger - Verknüpfung.lnk
[2012.08.02 17:23:16 | 000,001,430 | ---- | C] () -- C:\Users\Ninchen\Desktop\OTL - Verknüpfung.lnk
[2012.08.02 17:22:07 | 000,000,168 | ---- | C] () -- C:\Users\Ninchen\defogger_reenable
[2012.08.02 04:30:18 | 000,000,514 | ---- | C] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task d9daa13f-20d9-4414-8e1f-10430e1847dd.job
[2012.08.02 04:30:17 | 000,000,514 | ---- | C] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task 1ddbee62-2b5b-4452-b38a-abcaade39472.job
[2012.08.02 04:29:34 | 000,001,808 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012.08.02 04:08:15 | 000,001,139 | ---- | C] () -- C:\Users\Public\Desktop\Trojan Remover.lnk
[2012.08.02 04:08:14 | 000,153,088 | ---- | C] () -- C:\Windows\SysWow64\UNRAR3.dll
[2012.08.02 04:08:14 | 000,075,264 | ---- | C] () -- C:\Windows\SysWow64\unacev2.dll
[2012.07.29 00:40:13 | 000,004,608 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.07.29 00:31:30 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\PropertyGrid.ocx
[2012.07.29 00:31:30 | 000,208,500 | ---- | C] () -- C:\Windows\SysWow64\ReyXpBasics.tlb
[2012.07.29 00:31:30 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\ControlSubX.ocx
[2012.07.25 23:37:57 | 000,000,340 | ---- | C] () -- C:\Windows\tasks\HPCeeScheduleForNinchen.job
[2012.07.16 02:03:37 | 000,001,783 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012.07.14 23:15:27 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.07.12 04:46:28 | 000,001,949 | ---- | C] () -- C:\Users\Public\Desktop\CDBurnerXP.lnk
[2012.07.12 04:46:28 | 000,001,899 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
[2012.07.12 03:05:23 | 000,001,398 | ---- | C] () -- C:\Users\Ninchen\Desktop\Free YouTube to MP3 Converter.lnk
[2012.07.12 03:05:23 | 000,001,239 | ---- | C] () -- C:\Users\Ninchen\Desktop\DVDVideoSoft Free Studio.lnk
[2012.07.11 23:24:34 | 000,002,005 | ---- | C] () -- C:\Users\Public\Desktop\Logitech Vid HD.lnk
[2011.12.27 19:39:36 | 000,238,995 | ---- | C] () -- C:\Windows\hpwins26.dat
[2011.04.16 17:03:57 | 000,001,854 | ---- | C] () -- C:\Users\Ninchen\AppData\Roaming\GhostObjGAFix.xml
[2011.01.13 16:22:56 | 000,000,087 | ---- | C] () -- C:\Users\Ninchen\webct_upload_applet.properties
[2010.11.02 15:32:37 | 000,000,001 | R--- | C] () -- C:\Users\Ninchen\serverport
[2010.09.17 21:16:10 | 001,670,467 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\tmpIMG_0065.0
[2010.09.17 21:16:10 | 000,776,826 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\tmpIMG_0065.JPG
[2010.09.17 21:15:54 | 000,747,817 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\tmpIMG_0064.JPG
[2010.09.17 21:15:53 | 001,620,983 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\tmpIMG_0064.0
[2010.09.17 20:51:32 | 002,334,606 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\tmpDSC00349.JPG
[2010.09.17 20:51:31 | 005,029,971 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\tmpDSC00349.0
[2010.09.15 12:41:56 | 000,602,102 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\tmpIMG_0069.JPG
[2010.09.15 12:41:55 | 001,304,308 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\tmpIMG_0069.0
[2010.04.02 20:34:20 | 002,529,622 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\[j0004]-[p212].bmp
[2010.04.02 20:19:34 | 002,529,622 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\[j0003]-[p14].bmp
[2010.04.02 19:51:45 | 002,529,622 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\[j0002]-[p26].bmp

========== LOP Check ==========

[2012.04.10 15:21:24 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\Ad-Aware Antivirus
[2012.07.29 00:09:55 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\avidemux
[2012.07.12 04:46:34 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\Canneverbe Limited
[2011.10.21 21:03:13 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\DAEMON Tools Lite
[2012.07.12 03:05:57 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\DVDVideoSoft
[2011.10.17 12:18:32 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.07.29 00:31:38 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\FreeFLVConverter
[2010.10.02 00:13:59 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\OpenOffice.org
[2012.06.03 17:45:46 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\pdfforge
[2012.08.02 04:08:13 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\Simply Super Software
[2011.06.30 17:07:41 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\Sony
[2012.07.16 02:31:11 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\WindSolutions
[2010.03.29 21:07:34 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\_MDLogs
[2012.07.22 16:24:11 | 000,001,084 | ---- | M] () -- C:\Windows\Tasks\Ad-Aware Antivirus Scheduled Scan.job
[2012.07.08 01:58:45 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2012.08.02 13:13:31 | 000,000,514 | ---- | M] () -- C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 1ddbee62-2b5b-4452-b38a-abcaade39472.job
[2012.08.02 12:55:56 | 000,000,514 | ---- | M] () -- C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task d9daa13f-20d9-4414-8e1f-10430e1847dd.job

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 150 bytes -> C:\ProgramData\Temp:CB0AACC9

< End of report >

cosinus · 05.08.2012, 12:16

Zitat:

Dann einen Scan mit SUPERAntiSpyware free edition durchgeführt. Hier wurden 122 detected Files (Tracking Cookies) gefunden und removed.
Anschließend erschien eine Meldung von Avira, dass ein Virus im Papierkorb gefunden wurde:
ADWARE/Adware.Gen

Schön und wo sind die Logs dazu?

Solche Angaben reichen nicht, bitte poste die vollständigen Angaben/Logs der Virenscanner.

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

ATTFilter

 hier steht das Log

Ninchen911 · 06.08.2012, 01:39

Ok tut mir leid, das konnte ich aus der Checkliste nicht entnehmen und war für mich als Laie nicht offensichtlich.
Ich hoffe so ist es nun richtig:

Code:

ATTFilter

 Log SuperAntiSpyware
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 08/02/2012 at 01:09 PM

Application Version : 5.5.1012

Core Rules Database Version : 8962
Trace Rules Database Version: 6774

Scan type       : Complete Scan
Total Scan Time : 08:37:46

Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User

Memory items scanned      : 748
Memory threats detected   : 0
Registry items scanned    : 67328
Registry threats detected : 0
File items scanned        : 125768
File threats detected     : 122

Adware.Tracking Cookie
	C:\Users\Ninchen\AppData\Roaming\Microsoft\Windows\Cookies\NC4TFL1H.txt [ /apmebf.com ]
	C:\Users\Ninchen\AppData\Roaming\Microsoft\Windows\Cookies\YNU08WCT.txt [ /c.atdmt.com ]
	C:\Users\Ninchen\AppData\Roaming\Microsoft\Windows\Cookies\3LD3DH4J.txt [ /fastclick.net ]
	C:\Users\Ninchen\AppData\Roaming\Microsoft\Windows\Cookies\ID5B2PA1.txt [ /mediaplex.com ]
	C:\Users\Ninchen\AppData\Roaming\Microsoft\Windows\Cookies\HTJQRK11.txt [ /atdmt.com ]
	C:\Users\Ninchen\AppData\Roaming\Microsoft\Windows\Cookies\UQ7PIZ7Q.txt [ /adfarm1.adition.com ]
	C:\Users\Ninchen\AppData\Roaming\Microsoft\Windows\Cookies\UG5U9QKJ.txt [ /ad1.adfarm1.adition.com ]
	C:\USERS\NINCHEN\Cookies\NC4TFL1H.txt [ Cookie:ninchen@apmebf.com/ ]
	C:\USERS\NINCHEN\Cookies\YNU08WCT.txt [ Cookie:ninchen@c.atdmt.com/ ]
	C:\USERS\NINCHEN\Cookies\3LD3DH4J.txt [ Cookie:ninchen@fastclick.net/ ]
	C:\USERS\NINCHEN\Cookies\ID5B2PA1.txt [ Cookie:ninchen@mediaplex.com/ ]
	C:\USERS\NINCHEN\Cookies\HTJQRK11.txt [ Cookie:ninchen@atdmt.com/ ]
	C:\USERS\NINCHEN\Cookies\UQ7PIZ7Q.txt [ Cookie:ninchen@adfarm1.adition.com/ ]
	C:\USERS\NINCHEN\Cookies\UG5U9QKJ.txt [ Cookie:ninchen@ad1.adfarm1.adition.com/ ]
	.imrworldwide.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.imrworldwide.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.doubleclick.net [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.serving-sys.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.serving-sys.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	accounts.google.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.questionmarket.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.unister-adservices.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.histats.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.histats.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adtech.de [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	ad1.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.webmasterplan.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.webmasterplan.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	ad.zanox.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.questionmarket.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.questionmarket.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.questionmarket.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.apmebf.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.mediaplex.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.invitemedia.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.invitemedia.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.invitemedia.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.revsci.net [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.smartadserver.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.smartadserver.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.smartadserver.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.zanox.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.webmasterplan.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.zanox-affiliate.de [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	statse.webtrendslive.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.revsci.net [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.doubleclick.net [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	ad.zanox.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.blogads.de [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.blogads.de [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.amazon-adsystem.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.tribalfusion.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.ru4.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	adx.chip.de [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	ad3.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.serving-sys.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.serving-sys.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.serving-sys.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.tracker.vinsight.de [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.revsci.net [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.revsci.net [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.revsci.net [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	ad4.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	ad2.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	adx.chip.de [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	adx.chip.de [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	adx.chip.de [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	adx.chip.de [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	adx.chip.de [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.advertising.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.media6degrees.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.media6degrees.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.media6degrees.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.apmebf.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.fastclick.net [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.advertising.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.advertising.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.atdmt.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.atdmt.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	ww251.smartadserver.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.smartadserver.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.smartadserver.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.smartadserver.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]
	.mediaplex.com [ C:\USERS\NINCHEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BX65Q5DW.DEFAULT\COOKIES.SQLITE ]

Code:

ATTFilter

 


Avira Free Antivirus
Erstellungsdatum der Reportdatei: Donnerstag, 2. August 2012  04:32

Es wird nach 4048106 Virenstämmen gesucht.

Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer   : Avira AntiVir Personal - Free Antivirus
Seriennummer   : 0000149996-ADJIE-0000001
Plattform      : Windows 7 Home Premium
Windowsversion : (Service Pack 1)  [6.1.7601]
Boot Modus     : Normal gebootet
Benutzername   : SYSTEM
Computername   : NINCHEN-PC

Versionsinformationen:
BUILD.DAT      : 12.0.0.1125    41829 Bytes  02.05.2012 16:34:00
AVSCAN.EXE     : 12.3.0.15     466896 Bytes  15.05.2012 20:07:26
AVSCAN.DLL     : 12.3.0.15      66256 Bytes  15.05.2012 20:07:26
LUKE.DLL       : 12.3.0.15      68304 Bytes  15.05.2012 20:07:27
AVSCPLR.DLL    : 12.3.0.14      97032 Bytes  15.05.2012 20:07:27
AVREG.DLL      : 12.3.0.17     232200 Bytes  15.05.2012 20:07:27
VBASE000.VDF   : 7.10.0.0    19875328 Bytes  06.11.2009 09:49:21
VBASE001.VDF   : 7.11.0.0    13342208 Bytes  14.12.2010 06:56:15
VBASE002.VDF   : 7.11.19.170 14374912 Bytes  20.12.2011 06:56:21
VBASE003.VDF   : 7.11.21.238  4472832 Bytes  01.02.2012 17:38:40
VBASE004.VDF   : 7.11.26.44   4329472 Bytes  28.03.2012 17:48:10
VBASE005.VDF   : 7.11.34.116  4034048 Bytes  29.06.2012 22:23:19
VBASE006.VDF   : 7.11.34.117     2048 Bytes  29.06.2012 22:23:19
VBASE007.VDF   : 7.11.34.118     2048 Bytes  29.06.2012 22:23:19
VBASE008.VDF   : 7.11.34.119     2048 Bytes  29.06.2012 22:23:19
VBASE009.VDF   : 7.11.34.120     2048 Bytes  29.06.2012 22:23:19
VBASE010.VDF   : 7.11.34.121     2048 Bytes  29.06.2012 22:23:20
VBASE011.VDF   : 7.11.34.122     2048 Bytes  29.06.2012 22:23:20
VBASE012.VDF   : 7.11.34.123     2048 Bytes  29.06.2012 22:23:20
VBASE013.VDF   : 7.11.34.124     2048 Bytes  29.06.2012 22:23:20
VBASE014.VDF   : 7.11.38.18   2554880 Bytes  30.07.2012 22:45:18
VBASE015.VDF   : 7.11.38.70    556032 Bytes  31.07.2012 22:51:32
VBASE016.VDF   : 7.11.38.71      2048 Bytes  31.07.2012 22:51:32
VBASE017.VDF   : 7.11.38.72      2048 Bytes  31.07.2012 22:51:32
VBASE018.VDF   : 7.11.38.73      2048 Bytes  31.07.2012 22:51:33
VBASE019.VDF   : 7.11.38.74      2048 Bytes  31.07.2012 22:51:33
VBASE020.VDF   : 7.11.38.75      2048 Bytes  31.07.2012 22:51:33
VBASE021.VDF   : 7.11.38.76      2048 Bytes  31.07.2012 22:51:34
VBASE022.VDF   : 7.11.38.77      2048 Bytes  31.07.2012 22:51:34
VBASE023.VDF   : 7.11.38.78      2048 Bytes  31.07.2012 22:51:34
VBASE024.VDF   : 7.11.38.79      2048 Bytes  31.07.2012 22:51:34
VBASE025.VDF   : 7.11.38.80      2048 Bytes  31.07.2012 22:51:35
VBASE026.VDF   : 7.11.38.81      2048 Bytes  31.07.2012 22:51:35
VBASE027.VDF   : 7.11.38.82      2048 Bytes  31.07.2012 22:51:35
VBASE028.VDF   : 7.11.38.83      2048 Bytes  31.07.2012 22:51:35
VBASE029.VDF   : 7.11.38.84      2048 Bytes  31.07.2012 22:51:36
VBASE030.VDF   : 7.11.38.85      2048 Bytes  31.07.2012 22:51:36
VBASE031.VDF   : 7.11.38.130   134144 Bytes  01.08.2012 22:51:16
Engineversion  : 8.2.10.120
AEVDF.DLL      : 8.1.2.10      102772 Bytes  11.07.2012 22:23:35
AESCRIPT.DLL   : 8.1.4.36      459131 Bytes  27.07.2012 16:44:48
AESCN.DLL      : 8.1.8.2       131444 Bytes  10.04.2012 17:57:39
AESBX.DLL      : 8.2.5.12      606578 Bytes  16.06.2012 17:28:08
AERDL.DLL      : 8.1.9.15      639348 Bytes  31.01.2012 06:55:37
AEPACK.DLL     : 8.3.0.18      807287 Bytes  27.07.2012 16:44:40
AEOFFICE.DLL   : 8.1.2.42      201083 Bytes  20.07.2012 00:33:14
AEHEUR.DLL     : 8.1.4.80     5075318 Bytes  27.07.2012 16:44:37
AEHELP.DLL     : 8.1.23.2      258422 Bytes  11.07.2012 22:23:27
AEGEN.DLL      : 8.1.5.34      434548 Bytes  20.07.2012 00:33:13
AEEXP.DLL      : 8.1.0.72       86389 Bytes  27.07.2012 16:44:49
AEEMU.DLL      : 8.1.3.2       393587 Bytes  11.07.2012 22:23:25
AECORE.DLL     : 8.1.27.2      201078 Bytes  11.07.2012 22:23:25
AEBB.DLL       : 8.1.1.0        53618 Bytes  31.01.2012 06:55:33
AVWINLL.DLL    : 12.3.0.15      27344 Bytes  15.05.2012 20:07:26
AVPREF.DLL     : 12.3.0.15      51920 Bytes  15.05.2012 20:07:26
AVREP.DLL      : 12.3.0.15     179208 Bytes  15.05.2012 20:07:27
AVARKT.DLL     : 12.3.0.15     211408 Bytes  15.05.2012 20:07:26
AVEVTLOG.DLL   : 12.3.0.15     169168 Bytes  15.05.2012 20:07:26
SQLITE3.DLL    : 3.7.0.1       398288 Bytes  15.05.2012 20:07:27
AVSMTP.DLL     : 12.3.0.15      63440 Bytes  15.05.2012 20:07:26
NETNT.DLL      : 12.3.0.15      17104 Bytes  15.05.2012 20:07:27
RCIMAGE.DLL    : 12.3.0.15    4447952 Bytes  15.05.2012 20:07:26
RCTEXT.DLL     : 12.3.0.15      98512 Bytes  15.05.2012 20:07:26

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: AVGuardAsyncScan
Konfigurationsdatei...................: C:\ProgramData\Avira\AntiVir Desktop\TEMP\AVGUARD_5019e1df\guard_slideup.avp
Protokollierung.......................: standard
Primäre Aktion........................: reparieren
Sekundäre Aktion......................: quarantäne
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: aus
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: aus
Suche nach Rootkits...................: aus
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: vollständig

Beginn des Suchlaufs: Donnerstag, 2. August 2012  04:32

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'avscan.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'hpqToaster.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'Com4QLBEx.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'hpqgpc01.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'hpqbam08.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'hpqSTE08.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'hpqwmiex.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'CLMLSvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'DVDAgent.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'TVAgent.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'datamngrUI.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'iTunesHelper.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'hpwuschd2.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'QLBCTRL.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'ONENOTEM.EXE' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'hpqtra08.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'DTLite.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'RichVideo.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'mdm.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'LightScribeControlPanel.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'LSSrvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'HPDrvMntSvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'DCSHelper.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'DCService.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'HPAdvisor.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleMobileDeviceService.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '1' Modul(e) wurden durchsucht

Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\$Recycle.Bin\S-1-5-21-722066157-1209004584-819911206-1000\$RPVU7HJ.exe'
C:\$Recycle.Bin\S-1-5-21-722066157-1209004584-819911206-1000\$RPVU7HJ.exe
  [FUND]      Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '56eb4d2b.qua' verschoben!


Ende des Suchlaufs: Donnerstag, 2. August 2012  04:33
Benötigte Zeit: 01:02 Minute(n)

Der Suchlauf wurde vollständig durchgeführt.

      0 Verzeichnisse wurden überprüft
     45 Dateien wurden geprüft
      1 Viren bzw. unerwünschte Programme wurden gefunden
      0 Dateien wurden als verdächtig eingestuft
      0 Dateien wurden gelöscht
      0 Viren bzw. unerwünschte Programme wurden repariert
      1 Dateien wurden in die Quarantäne verschoben
      0 Dateien wurden umbenannt
      0 Dateien konnten nicht durchsucht werden
     44 Dateien ohne Befall
      1 Archive wurden durchsucht
      0 Warnungen
      1 Hinweise

OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 02.08.2012 17:25:03 - Run 1
OTL by OldTimer - Version 3.2.55.0     Folder = C:\Users\Ninchen\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,69 Gb Available Physical Memory | 67,20% Memory free
7,99 Gb Paging File | 5,90 Gb Available in Paging File | 73,78% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 284,56 Gb Total Space | 187,91 Gb Free Space | 66,03% Space Free | Partition Type: NTFS
Drive D: | 13,23 Gb Total Space | 2,21 Gb Free Space | 16,67% Space Free | Partition Type: NTFS
 
Computer Name: NINCHEN-PC | User Name: Ninchen | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.08.02 17:22:47 | 000,597,504 | ---- | M] (OldTimer Tools) -- C:\Users\Ninchen\Downloads\OTL.exe
PRC - [2012.07.08 17:11:04 | 001,825,720 | ---- | M] (Bandoo Media, inc) -- C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\datamngrUI.exe
PRC - [2012.05.15 22:07:27 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.15 22:07:26 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.15 22:07:26 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.03.28 17:07:50 | 000,094,264 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
PRC - [2011.01.20 11:20:12 | 001,305,408 | ---- | M] (DT Soft Ltd) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
PRC - [2010.05.08 13:48:36 | 000,229,376 | ---- | M] () -- C:\ProgramData\DatacardService\DCService.exe
PRC - [2010.05.08 13:48:26 | 000,241,664 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\ProgramData\DatacardService\DCSHelper.exe
PRC - [2009.07.24 19:24:02 | 000,427,304 | ---- | M] (CyberLink Corp.) -- c:\Program Files (x86)\Hewlett-Packard\Media\Live TV\TVAgent.exe
PRC - [2009.07.23 21:45:52 | 000,128,296 | ---- | M] (CyberLink Corp.) -- c:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe
PRC - [2009.07.23 12:37:16 | 000,206,120 | ---- | M] (CyberLink) -- c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.06.14 21:25:58 | 014,340,608 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\e717a230496832656b05b515eb9f3bc5\PresentationFramework.ni.dll
MOD - [2012.06.14 21:25:40 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll
MOD - [2012.06.14 21:25:31 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll
MOD - [2012.06.14 21:25:23 | 012,237,824 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\14a87218ea49639f38097e278b98a3da\PresentationCore.ni.dll
MOD - [2012.05.31 17:14:27 | 000,036,920 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\HP.ActiveSupportLibrary\2.0.0.1__01a974bc1760f423\HP.ActiveSupportLibrary.dll
MOD - [2012.05.24 10:42:43 | 001,051,136 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\9b2f17fb61b7197f2a04108f5d1a1cc6\System.Management.ni.dll
MOD - [2012.05.24 10:21:38 | 000,368,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\8e56489276063ededde74e597a121df3\PresentationFramework.Aero.ni.dll
MOD - [2012.05.24 10:21:15 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll
MOD - [2012.05.24 10:21:13 | 006,611,456 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\f3814b488d9e083cbbc623e01b389f09\System.Data.ni.dll
MOD - [2012.05.24 10:20:29 | 000,185,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationTypes\d8af9a65cf0ed85d47360796e2645a06\UIAutomationTypes.ni.dll
MOD - [2012.05.24 10:20:13 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll
MOD - [2012.05.24 10:20:06 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll
MOD - [2012.05.24 10:20:01 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll
MOD - [2012.05.24 10:20:00 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll
MOD - [2012.05.24 10:19:53 | 011,492,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll
MOD - [2011.09.27 07:23:00 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.09.27 07:22:40 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2010.11.13 02:08:41 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010.11.05 03:58:05 | 002,927,616 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
MOD - [2009.10.02 04:39:04 | 000,249,856 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\PresentationFramework.resources\3.0.0.0_de_31bf3856ad364e35\PresentationFramework.resources.dll
MOD - [2009.10.02 04:39:04 | 000,110,592 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\PresentationCore.resources\3.0.0.0_de_31bf3856ad364e35\PresentationCore.resources.dll
MOD - [2009.07.24 19:24:16 | 000,275,848 | ---- | M] () -- c:\Program Files (x86)\Hewlett-Packard\Media\Live TV\Kernel\TV\CLCapEngine.dll
MOD - [2009.07.24 19:24:16 | 000,124,288 | ---- | M] () -- c:\Program Files (x86)\Hewlett-Packard\Media\Live TV\Kernel\TV\CLSchMgr.dll
MOD - [2009.07.24 19:24:14 | 000,349,480 | ---- | M] () -- c:\Program Files (x86)\Hewlett-Packard\Media\Live TV\Kernel\TV\CLTinyDB.dll
MOD - [2009.07.23 12:37:14 | 000,931,112 | ---- | M] () -- c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMediaLibrary.dll
MOD - [2009.07.15 17:51:04 | 000,061,440 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Pillars\PCAlerts\PCAlertsPillar.dll
MOD - [2009.07.15 17:51:02 | 000,131,072 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Pillars\ECenter\ECLibrary.dll
MOD - [2009.07.15 17:50:58 | 000,040,960 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingServer.dll
MOD - [2009.07.15 17:50:56 | 000,036,864 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingClients.dll
MOD - [2009.07.15 17:50:56 | 000,007,680 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\HP Advisor\RemotingClient.dll
MOD - [2009.07.15 17:50:54 | 000,005,632 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingInterface.dll
MOD - [2009.07.15 17:50:52 | 000,018,944 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingMessages.dll
MOD - [2009.07.15 17:50:44 | 000,028,672 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.Logging.dll
MOD - [2009.06.17 12:40:16 | 007,745,536 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll
MOD - [2009.06.17 12:40:16 | 002,121,728 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll
MOD - [2009.06.17 12:40:16 | 000,135,168 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2009.07.22 03:33:32 | 000,240,128 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\stacsv64.exe -- (STacSV)
SRV:64bit: - [2009.07.08 14:49:02 | 000,030,520 | ---- | M] (Hewlett-Packard) [Auto | Running] -- C:\Windows\SysNative\hpservice.exe -- (hpsrv)
SRV:64bit: - [2009.07.02 20:16:06 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009.03.02 23:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\AESTSr64.exe -- (AESTFilters)
SRV - [2012.07.28 03:12:10 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.07.20 00:20:36 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.07.03 13:19:28 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.05.15 22:07:27 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.15 22:07:26 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.01.18 14:38:28 | 000,155,320 | ---- | M] (Avanquest Software) [On_Demand | Stopped] -- C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe -- (Sony PC Companion)
SRV - [2011.09.09 17:10:28 | 000,086,072 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe -- (HP Support Assistant Service)
SRV - [2011.08.12 01:38:04 | 000,140,672 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Programme\SUPERAntiSpyware\SASCore64.exe -- (!SASCORE)
SRV - [2011.03.28 17:07:50 | 000,094,264 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe -- (HPDrvMntSvc.exe)
SRV - [2010.05.08 13:48:36 | 000,229,376 | ---- | M] () [Auto | Running] -- C:\ProgramData\DatacardService\DCService.exe -- (DCService.exe)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.07.22 03:33:32 | 000,240,128 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\STacSV64.exe -- (STacSV)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.05.22 20:02:20 | 000,250,616 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe -- (GameConsoleService)
SRV - [2009.05.21 22:35:32 | 000,923,136 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL -- (HPSLPSVC)
SRV - [2009.03.02 23:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\AESTSr64.exe -- (AESTFilters)
SRV - [2009.02.22 12:00:00 | 000,129,584 | ---- | M] (EasyBits Sofware AS) [Auto | Running] -- C:\Windows\SysWOW64\ezsvc7.dll -- (ezSharedSvc)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.05.15 22:07:27 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.05.15 22:07:27 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.04.25 12:11:36 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.01.24 10:18:06 | 000,027,176 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ggsemc.sys -- (ggsemc)
DRV:64bit: - [2012.01.24 10:18:06 | 000,013,352 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ggflt.sys -- (ggflt)
DRV:64bit: - [2011.10.21 21:01:48 | 000,254,528 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2011.09.16 16:08:07 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011.04.05 17:35:20 | 000,253,528 | ---- | M] (Sunbelt Software, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\SbFw.sys -- (SbFw)
DRV:64bit: - [2011.04.05 17:35:20 | 000,094,296 | ---- | M] (Sunbelt Software, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\sbtis.sys -- (SbTis)
DRV:64bit: - [2011.04.05 17:35:20 | 000,060,504 | ---- | M] (Sunbelt Software, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sbhips.sys -- (sbhips)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.02.08 09:14:20 | 000,084,568 | ---- | M] (Sunbelt Software, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SbFwIm.sys -- (SBFWIMCLMP)
DRV:64bit: - [2011.02.08 09:14:20 | 000,084,568 | ---- | M] (Sunbelt Software, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SbFwIm.sys -- (SBFWIMCL)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.20 11:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2010.04.09 15:24:32 | 000,076,288 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ew_jubusenum.sys -- (huawei_enumerator)
DRV:64bit: - [2010.04.07 17:05:00 | 000,250,368 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbnet.sys -- (ewusbnet)
DRV:64bit: - [2010.03.25 10:08:46 | 000,120,704 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard)
DRV:64bit: - [2010.03.20 11:56:56 | 000,114,560 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_hwusbdev.sys -- (ew_hwusbdev)
DRV:64bit: - [2009.09.22 02:47:14 | 001,484,800 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2009.07.22 03:33:32 | 000,487,936 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA)
DRV:64bit: - [2009.07.21 05:39:22 | 000,140,712 | ---- | M] (JMicron Technology Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\jmcr.sys -- (JMCR)
DRV:64bit: - [2009.07.15 01:16:34 | 000,273,456 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.08 14:49:08 | 000,030,008 | ---- | M] (Hewlett-Packard) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\hpdskflt.sys -- (hpdskflt)
DRV:64bit: - [2009.07.08 14:48:50 | 000,041,272 | ---- | M] (Hewlett-Packard) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Accelerometer.sys -- (Accelerometer)
DRV:64bit: - [2009.07.02 20:51:30 | 006,036,480 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2009.06.29 20:17:00 | 000,070,656 | ---- | M] (ENE TECHNOLOGY INC.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\enecir.sys -- (enecir)
DRV:64bit: - [2009.06.10 23:01:11 | 001,485,312 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTDPV6.SYS -- (SrvHsfV92)
DRV:64bit: - [2009.06.10 23:01:11 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTCNXT6.SYS -- (SrvHsfWinac)
DRV:64bit: - [2009.06.10 23:01:11 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTAZL6.SYS -- (SrvHsfHDA)
DRV:64bit: - [2009.06.10 23:01:06 | 001,146,880 | ---- | M] (LSI Corp) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\agrsm64.sys -- (AgereSoftModem)
DRV:64bit: - [2009.06.10 22:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2009.06.10 22:35:33 | 000,389,120 | ---- | M] (Marvell) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7)
DRV:64bit: - [2009.06.10 22:35:28 | 005,434,368 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netw5v64.sys -- (netw5v64)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.06.05 12:20:26 | 000,114,192 | ---- | M] (ATI Research Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2009.05.23 08:52:30 | 000,215,040 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009.05.18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009.05.05 07:30:28 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie.sys -- (AtiPcie)
DRV:64bit: - [2009.04.29 08:48:32 | 000,018,432 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)
DRV:64bit: - [2009.03.09 07:49:08 | 000,036,408 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbfilter.sys -- (usbfilter)
DRV - [2011.07.22 18:26:56 | 000,014,928 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\sasdifsv64.sys -- (SASDIFSV)
DRV - [2011.07.12 23:55:18 | 000,012,368 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\saskutil64.sys -- (SASKUTIL)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cnnb
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cnnb
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
IE:64bit: - HKLM\..\SearchScopes\{1366F70F-D4B1-41A2-9C50-344E76EADE50}: "URL" = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
IE:64bit: - HKLM\..\SearchScopes\{2C7072CC-3B6A-4D18-856D-F60EF665414F}: "URL" = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcnnbie7-de-de
IE:64bit: - HKLM\..\SearchScopes\{3CA7DAB2-1C99-4C76-88C3-55972FB79B59}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
IE:64bit: - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cnnb
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cnnb
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
IE - HKLM\..\SearchScopes\{1366F70F-D4B1-41A2-9C50-344E76EADE50}: "URL" = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
IE - HKLM\..\SearchScopes\{2C7072CC-3B6A-4D18-856D-F60EF665414F}: "URL" = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcnnbie7-de-de
IE - HKLM\..\SearchScopes\{3CA7DAB2-1C99-4C76-88C3-55972FB79B59}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cnnb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 78 91 C1 30 21 02 CD 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
IE - HKCU\..\SearchScopes\{1366F70F-D4B1-41A2-9C50-344E76EADE50}: "URL" = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
IE - HKCU\..\SearchScopes\{2C7072CC-3B6A-4D18-856D-F60EF665414F}: "URL" = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcnnbie7-de-de
IE - HKCU\..\SearchScopes\{3CA7DAB2-1C99-4C76-88C3-55972FB79B59}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Search Results"
FF - prefs.js..browser.search.order.1: "Search Results"
FF - prefs.js..browser.search.selectedEngine: "Search Results"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..keyword.URL: "hxxp://dts.search-results.com/sr?src=ffb&appid=0&systemid=413&sr=0&q="
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_268.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_268.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@SonyCreativeSoftware.com/Media Go,version=1.0: C:\Program Files (x86)\Sony\Media Go\npmediago.dll (Sony Media Software and Services Inc)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011.12.27 19:47:07 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.20 00:20:36 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.03.28 12:47:50 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011.12.27 19:47:07 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.20 00:20:36 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.03.28 12:47:50 | 000,000,000 | ---D | M]
 
[2012.07.29 00:31:48 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ninchen\AppData\Roaming\mozilla\Extensions
[2012.08.02 03:42:12 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ninchen\AppData\Roaming\mozilla\Firefox\Profiles\bx65q5dw.default\extensions
[2011.10.17 12:18:33 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Ninchen\AppData\Roaming\mozilla\Firefox\Profiles\bx65q5dw.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.07.29 00:31:33 | 000,002,515 | ---- | M] () -- C:\Users\Ninchen\AppData\Roaming\Mozilla\Firefox\Profiles\bx65q5dw.default\searchplugins\Search_Results.xml
[2012.07.29 00:31:48 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.07.29 00:31:48 | 000,000,000 | ---D | M] (DataMngr) -- C:\PROGRAM FILES (X86)\WINDOWS SEARCHQU TOOLBAR\DATAMNGR\FIREFOXEXTENSION
[2012.07.20 00:20:36 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.02.02 21:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2012.05.02 23:04:01 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.05.02 23:04:01 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.05.02 23:04:01 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.05.02 23:04:01 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.07.29 00:31:33 | 000,002,515 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\Search_Results.xml
[2012.05.02 23:04:01 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.05.02 23:04:01 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (DataMngr) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~2\WIA6EB~1\Datamngr\x64\BROWSE~1.DLL (Bandoo Media, inc)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WIA6EB~1\Datamngr\ToolBar\searchqudtx.dll ()
O2 - BHO: (DataMngr) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~2\WIA6EB~1\Datamngr\BROWSE~1.DLL (Bandoo Media, inc)
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WIA6EB~1\Datamngr\ToolBar\searchqudtx.dll ()
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4:64bit: - HKLM..\Run: [SmartMenu] C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe ()
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray64.exe (IDT, Inc.)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [DATAMNGR] C:\PROGRA~2\WIA6EB~1\Datamngr\DATAMN~1.EXE (Bandoo Media, inc)
O4 - HKLM..\Run: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe File not found
O4 - HKLM..\Run: [HPCam_Menu] c:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [TrojanScanner] C:\Program Files (x86)\Trojan Remover\Trjscan.exe (Simply Super Software)
O4 - HKLM..\Run: [UpdatePRCShortCut] C:\Program Files (x86)\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKCU..\Run: [Sony PC Companion] "C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe" /Background File not found
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableLockWorkstation = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableChangePassword = 0
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Ninchen\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Ninchen\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~4\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 209.18.47.61 209.18.47.62
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{001356F1-282B-4474-A508-3CDE2CA5263C}: NameServer = 193.189.244.225 193.189.244.206
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{21DB8336-6CDB-41BC-ABA8-AD59EEBD68BF}: NameServer = 193.189.244.225 193.189.244.206
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5ACF2B2B-E010-4008-89CC-AEB006EEB631}: NameServer = 193.189.244.225 193.189.244.206
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CF27DC44-C0C5-47FC-BB45-E8915C78496B}: NameServer = 193.189.244.225 193.189.244.206
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FA92405A-2AA9-4546-964D-8016BF7078D0}: DhcpNameServer = 209.18.47.61 209.18.47.62
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\WIA6EB~1\Datamngr\x64\datamngr.dll) - C:\PROGRA~2\WIA6EB~1\Datamngr\x64\datamngr.dll (Bandoo Media, inc)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\WIA6EB~1\Datamngr\x64\IEBHO.dll) - C:\PROGRA~2\WIA6EB~1\Datamngr\x64\IEBHO.dll (Bandoo Media, inc)
O20 - AppInit_DLLs: (C:\PROGRA~2\WIA6EB~1\Datamngr\datamngr.dll) - C:\PROGRA~2\WIA6EB~1\Datamngr\datamngr.dll (Bandoo Media, inc)
O20 - AppInit_DLLs: (C:\PROGRA~2\WIA6EB~1\Datamngr\IEBHO.dll) - C:\PROGRA~2\WIA6EB~1\Datamngr\IEBHO.dll (Bandoo Media, inc)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{0564190b-3e3f-11df-844a-00269ea1672c}\Shell - "" = AutoRun
O33 - MountPoints2\{0564190b-3e3f-11df-844a-00269ea1672c}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\{31da5220-fbe6-11e0-865a-001e101fa1f5}\Shell - "" = AutoRun
O33 - MountPoints2\{31da5220-fbe6-11e0-865a-001e101fa1f5}\Shell\AutoRun\command - "" = H:\Installer.exe
O33 - MountPoints2\{3b36dcac-aca4-11e0-8dad-00269ea1672c}\Shell - "" = AutoRun
O33 - MountPoints2\{3b36dcac-aca4-11e0-8dad-00269ea1672c}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{3b36dcbc-aca4-11e0-8dad-00269ea1672c}\Shell - "" = AutoRun
O33 - MountPoints2\{3b36dcbc-aca4-11e0-8dad-00269ea1672c}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{430025b9-1671-11e1-83b4-001e101f2c0e}\Shell - "" = AutoRun
O33 - MountPoints2\{430025b9-1671-11e1-83b4-001e101f2c0e}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{713b3552-fce9-11e0-8632-00269ea1672c}\Shell - "" = AutoRun
O33 - MountPoints2\{713b3552-fce9-11e0-8632-00269ea1672c}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{98698422-2b2d-11e1-8ff5-001e101fa1f5}\Shell - "" = AutoRun
O33 - MountPoints2\{98698422-2b2d-11e1-8ff5-001e101fa1f5}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.02 04:29:51 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\AppData\Roaming\SUPERAntiSpyware.com
[2012.08.02 04:29:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2012.08.02 04:29:30 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2012.08.02 04:29:30 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2012.08.02 04:08:40 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\Documents\Simply Super Software
[2012.08.02 04:08:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trojan Remover
[2012.08.02 04:08:13 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\AppData\Roaming\Simply Super Software
[2012.08.02 04:08:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Simply Super Software
[2012.08.02 04:08:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Trojan Remover
[2012.07.29 02:19:01 | 000,000,000 | ---D | C] -- C:\ProgramData\boost_interprocess
[2012.07.29 01:17:51 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\Documents\Freemake
[2012.07.29 01:17:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Freemake
[2012.07.29 01:17:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Freemake
[2012.07.29 01:17:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\FreemakeVideoConverterTB
[2012.07.29 00:39:36 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\Documents\Video Converter
[2012.07.29 00:39:36 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\AppData\Local\Video Converter
[2012.07.29 00:39:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MPEG4E
[2012.07.29 00:39:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Free Video Converter
[2012.07.29 00:38:29 | 000,000,000 | ---D | C] -- C:\ProgramData\VideoConverter
[2012.07.29 00:31:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Windows Searchqu Toolbar
[2012.07.29 00:31:31 | 000,360,448 | ---- | C] (FLV.com) -- C:\Windows\SysWow64\TubeFinder.exe
[2012.07.29 00:31:29 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\AppData\Roaming\FreeFLVConverter
[2012.07.29 00:31:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Free FLV Converter
[2012.07.29 00:09:15 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\AppData\Roaming\avidemux
[2012.07.16 02:31:11 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\AppData\Roaming\WindSolutions
[2012.07.16 02:30:38 | 000,000,000 | ---D | C] -- C:\ProgramData\WindSolutions
[2012.07.16 02:03:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012.07.16 02:02:36 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2012.07.16 02:02:35 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2012.07.16 02:02:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes
[2012.07.14 23:21:23 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\AppData\Local\Macromedia
[2012.07.14 23:15:29 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee
[2012.07.14 23:15:19 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed
[2012.07.14 03:01:16 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Wat
[2012.07.14 03:01:16 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Wat
[2012.07.12 04:46:34 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\AppData\Roaming\Canneverbe Limited
[2012.07.12 04:46:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Canneverbe Limited
[2012.07.12 04:46:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CDBurnerXP
[2012.07.12 04:40:50 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\AppData\Local\Nero_AG
[2012.07.12 04:40:35 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\AppData\Roaming\Nero
[2012.07.12 04:40:22 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\AppData\Local\Nero
[2012.07.12 04:37:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Nero
[2012.07.12 04:36:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2012.07.12 04:36:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2012.07.12 03:05:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DVDVideoSoftTB_DE
[2012.07.12 03:05:22 | 000,405,144 | ---- | C] (Newtonsoft) -- C:\Windows\SysWow64\Newtonsoft.Json.Net20.dll
[2012.07.12 03:05:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
[2012.07.12 03:05:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DVDVideoSoft
[2012.07.11 23:24:39 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\AppData\Local\LogiShrd
[2012.07.11 23:24:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech
[2012.07.11 23:24:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Logitech
 
========== Files - Modified Within 30 Days ==========
 
[2012.08.02 17:23:40 | 000,001,074 | ---- | M] () -- C:\Users\Ninchen\Desktop\Defogger - Verknüpfung.lnk
[2012.08.02 17:23:16 | 000,001,430 | ---- | M] () -- C:\Users\Ninchen\Desktop\OTL - Verknüpfung.lnk
[2012.08.02 17:22:08 | 000,000,168 | ---- | M] () -- C:\Users\Ninchen\defogger_reenable
[2012.08.02 17:19:59 | 000,023,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.02 17:19:59 | 000,023,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.02 17:12:54 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.08.02 17:11:09 | 000,065,536 | ---- | M] () -- C:\Windows\SysNative\Ikeext.etl
[2012.08.02 17:10:59 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.02 17:10:54 | 3218,235,392 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.02 13:13:31 | 000,000,514 | ---- | M] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task 1ddbee62-2b5b-4452-b38a-abcaade39472.job
[2012.08.02 12:55:56 | 000,000,514 | ---- | M] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task d9daa13f-20d9-4414-8e1f-10430e1847dd.job
[2012.08.02 04:29:34 | 000,001,808 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012.08.02 04:08:15 | 000,001,139 | ---- | M] () -- C:\Users\Public\Desktop\Trojan Remover.lnk
[2012.08.02 03:12:50 | 000,000,340 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForNinchen.job
[2012.07.31 00:45:02 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.07.31 00:45:02 | 000,654,400 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.07.31 00:45:02 | 000,616,242 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.07.31 00:45:02 | 000,130,240 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.07.31 00:45:02 | 000,106,622 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.07.29 00:40:24 | 000,004,608 | ---- | M] () -- C:\Users\Ninchen\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.07.22 16:24:11 | 000,001,084 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Antivirus Scheduled Scan.job
[2012.07.16 02:03:37 | 000,001,783 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012.07.12 04:46:28 | 000,001,949 | ---- | M] () -- C:\Users\Public\Desktop\CDBurnerXP.lnk
[2012.07.12 04:36:24 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2012.07.12 03:32:11 | 000,410,736 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.07.12 03:05:23 | 000,001,398 | ---- | M] () -- C:\Users\Ninchen\Desktop\Free YouTube to MP3 Converter.lnk
[2012.07.12 03:05:23 | 000,001,239 | ---- | M] () -- C:\Users\Ninchen\Desktop\DVDVideoSoft Free Studio.lnk
[2012.07.11 23:24:34 | 000,002,005 | ---- | M] () -- C:\Users\Public\Desktop\Logitech Vid HD.lnk
 
========== Files Created - No Company Name ==========
 
[2012.08.02 17:23:40 | 000,001,074 | ---- | C] () -- C:\Users\Ninchen\Desktop\Defogger - Verknüpfung.lnk
[2012.08.02 17:23:16 | 000,001,430 | ---- | C] () -- C:\Users\Ninchen\Desktop\OTL - Verknüpfung.lnk
[2012.08.02 17:22:07 | 000,000,168 | ---- | C] () -- C:\Users\Ninchen\defogger_reenable
[2012.08.02 04:30:18 | 000,000,514 | ---- | C] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task d9daa13f-20d9-4414-8e1f-10430e1847dd.job
[2012.08.02 04:30:17 | 000,000,514 | ---- | C] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task 1ddbee62-2b5b-4452-b38a-abcaade39472.job
[2012.08.02 04:29:34 | 000,001,808 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012.08.02 04:08:15 | 000,001,139 | ---- | C] () -- C:\Users\Public\Desktop\Trojan Remover.lnk
[2012.08.02 04:08:14 | 000,153,088 | ---- | C] () -- C:\Windows\SysWow64\UNRAR3.dll
[2012.08.02 04:08:14 | 000,075,264 | ---- | C] () -- C:\Windows\SysWow64\unacev2.dll
[2012.07.29 00:40:13 | 000,004,608 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.07.29 00:31:30 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\PropertyGrid.ocx
[2012.07.29 00:31:30 | 000,208,500 | ---- | C] () -- C:\Windows\SysWow64\ReyXpBasics.tlb
[2012.07.29 00:31:30 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\ControlSubX.ocx
[2012.07.25 23:37:57 | 000,000,340 | ---- | C] () -- C:\Windows\tasks\HPCeeScheduleForNinchen.job
[2012.07.16 02:03:37 | 000,001,783 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012.07.14 23:15:27 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.07.12 04:46:28 | 000,001,949 | ---- | C] () -- C:\Users\Public\Desktop\CDBurnerXP.lnk
[2012.07.12 04:46:28 | 000,001,899 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
[2012.07.12 03:05:23 | 000,001,398 | ---- | C] () -- C:\Users\Ninchen\Desktop\Free YouTube to MP3 Converter.lnk
[2012.07.12 03:05:23 | 000,001,239 | ---- | C] () -- C:\Users\Ninchen\Desktop\DVDVideoSoft Free Studio.lnk
[2012.07.11 23:24:34 | 000,002,005 | ---- | C] () -- C:\Users\Public\Desktop\Logitech Vid HD.lnk
[2011.12.27 19:39:36 | 000,238,995 | ---- | C] () -- C:\Windows\hpwins26.dat
[2011.04.16 17:03:57 | 000,001,854 | ---- | C] () -- C:\Users\Ninchen\AppData\Roaming\GhostObjGAFix.xml
[2011.01.13 16:22:56 | 000,000,087 | ---- | C] () -- C:\Users\Ninchen\webct_upload_applet.properties
[2010.11.02 15:32:37 | 000,000,001 | R--- | C] () -- C:\Users\Ninchen\serverport
[2010.09.17 21:16:10 | 001,670,467 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\tmpIMG_0065.0
[2010.09.17 21:16:10 | 000,776,826 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\tmpIMG_0065.JPG
[2010.09.17 21:15:54 | 000,747,817 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\tmpIMG_0064.JPG
[2010.09.17 21:15:53 | 001,620,983 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\tmpIMG_0064.0
[2010.09.17 20:51:32 | 002,334,606 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\tmpDSC00349.JPG
[2010.09.17 20:51:31 | 005,029,971 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\tmpDSC00349.0
[2010.09.15 12:41:56 | 000,602,102 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\tmpIMG_0069.JPG
[2010.09.15 12:41:55 | 001,304,308 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\tmpIMG_0069.0
[2010.04.02 20:34:20 | 002,529,622 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\[j0004]-[p212].bmp
[2010.04.02 20:19:34 | 002,529,622 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\[j0003]-[p14].bmp
[2010.04.02 19:51:45 | 002,529,622 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\[j0002]-[p26].bmp
 
========== LOP Check ==========
 
[2012.04.10 15:21:24 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\Ad-Aware Antivirus
[2012.07.29 00:09:55 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\avidemux
[2012.07.12 04:46:34 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\Canneverbe Limited
[2011.10.21 21:03:13 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\DAEMON Tools Lite
[2012.07.12 03:05:57 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\DVDVideoSoft
[2011.10.17 12:18:32 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.07.29 00:31:38 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\FreeFLVConverter
[2010.10.02 00:13:59 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\OpenOffice.org
[2012.06.03 17:45:46 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\pdfforge
[2012.08.02 04:08:13 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\Simply Super Software
[2011.06.30 17:07:41 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\Sony
[2012.07.16 02:31:11 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\WindSolutions
[2010.03.29 21:07:34 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\_MDLogs
[2012.07.22 16:24:11 | 000,001,084 | ---- | M] () -- C:\Windows\Tasks\Ad-Aware Antivirus Scheduled Scan.job
[2012.07.08 01:58:45 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2012.08.02 13:13:31 | 000,000,514 | ---- | M] () -- C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 1ddbee62-2b5b-4452-b38a-abcaade39472.job
[2012.08.02 12:55:56 | 000,000,514 | ---- | M] () -- C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task d9daa13f-20d9-4414-8e1f-10430e1847dd.job
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 150 bytes -> C:\ProgramData\Temp:CB0AACC9

< End of report >

--- --- ---

OTL EXTRAS Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 02.08.2012 17:25:03 - Run 1
OTL by OldTimer - Version 3.2.55.0     Folder = C:\Users\Ninchen\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,69 Gb Available Physical Memory | 67,20% Memory free
7,99 Gb Paging File | 5,90 Gb Available in Paging File | 73,78% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 284,56 Gb Total Space | 187,91 Gb Free Space | 66,03% Space Free | Partition Type: NTFS
Drive D: | 13,23 Gb Total Space | 2,21 Gb Free Space | 16,67% Space Free | Partition Type: NTFS
 
Computer Name: NINCHEN-PC | User Name: Ninchen | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~4\Office12\ONENOTE.EXE "%L"
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Scan with Trojan Remover] -- C:\Program Files (x86)\Trojan Remover\rmvtrjan.exe /d "%1" (Simply Super Software)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~4\Office12\ONENOTE.EXE "%L"
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Scan with Trojan Remover] -- C:\Program Files (x86)\Trojan Remover\rmvtrjan.exe /d "%1" (Simply Super Software)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{06B2F715-A9B1-4558-A6EC-7C4D8306E196}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{0883F22A-2A2A-420B-A802-0E79498474A1}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{0D03401A-535A-44C6-B964-D064B2EEB73C}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{100EBEE0-2B5C-4B2F-9604-6F1BE41C24FC}" = rport=139 | protocol=6 | dir=out | app=system | 
"{10BB569C-FB5A-4942-973B-4782D6C29743}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{153C72C9-5F4E-4096-96BE-FAC4258295CE}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{186B87D5-804D-4322-9BDE-40267355DCB3}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{1A555BC5-83FA-4E01-B170-607DD5CD38C8}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{3765DB87-3696-4623-A290-472A2651DFD0}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{38D21D79-4834-463D-94CE-39FD1BE55375}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{3DCB3428-DDF6-4795-9227-5B67C96DDBB3}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{4BC05270-E324-4C16-96DA-E84F129CF66C}" = lport=138 | protocol=17 | dir=in | app=system | 
"{5196A66A-4B6B-4956-8BAB-A59220D959D6}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{56B4C106-7E11-4685-A1E8-902C9AFD3986}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{5CAD20AD-A305-445D-BC9F-25BDEA21ED50}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{5F713ECF-63B1-4CA5-9872-CC847B85398B}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{64CA0515-FB1F-4BAE-9703-F90C1EE339E4}" = rport=137 | protocol=17 | dir=out | app=system | 
"{6B87A293-ACB5-4709-B645-47DD5942E241}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{6E7008B4-190F-4037-A6D5-52A8152F1779}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{801DE2F6-ACE5-4877-9246-43CE51F149B6}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{86B6D13A-1214-45FB-ACE6-6254A8B65983}" = rport=138 | protocol=17 | dir=out | app=system | 
"{A31A9392-1556-4A78-A246-5D0975AB52E7}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{A664FD35-C17F-471F-A2BB-A244501618E2}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{A7C22642-FA9B-4006-82E7-44B04CF2B92E}" = rport=445 | protocol=6 | dir=out | app=system | 
"{A86EA9D7-A3C1-44BA-8607-8A4B931FEEBC}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{B2FE6048-BD64-445B-8FDE-4894410B72EA}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{B98C67D8-9C74-41C9-80B6-A0400FF6158C}" = lport=139 | protocol=6 | dir=in | app=system | 
"{C164546A-6EB4-4725-B9DF-B75491A0C61E}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{D83DABB2-C5E2-4942-B95E-14D45EBFABB5}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{DC36D9D0-DB54-42E3-9324-3F0954FA4350}" = lport=137 | protocol=17 | dir=in | app=system | 
"{F34B7D6D-EF6C-4DF7-8C08-49B2A952A579}" = lport=445 | protocol=6 | dir=in | app=system | 
"{F4E5E7BB-0850-4FD7-B9EB-178E1A6E2E34}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{FAC2C6EB-8466-4F87-92E7-1732DEE0190E}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0235F562-639A-475E-A349-13BBB3DF3AC6}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\media\hptouchsmartvideo.exe | 
"{08F4FED6-23B3-4F50-A157-671BB16B39DC}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{0BE1B300-39EE-46FA-8A06-C3BD9F269C7C}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\hptouchsmartphoto.exe | 
"{0C69438E-9A4C-428C-9730-B40DA20F701D}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{0D4D99E9-7237-477C-8490-CFDAD742224B}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\media\hptouchsmartphoto.exe | 
"{0F94483B-F130-4888-BC07-7C9A355BDDBA}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{148EBF85-5472-48CA-934C-706115351564}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hposid01.exe | 
"{2007C49C-E298-4522-B5BE-F5FF98CC7426}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{2517F634-1BAA-403C-A9F9-F27BECA9D2AA}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{260F0021-6A39-4FA7-97C3-BCABD783B45A}" = dir=in | app=c:\program files (x86)\hp\hp software update\hpwucli.exe | 
"{280E6BD3-DF7B-4D54-83EE-28C72858C0B2}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{295D121E-DC25-4410-8A69-3C6092A3AFEB}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{299AE038-9D8F-4D28-BFB2-6E13F9C3812F}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqusgh.exe | 
"{2AC6DB5E-2920-4450-8FB1-AA4309F41BD9}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{2CFAA85F-C165-4D8C-AAB6-C005CB0706F8}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqusgm.exe | 
"{2EF15648-DDC8-4163-A67F-9940EBA74E13}" = dir=in | app=c:\program files (x86)\windows live\messenger\wlcsdk.exe | 
"{3ACE5D51-A006-430E-BFAD-77AFC9C829CC}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqste08.exe | 
"{3F3359E5-1B03-42BD-AE8B-031C8D71E55F}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{45BEAE28-0C28-43B4-BC23-3C9ED6B0FA99}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | 
"{48BCBF50-9F29-4CB6-B1F1-2E46130637DC}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{4BF24B4B-4779-43C7-BD4D-5516FF990BFA}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\kernel\clml\clmlsvc.exe | 
"{4C3A85AE-0DED-424D-BF19-C1E89833B0C5}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe | 
"{4CB912D0-9077-400E-9A61-D5BB92761FEC}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{50A1006D-BBB3-4669-8132-66401C53EAE0}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{51C0F798-ADCA-4329-B920-958EE657A85D}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\media\kernel\clml\clmlsvc.exe | 
"{56631F64-F316-42AB-8176-86F751867D72}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\hpdvdsmart.exe | 
"{5A61E3D8-C9AD-4549-8CAD-60073A3EEFCA}" = dir=in | app=c:\program files (x86)\cyberlink\powerdirector\pdr.exe | 
"{5C8D8F0F-1001-4869-90B6-1C908776DEE0}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\tsmagent.exe | 
"{616A90F0-53E9-43D3-BCFE-35E5ACD59101}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | 
"{6971CF84-80B2-4357-BCB1-8BEA0D881130}" = protocol=17 | dir=in | app=c:\program files (x86)\sony ericsson\update engine\sony ericsson update engine.exe | 
"{6ED579FC-BADB-459D-85EF-CFD6307D4904}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\live tv\qp.exe | 
"{7208DE20-1A06-4A05-8107-DF291B05BA8D}" = protocol=58 | dir=out | name=@iphlpsvc.dll,-503 | 
"{77166B9E-3759-49BE-807B-98C8BC05DB51}" = protocol=17 | dir=in | app=c:\program files (x86)\windows searchqu toolbar\datamngr\toolbar\dtuser.exe | 
"{779128D8-240E-44A2-BC9F-91D3CDB54B16}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{78C65999-8D34-4EB1-A8EE-7A9098F537B6}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{79D9CA72-9CA3-4A9A-B675-73C38BDA86FE}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe | 
"{7F2E5141-322E-4B78-AE5D-C302179C2BF0}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{8161BB1D-7CC0-439F-B651-E089B7E0ADDB}" = protocol=6 | dir=in | app=c:\program files (x86)\windows searchqu toolbar\datamngr\toolbar\dtuser.exe | 
"{844D5EA0-145D-4F74-8276-BB81194A9890}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqfxt08.exe | 
"{981713E9-74CF-4983-82BE-D1D37980872C}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpofxm08.exe | 
"{9FD57D13-AB03-40E5-A577-6FDFBF3C7778}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpfccopy.exe | 
"{A09EE779-790E-427C-8A5E-DF4717ABAE4F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{A5ADE7F6-5F1A-4BB3-99A6-BB7138E64898}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe | 
"{A81F48ED-5AB8-403D-BC2F-B76A50520D4E}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpiscnapp.exe | 
"{AE99CEA9-CF51-43FF-8565-0B7E56BA5D66}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{B47AEF97-305E-4385-A795-C553E4672084}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{B6725E87-8AA1-42C8-8632-13EFA4E05DCB}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\media\hptouchsmartmusic.exe | 
"{B6E14C61-1EA9-4995-95FD-723205DEC34C}" = protocol=6 | dir=in | app=c:\program files (x86)\logitech\vid hd\vid.exe | 
"{B9265CF7-B036-40A3-814B-19950B2BB49C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{BA86FF11-3BAF-49C0-B82F-2E3596C89986}" = protocol=17 | dir=in | app=c:\program files (x86)\logitech\vid hd\vid.exe | 
"{BE3535C7-FADF-42BB-86B6-11F6826D6E94}" = protocol=58 | dir=in | app=system | 
"{BEC8EF47-0692-4499-8AA6-90B179C8172A}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqkygrp.exe | 
"{BF42FD35-4BE0-4A0B-AE3E-C9610164B44C}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\hptouchsmartmusic.exe | 
"{C79759B5-66D8-4721-8A1A-3356A2E78EBE}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpoews01.exe | 
"{CB636AA3-DE51-4EAD-A3A1-732D5B56153A}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqgplgtupl.exe | 
"{CC3B87D5-0A82-4E31-A4B2-B736BFF95051}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{CFDAC044-D641-4737-AE19-4BE6031293EC}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{D41045BE-F09B-4D61-9D6A-149989A3BB00}" = protocol=6 | dir=out | app=system | 
"{D573F4A2-9FFD-4029-8BFB-E8E74C596548}" = protocol=6 | dir=in | app=c:\program files (x86)\sony ericsson\update engine\sony ericsson update engine.exe | 
"{D7DD7EC9-4D51-4717-9599-80A68C3AC6E5}" = dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\media\tsmagent.exe | 
"{D943FDB9-550D-46A4-91C4-8916B43E16F8}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{DEB29AA2-0D60-433E-9F33-0FF2C4DC9A21}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpofxs08.exe | 
"{E7B3DDC1-B442-486F-9F03-C25A1CD1529D}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\live tv\qpservice.exe | 
"{ED34B36C-3880-4FF3-8BAA-89F7EAD3F151}" = dir=in | app=c:\program files (x86)\hp\digital imaging\smart web printing\smartwebprintexe.exe | 
"{F062C46E-7998-4EAC-8AA5-5806E2C5ADF3}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{F266F3C1-5C2B-4AF3-A81B-5915CB481A59}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hposfx08.exe | 
"{F2C97858-B50D-4233-864B-F85251F85FC3}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqgpc01.exe | 
"{F2F8B1A0-8507-45FE-B776-1EA1F049DB11}" = dir=in | app=c:\program files (x86)\hewlett-packard\media\dvd\hptouchsmartvideo.exe | 
"{F6320CAE-A459-46FB-86F7-9BC68444E070}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqtra08.exe | 
"{FDCB6F8C-E60E-432B-993F-5223736231B6}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{FEB46315-F3DC-4D43-87B7-D5E723CA020F}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpzwiz01.exe | 
"TCP Query User{2224D8F6-3499-4E04-A0C5-4CC597A3907E}C:\program files (x86)\ubisoft\funatics\die siedler ii - die nächste generation\bin\s2dng_addon.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\funatics\die siedler ii - die nächste generation\bin\s2dng_addon.exe | 
"TCP Query User{4771666D-9819-4CA9-9073-36A22FD73279}C:\program files (x86)\sid meier's civilization v\civilizationv.exe" = protocol=6 | dir=in | app=c:\program files (x86)\sid meier's civilization v\civilizationv.exe | 
"TCP Query User{AA1E2937-D61B-46AE-BB12-5F2E1BC2B7F3}C:\users\ninchen\appdata\local\temp\jivexviewer\jre\bin\jivex[dv] light" = protocol=6 | dir=in | app=c:\users\ninchen\appdata\local\temp\jivexviewer\jre\bin\jivex[dv] light | 
"TCP Query User{D06464AD-D595-4064-893F-6058F871C8E0}C:\program files (x86)\sid meier's civilization v\civilizationv_dx11.exe" = protocol=6 | dir=in | app=c:\program files (x86)\sid meier's civilization v\civilizationv_dx11.exe | 
"UDP Query User{2430B875-269B-4D2B-80E6-D061C0B0D3DD}C:\program files (x86)\sid meier's civilization v\civilizationv_dx11.exe" = protocol=17 | dir=in | app=c:\program files (x86)\sid meier's civilization v\civilizationv_dx11.exe | 
"UDP Query User{93F89419-89A5-4E44-8E20-FA0566689F05}C:\program files (x86)\sid meier's civilization v\civilizationv.exe" = protocol=17 | dir=in | app=c:\program files (x86)\sid meier's civilization v\civilizationv.exe | 
"UDP Query User{CF9AB772-10F6-4448-9814-0983B4BCFC4E}C:\program files (x86)\ubisoft\funatics\die siedler ii - die nächste generation\bin\s2dng_addon.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\funatics\die siedler ii - die nächste generation\bin\s2dng_addon.exe | 
"UDP Query User{EBFCFD31-6E1C-4830-A4D6-258472F6EB4B}C:\users\ninchen\appdata\local\temp\jivexviewer\jre\bin\jivex[dv] light" = protocol=17 | dir=in | app=c:\users\ninchen\appdata\local\temp\jivexviewer\jre\bin\jivex[dv] light | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{26A24AE4-039D-4CA4-87B4-2F86416014FF}" = Java(TM) 6 Update 14 (64-bit)
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{55D55008-E5F6-47D6-B16F-B2A40D4D145F}" = 64 Bit HP CIO Components Installer
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6A76BEAF-6D1F-4273-A79B-DA8410A2E56B}" = Apple Mobile Device Support
"{6C47240C-016E-03B5-D13E-AECAED09F2E3}" = ATI Catalyst Install Manager
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{7FD7F421-39B2-4CAC-BC41-7D83DDBAB329}" = HP 3D DriveGuard
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{840A3BAA-4C68-4581-9C7A-6F8D6CF531B9}" = iTunes
"{88E60521-1E4E-4785-B9F1-1798A4BD0C30}" = HP MediaSmart SmartMenu
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A4DDB2AB-ECCD-4C3A-8633-77D5A1A0E542}" = Network64
"{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{ADEB3402-CFBD-00E2-0EE6-F6A3F1AFACF0}" = ccc-utility64
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{E5083D57-D93F-404C-A91F-1C50D67C2BEB}" = HP Officejet 4500 G510g-m
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"FFE7D41DF3C645075BB149E21988B63996C34187" = ENE CIR Receiver Driver
"HP Document Manager" = HP Document Manager 2.0
"HP Imaging Device Functions" = HP Imaging Device Functions 13.0
"HP Smart Web Printing" = HP Smart Web Printing 4.5
"HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0
"HPExtendedCapabilities" = HP Customer Participation Program 13.0
"HPOCR" = OCR Software by I.R.I.S. 13.0
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Shop for HP Supplies" = Shop for HP Supplies
"SynTPDeinstKey" = Synaptics Pointing Device Driver
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = HP MediaSmart Webcam
"{07FA4960-B038-49EB-891B-9F95930AA544}" = HP Customer Experience Enhancements
"{09CC0D0E-061D-3C7B-3881-D2EB53A8AAFC}" = CCC Help Polish
"{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}" = PlayStation(R)Store
"{0F367CA3-3B2F-43F9-A44A-25A8EE69E45D}" = Scan
"{122ADF8C-DDA1-480C-9936-C88F2825B265}" = Apple Application Support
"{175F0111-2968-4935-8F70-33108C6A4DE3}" = MarketResearch
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{21A2F5EE-1DC5-488A-BE7E-E526F8C61488}" = DeviceDiscovery
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26604C7E-A313-4D12-867F-7C6E7820BE4C}" = JMicron Flash Media Controller Driver
"{26606D8F-3133-DBE2-8AF5-AB28F300860A}" = CCC Help Chinese Standard
"{266D0EEA-E5A6-4A08-A0EE-5391D4EA44A7}" = Catalyst Control Center - Branding
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 24
"{28379381-B56A-43e1-B505-3098D82B1C30}" = 4500G510gm_Software_Min
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm
"{3023EBDA-BF1B-4831-B347-E5018555F26E}" = HP MediaSmart Movie Themes
"{33C17B75-EA9C-0687-9CED-03D92637B042}" = CCC Help Hungarian
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons
"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3FBDB7B8-7472-E895-2E5D-99D190B2D1B6}" = Catalyst Control Center InstallProxy
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{43CDF946-F5D9-4292-B006-BA0D92013021}" = WebReg
"{440B915A-0C85-45DB-92AE-75AE14704A64}" = Fax
"{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}" = PowerRecover
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter
"{4DE3E3D9-AE81-45DE-9195-3015F7B1DBF3}" = Junk Mail filter update
"{4E432692-A736-4F77-AF77-F9078CF88D31}" = HP Wireless Assistant
"{520CD4F0-9DAC-4C5C-8CA1-D0210CFF6062}" = Media Go
"{5271C0D4-24E4-4C3D-A782-C012033FD3CF}" = AMD USB Filter Driver
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{546937C5-0529-333E-0D5E-FE3C53108806}" = CCC Help Japanese
"{55C70B62-5EF1-D527-7CAB-E50D8B3B4990}" = Catalyst Control Center Graphics Full New
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{577ED77E-25D9-1A76-4EF0-773B9C173758}" = CCC Help Portuguese
"{5A166C0B-9557-4364-A057-F946D674E6AC}" = Windows Live Mail
"{5DB4EA68-A509-D408-585C-C9D045FADF72}" = Catalyst Control Center Graphics Previews Vista
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2
"{67626E09-5366-4480-8F1E-93FADF50CA15}" = HP MediaSmart Live TV
"{68A10D12-0D0F-4212-BDE6-D87FAD32A8FA}" = SmartWebPrinting
"{6B2FFB21-AC88-45C3-9A7D-4BB3E744EC91}" = HPSSupply
"{6BBA26E9-AB03-4FE7-831A-3535584CA002}" = Toolbox
"{6D335F78-1F4F-7826-56DD-4F350EA6EADD}" = CCC Help Greek
"{6EF04EAE-0354-9919-E757-F1203E6F422B}" = CCC Help Italian
"{6F340107-F9AA-47C6-B54C-C3A19F11553F}" = Hewlett-Packard ACLM.NET v1.1.2.0
"{6F44AF95-3CDE-4513-AD3F-6D45F17BF324}" = HP Support Assistant
"{7028B245-30A2-BD8C-31B9-6008216FBDC2}" = CCC Help French
"{70C592EC-AE9B-4734-928B-676E824FB41E}" = MFC RunTime files
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{779D3256-84D0-936F-18F9-A154DC85B4B4}" = Catalyst Control Center Localization All
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{7F4DA5B8-6884-47F2-AEBA-D9111E420C63}" = CCC Help Danish
"{7F9A8D27-A1B9-164F-FCB1-0B64C88629CF}" = CCC Help Norwegian
"{803263F7-8CAC-DC6D-3288-8128865A7472}" = CCC Help German
"{81821BF8-DA20-4F8C-AA87-F70A274828D4}" = Windows Live Writer
"{82EF29B1-9B60-4142-A155-0599216DD053}" = LightScribe System Software
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{837B6259-6FF5-4E66-87C1-A5A15ED36FF4}" = Windows Live Messenger
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8136 8168 8169 Ethernet Driver
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8CC47AA0-5774-61FC-6A59-7E1C936DB753}" = ccc-core-static
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0407-1000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0407-1000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{91E04CA7-0B13-4F8C-AA4D-2A573AC96D19}" = Windows Live Essentials
"{92A51949-EE4C-466D-AAF0-99E74A49A63F}" = DocMgr
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A28867B-109A-5BBF-85C0-FC1BAA98CA1C}" = CCC Help Russian
"{9B362566-EC1B-4700-BB9C-EC661BDE2175}" = DocProc
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A8BCC9E4-9036-3029-F2BC-AA73A62DA73D}" = CCC Help Turkish
"{AC76BA86-7AD7-FFFF-7B44-A91000000001}" = Adobe Reader 9.5.0 MUI
"{AE8705FB-E13C-40A9-8A2D-68D6733FBFC2}" = Status
"{B2EE25B9-5B00-4ACF-94F0-92433C28C39E}" = HP MediaSmart Music/Photo/Video
"{B51605BF-6326-4553-AE96-6D7F1813D5F5}" = HP User Guides 0154
"{B53E61D7-7C80-40DF-82D2-CF5390D6D20A}" = HP Advisor
"{B5C746E6-D961-445C-3768-5B6FAF6A1A31}" = CCC Help Spanish
"{B6659DD8-00A7-4A24-BBFB-C1F6982E5D66}" = PlayStation(R)Network Downloader
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{BE0D4271-69C9-4f28-AD9B-BB33D126A30E}" = 4500G510gm
"{C0769946-2CF1-9E8D-009B-5C413B3F01D1}" = CCC Help Czech
"{C3A32068-8AB1-4327-BB16-BED9C6219DC7}" = Atheros Driver Installation Program
"{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant
"{C4F7EEE5-3D99-8552-7483-B2F412838B2A}" = Catalyst Control Center Graphics Previews Common
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{D46D081B-F60E-467E-A7C4-117B70D76731}" = HP Update
"{D4C41D27-A2D5-94C6-1D08-3D470A12EAF0}" = CCC Help Swedish
"{D9D6A848-1BFD-592B-5F9D-0BA8692FDF0B}" = CCC Help Finnish
"{DC0A5F99-FD66-433F-9D3A-05DCBA64BE42}" = TrayApp
"{DCCAD079-F92C-44DA-B258-624FC6517A5A}" = HP MediaSmart DVD
"{DCD91C2F-3A86-B328-59A0-5EED6190D983}" = Catalyst Control Center Graphics Full Existing
"{DF0B357C-5874-47D0-81E7-79AA890B0CE0}" = 4500_G510gm_Help
"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{E553760D-D7F7-48BF-BD8B-C7E23BA04CB5}" = HP MediaSmart Internet TV
"{E5F5CAA5-84ED-DE41-40D0-8926FE7E5F4D}" = Catalyst Control Center Graphics Light
"{E6CE345D-BF83-1242-9E4D-3D60A5036D87}" = CCC Help English
"{EC155897-712F-5637-A5DA-6C7CE7CB5521}" = CCC Help Korean
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0580F64-44A1-C607-9364-887912B74F4D}" = CCC Help Thai
"{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}" = Sony PC Companion 2.10.065
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F1D7AC58-554A-4A58-B784-B61558B1449A}" = QLBCASL
"{F3B912F5-EB57-45AA-B3D1-EB532BCF6EF8}" = HP Setup
"{F3F9A4E5-CD9F-4657-CF99-5CE3F7729909}" = Catalyst Control Center Core Implementation
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F5B1D41A-05B9-98E2-C350-E69D4A444CB4}" = CCC Help Chinese Traditional
"{FCF0F615-6E70-B949-028F-88D32C55C2BC}" = CCC Help Dutch
"Ad-Aware Browsing Protection" = Ad-Aware Browsing Protection
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Avira AntiVir Desktop" = Avira Free Antivirus
"DAEMON Tools Lite" = DAEMON Tools Lite
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.26.706
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = HP MediaSmart Webcam
"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite
"InstallShield_{3023EBDA-BF1B-4831-B347-E5018555F26E}" = HP MediaSmart Movie Themes
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"InstallShield_{67626E09-5366-4480-8F1E-93FADF50CA15}" = HP MediaSmart Live TV
"InstallShield_{B2EE25B9-5B00-4ACF-94F0-92433C28C39E}" = HP MediaSmart Music/Photo/Video
"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"InstallShield_{DCCAD079-F92C-44DA-B258-624FC6517A5A}" = HP MediaSmart DVD
"InstallShield_{E553760D-D7F7-48BF-BD8B-C7E23BA04CB5}" = HP MediaSmart Internet TV
"Logitech Vid" = Logitech Vid HD
"Mobile Partner" = Mobile Partner
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"S2TNG" = Die Siedler II - Die nächste Generation
"Searchqu Toolbar" = Windows Searchqu Toolbar
"Trojan Remover_is1" = Trojan Remover 6.8.4
"Update Engine" = Sony Ericsson Update Engine
"VLC media player" = VLC media player 1.1.10
"WildTangent hp Master Uninstall" = HP Games
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 25.07.2011 03:59:33 | Computer Name = Ninchen-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\system32\conhost.exe".
Die
 abhängige Assemblierung "Microsoft.Windows.SystemCompatible,processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.7600.16823""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 25.07.2011 03:59:33 | Computer Name = Ninchen-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\system32\conhost.exe".
Die
 abhängige Assemblierung "Microsoft.Windows.SystemCompatible,processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.7600.16823""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 25.07.2011 03:59:33 | Computer Name = Ninchen-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\system32\conhost.exe".
Die
 abhängige Assemblierung "Microsoft.Windows.SystemCompatible,processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.7600.16823""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 25.07.2011 03:59:33 | Computer Name = Ninchen-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\system32\conhost.exe".
Die
 abhängige Assemblierung "Microsoft.Windows.SystemCompatible,processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.7600.16823""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 25.07.2011 10:22:37 | Computer Name = Ninchen-PC | Source = RasClient | ID = 20227
Description = 
 
Error - 25.07.2011 10:47:30 | Computer Name = Ninchen-PC | Source = RasClient | ID = 20227
Description = 
 
Error - 25.07.2011 10:59:33 | Computer Name = Ninchen-PC | Source = RasClient | ID = 20227
Description = 
 
Error - 25.07.2011 11:05:02 | Computer Name = Ninchen-PC | Source = RasClient | ID = 20227
Description = 
 
Error - 25.07.2011 11:06:01 | Computer Name = Ninchen-PC | Source = RasClient | ID = 20227
Description = 
 
Error - 25.07.2011 11:12:03 | Computer Name = Ninchen-PC | Source = RasClient | ID = 20227
Description = 
 
[ Hewlett-Packard Events ]
Error - 16.04.2011 11:03:52 | Computer Name = Ninchen-PC | Source = Hewlett-Packard | ID = 0
Description = AAProcessExited() C:\ProgramData\Hewlett-Packard\HP Support Framework\Telemetry\041116050349.xml
 File not created by asset agent
 
Error - 26.08.2011 06:26:44 | Computer Name = Ninchen-PC | Source = Hewlett-Packard | ID = 0
Description = 
 
Error - 26.08.2011 06:27:08 | Computer Name = Ninchen-PC | Source = Hewlett-Packard | ID = 0
Description = AAProcessExited() C:\ProgramData\Hewlett-Packard\HP Support Framework\Telemetry\081126122705.xml
 File not created by asset agent
 
Error - 08.09.2011 10:03:34 | Computer Name = Ninchen-PC | Source = Hewlett-Packard | ID = 0
Description = AAProcessExited() C:\ProgramData\Hewlett-Packard\HP Support Framework\Telemetry\091108040331.xml
 File not created by asset agent
 
Error - 07.03.2012 07:50:32 | Computer Name = Ninchen-PC | Source = hpsa_service.exe | ID = 2000
Description = HP Error ID: -2146233088   bei HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateDetail(String
 category)     bei HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetectCore()

   bei HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
 Boolean localScan)  Message: Failed to perform update.  StackTrace:   bei HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateDetail(String
 category)     bei HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetectCore()

   bei HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
 Boolean localScan)  Source: HP.ActiveCheckLocalMode.SessionManager  InnerException.Message:
 Das Objekt "/488cf124_9dc2_4198_8f67_6799f46cd826/9spmyvuzpm39o8fmqtp0h9fo_5.rem"
 wurde getrennt oder ist nicht auf dem Server vorhanden.    Name: hpsa_service.exe  Version:
 06.00.01.01  Path: C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
Format:
 de-DE  RAM: 4092  Ram Utilization: 30  TargetSite: Void UpdateDetail(System.String)  
 
Error - 27.06.2012 05:59:24 | Computer Name = Ninchen-PC | Source = hpsa_service.exe | ID = 2000
Description = HP Error ID: -2146233088   bei HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

   bei HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
 Boolean localScan)  Message: One HP Active Check Local Mode job already running.  StackTrace:
   bei HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

   bei HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
 Boolean localScan)  Source: HP.ActiveCheckLocalMode.SessionManager    Name: hpsa_service.exe
Version:
 06.00.01.01  Path: C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
Format:
 de-DE  RAM: 4092  Ram Utilization: 30  TargetSite: Void UpdateAndDetect()  
 
Error - 06.07.2012 02:57:36 | Computer Name = Ninchen-PC | Source = hpsa_service.exe | ID = 2000
Description = HP Error ID: -2146233088   bei HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

   bei HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
 Boolean localScan)  Message: One HP Active Check Local Mode job already running.  StackTrace:
   bei HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

   bei HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
 Boolean localScan)  Source: HP.ActiveCheckLocalMode.SessionManager    Name: hpsa_service.exe
Version:
 06.00.01.01  Path: C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
Format:
 de-DE  RAM: 4092  Ram Utilization:   TargetSite: Void UpdateAndDetect()  
 
Error - 11.07.2012 06:48:44 | Computer Name = Ninchen-PC | Source = hpsa_service.exe | ID = 2000
Description = HP Error ID: -2146233088   bei HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

   bei HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
 Boolean localScan)  Message: One HP Active Check Local Mode job already running.  StackTrace:
   bei HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

   bei HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
 Boolean localScan)  Source: HP.ActiveCheckLocalMode.SessionManager    Name: hpsa_service.exe
Version:
 06.00.01.01  Path: C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
Format:
 de-DE  RAM: 4092  Ram Utilization: 40  TargetSite: Void UpdateAndDetect()  
 
Error - 18.07.2012 17:05:02 | Computer Name = Ninchen-PC | Source = hpsa_service.exe | ID = 2000
Description = HP Error ID: -2146233088   bei HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

   bei HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
 Boolean localScan)  Message: One HP Active Check Local Mode job already running.  StackTrace:
   bei HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

   bei HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
 Boolean localScan)  Source: HP.ActiveCheckLocalMode.SessionManager    Name: hpsa_service.exe
Version:
 06.00.01.01  Path: C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
Format:
 de-DE  RAM: 4092  Ram Utilization: 30  TargetSite: Void UpdateAndDetect()  
 
Error - 25.07.2012 17:37:35 | Computer Name = Ninchen-PC | Source = hpsa_service.exe | ID = 2000
Description = HP Error ID: -2146233088   bei HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

   bei HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
 Boolean localScan)  Message: One HP Active Check Local Mode job already running.  StackTrace:
   bei HP.ActiveCheckLocalMode.SessionManager.ActiveCheckManager.UpdateAndDetect()

   bei HP.SupportAssistant.Service.ACLM.ActiveCheck.LaunchActiveCheck(Boolean singleScan,
 Boolean localScan)  Source: HP.ActiveCheckLocalMode.SessionManager    Name: hpsa_service.exe
Version:
 06.00.01.01  Path: C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
Format:
 de-DE  RAM: 4092  Ram Utilization: 30  TargetSite: Void UpdateAndDetect()  
 
[ System Events ]
Error - 31.07.2012 18:06:57 | Computer Name = Ninchen-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   SBRE
 
Error - 01.08.2012 15:34:21 | Computer Name = Ninchen-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   SBRE
 
Error - 01.08.2012 21:12:48 | Computer Name = Ninchen-PC | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
 Windows-Audio-Endpunkterstellung erreicht.
 
Error - 01.08.2012 21:12:48 | Computer Name = Ninchen-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Windows-Audio-Endpunkterstellung" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%1053
 
Error - 01.08.2012 21:12:48 | Computer Name = Ninchen-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Windows-Audio" ist vom Dienst "Windows-Audio-Endpunkterstellung"
 abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1053
 
Error - 01.08.2012 21:13:08 | Computer Name = Ninchen-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   SBRE
 
Error - 01.08.2012 22:12:28 | Computer Name = Ninchen-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   SBRE
 
Error - 01.08.2012 22:28:57 | Computer Name = Ninchen-PC | Source = DCOM | ID = 10010
Description = 
 
Error - 02.08.2012 07:13:49 | Computer Name = Ninchen-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   SBRE
 
Error - 02.08.2012 11:12:50 | Computer Name = Ninchen-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   SBRE
 
 
< End of report >

--- --- ---

Ninchen911 · 06.08.2012, 02:04

Hier noch die Log-File vom Trjoan Remover:

Code:

ATTFilter

***** NORMAL SCAN FOR ACTIVE MALWARE *****
Trojan Remover Ver 6.8.4.2606. For information, email support@simplysup.com
[Unregistered version]
Scan started at: 04:19:08 02 Aug 2012
Using Database v7929
Operating System:  Windows 7 x64 Home Premium (SP1) [Build: 6.1.7601]
File System:       NTFS
UAC is ENABLED [default level]
UserData directory: C:\Users\Ninchen\AppData\Roaming\Simply Super Software\Trojan Remover\
Database directory: C:\ProgramData\Simply Super Software\Trojan Remover\Data\
Logfile directory:  C:\Users\Ninchen\Documents\Simply Super Software\Trojan Remover Logfiles\
Program directory:  C:\Program Files (x86)\Trojan Remover\
Running with Administrator privileges

************************************************************
04:19:08: ----- CHECKING DEFAULT FILE ASSOCIATIONS -----
No modified default file associations detected

************************************************************
04:19:08: ----- SCANNING FOR ROOTKIT SERVICES -----
No hidden Services were detected.

************************************************************
04:19:09: Scanning -----WINDOWS  REGISTRY-----
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
This key's "Shell" value calls the following program(s):
Key value: [explorer.exe]
File: C:\Windows\Explorer.exe
C:\Windows\Explorer.exe
2871808 bytes
Created:  27.04.2011 11:45
Modified: 25.02.2011 08:19
Company:  Microsoft Corporation
----------
This key's "Userinit" value calls the following program(s):
Key value: [C:\Windows\system32\userinit.exe,]
File: C:\Windows\system32\userinit.exe
C:\Windows\System32\userinit.exe
30720 bytes
Created:  02.07.2011 16:38
Modified: 20.11.2010 15:25
Company:  Microsoft Corporation
----------
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: [StartCCC]
Value Data: ["C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun]
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
98304 bytes
Created:  02.07.2009 13:32
Modified: 02.07.2009 13:32
Company:  Advanced Micro Devices, Inc.
--------------------
Value Name: [HPCam_Menu]
Value Data: ["c:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" "c:\Program Files (x86)\Hewlett-Packard\Media\Webcam" UpdateWithCreateOnce "Software\Hewlett-Packard\Media\Webcam"]
c:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe
218408 bytes
Created:  25.02.2009 15:40
Modified: 25.02.2009 15:40
Company:  CyberLink Corp.
--------------------
Value Name: [QlbCtrl.exe]
Value Data: [C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start]
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
320056 bytes
Created:  01.10.2009 19:20
Modified: 24.06.2009 14:57
Company:   Hewlett-Packard Development Company, L.P.
--------------------
Value Name: [UpdatePRCShortCut]
Value Data: ["C:\Program Files (x86)\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Hewlett-Packard\Recovery" UpdateWithCreateOnce "Software\CyberLink\PowerRecover"]
C:\Program Files (x86)\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe
222504 bytes
Created:  19.05.2009 22:16
Modified: 19.05.2009 22:16
Company:  CyberLink Corp.
--------------------
Value Name: [Adobe Reader Speed Launcher]
Value Data: ["C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"]
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe
37296 bytes
Created:  04.01.2012 08:51
Modified: 04.01.2012 08:51
Company:  Adobe Systems Incorporated
--------------------
Value Name: [Easybits Recovery]
Value Data: [C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe]
C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe - [file not found to scan]
--------------------
Value Name: [HP Software Update]
Value Data: [C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe]
C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
54576 bytes
Created:  08.12.2008 14:50
Modified: 08.12.2008 14:50
Company:  Hewlett-Packard
--------------------
Value Name: [Adobe ARM]
Value Data: ["C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"]
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
843712 bytes
Created:  11.12.2009 15:57
Modified: 03.01.2012 09:37
Company:  Adobe Systems Incorporated
--------------------
Value Name: [WirelessAssistant]
Value Data: [C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe]
C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
500792 bytes
Created:  23.03.2010 13:47
Modified: 23.03.2010 13:47
Company:  Hewlett-Packard Company
--------------------
Value Name: [QuickTime Task]
Value Data: ["C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime]
C:\Program Files (x86)\QuickTime\QTTask.exe
421888 bytes
Created:  29.11.2010 18:38
Modified: 29.11.2010 18:38
Company:  Apple Inc.
--------------------
Value Name: [SunJavaUpdateSched]
Value Data: ["C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"]
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
249064 bytes
Created:  29.10.2010 14:49
Modified: 29.10.2010 14:49
Company:  Sun Microsystems, Inc.
--------------------
Value Name: [APSDaemon]
Value Data: ["C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"]
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
59280 bytes
Created:  30.05.2012 20:06
Modified: 30.05.2012 20:06
Company:  Apple Inc.
--------------------
Value Name: [avgnt]
Value Data: ["C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min]
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
348624 bytes
Created:  10.04.2012 19:27
Modified: 15.05.2012 22:07
Company:  Avira Operations GmbH & Co. KG
--------------------
Value Name: [iTunesHelper]
Value Data: ["C:\Program Files (x86)\iTunes\iTunesHelper.exe"]
C:\Program Files (x86)\iTunes\iTunesHelper.exe
421776 bytes
Created:  07.06.2012 19:33
Modified: 07.06.2012 19:33
Company:  Apple Inc.
--------------------
Value Name: [DATAMNGR]
Value Data: [C:\PROGRA~2\WIA6EB~1\Datamngr\DATAMN~1.EXE]
C:\PROGRA~2\WIA6EB~1\Datamngr\DATAMN~1.EXE
1825720 bytes
Created:  29.07.2012 00:31
Modified: 08.07.2012 17:11
Company:  Bandoo Media, inc
--------------------
Value Name: [TrojanScanner]
Value Data: [C:\Program Files (x86)\Trojan Remover\Trjscan.exe /boot]
C:\Program Files (x86)\Trojan Remover\Trjscan.exe
1240848 bytes
Created:  02.08.2012 04:08
Modified: 02.08.2012 04:18
Company:  Simply Super Software
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Value Name: [HPADVISOR]
Value Data: [C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe view=DOCKVIEW]
C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe
1668664 bytes
Created:  15.07.2009 17:51
Modified: 15.07.2009 17:51
Company:  Hewlett-Packard
--------------------
Value Name: [LightScribe Control Panel]
Value Data: [C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden]
C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
2363392 bytes
Created:  17.06.2009 13:13
Modified: 17.06.2009 13:13
Company:  Hewlett-Packard Company
--------------------
Value Name: [Sidebar]
Value Data: [C:\Program Files\Windows Sidebar\sidebar.exe /autoRun]
C:\Program Files\Windows Sidebar\sidebar.exe
1475584 bytes
Created:  02.07.2011 16:39
Modified: 20.11.2010 15:25
Company:  Microsoft Corporation
--------------------
Value Name: [DAEMON Tools Lite]
Value Data: ["C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun]
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
1305408 bytes
Created:  20.01.2011 11:20
Modified: 20.01.2011 11:20
Company:  DT Soft Ltd
--------------------
Value Name: [RESTART_STICKY_NOTES]
Value Data: [C:\Windows\System32\StikyNot.exe]
C:\Windows\System32\StikyNot.exe
427520 bytes
Created:  14.07.2009 01:57
Modified: 14.07.2009 03:39
Company:  Microsoft Corporation
--------------------
Value Name: [Sony PC Companion]
Value Data: ["C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe" /Background]
C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe - [file not found to scan]
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
This Registry key appears to be empty

************************************************************
04:19:11: Scanning -----WINDOWS  64 Bit  REGISTRY-----
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: [SynTPEnh]
Value Data: [%ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe]
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
1815848 bytes
Created:  15.07.2009 01:12
Modified: 15.07.2009 01:12
Company:  Synaptics Incorporated
--------------------
Value Name: [SysTrayApp]
Value Data: [C:\Program Files\IDT\WDM\sttray64.exe]
C:\Program Files\IDT\WDM\sttray64.exe
450048 bytes
Created:  25.11.2009 01:20
Modified: 22.07.2009 03:33
Company:  IDT, Inc.
--------------------
Value Name: [SmartMenu]
Value Data: [C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe /background]
C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
610872 bytes
Created:  21.07.2009 11:34
Modified: 21.07.2009 11:34
Company:  
--------------------
Value Name: [SunJavaUpdateSched]
Value Data: ["C:\Program Files\Java\jre6\bin\jusched.exe"]
C:\Program Files\Java\jre6\bin\jusched.exe
171520 bytes
Created:  01.10.2009 21:10
Modified: 01.10.2009 21:10
Company:  Sun Microsystems, Inc.
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry key appears to be empty

************************************************************
04:19:12: Scanning -----SHELLEXECUTEHOOKS-----
ShellExecuteHooks key is empty

************************************************************
04:19:12: Scanning -----HIDDEN REGISTRY ENTRIES-----
Taskdir check completed
----------
No Hidden File-loading Registry Entries found
----------

************************************************************
04:19:12: Scanning -----ACTIVE SCREENSAVER-----
ScreenSaver: C:\Windows\system32\scrnsave.scr
C:\Windows\System32\scrnsave.scr
11264 bytes
Created:  14.07.2009 01:56
Modified: 14.07.2009 03:38
Company:  Microsoft Corporation
--------------------

************************************************************
04:19:13: Scanning ----- REGISTRY ACTIVE SETUP KEYS -----
Key:  >{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
Path: %SystemRoot%\system32\unregmp2.exe /ShowWMP
C:\Windows\System32\unregmp2.exe
323584 bytes
Created:  14.07.2009 02:23
Modified: 14.07.2009 03:39
Company:  Microsoft Corporation
----------
Key:  >{26923b43-4d38-484f-9b9e-de460746276c}
Path: C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
C:\Windows\SysWOW64\ie4uinit.exe
74240 bytes
Created:  24.02.2012 12:59
Modified: 24.02.2012 12:59
Company:  Microsoft Corporation
----------
Key:  >{60B49E34-C7CC-11D0-8953-00A0C90347FF}
Path: "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
C:\Windows\SysWOW64\iedkcs32.dll
353584 bytes
Created:  24.02.2012 12:59
Modified: 24.02.2012 12:59
Company:  Microsoft Corporation
----------
Key:  {10880D85-AAD9-4558-ABDC-2AB1552D831F}
Path: "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"
C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe
451872 bytes
Created:  17.06.2009 13:11
Modified: 17.06.2009 13:11
Company:  Hewlett-Packard Company
----------
Key:  {2C7339CF-2B09-4501-B3F3-F3508C9228ED}
Path: %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
C:\Windows\System32\themeui.dll
2851840 bytes
Created:  02.07.2011 16:38
Modified: 20.11.2010 15:27
Company:  Microsoft Corporation
----------
Key:  {44BBA840-CC51-11CF-AAFA-00AA00B6015C}
Path: "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
C:\Program Files (x86)\Windows Mail\WinMail.exe
Key:  {6BF52A52-394A-11d3-B153-00C04F79FAA6}
Path: %SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI
C:\Windows\System32\unregmp2.exe
323584 bytes
Created:  14.07.2009 02:23
Modified: 14.07.2009 03:39
Company:  Microsoft Corporation
----------
Key:  {89820200-ECBD-11cf-8B85-00AA005B4340}
Path: regsvr32.exe /s /n /i:U shell32.dll
C:\Windows\System32\shell32.dll
14172672 bytes
Created:  11.07.2012 12:47
Modified: 09.06.2012 07:43
Company:  Microsoft Corporation
----------
Key:  {89820200-ECBD-11cf-8B85-00AA005B4383}
Path: C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
C:\Windows\SysWOW64\ie4uinit.exe
74240 bytes
Created:  24.02.2012 12:59
Modified: 24.02.2012 12:59
Company:  Microsoft Corporation
----------
Key:  {89B4C1CD-B018-4511-B0A1-5476DBF70820}
Path: C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
C:\Windows\SysWOW64\mscories.dll
80720 bytes
Created:  02.07.2011 16:37
Modified: 05.11.2010 03:58
Company:  Microsoft Corporation
----------

************************************************************
04:19:14: Scanning ----- SERVICEDLL REGISTRY KEYS -----
Key:  ezSharedSvc
Path: C:\Windows\System32\ezsvc7.dll
C:\Windows\SysWOW64\ezsvc7.dll
129584 bytes
Created:  01.10.2009 20:57
Modified: 22.02.2009 12:00
Company:  EasyBits Sofware AS
--------------------
Key:  hpqcxs08
Path: C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll
248832 bytes
Created:  21.05.2009 23:13
Modified: 21.05.2009 23:13
Company:  Hewlett-Packard Co.
--------------------
Key:  hpqddsvc
Path: C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll
133120 bytes
Created:  21.05.2009 23:03
Modified: 21.05.2009 23:03
Company:  Hewlett-Packard Co.
--------------------
Key:  HPSLPSVC
Path: C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL
C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL
923136 bytes
Created:  21.05.2009 22:35
Modified: 21.05.2009 22:35
Company:  Hewlett-Packard Co.
--------------------

************************************************************
04:19:16: Scanning ----- SERVICES REGISTRY KEYS -----
Key:       Accelerometer
ImagePath: system32\DRIVERS\Accelerometer.sys
C:\Windows\System32\DRIVERS\Accelerometer.sys
41272 bytes
Created:  08.07.2009 14:48
Modified: 08.07.2009 14:48
Company:  Hewlett-Packard
----------
Key:       AdobeFlashPlayerUpdateSvc
ImagePath: C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
250056 bytes
Created:  14.07.2012 23:15
Modified: 28.07.2012 03:12
Company:  Adobe Systems Incorporated
----------
Key:       adp94xx
ImagePath: system32\DRIVERS\adp94xx.sys
C:\Windows\System32\DRIVERS\adp94xx.sys
491088 bytes
Created:  10.06.2009 22:36
Modified: 14.07.2009 03:52
Company:  Adaptec, Inc.
----------
Key:       adpahci
ImagePath: system32\DRIVERS\adpahci.sys
C:\Windows\System32\DRIVERS\adpahci.sys
339536 bytes
Created:  13.07.2009 23:59
Modified: 14.07.2009 03:52
Company:  Adaptec, Inc.
----------
Key:       adpu320
ImagePath: system32\DRIVERS\adpu320.sys
C:\Windows\System32\DRIVERS\adpu320.sys
182864 bytes
Created:  13.07.2009 23:59
Modified: 14.07.2009 03:52
Company:  Adaptec, Inc.
----------
Key:       AESTFilters
ImagePath: C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\AESTSr64.exe
C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\AESTSr64.exe
89600 bytes
Created:  25.11.2009 01:20
Modified: 02.03.2009 23:42
Company:  Andrea Electronics Corporation
----------
Key:       AgereSoftModem
ImagePath: system32\DRIVERS\agrsm64.sys
C:\Windows\System32\DRIVERS\agrsm64.sys
1146880 bytes
Created:  10.06.2009 23:01
Modified: 10.06.2009 23:01
Company:  LSI Corp
----------
Key:       AMD External Events Utility
ImagePath: %SystemRoot%\system32\atiesrxx.exe
C:\Windows\System32\atiesrxx.exe
203264 bytes
Created:  02.07.2009 20:16
Modified: 02.07.2009 20:16
Company:  AMD
----------
Key:       amdide
ImagePath: system32\drivers\amdide.sys
C:\Windows\System32\drivers\amdide.sys
15440 bytes
Created:  14.07.2009 01:19
Modified: 14.07.2009 03:52
Company:  Microsoft Corporation
----------
Key:       AmdPPM
ImagePath: system32\DRIVERS\amdppm.sys
C:\Windows\System32\DRIVERS\amdppm.sys
60928 bytes
Created:  14.07.2009 01:19
Modified: 14.07.2009 01:19
Company:  Microsoft Corporation
----------
Key:       amdsata
ImagePath: system32\drivers\amdsata.sys
C:\Windows\System32\drivers\amdsata.sys
107904 bytes
Created:  27.04.2011 11:45
Modified: 11.03.2011 08:41
Company:  Advanced Micro Devices
----------
Key:       amdsbs
ImagePath: system32\DRIVERS\amdsbs.sys
C:\Windows\System32\DRIVERS\amdsbs.sys
194128 bytes
Created:  10.06.2009 22:37
Modified: 14.07.2009 03:52
Company:  AMD Technologies Inc.
----------
Key:       amdxata
ImagePath: system32\drivers\amdxata.sys
C:\Windows\System32\drivers\amdxata.sys
27008 bytes
Created:  27.04.2011 11:45
Modified: 11.03.2011 08:41
Company:  Advanced Micro Devices
----------
Key:       AntiVirSchedulerService
ImagePath: "C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe"
C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
86224 bytes
Created:  10.04.2012 19:27
Modified: 15.05.2012 22:07
Company:  Avira Operations GmbH & Co. KG
----------
Key:       AntiVirService
ImagePath: "C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe"
C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
110032 bytes
Created:  10.04.2012 19:27
Modified: 15.05.2012 22:07
Company:  Avira Operations GmbH & Co. KG
----------
Key:       Apple Mobile Device
ImagePath: "C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
55184 bytes
Created:  24.05.2012 13:28
Modified: 24.05.2012 13:28
Company:  Apple Inc.
----------
Key:       arc
ImagePath: system32\DRIVERS\arc.sys
C:\Windows\System32\DRIVERS\arc.sys
87632 bytes
Created:  13.07.2009 23:59
Modified: 14.07.2009 03:52
Company:  Adaptec, Inc.
----------
Key:       arcsas
ImagePath: system32\DRIVERS\arcsas.sys
C:\Windows\System32\DRIVERS\arcsas.sys
97856 bytes
Created:  13.07.2009 23:59
Modified: 14.07.2009 03:52
Company:  Adaptec, Inc.
----------
Key:       atapi
ImagePath: system32\drivers\atapi.sys
C:\Windows\System32\drivers\atapi.sys
24128 bytes
Created:  14.07.2009 01:19
Modified: 14.07.2009 03:52
Company:  Microsoft Corporation
----------
Key:       athr
ImagePath: system32\DRIVERS\athrx.sys
C:\Windows\System32\DRIVERS\athrx.sys
1484800 bytes
Created:  22.09.2009 02:47
Modified: 22.09.2009 02:47
Company:  Atheros Communications, Inc.
----------
Key:       AtiHdmiService
ImagePath: system32\drivers\AtiHdmi.sys
C:\Windows\System32\drivers\AtiHdmi.sys
114192 bytes
Created:  05.06.2009 12:20
Modified: 05.06.2009 12:20
Company:  ATI Research Inc.
----------
Key:       AtiPcie
ImagePath: system32\DRIVERS\AtiPcie.sys
C:\Windows\System32\DRIVERS\AtiPcie.sys
16440 bytes
Created:  05.05.2009 07:30
Modified: 05.05.2009 07:30
Company:  Advanced Micro Devices Inc.
----------
Key:       avkmgr
ImagePath: system32\DRIVERS\avkmgr.sys
C:\Windows\System32\DRIVERS\avkmgr.sys
27760 bytes
Created:  10.04.2012 19:27
Modified: 16.09.2011 16:08
Company:  Avira GmbH
----------
Key:       b06bdrv
ImagePath: \SystemRoot\system32\DRIVERS\bxvbda.sys
C:\Windows\System32\DRIVERS\bxvbda.sys
468480 bytes
Created:  10.06.2009 22:34
Modified: 10.06.2009 22:34
Company:  Broadcom Corporation
----------
Key:       b57nd60a
ImagePath: system32\DRIVERS\b57nd60a.sys
C:\Windows\System32\DRIVERS\b57nd60a.sys
270848 bytes
Created:  10.06.2009 22:34
Modified: 10.06.2009 22:34
Company:  Broadcom Corporation
----------
Key:       circlass
ImagePath: system32\DRIVERS\circlass.sys
C:\Windows\System32\DRIVERS\circlass.sys
45568 bytes
Created:  14.07.2009 02:06
Modified: 14.07.2009 02:06
Company:  Microsoft Corporation
----------
Key:       clr_optimization_v2.0.50727_64
ImagePath: %systemroot%\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
89920 bytes
Created:  13.07.2009 22:37
Modified: 10.06.2009 22:39
Company:  Microsoft Corporation
----------
Key:       clr_optimization_v4.0.30319_32
ImagePath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
130384 bytes
Created:  18.03.2010 13:16
Modified: 18.03.2010 13:16
Company:  Microsoft Corporation
----------
Key:       clr_optimization_v4.0.30319_64
ImagePath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
138576 bytes
Created:  18.03.2010 14:27
Modified: 18.03.2010 14:27
Company:  Microsoft Corporation
----------
Key:       cmdide
ImagePath: system32\drivers\cmdide.sys
C:\Windows\System32\drivers\cmdide.sys
17488 bytes
Created:  14.07.2009 01:19
Modified: 14.07.2009 03:52
Company:  CMD Technology, Inc.
----------
Key:       Com4QLBEx
ImagePath: "C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe"
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
228408 bytes
Created:  01.10.2009 19:20
Modified: 05.05.2009 10:11
Company:  Hewlett-Packard Development Company, L.P.
----------
Key:       CompositeBus
ImagePath: \SystemRoot\system32\drivers\CompositeBus.sys
C:\Windows\System32\drivers\CompositeBus.sys
38912 bytes
Created:  02.07.2011 16:37
Modified: 20.11.2010 12:33
Company:  Microsoft Corporation
----------
Key:       DCService.exe
ImagePath: C:\ProgramData\DatacardService\DCService.exe
C:\ProgramData\DatacardService\DCService.exe
229376 bytes
Created:  08.05.2010 13:48
Modified: 08.05.2010 13:48
Company:  
----------
Key:       Dot4
ImagePath: system32\DRIVERS\Dot4.sys
C:\Windows\System32\DRIVERS\Dot4.sys
145920 bytes
Created:  14.07.2009 02:00
Modified: 14.07.2009 02:00
Company:  Microsoft Corporation
----------
Key:       Dot4Print
ImagePath: \SystemRoot\system32\drivers\Dot4Prt.sys
C:\Windows\System32\drivers\Dot4Prt.sys
19968 bytes
Created:  02.07.2011 16:37
Modified: 20.11.2010 12:32
Company:  Microsoft Corporation
----------
Key:       dot4usb
ImagePath: system32\DRIVERS\dot4usb.sys
C:\Windows\System32\DRIVERS\dot4usb.sys
43008 bytes
Created:  14.07.2009 02:00
Modified: 14.07.2009 02:00
Company:  Microsoft Corporation
----------
Key:       dtsoftbus01
ImagePath: system32\DRIVERS\dtsoftbus01.sys
C:\Windows\System32\DRIVERS\dtsoftbus01.sys
254528 bytes
Created:  21.10.2011 21:01
Modified: 21.10.2011 21:01
Company:  DT Soft Ltd
----------
Key:       ebdrv
ImagePath: \SystemRoot\system32\DRIVERS\evbda.sys
C:\Windows\System32\DRIVERS\evbda.sys
3286016 bytes
Created:  10.06.2009 22:34
Modified: 10.06.2009 22:34
Company:  Broadcom Corporation
----------
Key:       elxstor
ImagePath: system32\DRIVERS\elxstor.sys
C:\Windows\System32\DRIVERS\elxstor.sys
530496 bytes
Created:  10.06.2009 22:36
Modified: 14.07.2009 03:47
Company:  Emulex
----------
Key:       enecir
ImagePath: system32\DRIVERS\enecir.sys
C:\Windows\System32\DRIVERS\enecir.sys
70656 bytes
Created:  29.06.2009 20:17
Modified: 29.06.2009 20:17
Company:  ENE TECHNOLOGY INC.
----------
Key:       ewusbnet
ImagePath: system32\DRIVERS\ewusbnet.sys
C:\Windows\System32\DRIVERS\ewusbnet.sys
250368 bytes
Created:  12.07.2011 18:34
Modified: 07.04.2010 17:05
Company:  Huawei Technologies Co., Ltd.
----------
Key:       ew_hwusbdev
ImagePath: system32\DRIVERS\ew_hwusbdev.sys
C:\Windows\System32\DRIVERS\ew_hwusbdev.sys
114560 bytes
Created:  12.07.2011 18:33
Modified: 20.03.2010 11:56
Company:  Huawei Technologies Co., Ltd.
----------
Key:       FontCache3.0.0.0
ImagePath: %systemroot%\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
42856 bytes
Created:  02.07.2011 16:38
Modified: 05.11.2010 03:53
Company:  Microsoft Corporation
----------
Key:       GameConsoleService
ImagePath: "C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe"
C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe
250616 bytes
Created:  22.05.2009 20:02
Modified: 22.05.2009 20:02
Company:  WildTangent, Inc.
----------
Key:       ggflt
ImagePath: system32\DRIVERS\ggflt.sys
C:\Windows\System32\DRIVERS\ggflt.sys
13352 bytes
Created:  24.01.2012 10:18
Modified: 24.01.2012 10:18
Company:  Sony Ericsson Mobile Communications
----------
Key:       ggsemc
ImagePath: system32\DRIVERS\ggsemc.sys
C:\Windows\System32\DRIVERS\ggsemc.sys
27176 bytes
Created:  24.01.2012 10:18
Modified: 24.01.2012 10:18
Company:  Sony Ericsson Mobile Communications
----------
Key:       HdAudAddService
ImagePath: \SystemRoot\system32\drivers\HdAudio.sys
C:\Windows\System32\drivers\HdAudio.sys
350208 bytes
Created:  02.07.2011 16:37
Modified: 20.11.2010 12:44
Company:  Microsoft Corporation
----------
Key:       HidIr
ImagePath: system32\DRIVERS\hidir.sys
C:\Windows\System32\DRIVERS\hidir.sys
46592 bytes
Created:  14.07.2009 02:06
Modified: 14.07.2009 02:06
Company:  Microsoft Corporation
----------
Key:       HP Support Assistant Service
ImagePath: "C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe"
C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
86072 bytes
Created:  09.09.2011 17:10
Modified: 09.09.2011 17:10
Company:  Hewlett-Packard Company
----------
Key:       HPDrvMntSvc.exe
ImagePath: "C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe"
C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
94264 bytes
Created:  28.03.2011 17:07
Modified: 28.03.2011 17:07
Company:  Hewlett-Packard Company
----------
Key:       hpdskflt
ImagePath: system32\DRIVERS\hpdskflt.sys
C:\Windows\System32\DRIVERS\hpdskflt.sys
30008 bytes
Created:  08.07.2009 14:49
Modified: 08.07.2009 14:49
Company:  Hewlett-Packard
----------
Key:       HpqKbFiltr
ImagePath: \SystemRoot\system32\DRIVERS\HpqKbFiltr.sys
C:\Windows\System32\DRIVERS\HpqKbFiltr.sys
18432 bytes
Created:  01.10.2009 19:20
Modified: 29.04.2009 08:48
Company:  Hewlett-Packard Development Company, L.P.
----------
Key:       hpqwmiex
ImagePath: "C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe"
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
799800 bytes
Created:  28.03.2011 17:03
Modified: 28.03.2011 17:03
Company:  Hewlett-Packard Company
----------
Key:       HpSAMD
ImagePath: system32\drivers\HpSAMD.sys
C:\Windows\System32\drivers\HpSAMD.sys
78720 bytes
Created:  02.07.2011 16:38
Modified: 20.11.2010 15:33
Company:  Hewlett-Packard Company
----------
Key:       hpsrv
ImagePath: %SystemRoot%\system32\Hpservice.exe
C:\Windows\System32\Hpservice.exe
30520 bytes
Created:  08.07.2009 14:49
Modified: 08.07.2009 14:49
Company:  Hewlett-Packard
----------
Key:       huawei_enumerator
ImagePath: system32\DRIVERS\ew_jubusenum.sys
C:\Windows\System32\DRIVERS\ew_jubusenum.sys
76288 bytes
Created:  12.07.2011 18:34
Modified: 09.04.2010 15:24
Company:  Huawei Technologies Co., Ltd.
----------
Key:       hwdatacard
ImagePath: system32\DRIVERS\ewusbmdm.sys
C:\Windows\System32\DRIVERS\ewusbmdm.sys
120704 bytes
Created:  12.07.2011 18:34
Modified: 25.03.2010 10:08
Company:  Huawei Technologies Co., Ltd.
----------
Key:       iaStorV
ImagePath: system32\drivers\iaStorV.sys
C:\Windows\System32\drivers\iaStorV.sys
410496 bytes
Created:  27.04.2011 11:45
Modified: 11.03.2011 08:41
Company:  Intel Corporation
----------
Key:       idsvc
ImagePath: "%systemroot%\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe"
C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
856400 bytes
Created:  02.07.2011 16:38
Modified: 05.11.2010 03:52
Company:  Microsoft Corporation
----------
Key:       igfx
ImagePath: system32\DRIVERS\igdkmd64.sys
C:\Windows\System32\DRIVERS\igdkmd64.sys
6108416 bytes
Created:  10.06.2009 22:37
Modified: 10.06.2009 22:37
Company:  Intel Corporation
----------
Key:       iirsp
ImagePath: system32\DRIVERS\iirsp.sys
C:\Windows\System32\DRIVERS\iirsp.sys
44112 bytes
Created:  13.07.2009 23:59
Modified: 14.07.2009 03:48
Company:  Intel Corp./ICP vortex GmbH
----------
Key:       JMCR
ImagePath: system32\DRIVERS\jmcr.sys
C:\Windows\System32\DRIVERS\jmcr.sys
140712 bytes
Created:  21.07.2009 05:39
Modified: 21.07.2009 05:39
Company:  JMicron Technology Corporation
----------
Key:       kbdclass
ImagePath: \SystemRoot\system32\drivers\kbdclass.sys
C:\Windows\System32\drivers\kbdclass.sys
50768 bytes
Created:  14.07.2009 01:19
Modified: 14.07.2009 03:48
Company:  Microsoft Corporation
----------
Key:       kbdhid
ImagePath: \SystemRoot\system32\drivers\kbdhid.sys
C:\Windows\System32\drivers\kbdhid.sys
33280 bytes
Created:  02.07.2011 16:37
Modified: 20.11.2010 12:33
Company:  Microsoft Corporation
----------
Key:       ksthunk
ImagePath: \SystemRoot\system32\drivers\ksthunk.sys
C:\Windows\System32\drivers\ksthunk.sys
20992 bytes
Created:  14.07.2009 02:00
Modified: 14.07.2009 02:00
Company:  Microsoft Corporation
----------
Key:       LightScribeService
ImagePath: "C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe"
C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
73728 bytes
Created:  17.06.2009 13:21
Modified: 17.06.2009 13:21
Company:  Hewlett-Packard Company
----------
Key:       LSI_FC
ImagePath: system32\DRIVERS\lsi_fc.sys
C:\Windows\System32\DRIVERS\lsi_fc.sys
114752 bytes
Created:  13.07.2009 23:59
Modified: 14.07.2009 03:48
Company:  LSI Corporation
----------
Key:       LSI_SAS
ImagePath: system32\DRIVERS\lsi_sas.sys
C:\Windows\System32\DRIVERS\lsi_sas.sys
106560 bytes
Created:  13.07.2009 23:59
Modified: 14.07.2009 03:48
Company:  LSI Corporation
----------
Key:       LSI_SAS2
ImagePath: system32\DRIVERS\lsi_sas2.sys
C:\Windows\System32\DRIVERS\lsi_sas2.sys
65600 bytes
Created:  13.07.2009 23:59
Modified: 14.07.2009 03:48
Company:  LSI Corporation
----------
Key:       LSI_SCSI
ImagePath: system32\DRIVERS\lsi_scsi.sys
C:\Windows\System32\DRIVERS\lsi_scsi.sys
115776 bytes
Created:  13.07.2009 23:59
Modified: 14.07.2009 03:48
Company:  LSI Corporation
----------
Key:       MDM
ImagePath: "C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe"
C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
335872 bytes
Created:  26.10.2006 13:40
Modified: 26.10.2006 13:40
Company:  Microsoft Corporation
----------
Key:       megasas
ImagePath: system32\DRIVERS\megasas.sys
C:\Windows\System32\DRIVERS\megasas.sys
35392 bytes
Created:  10.06.2009 22:37
Modified: 14.07.2009 03:48
Company:  LSI Corporation
----------
Key:       MegaSR
ImagePath: system32\DRIVERS\MegaSR.sys
C:\Windows\System32\DRIVERS\MegaSR.sys
284736 bytes
Created:  13.07.2009 23:59
Modified: 14.07.2009 03:48
Company:  LSI Corporation, Inc.
----------
Key:       MozillaMaintenance
ImagePath: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
113120 bytes
Created:  02.05.2012 23:04
Modified: 20.07.2012 00:20
Company:  Mozilla Foundation
----------
Key:       mpio
ImagePath: system32\drivers\mpio.sys
C:\Windows\System32\drivers\mpio.sys
155008 bytes
Created:  02.07.2011 16:37
Modified: 20.11.2010 15:33
Company:  Microsoft Corporation
----------
Key:       msahci
ImagePath: system32\drivers\msahci.sys
C:\Windows\System32\drivers\msahci.sys
31104 bytes
Created:  02.07.2011 16:38
Modified: 20.11.2010 15:33
Company:  Microsoft Corporation
----------
Key:       msdsm
ImagePath: system32\drivers\msdsm.sys
C:\Windows\System32\drivers\msdsm.sys
140672 bytes
Created:  02.07.2011 16:38
Modified: 20.11.2010 15:33
Company:  Microsoft Corporation
----------
Key:       mssmbios
ImagePath: \SystemRoot\system32\drivers\mssmbios.sys
C:\Windows\System32\drivers\mssmbios.sys
32320 bytes
Created:  14.07.2009 01:31
Modified: 14.07.2009 03:48
Company:  Microsoft Corporation
----------
Key:       netw5v64
ImagePath: system32\DRIVERS\netw5v64.sys
C:\Windows\System32\DRIVERS\netw5v64.sys
5434368 bytes
Created:  10.06.2009 22:35
Modified: 10.06.2009 22:35
Company:  Intel Corporation
----------
Key:       nfrd960
ImagePath: system32\DRIVERS\nfrd960.sys
C:\Windows\System32\DRIVERS\nfrd960.sys
51264 bytes
Created:  13.07.2009 23:59
Modified: 14.07.2009 03:48
Company:  IBM Corporation
----------
Key:       nvraid
ImagePath: system32\drivers\nvraid.sys
C:\Windows\System32\drivers\nvraid.sys
148352 bytes
Created:  27.04.2011 11:45
Modified: 11.03.2011 08:41
Company:  NVIDIA Corporation
----------
Key:       nvstor
ImagePath: system32\drivers\nvstor.sys
C:\Windows\System32\drivers\nvstor.sys
166272 bytes
Created:  27.04.2011 11:45
Modified: 11.03.2011 08:41
Company:  NVIDIA Corporation
----------
Key:       odserv
ImagePath: "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE"
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
440696 bytes
Created:  20.07.2011 05:18
Modified: 20.07.2011 05:18
Company:  Microsoft Corporation
----------
Key:       ose
ImagePath: "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
145184 bytes
Created:  26.10.2006 14:03
Modified: 26.10.2006 14:03
Company:  Microsoft Corporation
----------
Key:       PerfHost
ImagePath: %SystemRoot%\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
20992 bytes
Created:  14.07.2009 01:11
Modified: 14.07.2009 03:14
Company:  Microsoft Corporation
----------
Key:       ql2300
ImagePath: system32\DRIVERS\ql2300.sys
C:\Windows\System32\DRIVERS\ql2300.sys
1524816 bytes
Created:  10.06.2009 22:37
Modified: 14.07.2009 03:45
Company:  QLogic Corporation
----------
Key:       ql40xx
ImagePath: system32\DRIVERS\ql40xx.sys
C:\Windows\System32\DRIVERS\ql40xx.sys
128592 bytes
Created:  13.07.2009 23:59
Modified: 14.07.2009 03:45
Company:  QLogic Corporation
----------
Key:       rdpbus
ImagePath: \SystemRoot\system32\DRIVERS\rdpbus.sys
C:\Windows\System32\DRIVERS\rdpbus.sys
24064 bytes
Created:  14.07.2009 02:17
Modified: 14.07.2009 02:17
Company:  Microsoft Corporation
----------
Key:       RichVideo
ImagePath: "C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe"
C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
247152 bytes
Created:  01.10.2009 20:46
Modified: 21.01.2009 20:47
Company:  
----------
Key:       RTL8167
ImagePath: system32\DRIVERS\Rt64win7.sys
C:\Windows\System32\DRIVERS\Rt64win7.sys
215040 bytes
Created:  25.11.2009 01:19
Modified: 23.05.2009 08:52
Company:  Realtek                                            
----------
Key:       SbFw
ImagePath: system32\drivers\SbFw.sys
C:\Windows\System32\drivers\SbFw.sys
253528 bytes
Created:  10.04.2012 14:44
Modified: 05.04.2011 17:35
Company:  Sunbelt Software, Inc.
----------
Key:       SBFWIMCL
ImagePath: system32\DRIVERS\sbfwim.sys
C:\Windows\System32\DRIVERS\sbfwim.sys
84568 bytes
Created:  10.04.2012 14:44
Modified: 08.02.2011 09:14
Company:  Sunbelt Software, Inc.
----------
Key:       SBFWIMCLMP
ImagePath: system32\DRIVERS\SBFWIM.sys
C:\Windows\System32\DRIVERS\SBFWIM.sys
84568 bytes
Created:  10.04.2012 14:44
Modified: 08.02.2011 09:14
Company:  Sunbelt Software, Inc.
----------
Key:       sbhips
ImagePath: system32\drivers\sbhips.sys
C:\Windows\System32\drivers\sbhips.sys
60504 bytes
Created:  10.04.2012 14:44
Modified: 05.04.2011 17:35
Company:  Sunbelt Software, Inc.
----------
Key:       SBRE
ImagePath: \??\C:\Windows\system32\drivers\SBREdrv.sys
C:\Windows\system32\drivers\SBREdrv.sys - [file not found to scan]
----------
Key:       SbTis
ImagePath: system32\drivers\sbtis.sys
C:\Windows\System32\drivers\sbtis.sys
94296 bytes
Created:  10.04.2012 14:44
Modified: 05.04.2011 17:35
Company:  Sunbelt Software, Inc.
----------
Key:       sdbus
ImagePath: \SystemRoot\system32\drivers\sdbus.sys
C:\Windows\System32\drivers\sdbus.sys
109056 bytes
Created:  02.07.2011 16:37
Modified: 20.11.2010 11:37
Company:  Microsoft Corporation
----------
Key:       Serenum
ImagePath: \SystemRoot\system32\DRIVERS\serenum.sys
C:\Windows\System32\DRIVERS\serenum.sys
23552 bytes
Created:  14.07.2009 02:00
Modified: 14.07.2009 02:00
Company:  Microsoft Corporation
----------
Key:       Serial
ImagePath: \SystemRoot\system32\DRIVERS\serial.sys
C:\Windows\System32\DRIVERS\serial.sys
94208 bytes
Created:  14.07.2009 02:00
Modified: 14.07.2009 02:00
Company:  Microsoft Corporation
----------
Key:       SiSRaid2
ImagePath: system32\DRIVERS\SiSRaid2.sys
C:\Windows\System32\DRIVERS\SiSRaid2.sys
43584 bytes
Created:  10.06.2009 22:37
Modified: 14.07.2009 03:45
Company:  Silicon Integrated Systems Corp.
----------
Key:       SiSRaid4
ImagePath: system32\DRIVERS\sisraid4.sys
C:\Windows\System32\DRIVERS\sisraid4.sys
80464 bytes
Created:  13.07.2009 23:59
Modified: 14.07.2009 03:45
Company:  Silicon Integrated Systems
----------
Key:       SkypeUpdate
ImagePath: "C:\Program Files (x86)\Skype\Updater\Updater.exe"
C:\Program Files (x86)\Skype\Updater\Updater.exe
-R- 160944 bytes
Created:  03.07.2012 13:19
Modified: 03.07.2012 13:19
Company:  Skype Technologies
----------
Key:       Sony PC Companion
ImagePath: "C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe"
C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe
155320 bytes
Created:  24.01.2012 10:14
Modified: 18.01.2012 14:38
Company:  Avanquest Software
----------
Key:       SrvHsfHDA
ImagePath: system32\DRIVERS\VSTAZL6.SYS
C:\Windows\System32\DRIVERS\VSTAZL6.SYS
292864 bytes
Created:  14.07.2009 00:04
Modified: 10.06.2009 23:01
Company:  Conexant Systems, Inc.
----------
Key:       SrvHsfV92
ImagePath: system32\DRIVERS\VSTDPV6.SYS
C:\Windows\System32\DRIVERS\VSTDPV6.SYS
1485312 bytes
Created:  14.07.2009 00:04
Modified: 10.06.2009 23:01
Company:  Conexant Systems, Inc.
----------
Key:       SrvHsfWinac
ImagePath: system32\DRIVERS\VSTCNXT6.SYS
C:\Windows\System32\DRIVERS\VSTCNXT6.SYS
740864 bytes
Created:  14.07.2009 00:04
Modified: 10.06.2009 23:01
Company:  Conexant Systems, Inc.
----------
Key:       STacSV
ImagePath: C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\STacSV64.exe
C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\STacSV64.exe
240128 bytes
Created:  25.11.2009 01:20
Modified: 22.07.2009 03:33
Company:  IDT, Inc.
----------
Key:       stexstor
ImagePath: system32\DRIVERS\stexstor.sys
C:\Windows\System32\DRIVERS\stexstor.sys
24656 bytes
Created:  13.07.2009 23:59
Modified: 14.07.2009 03:45
Company:  Promise Technology
----------
Key:       STHDA
ImagePath: system32\DRIVERS\stwrt64.sys
C:\Windows\System32\DRIVERS\stwrt64.sys
487936 bytes
Created:  25.11.2009 01:20
Modified: 22.07.2009 03:33
Company:  IDT, Inc.
----------
Key:       swenum
ImagePath: \SystemRoot\system32\drivers\swenum.sys
C:\Windows\System32\drivers\swenum.sys
12496 bytes
Created:  14.07.2009 02:00
Modified: 14.07.2009 03:45
Company:  Microsoft Corporation
----------
Key:       SynTP
ImagePath: system32\DRIVERS\SynTP.sys
C:\Windows\System32\DRIVERS\SynTP.sys
273456 bytes
Created:  15.07.2009 01:16
Modified: 15.07.2009 01:16
Company:  Synaptics Incorporated
----------
Key:       TermDD
ImagePath: \SystemRoot\system32\drivers\termdd.sys
C:\Windows\System32\drivers\termdd.sys
63360 bytes
Created:  02.07.2011 16:38
Modified: 20.11.2010 15:33
Company:  Microsoft Corporation
----------
Key:       TsUsbFlt
ImagePath: system32\drivers\tsusbflt.sys
C:\Windows\System32\drivers\tsusbflt.sys
59392 bytes
Created:  02.07.2011 16:39
Modified: 20.11.2010 13:07
Company:  Microsoft Corporation
----------
Key:       USBAAPL64
ImagePath: System32\Drivers\usbaapl64.sys
C:\Windows\System32\Drivers\usbaapl64.sys
52736 bytes
Created:  25.04.2012 12:11
Modified: 25.04.2012 12:11
Company:  Apple, Inc.
----------
Key:       usbfilter
ImagePath: system32\DRIVERS\usbfilter.sys
C:\Windows\System32\DRIVERS\usbfilter.sys
36408 bytes
Created:  25.11.2009 01:18
Modified: 09.03.2009 07:49
Company:  Advanced Micro Devices
----------
Key:       usbvideo
ImagePath: \SystemRoot\System32\Drivers\usbvideo.sys
C:\Windows\System32\Drivers\usbvideo.sys
184960 bytes
Created:  02.07.2011 16:38
Modified: 20.11.2010 12:44
Company:  Microsoft Corporation
----------
Key:       viaide
ImagePath: system32\drivers\viaide.sys
C:\Windows\System32\drivers\viaide.sys
17488 bytes
Created:  14.07.2009 01:19
Modified: 14.07.2009 03:45
Company:  VIA Technologies, Inc.
----------
Key:       vsmraid
ImagePath: system32\DRIVERS\vsmraid.sys
C:\Windows\System32\DRIVERS\vsmraid.sys
161872 bytes
Created:  10.06.2009 22:37
Modified: 14.07.2009 03:45
Company:  VIA Technologies Inc.,Ltd
----------
Key:       vwifibus
ImagePath: system32\DRIVERS\vwifibus.sys
C:\Windows\System32\DRIVERS\vwifibus.sys
24576 bytes
Created:  14.07.2009 02:07
Modified: 14.07.2009 02:07
Company:  Microsoft Corporation
----------
Key:       vwififlt
ImagePath: system32\DRIVERS\vwififlt.sys
C:\Windows\System32\DRIVERS\vwififlt.sys
59904 bytes
Created:  14.07.2009 02:07
Modified: 14.07.2009 02:07
Company:  Microsoft Corporation
----------
Key:       WatAdminSvc
ImagePath: %SystemRoot%\system32\Wat\WatAdminSvc.exe
C:\Windows\System32\Wat\WatAdminSvc.exe
1255736 bytes
Created:  14.07.2012 03:01
Modified: 14.07.2012 03:01
Company:  Microsoft Corporation
----------
Key:       Wd
ImagePath: system32\DRIVERS\wd.sys
C:\Windows\System32\DRIVERS\wd.sys
21056 bytes
Created:  14.07.2009 01:19
Modified: 14.07.2009 03:45
Company:  Microsoft Corporation
----------
Key:       WinUsb
ImagePath: system32\DRIVERS\WinUsb.sys
C:\Windows\System32\DRIVERS\WinUsb.sys
41984 bytes
Created:  02.07.2011 16:38
Modified: 20.11.2010 12:43
Company:  Microsoft Corporation
----------
Key:       yukonw7
ImagePath: system32\DRIVERS\yk62x64.sys
C:\Windows\System32\DRIVERS\yk62x64.sys
389120 bytes
Created:  10.06.2009 22:35
Modified: 10.06.2009 22:35
Company:  Marvell
----------

************************************************************
04:19:56: Scanning -----VXD ENTRIES-----

************************************************************
04:19:56: Scanning ----- WINLOGON\NOTIFY DLLS -----
No WINLOGON\NOTIFY DLLs found to scan
Rootkit scan of Winlogon\Notify key not possible [key may not exist]

************************************************************
04:19:56: Scanning ----- CONTEXTMENUHANDLERS -----
Key:   Shell Extension for Malware scanning
CLSID: {45AC2688-0253-4ED8-97DE-B5370FA7D48A}
File:  [CLSID does not appear to reference a file]
----------
Key:   WinRAR
CLSID: {B41DB860-64E4-11D2-9906-E49FADC173CA}
File:  [CLSID does not appear to reference a file]
----------
Key:   WinRAR32
CLSID: {B41DB860-8EE4-11D2-9906-E49FADC173CA}
Path:  C:\Program Files (x86)\WinRAR\rarext.dll
C:\Program Files (x86)\WinRAR\rarext.dll
141824 bytes
Created:  18.01.2011 18:44
Modified: 15.03.2010 12:28
Company:  Alexander Roshal
----------

************************************************************
04:19:57: Scanning ----- FOLDER\COLUMNHANDLERS -----
Key:  {F9DB5320-233E-11D1-9F84-707F02C10627}
File: C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
378264 bytes
Created:  03.01.2012 18:23
Modified: 03.01.2012 18:23
Company:  Adobe Systems, Inc.
----------

************************************************************
04:19:57: Scanning ----- BROWSER HELPER OBJECTS -----
Key: {0347C33E-8762-4905-BF09-768834316C61}
BHO: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
328248 bytes
Created:  21.05.2009 22:54
Modified: 21.05.2009 22:54
Company:  Hewlett-Packard Co.
----------
Key: {18DF081C-E8AD-4283-A596-FA578C2EBDC3}
BHO: C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
75200 bytes
Created:  03.01.2012 18:16
Modified: 03.01.2012 18:16
Company:  Adobe Systems Incorporated
----------
Key: {9030D464-4C02-4ABF-8ECC-5164760863C6}
BHO: C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
408448 bytes
Created:  22.01.2009 15:41
Modified: 22.01.2009 15:41
Company:  Microsoft Corporation
----------
Key: {99079a25-328f-4bd4-be04-00955acaa0a7}
BHO: C:\PROGRA~2\WIA6EB~1\Datamngr\ToolBar\searchqudtx.dll
C:\PROGRA~2\WIA6EB~1\Datamngr\ToolBar\searchqudtx.dll
88976 bytes
Created:  27.02.2012 10:42
Modified: 27.02.2012 10:42
Company:  
----------
Key: {9D717F81-9148-4f12-8568-69135F087DB0}
BHO: C:\PROGRA~2\WIA6EB~1\Datamngr\BROWSE~1.DLL
C:\PROGRA~2\WIA6EB~1\Datamngr\BROWSE~1.DLL
89016 bytes
Created:  29.07.2012 00:31
Modified: 08.07.2012 17:11
Company:  Bandoo Media, inc
----------
Key: {DBC80044-A445-435b-BC74-9C25C1C588A9}
BHO: C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
41760 bytes
Created:  09.02.2011 16:31
Modified: 09.02.2011 16:31
Company:  Sun Microsystems, Inc.
----------
Key: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856}
BHO: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
509496 bytes
Created:  21.05.2009 22:54
Modified: 21.05.2009 22:54
Company:  Hewlett-Packard Co.
----------

************************************************************
04:19:59: Scanning ----- SHELLSERVICEOBJECTS -----

************************************************************
04:19:59: Scanning ----- SHAREDTASKSCHEDULER ENTRIES -----
No SharedTaskScheduler entries found to scan

************************************************************
04:19:59: Scanning ----- IMAGEFILE DEBUGGERS -----
No "Debugger" entries found.

************************************************************
04:19:59: Scanning ----- APPINIT_DLLS -----
AppInitDLLs entry = [C:\PROGRA~2\WIA6EB~1\Datamngr\datamngr.dll C:\PROGRA~2\WIA6EB~1\Datamngr\IEBHO.dll ]
File: C:\PROGRA~2\WIA6EB~1\Datamngr\datamngr.dll
C:\PROGRA~2\WIA6EB~1\Datamngr\datamngr.dll
1470392 bytes
Created:  29.07.2012 00:31
Modified: 08.07.2012 17:11
Company:  Bandoo Media, inc
----------
File: C:\PROGRA~2\WIA6EB~1\Datamngr\IEBHO.dll
C:\PROGRA~2\WIA6EB~1\Datamngr\IEBHO.dll
1185208 bytes
Created:  29.07.2012 00:31
Modified: 08.07.2012 17:11
Company:  Bandoo Media, inc
----------

************************************************************
04:20:00: Scanning ----- SECURITY PROVIDER DLLS -----

************************************************************
04:20:00: Scanning ------ COMMON STARTUP GROUP ------
[C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup]
The Common Startup Group attempts to load the following file(s) at boot time:
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-HS- 174 bytes
Created:  14.07.2009 06:54
Modified: 14.07.2009 06:54
Company:  [no info]
--------------------
HP Digital Imaging Monitor.lnk - links to C:\PROGRA~2\Hp\DIGITA~1\bin\hpqtra08.exe
C:\PROGRA~2\Hp\DIGITA~1\bin\hpqtra08.exe
275768 bytes
Created:  21.05.2009 23:13
Modified: 21.05.2009 23:13
Company:  Hewlett-Packard Co.
--------------------

************************************************************
04:20:00: Scanning ----- USER STARTUP GROUPS -----
Checking Startup Group for: Ninchen
[C:\Users\Ninchen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup]
C:\Users\Ninchen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-HS- 174 bytes
Created:  26.03.2010 22:57
Modified: 12.07.2012 03:33
Company:  [no info]
----------
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - links to C:\PROGRA~2\MICROS~4\Office12\ONENOTEM.EXE
C:\PROGRA~2\MICROS~4\Office12\ONENOTEM.EXE
97680 bytes
Created:  26.02.2009 15:24
Modified: 26.02.2009 15:24
Company:  Microsoft Corporation
----------
--------------------

************************************************************
04:20:01: Scanning ----- SCHEDULED TASKS -----
Taskname:      {F301AF46-6DD9-4A5D-93D5-E0E8891CEF1E}
----------
Taskname:      Ad-Aware Antivirus Scheduled Scan
File:          C:\PROGRA~2\AD-AWA~1\AdAwareLauncher.exe
Parameters:    --scan=full
Schedule:      At 15:05:00 every day
Next Run Time: 02.08.2012 15:05:00
Status:        Ready
Creator:       Ninchen
Comments:      Wir empfehlen regelmäßig Scans durchzuführen, um sicherzustellen, dass Ihr Computer sauber von Viren, Würmern, Trojanern und anderer schädlicher Software ist. Wenn Sie diesen Schritt deaktivieren, ist Ihr Computer möglicherweise ungeschützt und angreifbar. Dieser Schritt wird automatisch enfernt, wenn auf Ihrem PC Ad-Aware Antivirus, das diesen Schritt nutzt, nicht zu Verfügung steht.;
C:\PROGRA~2\AD-AWA~1\AdAwareLauncher.exe - [file not found to scan]
----------
Taskname:      Adobe Flash Player Updater
File:          C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
250056 bytes
Created:  14.07.2012 23:15
Modified: 28.07.2012 03:12
Company:  Adobe Systems Incorporated
Schedule:      At 01:12:00 every day
Next Run Time: 02.08.2012 05:12:00
Status:        Ready
Creator:       Adobe Systems Incorporated
Comments:      Mit diesem Task ist Ihre Flash Player-Installation immer aktuell und verwendet die neuesten Verbesserungen und Sicherheits-Fixes. Wenn dieser Task deaktiviert oder entfernt wird, kann Adobe Flash Player Ihren Computer nicht automatisch mit den neuesten Sicherheits-Fixes sichern.
----------
Taskname:      CapSchedInst
File:          c:\Program Files (x86)\Hewlett-Packard\Media\Live TV\Kernel\TV\CapSchedInst.exe
c:\Program Files (x86)\Hewlett-Packard\Media\Live TV\Kernel\TV\CapSchedInst.exe
54568 bytes
Created:  24.07.2009 19:24
Modified: 24.07.2009 19:24
Company:  CL
Schedule:      Task not scheduled
Next Run Time: 
Status:        Ready
Creator:       CyberLink
Comments:      
----------
Taskname:      CapSvcInst
File:          c:\Program Files (x86)\Hewlett-Packard\Media\Live TV\Kernel\TV\CapSvcInst.exe
c:\Program Files (x86)\Hewlett-Packard\Media\Live TV\Kernel\TV\CapSvcInst.exe
54568 bytes
Created:  24.07.2009 19:24
Modified: 24.07.2009 19:24
Company:  CL
Schedule:      Task not scheduled
Next Run Time: 
Status:        Ready
Creator:       CyberLink
Comments:      
----------
Taskname:      CapUninst
File:          c:\Program Files (x86)\Hewlett-Packard\Media\Live TV\Kernel\TV\CapUninst.exe
c:\Program Files (x86)\Hewlett-Packard\Media\Live TV\Kernel\TV\CapUninst.exe
42280 bytes
Created:  24.07.2009 19:24
Modified: 24.07.2009 19:24
Company:  CL
Schedule:      Task not scheduled
Next Run Time: 
Status:        Ready
Creator:       CyberLink
Comments:      
----------
Taskname:      CLMLSvc
File:          c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
206120 bytes
Created:  23.07.2009 12:37
Modified: 23.07.2009 12:37
Company:  CyberLink
Schedule:      At logon
Next Run Time: 
Status:        Running
Creator:       CyberLink
Comments:      
----------
Taskname:      DVDAgent
File:          c:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe
c:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe
128296 bytes
Created:  23.07.2009 21:45
Modified: 23.07.2009 21:45
Company:  CyberLink Corp.
Schedule:      At logon
Next Run Time: 
Status:        Running
Creator:       CyberLink
Comments:      
----------
Taskname:      HPCeeScheduleForNinchen
File:          C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
91704 bytes
Created:  07.10.2009 04:22
Modified: 07.10.2009 04:22
Company:  Hewlett-Packard
Parameters:    HPCeeScheduleForNinchen (null)
Schedule:      At 21:45:00 on 31.08.2012
Next Run Time: 30.09.2012 21:45:00
Status:        Ready
Creator:       Ninchen
Comments:      
----------
Taskname:      TVAgent
File:          c:\Program Files (x86)\Hewlett-Packard\Media\Live TV\TVAgent.exe
c:\Program Files (x86)\Hewlett-Packard\Media\Live TV\TVAgent.exe
427304 bytes
Created:  24.07.2009 19:24
Modified: 24.07.2009 19:24
Company:  CyberLink Corp.
Schedule:      At logon
Next Run Time: 
Status:        Running
Creator:       CyberLink
Comments:      
----------
Taskname:      User_Feed_Synchronization-{4034AE4C-9FC3-40EE-BF43-214C49A6C531}
File:          C:\Windows\Sysnative\msfeedssync.exe
C:\Windows\System32\msfeedssync.exe
10752 bytes
Created:  24.02.2012 12:59
Modified: 24.02.2012 12:59
Company:  Microsoft Corporation
Parameters:    sync
Schedule:      At 20:24:42 every day
Next Run Time: 02.08.2012 22:24:42
Status:        Ready
Creator:       Ninchen-PC\Ninchen
Comments:      Aktualisiert veraltete Systemfeeds.
----------

************************************************************
04:20:05: Scanning ----- SHELLICONOVERLAYIDENTIFIERS -----
Key:   SharingPrivate
CLSID: {08244EE6-92F0-47f2-9FC9-929BAA2E7235}
File:  %SystemRoot%\system32\ntshrui.dll
C:\Windows\System32\ntshrui.dll
509952 bytes
Created:  21.02.2012 11:38
Modified: 04.01.2012 12:44
Company:  Microsoft Corporation
----------

************************************************************
04:20:05: Scanning ----- DEVICE DRIVER ENTRIES -----
Value: msacm.l3acm
File:  C:\Windows\SysWOW64\l3codeca.acm
C:\Windows\SysWOW64\l3codeca.acm
64000 bytes
Created:  14.07.2009 02:07
Modified: 14.07.2009 03:14
Company:  Fraunhofer Institut Integrierte Schaltungen IIS
----------
Value: vidc.cvid
File:  iccvid.dll
iccvid.dll - [file not found to scan]
----------
Value: msacm.siren
File:  sirenacm.dll
sirenacm.dll - [file not found to scan]
----------
Value: msacm.l3codecp
File:  l3codecp.acm
C:\Windows\System32\l3codecp.acm
182272 bytes
Created:  14.07.2009 02:23
Modified: 14.07.2009 03:38
Company:  Fraunhofer Institut Integrierte Schaltungen IIS
----------

************************************************************
04:20:07: ----- ADDITIONAL CHECKS -----
Heuristic checks for hidden files/drivers completed
----------
Layered Service Provider entries checks completed
----------
Windows Explorer Policies checks completed
----------
Desktop Wallpaper: C:\Users\Ninchen\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
C:\Users\Ninchen\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
4128532 bytes
Created:  26.03.2010 22:57
Modified: 11.06.2012 18:16
Company:  [no info]
----------
Web Desktop Wallpaper entry is blank
----------
DNS Server information:
Interface:   HUAWEI Mobile Connect - 3G Network Card
NameServers: 193.189.244.225 193.189.244.206
Interface:   HUAWEI Mobile Connect - 3G Network Card
NameServers: 193.189.244.225 193.189.244.206
Interface:   HUAWEI Mobile Connect - 3G Network Card
NameServers: 193.189.244.225 193.189.244.206
Interface:   HUAWEI Mobile Connect - 3G Network Card
NameServers: 193.189.244.225 193.189.244.206
Checks for rogue DNS NameServers completed
----------
Additional checks completed

************************************************************
04:20:08: Scanning ----- RUNNING PROCESSES -----

C:\Windows\System32\wininit.exe
96256 bytes
Created:  14.07.2009 01:36
Modified: 14.07.2009 03:14
Company:  Microsoft Corporation
--------------------
C:\Windows\System32\svchost.exe
20992 bytes
Created:  14.07.2009 01:19
Modified: 14.07.2009 03:14
Company:  Microsoft Corporation
--------------------
C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\stacsv64.exe
240128 bytes
Created:  25.11.2009 01:20
Modified: 22.07.2009 03:33
Company:  IDT, Inc.
--------------------
C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\AESTSr64.exe
89600 bytes
Created:  25.11.2009 01:20
Modified: 02.03.2009 23:42
Company:  Andrea Electronics Corporation
--------------------
C:\Program Files\Bonjour\mDNSResponder.exe
462184 bytes
Created:  30.08.2011 23:05
Modified: 30.08.2011 23:05
Company:  Apple Inc.
--------------------
C:\ProgramData\DatacardService\DCSHelper.exe
241664 bytes
Created:  08.05.2010 13:48
Modified: 08.05.2010 13:48
Company:  Huawei Technologies Co., Ltd.
--------------------
C:\Program Files (x86)\Hp\Digital Imaging\bin\hpqtra08.exe
275768 bytes
Created:  21.05.2009 23:13
Modified: 21.05.2009 23:13
Company:  Hewlett-Packard Co.
--------------------
C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
97680 bytes
Created:  26.02.2009 15:24
Modified: 26.02.2009 15:24
Company:  Microsoft Corporation
--------------------
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
65536 bytes
Created:  22.04.2009 18:38
Modified: 22.04.2009 18:38
Company:  Advanced Micro Devices Inc.
--------------------
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
65536 bytes
Created:  22.04.2009 18:37
Modified: 22.04.2009 18:37
Company:  ATI Technologies Inc.
--------------------
C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\datamngrUI.exe
1825720 bytes
Created:  29.07.2012 00:31
Modified: 08.07.2012 17:11
Company:  Bandoo Media, inc
--------------------
C:\Windows\System32\taskeng.exe
192000 bytes
Created:  02.07.2011 16:38
Modified: 20.11.2010 14:17
Company:  Microsoft Corporation
--------------------
C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
248784 bytes
Created:  10.04.2012 19:27
Modified: 15.05.2012 22:07
Company:  Avira Operations GmbH & Co. KG
--------------------
C:\Windows\System32\SearchIndexer.exe
427520 bytes
Created:  29.06.2011 09:25
Modified: 04.05.2011 06:28
Company:  Microsoft Corporation
--------------------
C:\Program Files\iPod\bin\iPodService.exe
936848 bytes
Created:  07.06.2012 19:33
Modified: 07.06.2012 19:33
Company:  Apple Inc.
--------------------
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
168960 bytes
Created:  21.05.2009 22:46
Modified: 21.05.2009 22:46
Company:  Hewlett-Packard Co.
--------------------
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
559104 bytes
Created:  21.05.2009 22:46
Modified: 21.05.2009 22:46
Company:  Hewlett-Packard Co.
--------------------
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
362496 bytes
Created:  21.05.2009 19:57
Modified: 21.05.2009 19:57
Company:  Hewlett-Packard
--------------------
C:\Windows\System32\wbem\WmiPrvSE.exe
257536 bytes
Created:  02.07.2011 16:38
Modified: 20.11.2010 14:17
Company:  Microsoft Corporation
--------------------
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqToaster.exe
632888 bytes
Created:  01.07.2009 15:44
Modified: 01.07.2009 15:44
Company:  
--------------------
C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe
311352 bytes
Created:  28.03.2011 17:06
Modified: 28.03.2011 17:06
Company:  Hewlett-Packard Development Company L.P.
--------------------
C:\Program Files\Windows Media Player\wmpnetwk.exe
1525248 bytes
Created:  02.07.2011 16:39
Modified: 20.11.2010 15:25
Company:  Microsoft Corporation
--------------------
C:\Windows\System32\SearchProtocolHost.exe
164352 bytes
Created:  29.06.2011 09:25
Modified: 04.05.2011 06:28
Company:  Microsoft Corporation
--------------------
C:\Program Files (x86)\Trojan Remover\Rmvtrjan.exe
FileSize:          4742392
[This is a Trojan Remover component]
--------------------
--------------------
C:\Windows\System32\SearchFilterHost.exe
86528 bytes
Created:  29.06.2011 09:25
Modified: 04.05.2011 06:28
Company:  Microsoft Corporation
--------------------

************************************************************
04:20:14: Checking HOSTS file
No malicious entries were found in the HOSTS file

************************************************************
------ INTERNET EXPLORER HOME/START/SEARCH SETTINGS ------
HKLM\Software\Microsoft\Internet Explorer\Main\"Start Page":
hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cnnb
HKLM\Software\Microsoft\Internet Explorer\Main\"Local Page":
C:\Windows\SysWOW64\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main\"Search Page":
hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Page_URL":
hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cnnb
HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Search_URL":
hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKCU\Software\Microsoft\Internet Explorer\Main\"Start Page":
hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main\"Local Page":
C:\Windows\system32\blank.htm
HKCU\Software\Microsoft\Internet Explorer\Main\"Search Page":
hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKCU\Software\Microsoft\Internet Explorer\Main\"Default_Page_URL":
hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cnnb

************************************************************
=== NO CHANGES HAVE BEEN MADE TO YOUR SYSTEM FILES ===
Scan completed at: 04:20:14 02 Aug 2012
Total Scan time: 00:01:06
************************************************************


***** NORMAL SCAN FOR ACTIVE MALWARE *****
Trojan Remover Ver 6.8.3.2601. For information, email support@simplysup.com
[Unregistered version]
Scan started at: 04:08:54 02 Aug 2012
Using Database v7848
Operating System:  Windows 7 x64 Home Premium (SP1) [Build: 6.1.7601]
File System:       NTFS
UAC is ENABLED [default level]
UserData directory: C:\Users\Ninchen\AppData\Roaming\Simply Super Software\Trojan Remover\
Database directory: C:\ProgramData\Simply Super Software\Trojan Remover\Data\
Logfile directory:  C:\Users\Ninchen\Documents\Simply Super Software\Trojan Remover Logfiles\
Program directory:  C:\Program Files (x86)\Trojan Remover\
Running with Administrator privileges

************************************************************
04:08:54: ----- CHECKING DEFAULT FILE ASSOCIATIONS -----
No modified default file associations detected

************************************************************
04:08:54: ----- SCANNING FOR ROOTKIT SERVICES -----
No hidden Services were detected.

************************************************************
04:08:54: Scanning -----WINDOWS REGISTRY-----
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
This key's "Shell" value calls the following program(s):
Key value: [explorer.exe]
File: explorer.exe
C:\Windows\system32\explorer.exe
2616320 bytes
Created:  27.04.2011 11:45
Modified: 25.02.2011 07:30
Company:  Microsoft Corporation
----------
This key's "Userinit" value calls the following program(s):
Key value: [C:\Windows\system32\userinit.exe]
File: C:\Windows\system32\userinit.exe
C:\Windows\SysWOW64\userinit.exe
30720 bytes
Created:  02.07.2011 16:38
Modified: 20.11.2010 15:25
Company:  Microsoft Corporation
----------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: StartCCC
Value Data: "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
98304 bytes
Created:  02.07.2009 13:32
Modified: 02.07.2009 13:32
Company:  Advanced Micro Devices, Inc.
--------------------
Value Name: HPCam_Menu
Value Data: "c:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" "c:\Program Files (x86)\Hewlett-Packard\Media\Webcam" UpdateWithCreateOnce "Software\Hewlett-Packard\Media\Webcam"
c:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe
218408 bytes
Created:  25.02.2009 15:40
Modified: 25.02.2009 15:40
Company:  CyberLink Corp.
--------------------
Value Name: QlbCtrl.exe
Value Data: C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
320056 bytes
Created:  01.10.2009 19:20
Modified: 24.06.2009 14:57
Company:   Hewlett-Packard Development Company, L.P.
--------------------
Value Name: UpdatePRCShortCut
Value Data: "C:\Program Files (x86)\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Hewlett-Packard\Recovery" UpdateWithCreateOnce "Software\CyberLink\PowerRecover"
C:\Program Files (x86)\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe
222504 bytes
Created:  19.05.2009 22:16
Modified: 19.05.2009 22:16
Company:  CyberLink Corp.
--------------------
Value Name: Adobe Reader Speed Launcher
Value Data: "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe
37296 bytes
Created:  04.01.2012 08:51
Modified: 04.01.2012 08:51
Company:  Adobe Systems Incorporated
--------------------
Value Name: Easybits Recovery
Value Data: C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe - [file not found to scan]
--------------------
Value Name: HP Software Update
Value Data: C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
54576 bytes
Created:  08.12.2008 14:50
Modified: 08.12.2008 14:50
Company:  Hewlett-Packard
--------------------
Value Name: 
Value Data: 
Blank entry: []
--------------------
Value Name: Adobe ARM
Value Data: "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
843712 bytes
Created:  11.12.2009 15:57
Modified: 03.01.2012 09:37
Company:  Adobe Systems Incorporated
--------------------
Value Name: WirelessAssistant
Value Data: C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
500792 bytes
Created:  23.03.2010 13:47
Modified: 23.03.2010 13:47
Company:  Hewlett-Packard Company
--------------------
Value Name: QuickTime Task
Value Data: "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
C:\Program Files (x86)\QuickTime\QTTask.exe
421888 bytes
Created:  29.11.2010 18:38
Modified: 29.11.2010 18:38
Company:  Apple Inc.
--------------------
Value Name: SunJavaUpdateSched
Value Data: "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
249064 bytes
Created:  29.10.2010 14:49
Modified: 29.10.2010 14:49
Company:  Sun Microsystems, Inc.
--------------------
Value Name: APSDaemon
Value Data: "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
59280 bytes
Created:  30.05.2012 20:06
Modified: 30.05.2012 20:06
Company:  Apple Inc.
--------------------
Value Name: avgnt
Value Data: "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
348624 bytes
Created:  10.04.2012 19:27
Modified: 15.05.2012 22:07
Company:  Avira Operations GmbH & Co. KG
--------------------
Value Name: iTunesHelper
Value Data: "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
C:\Program Files (x86)\iTunes\iTunesHelper.exe
421776 bytes
Created:  07.06.2012 19:33
Modified: 07.06.2012 19:33
Company:  Apple Inc.
--------------------
Value Name: DATAMNGR
Value Data: C:\PROGRA~2\WIA6EB~1\Datamngr\DATAMN~1.EXE
C:\PROGRA~2\WIA6EB~1\Datamngr\DATAMN~1.EXE
1825720 bytes
Created:  29.07.2012 00:31
Modified: 08.07.2012 17:11
Company:  Bandoo Media, inc
--------------------
Value Name: TrojanScanner
Value Data: C:\Program Files (x86)\Trojan Remover\Trjscan.exe /boot
C:\Program Files (x86)\Trojan Remover\Trjscan.exe
1238800 bytes
Created:  02.08.2012 04:08
Modified: 23.01.2012 14:12
Company:  Simply Super Software
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Value Name: HPADVISOR
Value Data: C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe view=DOCKVIEW
C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe
1668664 bytes
Created:  15.07.2009 17:51
Modified: 15.07.2009 17:51
Company:  Hewlett-Packard
--------------------
Value Name: LightScribe Control Panel
Value Data: C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
2363392 bytes
Created:  17.06.2009 13:13
Modified: 17.06.2009 13:13
Company:  Hewlett-Packard Company
--------------------
Value Name: Sidebar
Value Data: C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
C:\Program Files\Windows Sidebar\sidebar.exe
1475584 bytes
Created:  02.07.2011 16:39
Modified: 20.11.2010 15:25
Company:  Microsoft Corporation
--------------------
Value Name: DAEMON Tools Lite
Value Data: "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
1305408 bytes
Created:  20.01.2011 11:20
Modified: 20.01.2011 11:20
Company:  DT Soft Ltd
--------------------
Value Name: RESTART_STICKY_NOTES
Value Data: C:\Windows\System32\StikyNot.exe
C:\Windows\SysWOW64\StikyNot.exe
427520 bytes
Created:  14.07.2009 01:57
Modified: 14.07.2009 03:39
Company:  Microsoft Corporation
--------------------
Value Name: Sony PC Companion
Value Data: "C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe" /Background
C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe - [file not found to scan]
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty

************************************************************
04:08:57: Scanning -----SHELLEXECUTEHOOKS-----
ShellExecuteHooks key is empty

************************************************************
04:08:57: Scanning -----HIDDEN REGISTRY ENTRIES-----
Taskdir check completed
----------
No Hidden File-loading Registry Entries found
----------

************************************************************
04:08:57: Scanning -----ACTIVE SCREENSAVER-----
ScreenSaver: C:\Windows\system32\scrnsave.scr
C:\Windows\SysWOW64\scrnsave.scr
11264 bytes
Created:  14.07.2009 01:56
Modified: 14.07.2009 03:38
Company:  Microsoft Corporation
--------------------

************************************************************
04:08:58: Scanning ----- REGISTRY ACTIVE SETUP KEYS -----
Key:  >{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
Path: %SystemRoot%\system32\unregmp2.exe /ShowWMP
C:\Windows\SysWOW64\unregmp2.exe
323584 bytes
Created:  14.07.2009 02:23
Modified: 14.07.2009 03:39
Company:  Microsoft Corporation
----------
Key:  >{26923b43-4d38-484f-9b9e-de460746276c}
Path: C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
C:\Windows\SysWOW64\ie4uinit.exe
74240 bytes
Created:  24.02.2012 12:59
Modified: 24.02.2012 12:59
Company:  Microsoft Corporation
----------
Key:  >{60B49E34-C7CC-11D0-8953-00A0C90347FF}
Path: "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
C:\Windows\SysWOW64\iedkcs32.dll
353584 bytes
Created:  24.02.2012 12:59
Modified: 24.02.2012 12:59
Company:  Microsoft Corporation
----------
Key:  {10880D85-AAD9-4558-ABDC-2AB1552D831F}
Path: "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"
C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe
451872 bytes
Created:  17.06.2009 13:11
Modified: 17.06.2009 13:11
Company:  Hewlett-Packard Company
----------
Key:  {2C7339CF-2B09-4501-B3F3-F3508C9228ED}
Path: %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
C:\Windows\SysWOW64\themeui.dll
2851840 bytes
Created:  02.07.2011 16:38
Modified: 20.11.2010 15:27
Company:  Microsoft Corporation
----------
Key:  {44BBA840-CC51-11CF-AAFA-00AA00B6015C}
Path: "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
C:\Program Files (x86)\Windows Mail\WinMail.exe
Key:  {6BF52A52-394A-11d3-B153-00C04F79FAA6}
Path: %SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI
C:\Windows\SysWOW64\unregmp2.exe
323584 bytes
Created:  14.07.2009 02:23
Modified: 14.07.2009 03:39
Company:  Microsoft Corporation
----------
Key:  {89820200-ECBD-11cf-8B85-00AA005B4383}
Path: C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
C:\Windows\SysWOW64\ie4uinit.exe
74240 bytes
Created:  24.02.2012 12:59
Modified: 24.02.2012 12:59
Company:  Microsoft Corporation
----------
Key:  {89B4C1CD-B018-4511-B0A1-5476DBF70820}
Path: C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
C:\Windows\SysWOW64\mscories.dll
80720 bytes
Created:  02.07.2011 16:37
Modified: 05.11.2010 03:58
Company:  Microsoft Corporation
----------

************************************************************
04:08:59: Scanning ----- SERVICEDLL REGISTRY KEYS -----
Key:  ezSharedSvc
Path: C:\Windows\System32\ezsvc7.dll
C:\Windows\System32\ezsvc7.dll
129584 bytes
Created:  01.10.2009 20:57
Modified: 22.02.2009 12:00
Company:  EasyBits Sofware AS
--------------------
Key:  hpqcxs08
Path: C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll
248832 bytes
Created:  21.05.2009 23:13
Modified: 21.05.2009 23:13
Company:  Hewlett-Packard Co.
--------------------
Key:  hpqddsvc
Path: C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll
133120 bytes
Created:  21.05.2009 23:03
Modified: 21.05.2009 23:03
Company:  Hewlett-Packard Co.
--------------------
Key:  HPSLPSVC
Path: C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL
C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL
923136 bytes
Created:  21.05.2009 22:35
Modified: 21.05.2009 22:35
Company:  Hewlett-Packard Co.
--------------------

************************************************************
04:09:00: Scanning ----- SERVICES REGISTRY KEYS -----
Key:       Accelerometer
ImagePath: system32\DRIVERS\Accelerometer.sys
C:\Windows\SysWOW64\DRIVERS\Accelerometer.sys
41272 bytes
Created:  08.07.2009 14:48
Modified: 08.07.2009 14:48
Company:  Hewlett-Packard
----------
Key:       AdobeFlashPlayerUpdateSvc
ImagePath: C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
250056 bytes
Created:  14.07.2012 23:15
Modified: 28.07.2012 03:12
Company:  Adobe Systems Incorporated
----------
Key:       adp94xx
ImagePath: system32\DRIVERS\adp94xx.sys
C:\Windows\SysWOW64\DRIVERS\adp94xx.sys
491088 bytes
Created:  10.06.2009 22:36
Modified: 14.07.2009 03:52
Company:  Adaptec, Inc.
----------
Key:       adpahci
ImagePath: system32\DRIVERS\adpahci.sys
C:\Windows\SysWOW64\DRIVERS\adpahci.sys
339536 bytes
Created:  13.07.2009 23:59
Modified: 14.07.2009 03:52
Company:  Adaptec, Inc.
----------
Key:       adpu320
ImagePath: system32\DRIVERS\adpu320.sys
C:\Windows\SysWOW64\DRIVERS\adpu320.sys
182864 bytes
Created:  13.07.2009 23:59
Modified: 14.07.2009 03:52
Company:  Adaptec, Inc.
----------
Key:       AESTFilters
ImagePath: C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\AESTSr64.exe
C:\Windows\SysWOW64\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\AESTSr64.exe
89600 bytes
Created:  25.11.2009 01:20
Modified: 02.03.2009 23:42
Company:  Andrea Electronics Corporation
----------
Key:       AgereSoftModem
ImagePath: system32\DRIVERS\agrsm64.sys
C:\Windows\SysWOW64\DRIVERS\agrsm64.sys
1146880 bytes
Created:  10.06.2009 23:01
Modified: 10.06.2009 23:01
Company:  LSI Corp
----------
Key:       AMD External Events Utility
ImagePath: %SystemRoot%\system32\atiesrxx.exe
C:\Windows\SysWOW64\atiesrxx.exe
203264 bytes
Created:  02.07.2009 20:16
Modified: 02.07.2009 20:16
Company:  AMD
----------
Key:       amdide
ImagePath: system32\drivers\amdide.sys
C:\Windows\SysWOW64\drivers\amdide.sys
15440 bytes
Created:  14.07.2009 01:19
Modified: 14.07.2009 03:52
Company:  Microsoft Corporation
----------
Key:       AmdPPM
ImagePath: system32\DRIVERS\amdppm.sys
C:\Windows\SysWOW64\DRIVERS\amdppm.sys
60928 bytes
Created:  14.07.2009 01:19
Modified: 14.07.2009 01:19
Company:  Microsoft Corporation
----------
Key:       amdsata
ImagePath: system32\drivers\amdsata.sys
C:\Windows\SysWOW64\drivers\amdsata.sys
107904 bytes
Created:  27.04.2011 11:45
Modified: 11.03.2011 08:41
Company:  Advanced Micro Devices
----------
Key:       amdsbs
ImagePath: system32\DRIVERS\amdsbs.sys
C:\Windows\SysWOW64\DRIVERS\amdsbs.sys
194128 bytes
Created:  10.06.2009 22:37
Modified: 14.07.2009 03:52
Company:  AMD Technologies Inc.
----------
Key:       amdxata
ImagePath: system32\drivers\amdxata.sys
C:\Windows\SysWOW64\drivers\amdxata.sys
27008 bytes
Created:  27.04.2011 11:45
Modified: 11.03.2011 08:41
Company:  Advanced Micro Devices
----------
Key:       AntiVirSchedulerService
ImagePath: "C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe"
C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
86224 bytes
Created:  10.04.2012 19:27
Modified: 15.05.2012 22:07
Company:  Avira Operations GmbH & Co. KG
----------
Key:       AntiVirService
ImagePath: "C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe"
C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
110032 bytes
Created:  10.04.2012 19:27
Modified: 15.05.2012 22:07
Company:  Avira Operations GmbH & Co. KG
----------
Key:       Apple Mobile Device
ImagePath: "C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
55184 bytes
Created:  24.05.2012 13:28
Modified: 24.05.2012 13:28
Company:  Apple Inc.
----------
Key:       arc
ImagePath: system32\DRIVERS\arc.sys
C:\Windows\SysWOW64\DRIVERS\arc.sys
87632 bytes
Created:  13.07.2009 23:59
Modified: 14.07.2009 03:52
Company:  Adaptec, Inc.
----------
Key:       arcsas
ImagePath: system32\DRIVERS\arcsas.sys
C:\Windows\SysWOW64\DRIVERS\arcsas.sys
97856 bytes
Created:  13.07.2009 23:59
Modified: 14.07.2009 03:52
Company:  Adaptec, Inc.
----------
Key:       atapi
ImagePath: system32\drivers\atapi.sys
C:\Windows\SysWOW64\drivers\atapi.sys
24128 bytes
Created:  14.07.2009 01:19
Modified: 14.07.2009 03:52
Company:  Microsoft Corporation
----------
Key:       athr
ImagePath: system32\DRIVERS\athrx.sys
C:\Windows\SysWOW64\DRIVERS\athrx.sys
1484800 bytes
Created:  22.09.2009 02:47
Modified: 22.09.2009 02:47
Company:  Atheros Communications, Inc.
----------
Key:       AtiHdmiService
ImagePath: system32\drivers\AtiHdmi.sys
C:\Windows\SysWOW64\drivers\AtiHdmi.sys
114192 bytes
Created:  05.06.2009 12:20
Modified: 05.06.2009 12:20
Company:  ATI Research Inc.
----------
Key:       AtiPcie
ImagePath: system32\DRIVERS\AtiPcie.sys
C:\Windows\SysWOW64\DRIVERS\AtiPcie.sys
16440 bytes
Created:  05.05.2009 07:30
Modified: 05.05.2009 07:30
Company:  Advanced Micro Devices Inc.
----------
Key:       avkmgr
ImagePath: system32\DRIVERS\avkmgr.sys
C:\Windows\SysWOW64\DRIVERS\avkmgr.sys
27760 bytes
Created:  10.04.2012 19:27
Modified: 16.09.2011 16:08
Company:  Avira GmbH
----------
Key:       b06bdrv
ImagePath: \SystemRoot\system32\DRIVERS\bxvbda.sys
C:\Windows\SysWOW64\DRIVERS\bxvbda.sys
468480 bytes
Created:  10.06.2009 22:34
Modified: 10.06.2009 22:34
Company:  Broadcom Corporation
----------
Key:       b57nd60a
ImagePath: system32\DRIVERS\b57nd60a.sys
C:\Windows\SysWOW64\DRIVERS\b57nd60a.sys
270848 bytes
Created:  10.06.2009 22:34
Modified: 10.06.2009 22:34
Company:  Broadcom Corporation
----------
Key:       circlass
ImagePath: system32\DRIVERS\circlass.sys
C:\Windows\SysWOW64\DRIVERS\circlass.sys
45568 bytes
Created:  14.07.2009 02:06
Modified: 14.07.2009 02:06
Company:  Microsoft Corporation
----------
Key:       clr_optimization_v2.0.50727_64
ImagePath: %systemroot%\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
89920 bytes
Created:  13.07.2009 22:37
Modified: 10.06.2009 22:39
Company:  Microsoft Corporation
----------
Key:       clr_optimization_v4.0.30319_32
ImagePath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
130384 bytes
Created:  18.03.2010 13:16
Modified: 18.03.2010 13:16
Company:  Microsoft Corporation
----------
Key:       clr_optimization_v4.0.30319_64
ImagePath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
138576 bytes
Created:  18.03.2010 14:27
Modified: 18.03.2010 14:27
Company:  Microsoft Corporation
----------
Key:       cmdide
ImagePath: system32\drivers\cmdide.sys
C:\Windows\SysWOW64\drivers\cmdide.sys
17488 bytes
Created:  14.07.2009 01:19
Modified: 14.07.2009 03:52
Company:  CMD Technology, Inc.
----------
Key:       Com4QLBEx
ImagePath: "C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe"
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
228408 bytes
Created:  01.10.2009 19:20
Modified: 05.05.2009 10:11
Company:  Hewlett-Packard Development Company, L.P.
----------
Key:       CompositeBus
ImagePath: \SystemRoot\system32\drivers\CompositeBus.sys
C:\Windows\SysWOW64\drivers\CompositeBus.sys
38912 bytes
Created:  02.07.2011 16:37
Modified: 20.11.2010 12:33
Company:  Microsoft Corporation
----------
Key:       DCService.exe
ImagePath: C:\ProgramData\DatacardService\DCService.exe
C:\ProgramData\DatacardService\DCService.exe
229376 bytes
Created:  08.05.2010 13:48
Modified: 08.05.2010 13:48
Company:  
----------
Key:       Dot4
ImagePath: system32\DRIVERS\Dot4.sys
C:\Windows\SysWOW64\DRIVERS\Dot4.sys
145920 bytes
Created:  14.07.2009 02:00
Modified: 14.07.2009 02:00
Company:  Microsoft Corporation
----------
Key:       Dot4Print
ImagePath: \SystemRoot\system32\drivers\Dot4Prt.sys
C:\Windows\SysWOW64\drivers\Dot4Prt.sys
19968 bytes
Created:  02.07.2011 16:37
Modified: 20.11.2010 12:32
Company:  Microsoft Corporation
----------
Key:       dot4usb
ImagePath: system32\DRIVERS\dot4usb.sys
C:\Windows\SysWOW64\DRIVERS\dot4usb.sys
43008 bytes
Created:  14.07.2009 02:00
Modified: 14.07.2009 02:00
Company:  Microsoft Corporation
----------
Key:       dtsoftbus01
ImagePath: system32\DRIVERS\dtsoftbus01.sys
C:\Windows\SysWOW64\DRIVERS\dtsoftbus01.sys
254528 bytes
Created:  21.10.2011 21:01
Modified: 21.10.2011 21:01
Company:  DT Soft Ltd
----------
Key:       ebdrv
ImagePath: \SystemRoot\system32\DRIVERS\evbda.sys
C:\Windows\SysWOW64\DRIVERS\evbda.sys
3286016 bytes
Created:  10.06.2009 22:34
Modified: 10.06.2009 22:34
Company:  Broadcom Corporation
----------
Key:       elxstor
ImagePath: system32\DRIVERS\elxstor.sys
C:\Windows\SysWOW64\DRIVERS\elxstor.sys
530496 bytes
Created:  10.06.2009 22:36
Modified: 14.07.2009 03:47
Company:  Emulex
----------
Key:       enecir
ImagePath: system32\DRIVERS\enecir.sys
C:\Windows\SysWOW64\DRIVERS\enecir.sys
70656 bytes
Created:  29.06.2009 20:17
Modified: 29.06.2009 20:17
Company:  ENE TECHNOLOGY INC.
----------
Key:       ewusbnet
ImagePath: system32\DRIVERS\ewusbnet.sys
C:\Windows\SysWOW64\DRIVERS\ewusbnet.sys
250368 bytes
Created:  12.07.2011 18:34
Modified: 07.04.2010 17:05
Company:  Huawei Technologies Co., Ltd.
----------
Key:       ew_hwusbdev
ImagePath: system32\DRIVERS\ew_hwusbdev.sys
C:\Windows\SysWOW64\DRIVERS\ew_hwusbdev.sys
114560 bytes
Created:  12.07.2011 18:33
Modified: 20.03.2010 11:56
Company:  Huawei Technologies Co., Ltd.
----------
Key:       FontCache3.0.0.0
ImagePath: %systemroot%\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
42856 bytes
Created:  02.07.2011 16:38
Modified: 05.11.2010 03:53
Company:  Microsoft Corporation
----------
Key:       GameConsoleService
ImagePath: "C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe"
C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe
250616 bytes
Created:  22.05.2009 20:02
Modified: 22.05.2009 20:02
Company:  WildTangent, Inc.
----------
Key:       ggflt
ImagePath: system32\DRIVERS\ggflt.sys
C:\Windows\SysWOW64\DRIVERS\ggflt.sys
13352 bytes
Created:  24.01.2012 10:18
Modified: 24.01.2012 10:18
Company:  Sony Ericsson Mobile Communications
----------
Key:       ggsemc
ImagePath: system32\DRIVERS\ggsemc.sys
C:\Windows\SysWOW64\DRIVERS\ggsemc.sys
27176 bytes
Created:  24.01.2012 10:18
Modified: 24.01.2012 10:18
Company:  Sony Ericsson Mobile Communications
----------
Key:       HdAudAddService
ImagePath: \SystemRoot\system32\drivers\HdAudio.sys
C:\Windows\SysWOW64\drivers\HdAudio.sys
350208 bytes
Created:  02.07.2011 16:37
Modified: 20.11.2010 12:44
Company:  Microsoft Corporation
----------
Key:       HidIr
ImagePath: system32\DRIVERS\hidir.sys
C:\Windows\SysWOW64\DRIVERS\hidir.sys
46592 bytes
Created:  14.07.2009 02:06
Modified: 14.07.2009 02:06
Company:  Microsoft Corporation
----------
Key:       HP Support Assistant Service
ImagePath: "C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe"
C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
86072 bytes
Created:  09.09.2011 17:10
Modified: 09.09.2011 17:10
Company:  Hewlett-Packard Company
----------
Key:       HPDrvMntSvc.exe
ImagePath: "C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe"
C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
94264 bytes
Created:  28.03.2011 17:07
Modified: 28.03.2011 17:07
Company:  Hewlett-Packard Company
----------
Key:       hpdskflt
ImagePath: system32\DRIVERS\hpdskflt.sys
C:\Windows\SysWOW64\DRIVERS\hpdskflt.sys
30008 bytes
Created:  08.07.2009 14:49
Modified: 08.07.2009 14:49
Company:  Hewlett-Packard
----------
Key:       HpqKbFiltr
ImagePath: \SystemRoot\system32\DRIVERS\HpqKbFiltr.sys
C:\Windows\SysWOW64\DRIVERS\HpqKbFiltr.sys
18432 bytes
Created:  01.10.2009 19:20
Modified: 29.04.2009 08:48
Company:  Hewlett-Packard Development Company, L.P.
----------
Key:       hpqwmiex
ImagePath: "C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe"
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
799800 bytes
Created:  28.03.2011 17:03
Modified: 28.03.2011 17:03
Company:  Hewlett-Packard Company
----------
Key:       HpSAMD
ImagePath: system32\drivers\HpSAMD.sys
C:\Windows\SysWOW64\drivers\HpSAMD.sys
78720 bytes
Created:  02.07.2011 16:38
Modified: 20.11.2010 15:33
Company:  Hewlett-Packard Company
----------
Key:       hpsrv
ImagePath: %SystemRoot%\system32\Hpservice.exe
C:\Windows\SysWOW64\Hpservice.exe
30520 bytes
Created:  08.07.2009 14:49
Modified: 08.07.2009 14:49
Company:  Hewlett-Packard
----------
Key:       huawei_enumerator
ImagePath: system32\DRIVERS\ew_jubusenum.sys
C:\Windows\SysWOW64\DRIVERS\ew_jubusenum.sys
76288 bytes
Created:  12.07.2011 18:34
Modified: 09.04.2010 15:24
Company:  Huawei Technologies Co., Ltd.
----------
Key:       hwdatacard
ImagePath: system32\DRIVERS\ewusbmdm.sys
C:\Windows\SysWOW64\DRIVERS\ewusbmdm.sys
120704 bytes
Created:  12.07.2011 18:34
Modified: 25.03.2010 10:08
Company:  Huawei Technologies Co., Ltd.
----------
Key:       iaStorV
ImagePath: system32\drivers\iaStorV.sys
C:\Windows\SysWOW64\drivers\iaStorV.sys
410496 bytes
Created:  27.04.2011 11:45
Modified: 11.03.2011 08:41
Company:  Intel Corporation
----------
Key:       idsvc
ImagePath: "%systemroot%\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe"
C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
856400 bytes
Created:  02.07.2011 16:38
Modified: 05.11.2010 03:52
Company:  Microsoft Corporation
----------
Key:       igfx
ImagePath: system32\DRIVERS\igdkmd64.sys
C:\Windows\SysWOW64\DRIVERS\igdkmd64.sys
6108416 bytes
Created:  10.06.2009 22:37
Modified: 10.06.2009 22:37
Company:  Intel Corporation
----------
Key:       iirsp
ImagePath: system32\DRIVERS\iirsp.sys
C:\Windows\SysWOW64\DRIVERS\iirsp.sys
44112 bytes
Created:  13.07.2009 23:59
Modified: 14.07.2009 03:48
Company:  Intel Corp./ICP vortex GmbH
----------
Key:       JMCR
ImagePath: system32\DRIVERS\jmcr.sys
C:\Windows\SysWOW64\DRIVERS\jmcr.sys
140712 bytes
Created:  21.07.2009 05:39
Modified: 21.07.2009 05:39
Company:  JMicron Technology Corporation
----------
Key:       kbdclass
ImagePath: \SystemRoot\system32\drivers\kbdclass.sys
C:\Windows\SysWOW64\drivers\kbdclass.sys
50768 bytes
Created:  14.07.2009 01:19
Modified: 14.07.2009 03:48
Company:  Microsoft Corporation
----------
Key:       kbdhid
ImagePath: \SystemRoot\system32\drivers\kbdhid.sys
C:\Windows\SysWOW64\drivers\kbdhid.sys
33280 bytes
Created:  02.07.2011 16:37
Modified: 20.11.2010 12:33
Company:  Microsoft Corporation
----------
Key:       ksthunk
ImagePath: \SystemRoot\system32\drivers\ksthunk.sys
C:\Windows\SysWOW64\drivers\ksthunk.sys
20992 bytes
Created:  14.07.2009 02:00
Modified: 14.07.2009 02:00
Company:  Microsoft Corporation
----------
Key:       LightScribeService
ImagePath: "C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe"
C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
73728 bytes
Created:  17.06.2009 13:21
Modified: 17.06.2009 13:21
Company:  Hewlett-Packard Company
----------
Key:       LSI_FC
ImagePath: system32\DRIVERS\lsi_fc.sys
C:\Windows\SysWOW64\DRIVERS\lsi_fc.sys
114752 bytes
Created:  13.07.2009 23:59
Modified: 14.07.2009 03:48
Company:  LSI Corporation
----------
Key:       LSI_SAS
ImagePath: system32\DRIVERS\lsi_sas.sys
C:\Windows\SysWOW64\DRIVERS\lsi_sas.sys
106560 bytes
Created:  13.07.2009 23:59
Modified: 14.07.2009 03:48
Company:  LSI Corporation
----------
Key:       LSI_SAS2
ImagePath: system32\DRIVERS\lsi_sas2.sys
C:\Windows\SysWOW64\DRIVERS\lsi_sas2.sys
65600 bytes
Created:  13.07.2009 23:59
Modified: 14.07.2009 03:48
Company:  LSI Corporation
----------
Key:       LSI_SCSI
ImagePath: system32\DRIVERS\lsi_scsi.sys
C:\Windows\SysWOW64\DRIVERS\lsi_scsi.sys
115776 bytes
Created:  13.07.2009 23:59
Modified: 14.07.2009 03:48
Company:  LSI Corporation
----------
Key:       MDM
ImagePath: "C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe"
C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
335872 bytes
Created:  26.10.2006 13:40
Modified: 26.10.2006 13:40
Company:  Microsoft Corporation
----------
Key:       megasas
ImagePath: system32\DRIVERS\megasas.sys
C:\Windows\SysWOW64\DRIVERS\megasas.sys
35392 bytes
Created:  10.06.2009 22:37
Modified: 14.07.2009 03:48
Company:  LSI Corporation
----------
Key:       MegaSR
ImagePath: system32\DRIVERS\MegaSR.sys
C:\Windows\SysWOW64\DRIVERS\MegaSR.sys
284736 bytes
Created:  13.07.2009 23:59
Modified: 14.07.2009 03:48
Company:  LSI Corporation, Inc.
----------
Key:       MozillaMaintenance
ImagePath: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
113120 bytes
Created:  02.05.2012 23:04
Modified: 20.07.2012 00:20
Company:  Mozilla Foundation
----------
Key:       mpio
ImagePath: system32\drivers\mpio.sys
C:\Windows\SysWOW64\drivers\mpio.sys
155008 bytes
Created:  02.07.2011 16:37
Modified: 20.11.2010 15:33
Company:  Microsoft Corporation
----------
Key:       msahci
ImagePath: system32\drivers\msahci.sys
C:\Windows\SysWOW64\drivers\msahci.sys
31104 bytes
Created:  02.07.2011 16:38
Modified: 20.11.2010 15:33
Company:  Microsoft Corporation
----------
Key:       msdsm
ImagePath: system32\drivers\msdsm.sys
C:\Windows\SysWOW64\drivers\msdsm.sys
140672 bytes
Created:  02.07.2011 16:38
Modified: 20.11.2010 15:33
Company:  Microsoft Corporation
----------
Key:       mssmbios
ImagePath: \SystemRoot\system32\drivers\mssmbios.sys
C:\Windows\SysWOW64\drivers\mssmbios.sys
32320 bytes
Created:  14.07.2009 01:31
Modified: 14.07.2009 03:48
Company:  Microsoft Corporation
----------
Key:       netw5v64
ImagePath: system32\DRIVERS\netw5v64.sys
C:\Windows\SysWOW64\DRIVERS\netw5v64.sys
5434368 bytes
Created:  10.06.2009 22:35
Modified: 10.06.2009 22:35
Company:  Intel Corporation
----------
Key:       nfrd960
ImagePath: system32\DRIVERS\nfrd960.sys
C:\Windows\SysWOW64\DRIVERS\nfrd960.sys
51264 bytes
Created:  13.07.2009 23:59
Modified: 14.07.2009 03:48
Company:  IBM Corporation
----------
Key:       nvraid
ImagePath: system32\drivers\nvraid.sys
C:\Windows\SysWOW64\drivers\nvraid.sys
148352 bytes
Created:  27.04.2011 11:45
Modified: 11.03.2011 08:41
Company:  NVIDIA Corporation
----------
Key:       nvstor
ImagePath: system32\drivers\nvstor.sys
C:\Windows\SysWOW64\drivers\nvstor.sys
166272 bytes
Created:  27.04.2011 11:45
Modified: 11.03.2011 08:41
Company:  NVIDIA Corporation
----------
Key:       odserv
ImagePath: "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE"
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
440696 bytes
Created:  20.07.2011 05:18
Modified: 20.07.2011 05:18
Company:  Microsoft Corporation
----------
Key:       ose
ImagePath: "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
145184 bytes
Created:  26.10.2006 14:03
Modified: 26.10.2006 14:03
Company:  Microsoft Corporation
----------
Key:       PerfHost
ImagePath: %SystemRoot%\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
20992 bytes
Created:  14.07.2009 01:11
Modified: 14.07.2009 03:14
Company:  Microsoft Corporation
----------
Key:       ql2300
ImagePath: system32\DRIVERS\ql2300.sys
C:\Windows\SysWOW64\DRIVERS\ql2300.sys
1524816 bytes
Created:  10.06.2009 22:37
Modified: 14.07.2009 03:45
Company:  QLogic Corporation
----------
Key:       ql40xx
ImagePath: system32\DRIVERS\ql40xx.sys
C:\Windows\SysWOW64\DRIVERS\ql40xx.sys
128592 bytes
Created:  13.07.2009 23:59
Modified: 14.07.2009 03:45
Company:  QLogic Corporation
----------
Key:       rdpbus
ImagePath: \SystemRoot\system32\DRIVERS\rdpbus.sys
C:\Windows\SysWOW64\DRIVERS\rdpbus.sys
24064 bytes
Created:  14.07.2009 02:17
Modified: 14.07.2009 02:17
Company:  Microsoft Corporation
----------
Key:       RichVideo
ImagePath: "C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe"
C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
247152 bytes
Created:  01.10.2009 20:46
Modified: 21.01.2009 20:47
Company:  
----------
Key:       RTL8167
ImagePath: system32\DRIVERS\Rt64win7.sys
C:\Windows\SysWOW64\DRIVERS\Rt64win7.sys
215040 bytes
Created:  25.11.2009 01:19
Modified: 23.05.2009 08:52
Company:  Realtek                                            
----------
Key:       SbFw
ImagePath: system32\drivers\SbFw.sys
C:\Windows\SysWOW64\drivers\SbFw.sys
253528 bytes
Created:  10.04.2012 14:44
Modified: 05.04.2011 17:35
Company:  Sunbelt Software, Inc.
----------
Key:       SBFWIMCL
ImagePath: system32\DRIVERS\sbfwim.sys
C:\Windows\SysWOW64\DRIVERS\sbfwim.sys
84568 bytes
Created:  10.04.2012 14:44
Modified: 08.02.2011 09:14
Company:  Sunbelt Software, Inc.
----------
Key:       SBFWIMCLMP
ImagePath: system32\DRIVERS\SBFWIM.sys
C:\Windows\SysWOW64\DRIVERS\SBFWIM.sys
84568 bytes
Created:  10.04.2012 14:44
Modified: 08.02.2011 09:14
Company:  Sunbelt Software, Inc.
----------
Key:       sbhips
ImagePath: system32\drivers\sbhips.sys
C:\Windows\SysWOW64\drivers\sbhips.sys
60504 bytes
Created:  10.04.2012 14:44
Modified: 05.04.2011 17:35
Company:  Sunbelt Software, Inc.
----------
Key:       SBRE
ImagePath: \??\C:\Windows\system32\drivers\SBREdrv.sys
C:\Windows\system32\drivers\SBREdrv.sys - [file not found to scan]
----------
Key:       SbTis
ImagePath: system32\drivers\sbtis.sys
C:\Windows\SysWOW64\drivers\sbtis.sys
94296 bytes
Created:  10.04.2012 14:44
Modified: 05.04.2011 17:35
Company:  Sunbelt Software, Inc.
----------
Key:       sdbus
ImagePath: \SystemRoot\system32\drivers\sdbus.sys
C:\Windows\SysWOW64\drivers\sdbus.sys
109056 bytes
Created:  02.07.2011 16:37
Modified: 20.11.2010 11:37
Company:  Microsoft Corporation
----------
Key:       Serenum
ImagePath: \SystemRoot\system32\DRIVERS\serenum.sys
C:\Windows\SysWOW64\DRIVERS\serenum.sys
23552 bytes
Created:  14.07.2009 02:00
Modified: 14.07.2009 02:00
Company:  Microsoft Corporation
----------
Key:       Serial
ImagePath: \SystemRoot\system32\DRIVERS\serial.sys
C:\Windows\SysWOW64\DRIVERS\serial.sys
94208 bytes
Created:  14.07.2009 02:00
Modified: 14.07.2009 02:00
Company:  Microsoft Corporation
----------
Key:       SiSRaid2
ImagePath: system32\DRIVERS\SiSRaid2.sys
C:\Windows\SysWOW64\DRIVERS\SiSRaid2.sys
43584 bytes
Created:  10.06.2009 22:37
Modified: 14.07.2009 03:45
Company:  Silicon Integrated Systems Corp.
----------
Key:       SiSRaid4
ImagePath: system32\DRIVERS\sisraid4.sys
C:\Windows\SysWOW64\DRIVERS\sisraid4.sys
80464 bytes
Created:  13.07.2009 23:59
Modified: 14.07.2009 03:45
Company:  Silicon Integrated Systems
----------
Key:       SkypeUpdate
ImagePath: "C:\Program Files (x86)\Skype\Updater\Updater.exe"
C:\Program Files (x86)\Skype\Updater\Updater.exe
-R- 160944 bytes
Created:  03.07.2012 13:19
Modified: 03.07.2012 13:19
Company:  Skype Technologies
----------
Key:       Sony PC Companion
ImagePath: "C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe"
C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe
155320 bytes
Created:  24.01.2012 10:14
Modified: 18.01.2012 14:38
Company:  Avanquest Software
----------
Key:       SrvHsfHDA
ImagePath: system32\DRIVERS\VSTAZL6.SYS
C:\Windows\SysWOW64\DRIVERS\VSTAZL6.SYS
292864 bytes
Created:  14.07.2009 00:04
Modified: 10.06.2009 23:01
Company:  Conexant Systems, Inc.
----------
Key:       SrvHsfV92
ImagePath: system32\DRIVERS\VSTDPV6.SYS
C:\Windows\SysWOW64\DRIVERS\VSTDPV6.SYS
1485312 bytes
Created:  14.07.2009 00:04
Modified: 10.06.2009 23:01
Company:  Conexant Systems, Inc.
----------
Key:       SrvHsfWinac
ImagePath: system32\DRIVERS\VSTCNXT6.SYS
C:\Windows\SysWOW64\DRIVERS\VSTCNXT6.SYS
740864 bytes
Created:  14.07.2009 00:04
Modified: 10.06.2009 23:01
Company:  Conexant Systems, Inc.
----------
Key:       STacSV
ImagePath: C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\STacSV64.exe
C:\Windows\SysWOW64\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\STacSV64.exe
240128 bytes
Created:  25.11.2009 01:20
Modified: 22.07.2009 03:33
Company:  IDT, Inc.
----------
Key:       stexstor
ImagePath: system32\DRIVERS\stexstor.sys
C:\Windows\SysWOW64\DRIVERS\stexstor.sys
24656 bytes
Created:  13.07.2009 23:59
Modified: 14.07.2009 03:45
Company:  Promise Technology
----------
Key:       STHDA
ImagePath: system32\DRIVERS\stwrt64.sys
C:\Windows\SysWOW64\DRIVERS\stwrt64.sys
487936 bytes
Created:  25.11.2009 01:20
Modified: 22.07.2009 03:33
Company:  IDT, Inc.
----------
Key:       swenum
ImagePath: \SystemRoot\system32\drivers\swenum.sys
C:\Windows\SysWOW64\drivers\swenum.sys
12496 bytes
Created:  14.07.2009 02:00
Modified: 14.07.2009 03:45
Company:  Microsoft Corporation
----------
Key:       SynTP
ImagePath: system32\DRIVERS\SynTP.sys
C:\Windows\SysWOW64\DRIVERS\SynTP.sys
273456 bytes
Created:  15.07.2009 01:16
Modified: 15.07.2009 01:16
Company:  Synaptics Incorporated
----------
Key:       TermDD
ImagePath: \SystemRoot\system32\drivers\termdd.sys
C:\Windows\SysWOW64\drivers\termdd.sys
63360 bytes
Created:  02.07.2011 16:38
Modified: 20.11.2010 15:33
Company:  Microsoft Corporation
----------
Key:       TsUsbFlt
ImagePath: system32\drivers\tsusbflt.sys
C:\Windows\SysWOW64\drivers\tsusbflt.sys
59392 bytes
Created:  02.07.2011 16:39
Modified: 20.11.2010 13:07
Company:  Microsoft Corporation
----------
Key:       USBAAPL64
ImagePath: System32\Drivers\usbaapl64.sys
C:\Windows\SysWOW64\Drivers\usbaapl64.sys
52736 bytes
Created:  25.04.2012 12:11
Modified: 25.04.2012 12:11
Company:  Apple, Inc.
----------
Key:       usbfilter
ImagePath: system32\DRIVERS\usbfilter.sys
C:\Windows\SysWOW64\DRIVERS\usbfilter.sys
36408 bytes
Created:  25.11.2009 01:18
Modified: 09.03.2009 07:49
Company:  Advanced Micro Devices
----------
Key:       usbvideo
ImagePath: \SystemRoot\System32\Drivers\usbvideo.sys
C:\Windows\SysWOW64\Drivers\usbvideo.sys
184960 bytes
Created:  02.07.2011 16:38
Modified: 20.11.2010 12:44
Company:  Microsoft Corporation
----------
Key:       viaide
ImagePath: system32\drivers\viaide.sys
C:\Windows\SysWOW64\drivers\viaide.sys
17488 bytes
Created:  14.07.2009 01:19
Modified: 14.07.2009 03:45
Company:  VIA Technologies, Inc.
----------
Key:       vsmraid
ImagePath: system32\DRIVERS\vsmraid.sys
C:\Windows\SysWOW64\DRIVERS\vsmraid.sys
161872 bytes
Created:  10.06.2009 22:37
Modified: 14.07.2009 03:45
Company:  VIA Technologies Inc.,Ltd
----------
Key:       vwifibus
ImagePath: system32\DRIVERS\vwifibus.sys
C:\Windows\SysWOW64\DRIVERS\vwifibus.sys
24576 bytes
Created:  14.07.2009 02:07
Modified: 14.07.2009 02:07
Company:  Microsoft Corporation
----------
Key:       vwififlt
ImagePath: system32\DRIVERS\vwififlt.sys
C:\Windows\SysWOW64\DRIVERS\vwififlt.sys
59904 bytes
Created:  14.07.2009 02:07
Modified: 14.07.2009 02:07
Company:  Microsoft Corporation
----------
Key:       WatAdminSvc
ImagePath: %SystemRoot%\system32\Wat\WatAdminSvc.exe
C:\Windows\SysWOW64\Wat\WatAdminSvc.exe
1255736 bytes
Created:  14.07.2012 03:01
Modified: 14.07.2012 03:01
Company:  Microsoft Corporation
----------
Key:       Wd
ImagePath: system32\DRIVERS\wd.sys
C:\Windows\SysWOW64\DRIVERS\wd.sys
21056 bytes
Created:  14.07.2009 01:19
Modified: 14.07.2009 03:45
Company:  Microsoft Corporation
----------
Key:       WinUsb
ImagePath: system32\DRIVERS\WinUsb.sys
C:\Windows\SysWOW64\DRIVERS\WinUsb.sys
41984 bytes
Created:  02.07.2011 16:38
Modified: 20.11.2010 12:43
Company:  Microsoft Corporation
----------
Key:       yukonw7
ImagePath: system32\DRIVERS\yk62x64.sys
C:\Windows\SysWOW64\DRIVERS\yk62x64.sys
389120 bytes
Created:  10.06.2009 22:35
Modified: 10.06.2009 22:35
Company:  Marvell
----------

************************************************************
04:09:24: Scanning -----VXD ENTRIES-----

************************************************************
04:09:25: Scanning ----- WINLOGON\NOTIFY DLLS -----
No WINLOGON\NOTIFY DLLs found to scan
Rootkit scan of Winlogon\Notify key not possible [key may not exist]

************************************************************
04:09:25: Scanning ----- CONTEXTMENUHANDLERS -----
Key:   Shell Extension for Malware scanning
CLSID: {45AC2688-0253-4ED8-97DE-B5370FA7D48A}
File:  [CLSID does not appear to reference a file]
----------
Key:   WinRAR
CLSID: {B41DB860-64E4-11D2-9906-E49FADC173CA}
File:  [CLSID does not appear to reference a file]
----------
Key:   WinRAR32
CLSID: {B41DB860-8EE4-11D2-9906-E49FADC173CA}
Path:  C:\Program Files (x86)\WinRAR\rarext.dll
C:\Program Files (x86)\WinRAR\rarext.dll
141824 bytes
Created:  18.01.2011 18:44
Modified: 15.03.2010 12:28
Company:  Alexander Roshal
----------

************************************************************
04:09:25: Scanning ----- FOLDER\COLUMNHANDLERS -----
Key:  {F9DB5320-233E-11D1-9F84-707F02C10627}
File: C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
378264 bytes
Created:  03.01.2012 18:23
Modified: 03.01.2012 18:23
Company:  Adobe Systems, Inc.
----------

************************************************************
04:09:25: Scanning ----- BROWSER HELPER OBJECTS -----
Key: {99079a25-328f-4bd4-be04-00955acaa0a7}
BHO: C:\PROGRA~2\WIA6EB~1\Datamngr\ToolBar\searchqudtx.dll
C:\PROGRA~2\WIA6EB~1\Datamngr\ToolBar\searchqudtx.dll
88976 bytes
Created:  27.02.2012 10:42
Modified: 27.02.2012 10:42
Company:  
----------
Key: {9D717F81-9148-4f12-8568-69135F087DB0}
BHO: C:\PROGRA~2\WIA6EB~1\Datamngr\BROWSE~1.DLL
C:\PROGRA~2\WIA6EB~1\Datamngr\BROWSE~1.DLL
89016 bytes
Created:  29.07.2012 00:31
Modified: 08.07.2012 17:11
Company:  Bandoo Media, inc
----------

************************************************************
04:09:26: Scanning ----- SHELLSERVICEOBJECTS -----

************************************************************
04:09:26: Scanning ----- SHAREDTASKSCHEDULER ENTRIES -----
No SharedTaskScheduler entries found to scan

************************************************************
04:09:26: Scanning ----- IMAGEFILE DEBUGGERS -----
No "Debugger" entries found.

************************************************************
04:09:26: Scanning ----- APPINIT_DLLS -----
AppInitDLLs entry = [C:\PROGRA~2\WIA6EB~1\Datamngr\datamngr.dll C:\PROGRA~2\WIA6EB~1\Datamngr\IEBHO.dll ]
File: C:\PROGRA~2\WIA6EB~1\Datamngr\datamngr.dll
C:\PROGRA~2\WIA6EB~1\Datamngr\datamngr.dll
1470392 bytes
Created:  29.07.2012 00:31
Modified: 08.07.2012 17:11
Company:  Bandoo Media, inc
----------
File: C:\PROGRA~2\WIA6EB~1\Datamngr\IEBHO.dll
C:\PROGRA~2\WIA6EB~1\Datamngr\IEBHO.dll
1185208 bytes
Created:  29.07.2012 00:31
Modified: 08.07.2012 17:11
Company:  Bandoo Media, inc
----------

************************************************************
04:09:27: Scanning ----- SECURITY PROVIDER DLLS -----

************************************************************
04:09:27: Scanning ------ COMMON STARTUP GROUP ------
[C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup]
The Common Startup Group attempts to load the following file(s) at boot time:
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-HS- 174 bytes
Created:  14.07.2009 06:54
Modified: 14.07.2009 06:54
Company:  [no info]
--------------------
HP Digital Imaging Monitor.lnk - links to C:\PROGRA~2\Hp\DIGITA~1\bin\hpqtra08.exe
C:\PROGRA~2\Hp\DIGITA~1\bin\hpqtra08.exe
275768 bytes
Created:  21.05.2009 23:13
Modified: 21.05.2009 23:13
Company:  Hewlett-Packard Co.
--------------------

************************************************************
04:09:27: Scanning ----- USER STARTUP GROUPS -----
Checking Startup Group for: Ninchen
[C:\Users\Ninchen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup]
C:\Users\Ninchen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-HS- 174 bytes
Created:  26.03.2010 22:57
Modified: 12.07.2012 03:33
Company:  [no info]
----------
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - links to C:\PROGRA~2\MICROS~4\Office12\ONENOTEM.EXE
C:\PROGRA~2\MICROS~4\Office12\ONENOTEM.EXE
97680 bytes
Created:  26.02.2009 15:24
Modified: 26.02.2009 15:24
Company:  Microsoft Corporation
----------
--------------------

************************************************************
04:09:28: Scanning ----- SCHEDULED TASKS -----
Taskname:      {F301AF46-6DD9-4A5D-93D5-E0E8891CEF1E}
----------
Taskname:      Ad-Aware Antivirus Scheduled Scan
File:          C:\PROGRA~2\AD-AWA~1\AdAwareLauncher.exe
Parameters:    --scan=full
Schedule:      At 15:05:00 every day
Next Run Time: 02.08.2012 15:05:00
Status:        Ready
Creator:       Ninchen
Comments:      Wir empfehlen regelmäßig Scans durchzuführen, um sicherzustellen, dass Ihr Computer sauber von Viren, Würmern, Trojanern und anderer schädlicher Software ist. Wenn Sie diesen Schritt deaktivieren, ist Ihr Computer möglicherweise ungeschützt und angreifbar. Dieser Schritt wird automatisch enfernt, wenn auf Ihrem PC Ad-Aware Antivirus, das diesen Schritt nutzt, nicht zu Verfügung steht.;
C:\PROGRA~2\AD-AWA~1\AdAwareLauncher.exe - [file not found to scan]
----------
Taskname:      Adobe Flash Player Updater
File:          C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
250056 bytes
Created:  14.07.2012 23:15
Modified: 28.07.2012 03:12
Company:  Adobe Systems Incorporated
Schedule:      At 01:12:00 every day
Next Run Time: 02.08.2012 04:12:00
Status:        Ready
Creator:       Adobe Systems Incorporated
Comments:      Mit diesem Task ist Ihre Flash Player-Installation immer aktuell und verwendet die neuesten Verbesserungen und Sicherheits-Fixes. Wenn dieser Task deaktiviert oder entfernt wird, kann Adobe Flash Player Ihren Computer nicht automatisch mit den neuesten Sicherheits-Fixes sichern.
----------
Taskname:      CapSchedInst
File:          c:\Program Files (x86)\Hewlett-Packard\Media\Live TV\Kernel\TV\CapSchedInst.exe
c:\Program Files (x86)\Hewlett-Packard\Media\Live TV\Kernel\TV\CapSchedInst.exe
54568 bytes
Created:  24.07.2009 19:24
Modified: 24.07.2009 19:24
Company:  CL
Schedule:      Task not scheduled
Next Run Time: 
Status:        Ready
Creator:       CyberLink
Comments:      
----------
Taskname:      CapSvcInst
File:          c:\Program Files (x86)\Hewlett-Packard\Media\Live TV\Kernel\TV\CapSvcInst.exe
c:\Program Files (x86)\Hewlett-Packard\Media\Live TV\Kernel\TV\CapSvcInst.exe
54568 bytes
Created:  24.07.2009 19:24
Modified: 24.07.2009 19:24
Company:  CL
Schedule:      Task not scheduled
Next Run Time: 
Status:        Ready
Creator:       CyberLink
Comments:      
----------
Taskname:      CapUninst
File:          c:\Program Files (x86)\Hewlett-Packard\Media\Live TV\Kernel\TV\CapUninst.exe
c:\Program Files (x86)\Hewlett-Packard\Media\Live TV\Kernel\TV\CapUninst.exe
42280 bytes
Created:  24.07.2009 19:24
Modified: 24.07.2009 19:24
Company:  CL
Schedule:      Task not scheduled
Next Run Time: 
Status:        Ready
Creator:       CyberLink
Comments:      
----------
Taskname:      CLMLSvc
File:          c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
206120 bytes
Created:  23.07.2009 12:37
Modified: 23.07.2009 12:37
Company:  CyberLink
Schedule:      At logon
Next Run Time: 
Status:        Running
Creator:       CyberLink
Comments:      
----------
Taskname:      DVDAgent
File:          c:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe
c:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe
128296 bytes
Created:  23.07.2009 21:45
Modified: 23.07.2009 21:45
Company:  CyberLink Corp.
Schedule:      At logon
Next Run Time: 
Status:        Running
Creator:       CyberLink
Comments:      
----------
Taskname:      HPCeeScheduleForNinchen
File:          C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
91704 bytes
Created:  07.10.2009 04:22
Modified: 07.10.2009 04:22
Company:  Hewlett-Packard
Parameters:    HPCeeScheduleForNinchen (null)
Schedule:      At 21:45:00 on 31.08.2012
Next Run Time: 30.09.2012 21:45:00
Status:        Ready
Creator:       Ninchen
Comments:      
----------
Taskname:      TVAgent
File:          c:\Program Files (x86)\Hewlett-Packard\Media\Live TV\TVAgent.exe
c:\Program Files (x86)\Hewlett-Packard\Media\Live TV\TVAgent.exe
427304 bytes
Created:  24.07.2009 19:24
Modified: 24.07.2009 19:24
Company:  CyberLink Corp.
Schedule:      At logon
Next Run Time: 
Status:        Running
Creator:       CyberLink
Comments:      
----------
Taskname:      User_Feed_Synchronization-{4034AE4C-9FC3-40EE-BF43-214C49A6C531}
File:          C:\Windows\SysWOW64\msfeedssync.exe
C:\Windows\SysWOW64\msfeedssync.exe
10752 bytes
Created:  24.02.2012 12:59
Modified: 24.02.2012 12:59
Company:  Microsoft Corporation
Parameters:    sync
Schedule:      At 20:24:42 every day
Next Run Time: 02.08.2012 22:24:42
Status:        Ready
Creator:       Ninchen-PC\Ninchen
Comments:      Aktualisiert veraltete Systemfeeds.
----------

************************************************************
04:09:31: Scanning ----- SHELLICONOVERLAYIDENTIFIERS -----
Key:   SharingPrivate
CLSID: {08244EE6-92F0-47f2-9FC9-929BAA2E7235}
File:  %SystemRoot%\system32\ntshrui.dll
C:\Windows\SysWOW64\ntshrui.dll
509952 bytes
Created:  21.02.2012 11:38
Modified: 04.01.2012 12:44
Company:  Microsoft Corporation
----------

************************************************************
04:09:31: Scanning ----- DEVICE DRIVER ENTRIES -----
Value: msacm.l3acm
File:  C:\Windows\SysWOW64\l3codeca.acm
C:\Windows\SysWOW64\l3codeca.acm
64000 bytes
Created:  14.07.2009 02:07
Modified: 14.07.2009 03:14
Company:  Fraunhofer Institut Integrierte Schaltungen IIS
----------
Value: msacm.l3codecp
File:  l3codecp.acm
C:\Windows\system32\l3codecp.acm
220672 bytes
Created:  14.07.2009 02:09
Modified: 14.07.2009 03:14
Company:  Fraunhofer Institut Integrierte Schaltungen IIS
----------

************************************************************
04:09:32: ----- ADDITIONAL CHECKS -----
Heuristic checks for hidden files/drivers completed
----------
Layered Service Provider entries checks completed
----------
==============================
Restrictive Windows Explorer Policies found in force on this computer:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
Value: WallpaperStyle
All Policy Values listed have been removed or reset
==============================
Windows Explorer Policies checks completed
----------
Desktop Wallpaper: C:\Users\Ninchen\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
C:\Users\Ninchen\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
4128532 bytes
Created:  26.03.2010 22:57
Modified: 11.06.2012 18:16
Company:  [no info]
----------
Web Desktop Wallpaper entry is blank
----------
DNS Server information:
Interface:   HUAWEI Mobile Connect - 3G Network Card
NameServers: 193.189.244.225 193.189.244.206
Interface:   HUAWEI Mobile Connect - 3G Network Card
NameServers: 193.189.244.225 193.189.244.206
Interface:   HUAWEI Mobile Connect - 3G Network Card
NameServers: 193.189.244.225 193.189.244.206
Interface:   HUAWEI Mobile Connect - 3G Network Card
NameServers: 193.189.244.225 193.189.244.206
Checks for rogue DNS NameServers completed
----------
Additional checks completed

************************************************************
04:10:01: Scanning ----- RUNNING PROCESSES -----

C:\Windows\System32\wininit.exe
96256 bytes
Created:  14.07.2009 01:36
Modified: 14.07.2009 03:14
Company:  Microsoft Corporation
--------------------
C:\Windows\System32\svchost.exe
20992 bytes
Created:  14.07.2009 01:19
Modified: 14.07.2009 03:14
Company:  Microsoft Corporation
--------------------
C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\stacsv64.exe
240128 bytes
Created:  25.11.2009 01:20
Modified: 22.07.2009 03:33
Company:  IDT, Inc.
--------------------
C:\Windows\explorer.exe
2871808 bytes
Created:  27.04.2011 11:45
Modified: 25.02.2011 08:19
Company:  Microsoft Corporation
--------------------
C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\AESTSr64.exe
89600 bytes
Created:  25.11.2009 01:20
Modified: 02.03.2009 23:42
Company:  Andrea Electronics Corporation
--------------------
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
1815848 bytes
Created:  15.07.2009 01:12
Modified: 15.07.2009 01:12
Company:  Synaptics Incorporated
--------------------
C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
610872 bytes
Created:  21.07.2009 11:34
Modified: 21.07.2009 11:34
Company:  
--------------------
C:\Program Files\Java\jre6\bin\jusched.exe
171520 bytes
Created:  01.10.2009 21:10
Modified: 01.10.2009 21:10
Company:  Sun Microsystems, Inc.
--------------------
C:\Program Files (x86)\Hp\Digital Imaging\bin\hpqtra08.exe
275768 bytes
Created:  21.05.2009 23:13
Modified: 21.05.2009 23:13
Company:  Hewlett-Packard Co.
--------------------
C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
97680 bytes
Created:  26.02.2009 15:24
Modified: 26.02.2009 15:24
Company:  Microsoft Corporation
--------------------
C:\Program Files\Bonjour\mDNSResponder.exe
462184 bytes
Created:  30.08.2011 23:05
Modified: 30.08.2011 23:05
Company:  Apple Inc.
--------------------
C:\ProgramData\DatacardService\DCSHelper.exe
241664 bytes
Created:  08.05.2010 13:48
Modified: 08.05.2010 13:48
Company:  Huawei Technologies Co., Ltd.
--------------------
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
65536 bytes
Created:  22.04.2009 18:38
Modified: 22.04.2009 18:38
Company:  Advanced Micro Devices Inc.
--------------------
C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\datamngrUI.exe
1825720 bytes
Created:  29.07.2012 00:31
Modified: 08.07.2012 17:11
Company:  Bandoo Media, inc
--------------------
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
65536 bytes
Created:  22.04.2009 18:37
Modified: 22.04.2009 18:37
Company:  ATI Technologies Inc.
--------------------
C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
248784 bytes
Created:  10.04.2012 19:27
Modified: 15.05.2012 22:07
Company:  Avira Operations GmbH & Co. KG
--------------------
C:\Program Files\iPod\bin\iPodService.exe
936848 bytes
Created:  07.06.2012 19:33
Modified: 07.06.2012 19:33
Company:  Apple Inc.
--------------------
C:\Windows\System32\SearchIndexer.exe
427520 bytes
Created:  29.06.2011 09:25
Modified: 04.05.2011 06:28
Company:  Microsoft Corporation
--------------------
C:\Windows\System32\wbem\WmiPrvSE.exe
257536 bytes
Created:  02.07.2011 16:38
Modified: 20.11.2010 14:17
Company:  Microsoft Corporation
--------------------
C:\Windows\System32\taskeng.exe
192000 bytes
Created:  02.07.2011 16:38
Modified: 20.11.2010 14:17
Company:  Microsoft Corporation
--------------------
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqToaster.exe
632888 bytes
Created:  01.07.2009 15:44
Modified: 01.07.2009 15:44
Company:  
--------------------
C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe
311352 bytes
Created:  28.03.2011 17:06
Modified: 28.03.2011 17:06
Company:  Hewlett-Packard Development Company L.P.
--------------------
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
120616 bytes
Created:  15.07.2009 01:13
Modified: 15.07.2009 01:13
Company:  Synaptics Incorporated
--------------------
C:\Program Files\Windows Media Player\wmpnetwk.exe
1525248 bytes
Created:  02.07.2011 16:39
Modified: 20.11.2010 15:25
Company:  Microsoft Corporation
--------------------
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
168960 bytes
Created:  21.05.2009 22:46
Modified: 21.05.2009 22:46
Company:  Hewlett-Packard Co.
--------------------
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
559104 bytes
Created:  21.05.2009 22:46
Modified: 21.05.2009 22:46
Company:  Hewlett-Packard Co.
--------------------
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
362496 bytes
Created:  21.05.2009 19:57
Modified: 21.05.2009 19:57
Company:  Hewlett-Packard
--------------------
C:\Windows\System32\rundll32.exe
44544 bytes
Created:  14.07.2009 01:41
Modified: 14.07.2009 03:14
Company:  Microsoft Corporation
--------------------
C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe
391632 bytes
Created:  10.04.2012 19:27
Modified: 15.05.2012 22:07
Company:  Avira Operations GmbH & Co. KG
--------------------
C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe
466896 bytes
Created:  10.04.2012 19:27
Modified: 15.05.2012 22:07
Company:  Avira Operations GmbH & Co. KG
--------------------
C:\Windows\System32\SearchProtocolHost.exe
164352 bytes
Created:  29.06.2011 09:25
Modified: 04.05.2011 06:28
Company:  Microsoft Corporation
--------------------
C:\Program Files (x86)\Trojan Remover\Rmvtrjan.exe
FileSize:          4746488
[This is a Trojan Remover component]
--------------------
--------------------
C:\Windows\System32\SearchFilterHost.exe
86528 bytes
Created:  29.06.2011 09:25
Modified: 04.05.2011 06:28
Company:  Microsoft Corporation
--------------------

************************************************************
04:10:08: Checking HOSTS file
No malicious entries were found in the HOSTS file

************************************************************
------ INTERNET EXPLORER HOME/START/SEARCH SETTINGS ------
HKLM\Software\Microsoft\Internet Explorer\Main\"Start Page":
hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cnnb
HKLM\Software\Microsoft\Internet Explorer\Main\"Local Page":
C:\Windows\SysWOW64\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main\"Search Page":
hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Page_URL":
hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cnnb
HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Search_URL":
hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKCU\Software\Microsoft\Internet Explorer\Main\"Start Page":
hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main\"Local Page":
C:\Windows\system32\blank.htm
HKCU\Software\Microsoft\Internet Explorer\Main\"Search Page":
hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKCU\Software\Microsoft\Internet Explorer\Main\"Default_Page_URL":
hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cnnb

************************************************************
=== CHANGES WERE MADE TO THE WINDOWS REGISTRY ===
Scan completed at: 04:10:08 02 Aug 2012
Total Scan time: 00:01:14
************************************************************

cosinus · 06.08.2012, 15:38

Bitte erstmal routinemäßig einen Vollscan mit Malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Die Funde mit Malwarebytes bitte alle entfernen, sodass sie in der Quarantäne von Malwarebytes aufgehoben werden! NICHTS voreilig aus der Quarantäne entfernen!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

ATTFilter

 hier steht das Log

Ninchen911 · 07.08.2012, 03:52

Code:

ATTFilter

 Malwarebytes Anti-Malware  (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.06.13

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Ninchen :: NINCHEN-PC [Administrator]

Schutz: Aktiviert

07.08.2012 02:35:42
mbam-log-2012-08-07 (02-35-42).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 456736
Laufzeit: 2 Stunde(n), 8 Minute(n), 46 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=8036778f9bfad74bb56a91882a6c2d68
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-08-07 03:57:03
# local_time=2012-08-07 05:57:03 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 10229862 10229862 0 0
# compatibility_mode=5893 16776573 100 94 218436 95938552 0 0
# compatibility_mode=8192 67108863 100 0 324 324 0 0
# scanned=101702
# found=3
# cleaned=0
# scan_time=3121
C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\datamngr.dll	a variant of Win32/Toolbar.SearchSuite application (unable to clean)	00000000000000000000000000000000	I
C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\DnsBHO.dll	a variant of Win32/Toolbar.SearchSuite application (unable to clean)	00000000000000000000000000000000	I
C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\IEBHO.dll	Win32/Toolbar.SearchSuite application (unable to clean)	00000000000000000000000000000000	I
ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=53251
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=8036778f9bfad74bb56a91882a6c2d68
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-08-07 06:31:36
# local_time=2012-08-07 08:31:36 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 10233130 10233130 0 0
# compatibility_mode=5893 16776573 100 94 221704 95941820 0 0
# compatibility_mode=8192 67108863 100 0 3592 3592 0 0
# scanned=277188
# found=6
# cleaned=0
# scan_time=9126
C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\datamngr.dll	a variant of Win32/Toolbar.SearchSuite application (unable to clean)	00000000000000000000000000000000	I
C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\DnsBHO.dll	a variant of Win32/Toolbar.SearchSuite application (unable to clean)	00000000000000000000000000000000	I
C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\IEBHO.dll	Win32/Toolbar.SearchSuite application (unable to clean)	00000000000000000000000000000000	I
C:\Users\Ninchen\AppData\Local\Temp\SetupDataMngr_Searchqu.exe	a variant of Win32/Toolbar.SearchSuite application (unable to clean)	00000000000000000000000000000000	I
C:\Users\Ninchen\Downloads\Setup74_FreeFlvConverter.exe	Win32/Toolbar.SearchSuite application (unable to clean)	00000000000000000000000000000000	I
${Memory}	a variant of Win32/Toolbar.SearchSuite application	00000000000000000000000000000000	I

cosinus · 07.08.2012, 21:04

adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Search.
Nach Ende des Suchlaufs öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

Ninchen911 · 08.08.2012, 01:31

Code:

ATTFilter

# AdwCleaner v1.800 - Logfile created 08/08/2012 at 02:30:11
# Updated 01/08/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Ninchen - NINCHEN-PC
# Running from : C:\Users\Ninchen\Downloads\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****

Folder Found : C:\Users\Ninchen\AppData\Local\Temp\boost_interprocess
Folder Found : C:\Users\Ninchen\AppData\LocalLow\Searchqutoolbar
Folder Found : C:\Users\Ninchen\AppData\Roaming\Mozilla\Firefox\Profiles\bx65q5dw.default\Searchqutoolbar
Folder Found : C:\ProgramData\boost_interprocess
Folder Found : C:\Program Files (x86)\Windows Searchqu Toolbar
File Found : C:\Users\Ninchen\AppData\Local\Temp\Searchqu.ini
File Found : C:\Users\Ninchen\AppData\Local\Temp\searchqutoolbar-manifest.xml
File Found : C:\Users\Ninchen\AppData\Local\Temp\SetupDataMngr_Searchqu.exe
File Found : C:\Users\Ninchen\AppData\Roaming\Mozilla\Firefox\Profiles\bx65q5dw.default\searchplugins\Search_Results.xml
File Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk
File Found : C:\Program Files (x86)\Mozilla FireFox\searchplugins\Search_Results.xml

***** [Registry] *****

Key Found : HKCU\Software\DataMngr
Key Found : HKCU\Software\DataMngr_Toolbar
Key Found : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard
Key Found : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard.1
Key Found : HKLM\SOFTWARE\DataMngr
Key Found : HKLM\SOFTWARE\DT Soft
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Searchqu Toolbar
Key Found : HKLM\SOFTWARE\SearchquMediabarTb
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [DataMngr]
[x64] Key Found : HKCU\Software\DataMngr
[x64] Key Found : HKCU\Software\DataMngr_Toolbar
[x64] Key Found : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard
[x64] Key Found : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard.1
[x64] Key Found : HKLM\SOFTWARE\DataMngr

***** [Registre - GUID] *****

Key Found : HKLM\SOFTWARE\Classes\CLSID\{761F6A83-F007-49E4-8EAC-CDB6808EF06F}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{9D717F81-9148-4F12-8568-69135F087DB0}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{FEFD3AF5-A346-4451-AA23-A3AD54915515}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{5B4144E1-B61D-495A-9A50-CD1A95D86D15}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{6A4BCABA-C437-4C76-A54E-AF31B8A76CB9}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{841D5A49-E48D-413C-9C28-EB3D9081D705}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D717F81-9148-4F12-8568-69135F087DB0}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9D717F81-9148-4F12-8568-69135F087DB0}
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{99079A25-328F-4BD4-BE04-00955ACAA0A7}]
[x64] Key Found : HKLM\SOFTWARE\Classes\CLSID\{9D717F81-9148-4F12-8568-69135F087DB0}
[x64] Key Found : HKLM\SOFTWARE\Classes\CLSID\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}
[x64] Key Found : HKLM\SOFTWARE\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}
[x64] Key Found : HKLM\SOFTWARE\Classes\CLSID\{FEFD3AF5-A346-4451-AA23-A3AD54915515}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{5B4144E1-B61D-495A-9A50-CD1A95D86D15}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{6A4BCABA-C437-4C76-A54E-AF31B8A76CB9}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{841D5A49-E48D-413C-9C28-EB3D9081D705}
[x64] Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
[x64] Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
[x64] Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D717F81-9148-4F12-8568-69135F087DB0}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9D717F81-9148-4F12-8568-69135F087DB0}

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Mozilla Firefox v14.0.1 (de)

Profile name : default 
File : C:\Users\Ninchen\AppData\Roaming\Mozilla\Firefox\Profiles\bx65q5dw.default\prefs.js

Found : user_pref("browser.search.defaultenginename", "Search Results");
Found : user_pref("browser.search.order.1", "Search Results");
Found : user_pref("browser.search.selectedEngine", "Search Results");
Found : user_pref("keyword.URL", "hxxp://dts.search-results.com/sr?src=ffb&appid=0&systemid=413&sr=0&q=");

*************************

AdwCleaner[R1].txt - [5578 octets] - [08/08/2012 02:30:11]

########## EOF - C:\AdwCleaner[R1].txt - [5706 octets] ##########

cosinus · 08.08.2012, 20:20

adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen

Schließe alle offenen Programme und Browser.
Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Delete.
Bestätige jeweils mit Ok.
Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

Ninchen911 · 09.08.2012, 02:18

Code:

ATTFilter

# AdwCleaner v1.800 - Logfile created 08/09/2012 at 03:12:19
# Updated 01/08/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Ninchen - NINCHEN-PC
# Running from : C:\Users\Ninchen\Downloads\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Folder Deleted : C:\Users\Ninchen\AppData\Local\Temp\boost_interprocess
Folder Deleted : C:\Users\Ninchen\AppData\LocalLow\Searchqutoolbar
Folder Deleted : C:\Users\Ninchen\AppData\Roaming\Mozilla\Firefox\Profiles\bx65q5dw.default\Searchqutoolbar
Folder Deleted : C:\ProgramData\boost_interprocess
Deleted on reboot : C:\Program Files (x86)\Windows Searchqu Toolbar
File Deleted : C:\Users\Ninchen\AppData\Local\Temp\Searchqu.ini
File Deleted : C:\Users\Ninchen\AppData\Local\Temp\searchqutoolbar-manifest.xml
File Deleted : C:\Users\Ninchen\AppData\Local\Temp\SetupDataMngr_Searchqu.exe
File Deleted : C:\Users\Ninchen\AppData\Roaming\Mozilla\Firefox\Profiles\bx65q5dw.default\searchplugins\Search_Results.xml
File Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk
File Deleted : C:\Program Files (x86)\Mozilla FireFox\searchplugins\Search_Results.xml

***** [Registry] *****

Key Deleted : HKCU\Software\Ask.com.tmp
Key Deleted : HKCU\Software\DataMngr
Key Deleted : HKCU\Software\DataMngr_Toolbar
Key Deleted : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard
Key Deleted : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard.1
Key Deleted : HKLM\SOFTWARE\DataMngr
Key Deleted : HKLM\SOFTWARE\DT Soft
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Searchqu Toolbar
Key Deleted : HKLM\SOFTWARE\SearchquMediabarTb
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [DataMngr]
[x64] Key Deleted : HKLM\SOFTWARE\DataMngr

***** [Registre - GUID] *****

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{761F6A83-F007-49E4-8EAC-CDB6808EF06F}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{9D717F81-9148-4F12-8568-69135F087DB0}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FEFD3AF5-A346-4451-AA23-A3AD54915515}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{5B4144E1-B61D-495A-9A50-CD1A95D86D15}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{6A4BCABA-C437-4C76-A54E-AF31B8A76CB9}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{841D5A49-E48D-413C-9C28-EB3D9081D705}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D717F81-9148-4F12-8568-69135F087DB0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9D717F81-9148-4F12-8568-69135F087DB0}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{99079A25-328F-4BD4-BE04-00955ACAA0A7}]
[x64] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{9D717F81-9148-4F12-8568-69135F087DB0}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FEFD3AF5-A346-4451-AA23-A3AD54915515}
[x64] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
[x64] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D717F81-9148-4F12-8568-69135F087DB0}

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Mozilla Firefox v14.0.1 (de)

Profile name : default 
File : C:\Users\Ninchen\AppData\Roaming\Mozilla\Firefox\Profiles\bx65q5dw.default\prefs.js

Deleted : user_pref("browser.search.defaultenginename", "Search Results");
Deleted : user_pref("browser.search.order.1", "Search Results");
Deleted : user_pref("browser.search.selectedEngine", "Search Results");
Deleted : user_pref("keyword.URL", "hxxp://dts.search-results.com/sr?src=ffb&appid=0&systemid=413&sr=0&q=");

*************************

AdwCleaner[R1].txt - [5675 octets] - [08/08/2012 02:30:11]
AdwCleaner[S1].txt - [5046 octets] - [09/08/2012 03:12:19]

########## EOF - C:\AdwCleaner[S1].txt - [5174 octets] ##########

cosinus · 10.08.2012, 09:34

Hätte da mal drei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?
3.) Searchnu bzw die Toolbar/Weiterleitung ist nun weg?

Ninchen911 · 10.08.2012, 19:22

Hi,

also soweit ich das beurteilen kann funktioniert der Windowsmodus normal.
Searchnu ist weg, sobald ich ein neues Tab öffne.
Super , vielen Dank schon mal dafür !!!

Was die Ordner in "Programme" angeht, da ist der Ordner MSXML 4.0 leer...aber ansonsten scheinen alle anderen einen Inhalt zu haben.

Btw: TrojanRemover macht mich täglich auf zwei unbekannte files aufmerksam. Inwieweit soll ich dem Beachtung schenken?
Aus irgendwelchen Gründen kann ich die Logfile jedoch grade nicht zippen.
Wird die unbedingt benötigt? In diesem Fall werde ich erneut scannen!

Ninchen911 · 10.08.2012, 19:28

So jetzt hats funktioniert. Das müsste die richtige Logfile vom TrojanRemover sein.

Nochmal zum Thema leere Ordner. In meinen Dokumenten befinden sich ein paar leere, z.B. "microsoft".

Gruß,
Ninchen

cosinus · 11.08.2012, 16:14

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

ATTFilter

 hier steht das Log

CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die Textbox von OTL - wenn OTL auf deutsch ist wird sie mit beschriftet

Code:

ATTFilter

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf .
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Ninchen911 · 13.08.2012, 00:40

OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 13.08.2012 01:17:03 - Run 2
OTL by OldTimer - Version 3.2.57.0     Folder = C:\Users\Ninchen\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,70 Gb Available Physical Memory | 67,57% Memory free
7,99 Gb Paging File | 5,81 Gb Available in Paging File | 72,67% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 284,56 Gb Total Space | 187,54 Gb Free Space | 65,90% Space Free | Partition Type: NTFS
Drive D: | 13,23 Gb Total Space | 2,21 Gb Free Space | 16,67% Space Free | Partition Type: NTFS
Drive I: | 1,87 Gb Total Space | 0,14 Gb Free Space | 7,41% Space Free | Partition Type: FAT
 
Computer Name: NINCHEN-PC | User Name: Ninchen | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.08.13 00:19:47 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Ninchen\Downloads\OTL(1).exe
PRC - [2012.08.08 22:02:27 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.07.03 13:46:44 | 000,462,920 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012.05.15 22:07:27 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.15 22:07:26 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.03.28 17:07:50 | 000,094,264 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
PRC - [2010.05.08 13:48:36 | 000,229,376 | ---- | M] () -- C:\ProgramData\DatacardService\DCService.exe
PRC - [2010.05.08 13:48:26 | 000,241,664 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\ProgramData\DatacardService\DCSHelper.exe
PRC - [2009.07.24 19:24:02 | 000,427,304 | ---- | M] (CyberLink Corp.) -- c:\Program Files (x86)\Hewlett-Packard\Media\Live TV\TVAgent.exe
PRC - [2009.07.23 21:45:52 | 000,128,296 | ---- | M] (CyberLink Corp.) -- c:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe
PRC - [2009.07.23 12:37:16 | 000,206,120 | ---- | M] (CyberLink) -- c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.06.14 21:25:58 | 014,340,608 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\e717a230496832656b05b515eb9f3bc5\PresentationFramework.ni.dll
MOD - [2012.06.14 21:25:40 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll
MOD - [2012.06.14 21:25:31 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll
MOD - [2012.06.14 21:25:23 | 012,237,824 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\14a87218ea49639f38097e278b98a3da\PresentationCore.ni.dll
MOD - [2012.05.31 17:14:27 | 000,036,920 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\HP.ActiveSupportLibrary\2.0.0.1__01a974bc1760f423\HP.ActiveSupportLibrary.dll
MOD - [2012.05.24 10:42:43 | 001,051,136 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\9b2f17fb61b7197f2a04108f5d1a1cc6\System.Management.ni.dll
MOD - [2012.05.24 10:21:38 | 000,368,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\8e56489276063ededde74e597a121df3\PresentationFramework.Aero.ni.dll
MOD - [2012.05.24 10:21:15 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll
MOD - [2012.05.24 10:21:13 | 006,611,456 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\f3814b488d9e083cbbc623e01b389f09\System.Data.ni.dll
MOD - [2012.05.24 10:20:29 | 000,185,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationTypes\d8af9a65cf0ed85d47360796e2645a06\UIAutomationTypes.ni.dll
MOD - [2012.05.24 10:20:13 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll
MOD - [2012.05.24 10:20:06 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll
MOD - [2012.05.24 10:20:01 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll
MOD - [2012.05.24 10:20:00 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll
MOD - [2012.05.24 10:19:53 | 011,492,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll
MOD - [2011.09.27 07:23:00 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.09.27 07:22:40 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2010.11.13 02:08:41 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010.11.05 03:58:05 | 002,927,616 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
MOD - [2009.10.02 04:39:04 | 000,249,856 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\PresentationFramework.resources\3.0.0.0_de_31bf3856ad364e35\PresentationFramework.resources.dll
MOD - [2009.10.02 04:39:04 | 000,110,592 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\PresentationCore.resources\3.0.0.0_de_31bf3856ad364e35\PresentationCore.resources.dll
MOD - [2009.07.24 19:24:16 | 000,275,848 | ---- | M] () -- c:\Program Files (x86)\Hewlett-Packard\Media\Live TV\Kernel\TV\CLCapEngine.dll
MOD - [2009.07.24 19:24:16 | 000,124,288 | ---- | M] () -- c:\Program Files (x86)\Hewlett-Packard\Media\Live TV\Kernel\TV\CLSchMgr.dll
MOD - [2009.07.24 19:24:14 | 000,349,480 | ---- | M] () -- c:\Program Files (x86)\Hewlett-Packard\Media\Live TV\Kernel\TV\CLTinyDB.dll
MOD - [2009.07.23 12:37:14 | 000,931,112 | ---- | M] () -- c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMediaLibrary.dll
MOD - [2009.07.15 17:51:04 | 000,061,440 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Pillars\PCAlerts\PCAlertsPillar.dll
MOD - [2009.07.15 17:51:02 | 000,131,072 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Pillars\ECenter\ECLibrary.dll
MOD - [2009.07.15 17:50:58 | 000,040,960 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingServer.dll
MOD - [2009.07.15 17:50:56 | 000,036,864 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingClients.dll
MOD - [2009.07.15 17:50:56 | 000,007,680 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\HP Advisor\RemotingClient.dll
MOD - [2009.07.15 17:50:54 | 000,005,632 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingInterface.dll
MOD - [2009.07.15 17:50:52 | 000,018,944 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingMessages.dll
MOD - [2009.07.15 17:50:44 | 000,028,672 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.Logging.dll
MOD - [2009.06.17 12:40:16 | 007,745,536 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll
MOD - [2009.06.17 12:40:16 | 002,121,728 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll
MOD - [2009.06.17 12:40:16 | 000,135,168 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2009.07.22 03:33:32 | 000,240,128 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\stacsv64.exe -- (STacSV)
SRV:64bit: - [2009.07.08 14:49:02 | 000,030,520 | ---- | M] (Hewlett-Packard) [Auto | Running] -- C:\Windows\SysNative\hpservice.exe -- (hpsrv)
SRV:64bit: - [2009.07.02 20:16:06 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009.03.02 23:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\AESTSr64.exe -- (AESTFilters)
SRV - [2012.08.04 17:12:14 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.07.20 00:20:36 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.07.03 13:19:28 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.05.15 22:07:27 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.15 22:07:26 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.01.18 14:38:28 | 000,155,320 | ---- | M] (Avanquest Software) [On_Demand | Stopped] -- C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe -- (Sony PC Companion)
SRV - [2011.09.09 17:10:28 | 000,086,072 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe -- (HP Support Assistant Service)
SRV - [2011.08.12 01:38:04 | 000,140,672 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Programme\SUPERAntiSpyware\SASCore64.exe -- (!SASCORE)
SRV - [2011.03.28 17:07:50 | 000,094,264 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe -- (HPDrvMntSvc.exe)
SRV - [2010.05.08 13:48:36 | 000,229,376 | ---- | M] () [Auto | Running] -- C:\ProgramData\DatacardService\DCService.exe -- (DCService.exe)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.07.22 03:33:32 | 000,240,128 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\STacSV64.exe -- (STacSV)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.05.22 20:02:20 | 000,250,616 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe -- (GameConsoleService)
SRV - [2009.05.21 22:35:32 | 000,923,136 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL -- (HPSLPSVC)
SRV - [2009.03.02 23:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\AESTSr64.exe -- (AESTFilters)
SRV - [2009.02.22 12:00:00 | 000,129,584 | ---- | M] (EasyBits Sofware AS) [Auto | Running] -- C:\Windows\SysWOW64\ezsvc7.dll -- (ezSharedSvc)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2012.05.15 22:07:27 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.05.15 22:07:27 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.04.25 12:11:36 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.01.24 10:18:06 | 000,027,176 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ggsemc.sys -- (ggsemc)
DRV:64bit: - [2012.01.24 10:18:06 | 000,013,352 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ggflt.sys -- (ggflt)
DRV:64bit: - [2011.10.21 21:01:48 | 000,254,528 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2011.09.16 16:08:07 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011.04.05 17:35:20 | 000,253,528 | ---- | M] (Sunbelt Software, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\SbFw.sys -- (SbFw)
DRV:64bit: - [2011.04.05 17:35:20 | 000,094,296 | ---- | M] (Sunbelt Software, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\sbtis.sys -- (SbTis)
DRV:64bit: - [2011.04.05 17:35:20 | 000,060,504 | ---- | M] (Sunbelt Software, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sbhips.sys -- (sbhips)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.02.08 09:14:20 | 000,084,568 | ---- | M] (Sunbelt Software, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SbFwIm.sys -- (SBFWIMCLMP)
DRV:64bit: - [2011.02.08 09:14:20 | 000,084,568 | ---- | M] (Sunbelt Software, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SbFwIm.sys -- (SBFWIMCL)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.20 11:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2010.04.09 15:24:32 | 000,076,288 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ew_jubusenum.sys -- (huawei_enumerator)
DRV:64bit: - [2010.04.07 17:05:00 | 000,250,368 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbnet.sys -- (ewusbnet)
DRV:64bit: - [2010.03.25 10:08:46 | 000,120,704 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard)
DRV:64bit: - [2010.03.20 11:56:56 | 000,114,560 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_hwusbdev.sys -- (ew_hwusbdev)
DRV:64bit: - [2009.09.22 02:47:14 | 001,484,800 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2009.07.22 03:33:32 | 000,487,936 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA)
DRV:64bit: - [2009.07.21 05:39:22 | 000,140,712 | ---- | M] (JMicron Technology Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\jmcr.sys -- (JMCR)
DRV:64bit: - [2009.07.15 01:16:34 | 000,273,456 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.08 14:49:08 | 000,030,008 | ---- | M] (Hewlett-Packard) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\hpdskflt.sys -- (hpdskflt)
DRV:64bit: - [2009.07.08 14:48:50 | 000,041,272 | ---- | M] (Hewlett-Packard) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Accelerometer.sys -- (Accelerometer)
DRV:64bit: - [2009.07.02 20:51:30 | 006,036,480 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2009.06.29 20:17:00 | 000,070,656 | ---- | M] (ENE TECHNOLOGY INC.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\enecir.sys -- (enecir)
DRV:64bit: - [2009.06.10 23:01:11 | 001,485,312 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTDPV6.SYS -- (SrvHsfV92)
DRV:64bit: - [2009.06.10 23:01:11 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTCNXT6.SYS -- (SrvHsfWinac)
DRV:64bit: - [2009.06.10 23:01:11 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTAZL6.SYS -- (SrvHsfHDA)
DRV:64bit: - [2009.06.10 23:01:06 | 001,146,880 | ---- | M] (LSI Corp) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\agrsm64.sys -- (AgereSoftModem)
DRV:64bit: - [2009.06.10 22:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2009.06.10 22:35:33 | 000,389,120 | ---- | M] (Marvell) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7)
DRV:64bit: - [2009.06.10 22:35:28 | 005,434,368 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netw5v64.sys -- (netw5v64)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.06.05 12:20:26 | 000,114,192 | ---- | M] (ATI Research Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2009.05.23 08:52:30 | 000,215,040 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009.05.18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009.05.05 07:30:28 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie.sys -- (AtiPcie)
DRV:64bit: - [2009.04.29 08:48:32 | 000,018,432 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)
DRV:64bit: - [2009.03.09 07:49:08 | 000,036,408 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbfilter.sys -- (usbfilter)
DRV - [2011.07.22 18:26:56 | 000,014,928 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\sasdifsv64.sys -- (SASDIFSV)
DRV - [2011.07.12 23:55:18 | 000,012,368 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\saskutil64.sys -- (SASKUTIL)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cnnb
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cnnb
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
IE:64bit: - HKLM\..\SearchScopes\{1366F70F-D4B1-41A2-9C50-344E76EADE50}: "URL" = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
IE:64bit: - HKLM\..\SearchScopes\{2C7072CC-3B6A-4D18-856D-F60EF665414F}: "URL" = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcnnbie7-de-de
IE:64bit: - HKLM\..\SearchScopes\{3CA7DAB2-1C99-4C76-88C3-55972FB79B59}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cnnb
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cnnb
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
IE - HKLM\..\SearchScopes\{1366F70F-D4B1-41A2-9C50-344E76EADE50}: "URL" = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
IE - HKLM\..\SearchScopes\{2C7072CC-3B6A-4D18-856D-F60EF665414F}: "URL" = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcnnbie7-de-de
IE - HKLM\..\SearchScopes\{3CA7DAB2-1C99-4C76-88C3-55972FB79B59}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-722066157-1209004584-819911206-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cnnb
IE - HKU\S-1-5-21-722066157-1209004584-819911206-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\S-1-5-21-722066157-1209004584-819911206-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-722066157-1209004584-819911206-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-722066157-1209004584-819911206-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 78 91 C1 30 21 02 CD 01  [binary data]
IE - HKU\S-1-5-21-722066157-1209004584-819911206-1000\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
IE - HKU\S-1-5-21-722066157-1209004584-819911206-1000\..\SearchScopes\{1366F70F-D4B1-41A2-9C50-344E76EADE50}: "URL" = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
IE - HKU\S-1-5-21-722066157-1209004584-819911206-1000\..\SearchScopes\{2C7072CC-3B6A-4D18-856D-F60EF665414F}: "URL" = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcnnbie7-de-de
IE - HKU\S-1-5-21-722066157-1209004584-819911206-1000\..\SearchScopes\{3CA7DAB2-1C99-4C76-88C3-55972FB79B59}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
IE - HKU\S-1-5-21-722066157-1209004584-819911206-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_270.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_270.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_33: C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@SonyCreativeSoftware.com/Media Go,version=1.0: C:\Program Files (x86)\Sony\Media Go\npmediago.dll (Sony Media Software and Services Inc)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011.12.27 19:47:07 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.20 00:20:36 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.08.09 03:38:33 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011.12.27 19:47:07 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.20 00:20:36 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.08.09 03:38:33 | 000,000,000 | ---D | M]
 
[2012.07.29 00:31:48 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ninchen\AppData\Roaming\mozilla\Extensions
[2012.08.09 03:16:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ninchen\AppData\Roaming\mozilla\Firefox\Profiles\bx65q5dw.default\extensions
[2011.10.17 12:18:33 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Ninchen\AppData\Roaming\mozilla\Firefox\Profiles\bx65q5dw.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.08.09 03:38:36 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.08.09 03:38:37 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2012.07.20 00:20:36 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.05.02 23:04:01 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.05.02 23:04:01 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.05.02 23:04:01 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.05.02 23:04:01 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.05.02 23:04:01 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.05.02 23:04:01 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4:64bit: - HKLM..\Run: [SmartMenu] C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe ()
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray64.exe (IDT, Inc.)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe File not found
O4 - HKLM..\Run: [HPCam_Menu] c:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [TrojanScanner] C:\Program Files (x86)\Trojan Remover\Trjscan.exe (Simply Super Software)
O4 - HKLM..\Run: [UpdatePRCShortCut] C:\Program Files (x86)\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-722066157-1209004584-819911206-1000..\Run: [Sony PC Companion] "C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe" /Background File not found
O4 - HKU\S-1-5-21-722066157-1209004584-819911206-1000..\Run: [SUPERAntiSpyware] C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: WallpaperStyle = 2
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: WallpaperStyle = 2
O7 - HKU\S-1-5-21-722066157-1209004584-819911206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableLockWorkstation = 0
O7 - HKU\S-1-5-21-722066157-1209004584-819911206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableChangePassword = 0
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Ninchen\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Ninchen\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~4\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 209.18.47.61 209.18.47.62
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{001356F1-282B-4474-A508-3CDE2CA5263C}: NameServer = 193.189.244.225 193.189.244.206
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{21DB8336-6CDB-41BC-ABA8-AD59EEBD68BF}: NameServer = 193.189.244.225 193.189.244.206
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5ACF2B2B-E010-4008-89CC-AEB006EEB631}: NameServer = 193.189.244.225 193.189.244.206
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CF27DC44-C0C5-47FC-BB45-E8915C78496B}: NameServer = 193.189.244.225 193.189.244.206
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FA92405A-2AA9-4546-964D-8016BF7078D0}: DhcpNameServer = 209.18.47.61 209.18.47.62
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\WIA6EB~1\Datamngr\x64\datamngr.dll) -  File not found
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\WIA6EB~1\Datamngr\x64\IEBHO.dll) -  File not found
O20 - AppInit_DLLs: (C:\PROGRA~2\WIA6EB~1\Datamngr\datamngr.dll) -  File not found
O20 - AppInit_DLLs: (C:\PROGRA~2\WIA6EB~1\Datamngr\IEBHO.dll) -  File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{0564190b-3e3f-11df-844a-00269ea1672c}\Shell - "" = AutoRun
O33 - MountPoints2\{0564190b-3e3f-11df-844a-00269ea1672c}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\{31da5220-fbe6-11e0-865a-001e101fa1f5}\Shell - "" = AutoRun
O33 - MountPoints2\{31da5220-fbe6-11e0-865a-001e101fa1f5}\Shell\AutoRun\command - "" = H:\Installer.exe
O33 - MountPoints2\{3b36dcac-aca4-11e0-8dad-00269ea1672c}\Shell - "" = AutoRun
O33 - MountPoints2\{3b36dcac-aca4-11e0-8dad-00269ea1672c}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{3b36dcbc-aca4-11e0-8dad-00269ea1672c}\Shell - "" = AutoRun
O33 - MountPoints2\{3b36dcbc-aca4-11e0-8dad-00269ea1672c}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{430025b9-1671-11e1-83b4-001e101f2c0e}\Shell - "" = AutoRun
O33 - MountPoints2\{430025b9-1671-11e1-83b4-001e101f2c0e}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{713b3552-fce9-11e0-8632-00269ea1672c}\Shell - "" = AutoRun
O33 - MountPoints2\{713b3552-fce9-11e0-8632-00269ea1672c}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{98698422-2b2d-11e1-8ff5-001e101fa1f5}\Shell - "" = AutoRun
O33 - MountPoints2\{98698422-2b2d-11e1-8ff5-001e101fa1f5}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
NetSvcs: ezSharedSvc - C:\Windows\SysWOW64\ezsvc7.dll (EasyBits Sofware AS)
 
 
SafeBootMin:64bit: AppMgmt - Service
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: !SASCORE - C:\Programme\SUPERAntiSpyware\SASCore64.exe (SUPERAntiSpyware.com)
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: AppMgmt - Service
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: !SASCORE - C:\Programme\SUPERAntiSpyware\SASCore64.exe (SUPERAntiSpyware.com)
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - C:\Windows\SysWow64\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.09 03:42:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2012.08.07 04:59:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.08.07 02:31:12 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\AppData\Roaming\Malwarebytes
[2012.08.07 02:30:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.08.07 02:30:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.07 02:30:08 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.08.07 02:30:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.08.02 18:05:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
[2012.08.02 18:05:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\7-Zip
[2012.08.02 04:29:51 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\AppData\Roaming\SUPERAntiSpyware.com
[2012.08.02 04:29:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2012.08.02 04:29:30 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2012.08.02 04:29:30 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2012.08.02 04:08:40 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\Documents\Simply Super Software
[2012.08.02 04:08:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trojan Remover
[2012.08.02 04:08:13 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\AppData\Roaming\Simply Super Software
[2012.08.02 04:08:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Simply Super Software
[2012.08.02 04:08:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Trojan Remover
[2012.07.29 01:17:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Freemake
[2012.07.29 01:17:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Freemake
[2012.07.29 01:17:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\FreemakeVideoConverterTB
[2012.07.29 00:39:36 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\AppData\Local\Video Converter
[2012.07.29 00:39:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MPEG4E
[2012.07.29 00:39:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Free Video Converter
[2012.07.29 00:38:29 | 000,000,000 | ---D | C] -- C:\ProgramData\VideoConverter
[2012.07.29 00:31:31 | 000,360,448 | ---- | C] (FLV.com) -- C:\Windows\SysWow64\TubeFinder.exe
[2012.07.29 00:31:29 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\AppData\Roaming\FreeFLVConverter
[2012.07.29 00:31:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Free FLV Converter
[2012.07.29 00:09:15 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\AppData\Roaming\avidemux
[2012.07.16 02:31:11 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\AppData\Roaming\WindSolutions
[2012.07.16 02:30:38 | 000,000,000 | ---D | C] -- C:\ProgramData\WindSolutions
[2012.07.16 02:03:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012.07.16 02:02:36 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2012.07.16 02:02:35 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2012.07.16 02:02:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes
[2012.07.14 23:21:23 | 000,000,000 | ---D | C] -- C:\Users\Ninchen\AppData\Local\Macromedia
[2012.07.14 23:15:29 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee
[2012.07.14 23:15:19 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed
[2012.07.14 03:01:16 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Wat
[2012.07.14 03:01:16 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Wat
 
========== Files - Modified Within 30 Days ==========
 
[2012.08.13 01:12:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.08.13 00:22:47 | 000,023,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.13 00:22:47 | 000,023,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.13 00:20:47 | 000,001,461 | ---- | M] () -- C:\Users\Ninchen\Desktop\OTL(1) - Verknüpfung.lnk
[2012.08.13 00:13:27 | 000,065,536 | ---- | M] () -- C:\Windows\SysNative\Ikeext.etl
[2012.08.13 00:13:00 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.13 00:12:53 | 3218,235,392 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.11 18:12:31 | 000,001,084 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Antivirus Scheduled Scan.job
[2012.08.11 18:12:31 | 000,000,514 | ---- | M] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task d9daa13f-20d9-4414-8e1f-10430e1847dd.job
[2012.08.11 02:48:41 | 000,000,514 | ---- | M] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task 1ddbee62-2b5b-4452-b38a-abcaade39472.job
[2012.08.08 02:29:33 | 000,001,499 | ---- | M] () -- C:\Users\Ninchen\Desktop\adwcleaner - Verknüpfung.lnk
[2012.08.07 02:30:10 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.02 17:23:40 | 000,001,074 | ---- | M] () -- C:\Users\Ninchen\Desktop\Defogger - Verknüpfung.lnk
[2012.08.02 17:23:16 | 000,001,430 | ---- | M] () -- C:\Users\Ninchen\Desktop\OTL - Verknüpfung.lnk
[2012.08.02 17:22:08 | 000,000,168 | ---- | M] () -- C:\Users\Ninchen\defogger_reenable
[2012.08.02 04:29:34 | 000,001,808 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012.08.02 04:08:15 | 000,001,139 | ---- | M] () -- C:\Users\Public\Desktop\Trojan Remover.lnk
[2012.08.02 03:12:50 | 000,000,340 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForNinchen.job
[2012.07.31 00:45:02 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.07.31 00:45:02 | 000,654,400 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.07.31 00:45:02 | 000,616,242 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.07.31 00:45:02 | 000,130,240 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.07.31 00:45:02 | 000,106,622 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.07.29 00:40:24 | 000,004,608 | ---- | M] () -- C:\Users\Ninchen\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.07.16 02:03:37 | 000,001,783 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
 
========== Files Created - No Company Name ==========
 
[2012.08.13 00:20:27 | 000,001,461 | ---- | C] () -- C:\Users\Ninchen\Desktop\OTL(1) - Verknüpfung.lnk
[2012.08.08 02:29:16 | 000,001,499 | ---- | C] () -- C:\Users\Ninchen\Desktop\adwcleaner - Verknüpfung.lnk
[2012.08.07 02:30:10 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.02 17:23:40 | 000,001,074 | ---- | C] () -- C:\Users\Ninchen\Desktop\Defogger - Verknüpfung.lnk
[2012.08.02 17:23:16 | 000,001,430 | ---- | C] () -- C:\Users\Ninchen\Desktop\OTL - Verknüpfung.lnk
[2012.08.02 17:22:07 | 000,000,168 | ---- | C] () -- C:\Users\Ninchen\defogger_reenable
[2012.08.02 04:30:18 | 000,000,514 | ---- | C] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task d9daa13f-20d9-4414-8e1f-10430e1847dd.job
[2012.08.02 04:30:17 | 000,000,514 | ---- | C] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task 1ddbee62-2b5b-4452-b38a-abcaade39472.job
[2012.08.02 04:29:34 | 000,001,808 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012.08.02 04:08:15 | 000,001,139 | ---- | C] () -- C:\Users\Public\Desktop\Trojan Remover.lnk
[2012.08.02 04:08:14 | 000,153,088 | ---- | C] () -- C:\Windows\SysWow64\UNRAR3.dll
[2012.08.02 04:08:14 | 000,075,264 | ---- | C] () -- C:\Windows\SysWow64\unacev2.dll
[2012.07.29 00:40:13 | 000,004,608 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.07.29 00:31:30 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\PropertyGrid.ocx
[2012.07.29 00:31:30 | 000,208,500 | ---- | C] () -- C:\Windows\SysWow64\ReyXpBasics.tlb
[2012.07.29 00:31:30 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\ControlSubX.ocx
[2012.07.25 23:37:57 | 000,000,340 | ---- | C] () -- C:\Windows\tasks\HPCeeScheduleForNinchen.job
[2012.07.16 02:03:37 | 000,001,783 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012.07.14 23:15:27 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2011.12.27 19:39:36 | 000,238,995 | ---- | C] () -- C:\Windows\hpwins26.dat
[2011.04.16 17:03:57 | 000,001,854 | ---- | C] () -- C:\Users\Ninchen\AppData\Roaming\GhostObjGAFix.xml
[2011.01.13 16:22:56 | 000,000,087 | ---- | C] () -- C:\Users\Ninchen\webct_upload_applet.properties
[2010.11.02 15:32:37 | 000,000,001 | R--- | C] () -- C:\Users\Ninchen\serverport
[2010.09.17 21:16:10 | 001,670,467 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\tmpIMG_0065.0
[2010.09.17 21:16:10 | 000,776,826 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\tmpIMG_0065.JPG
[2010.09.17 21:15:54 | 000,747,817 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\tmpIMG_0064.JPG
[2010.09.17 21:15:53 | 001,620,983 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\tmpIMG_0064.0
[2010.09.17 20:51:32 | 002,334,606 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\tmpDSC00349.JPG
[2010.09.17 20:51:31 | 005,029,971 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\tmpDSC00349.0
[2010.09.15 12:41:56 | 000,602,102 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\tmpIMG_0069.JPG
[2010.09.15 12:41:55 | 001,304,308 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\tmpIMG_0069.0
[2010.04.02 20:34:20 | 002,529,622 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\[j0004]-[p212].bmp
[2010.04.02 20:19:34 | 002,529,622 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\[j0003]-[p14].bmp
[2010.04.02 19:51:45 | 002,529,622 | ---- | C] () -- C:\Users\Ninchen\AppData\Local\[j0002]-[p26].bmp
 
========== LOP Check ==========
 
[2012.04.10 15:21:24 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\Ad-Aware Antivirus
[2012.07.29 00:09:55 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\avidemux
[2012.07.12 04:46:34 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\Canneverbe Limited
[2011.10.21 21:03:13 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\DAEMON Tools Lite
[2012.07.12 03:05:57 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\DVDVideoSoft
[2011.10.17 12:18:32 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.07.29 00:31:38 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\FreeFLVConverter
[2010.10.02 00:13:59 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\OpenOffice.org
[2012.08.02 04:08:13 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\Simply Super Software
[2011.06.30 17:07:41 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\Sony
[2012.07.16 02:31:11 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\WindSolutions
[2010.03.29 21:07:34 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\_MDLogs
[2012.08.11 18:12:31 | 000,001,084 | ---- | M] () -- C:\Windows\Tasks\Ad-Aware Antivirus Scheduled Scan.job
[2012.07.08 01:58:45 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2012.08.11 02:48:41 | 000,000,514 | ---- | M] () -- C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 1ddbee62-2b5b-4452-b38a-abcaade39472.job
[2012.08.11 18:12:31 | 000,000,514 | ---- | M] () -- C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task d9daa13f-20d9-4414-8e1f-10430e1847dd.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2012.04.10 15:21:24 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\Ad-Aware Antivirus
[2010.03.30 21:39:14 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\Adobe
[2012.02.26 16:52:01 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\Apple Computer
[2010.03.26 22:58:08 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\ATI
[2012.07.29 00:09:55 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\avidemux
[2012.04.10 19:59:59 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\Avira
[2012.07.12 04:46:34 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\Canneverbe Limited
[2011.06.30 21:56:10 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\CyberLink
[2011.10.21 21:03:13 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\DAEMON Tools Lite
[2012.07.12 03:05:57 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\DVDVideoSoft
[2011.10.17 12:18:32 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.07.29 00:31:38 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\FreeFLVConverter
[2010.06.08 15:00:29 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\Hewlett-Packard
[2012.01.02 18:32:10 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\HP
[2010.05.05 15:02:56 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\HP Support Assistant
[2010.03.26 22:54:32 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\HP TCS
[2010.12.21 13:44:24 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\hpqlog
[2010.05.05 15:02:56 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\HpUpdate
[2010.03.26 22:57:41 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\Identities
[2010.03.29 20:48:38 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\Macromedia
[2012.08.07 02:31:12 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\Malwarebytes
[2009.11.25 11:08:35 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\Media Center Programs
[2012.07.14 23:21:23 | 000,000,000 | --SD | M] -- C:\Users\Ninchen\AppData\Roaming\Microsoft
[2010.03.29 21:14:27 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\Mozilla
[2012.07.12 04:40:35 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\Nero
[2010.10.02 00:13:59 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\OpenOffice.org
[2012.08.02 04:08:13 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\Simply Super Software
[2012.08.11 19:56:16 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\Skype
[2011.06.30 17:07:41 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\Sony
[2012.08.02 04:29:51 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\SUPERAntiSpyware.com
[2011.07.03 23:50:43 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\vlc
[2012.07.16 02:31:11 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\WindSolutions
[2011.01.18 18:44:58 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\WinRAR
[2010.03.29 21:07:34 | 000,000,000 | ---D | M] -- C:\Users\Ninchen\AppData\Roaming\_MDLogs
 
< %APPDATA%\*.exe /s >
[2011.06.07 15:04:12 | 003,080,864 | ---- | M] (Adobe Systems, Inc.) -- C:\Users\Ninchen\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
[2011.06.30 17:07:22 | 000,010,134 | R--- | M] () -- C:\Users\Ninchen\AppData\Roaming\Microsoft\Installer\{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}\ARPPRODUCTICON.exe
 
< %SYSTEMDRIVE%\*.exe >
[2007.11.07 08:44:20 | 000,855,040 | ---- | M] (Microsoft Corporation) -- C:\install.exe
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: EVENTLOG.DLL  >
[2007.05.17 21:34:04 | 000,007,216 | ---- | M] () MD5=C2A279A458A06DE2C83D842AA042B5A8 -- C:\Program Files (x86)\CyberLink\PowerDirector\EventLog.dll
 
< MD5 for: IASTORV.SYS  >
[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys
[2011.03.11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys
[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll
[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys
[2011.03.11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys
[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll
[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2012.07.03 13:46:42 | 000,217,672 | ---- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009.10.28 09:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
<           >
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 150 bytes -> C:\ProgramData\Temp:CB0AACC9

< End of report >

--- --- ---

Trojaner Searchnu - http://www.searchnu.com/413?tag=newtab

Log-Analyse und Auswertung: Trojaner Searchnu - http://www.searchnu.com/413?tag=newtab