Desktop blockiert - zahlung von 100 € via UKASH verlangt

OTL Extras logfile created on: 03.08.2012 17:11:10 - Run 2
OTL by OldTimer - Version 3.2.55.0     Folder = C:\Users\***\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
8,00 Gb Total Physical Memory | 6,06 Gb Available Physical Memory | 75,73% Memory free
16,00 Gb Paging File | 14,24 Gb Available in Paging File | 89,04% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 70,00 Gb Total Space | 4,81 Gb Free Space | 6,87% Space Free | Partition Type: NTFS
Drive D: | 50,00 Gb Total Space | 37,14 Gb Free Space | 74,28% Space Free | Partition Type: NTFS
Drive E: | 345,66 Gb Total Space | 32,12 Gb Free Space | 9,29% Space Free | Partition Type: NTFS
Drive J: | 7,52 Gb Total Space | 6,92 Gb Free Space | 92,00% Space Free | Partition Type: FAT32
 
Computer Name: *** | User Name: *** | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
.js[@ = JSFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.jse[@ = JSEFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.vbe[@ = VBEFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.vbs[@ = VBSFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.wsf[@ = WSFFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.js [@ = JSFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.jse [@ = JSEFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.vbe [@ = VBEFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.vbs [@ = VBSFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
.wsf [@ = WSFFile] -- C:\Windows\SysWow64\CScript.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-100361996-2776585883-543826973-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- d:\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
jsfile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
jsefile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
vbefile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
vbsfile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
wsffile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "D:\VLC111.1\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "D:\VLC111.1\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
jsfile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
jsefile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
vbefile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
vbsfile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
wsffile [open] -- %SystemRoot%\SysWow64\CScript.exe "%1" %* (Microsoft Corporation)
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "D:\VLC111.1\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "D:\VLC111.1\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04F2DDCF-B8DB-4DA8-825C-9502567AAB5A}" = protocol=6 | dir=in | app=c:\program files (x86)\lexmark 3500-4500 series\lxdimon.exe | 
"{0F5A9830-0F0E-4A37-BEFA-7E97856417E3}" = protocol=6 | dir=in | app=c:\windows\syswow64\lxdicoms.exe | 
"{20C60FE6-BC7C-4AED-924A-EFA60F163E42}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\x64\3\lxdipswx.exe | 
"{214C80C8-0891-486C-B780-DC5EAA58C613}" = protocol=17 | dir=in | app=e:\spiele\mass effect 2\binaries\masseffect2.exe | 
"{24DEC824-AD1C-4E90-969A-91BDB4CA134E}" = protocol=6 | dir=in | app=c:\windows\system32\lxdicoms.exe | 
"{256EBD95-57EE-4740-BDC7-DC18F302F653}" = protocol=17 | dir=in | app=e:\spiele\resident evil5\re5dx9.exe | 
"{304E7828-B212-4CBB-93F5-D75EAEC31BE8}" = protocol=17 | dir=in | app=e:\spiele\resident evil5\re5dx10.exe | 
"{3401A99C-F2ED-4DB1-A820-9D18AA96B9F5}" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\common\skyrim\skyrimlauncher.exe | 
"{35087192-510C-42C9-9D15-BFBD8EA74124}" = protocol=17 | dir=in | app=d:\icq7.7\icq.exe | 
"{35142D29-F604-42C2-9F0E-3C3A5706D146}" = protocol=17 | dir=in | app=c:\program files (x86)\lexmark 3500-4500 series\lxdimon.exe | 
"{364E9027-6FEC-470A-B3DF-F5529AFAE6F0}" = protocol=6 | dir=in | app=d:\icq7.7\icq.exe | 
"{3D81C7B2-3B82-4AB2-A629-A90427594FED}" = protocol=6 | dir=in | app=c:\program files (x86)\lexmark 3500-4500 series\lxdiamon.exe | 
"{42139BBF-0478-4799-800B-F1F9FECED251}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\x64\3\lxdipswx.exe | 
"{4371E566-C971-47C0-A8D5-78DA3CC9DA29}" = protocol=17 | dir=in | app=c:\program files (x86)\lexmark 3500-4500 series\app4r.exe | 
"{442C21D5-B954-4246-AFEB-8E9CDA67A703}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.515\agent.exe | 
"{4539EF34-CEDF-4121-9BE2-CDA7FE3BA190}" = protocol=17 | dir=in | app=c:\windows\system32\lxdicoms.exe | 
"{4FFEFD2C-CF50-4892-94F5-A8550F4C1FB5}" = protocol=17 | dir=in | app=e:\spiele\rockstar games social club\rgsclauncher.exe | 
"{50A13F30-2E81-4E3D-9E5E-1257490BAD34}" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\common\skyrim\skyrimlauncher.exe | 
"{5687C3F4-A5D8-4BDB-9007-3CE267D6298E}" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\common\mafia ii\pc\mafia2.exe | 
"{595176D6-7A8F-4C0C-8200-DB2140D8ED3C}" = protocol=6 | dir=in | app=e:\spiele\resident evil5\re5dx10.exe | 
"{5A634658-2945-4DCA-AE96-1EE7E6F72238}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.515\agent.exe | 
"{687D96FB-9B35-4CEB-B132-B73F779A96BF}" = protocol=6 | dir=in | app=e:\spiele\mass effect 2\binaries\masseffect2.exe | 
"{728DF75C-52D5-4B78-BEAF-1825F83C23F8}" = protocol=17 | dir=in | app=e:\spiele\mass effect 2\masseffect2launcher.exe | 
"{72CA3F5B-3DF0-4F11-B5B3-C49E684BDC86}" = protocol=17 | dir=in | app=d:\icq7.7\icq.exe | 
"{748ABF0F-6BE7-4596-8D8E-643D1DEC567C}" = protocol=6 | dir=in | app=d:\icq7.7\icq.exe | 
"{749EC93E-DB58-4D42-BFE6-4D624794B8D8}" = protocol=6 | dir=in | app=e:\spiele\steam\steam.exe | 
"{7BF3C96D-240E-41E6-BBFE-5401A92EF4F4}" = protocol=17 | dir=in | app=d:\icq7.7\icq.exe | 
"{803A0720-2530-4F0E-AAAB-A534E1B35B09}" = dir=in | app=d:\skype\phone\skype.exe | 
"{80940451-2D43-4FBD-AFCF-B2AB0F64F16F}" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\common\mafia ii\pc\mafia2.exe | 
"{810C61CB-F23D-4832-A649-CA498BC3CDB1}" = protocol=6 | dir=in | app=d:\arcsoft\totalmedia 3.5\totalmedia.exe | 
"{81ABBC06-D7AD-4ED5-80B2-99AED78A7661}" = protocol=6 | dir=in | app=d:\icq7.7\icq.exe | 
"{85720CCE-5C81-4CDF-8979-B3DC4512B787}" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\common\risen 2\system\risen2.exe | 
"{85AB4DFF-5B1F-40FD-BCA2-984CD1E96251}" = dir=in | app=d:\powerdvd\powerdvd.exe | 
"{8710F19F-A5CE-476B-9A77-5C3F8774EC26}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.868\agent.exe | 
"{96FC2792-037C-42FA-BE66-6449B19B4E8F}" = protocol=17 | dir=in | app=e:\spiele\starcraft ii\versions\base19132\sc2.exe | 
"{989A2B0C-012F-4545-9856-9C396EC3CAD1}" = protocol=6 | dir=in | app=e:\spiele\rockstar games social club\rgsclauncher.exe | 
"{ACA9BE58-6CFF-4849-BA38-185829429FDA}" = protocol=17 | dir=in | app=c:\users\master\desktop\qccc\diablo iii beta dede setup.exe | 
"{AD12CAEB-68BD-4748-9629-46592F5C9E8D}" = protocol=6 | dir=in | app=c:\program files (x86)\lexmark 3500-4500 series\app4r.exe | 
"{B141A332-A7BE-4315-B826-3D6AD304E6DD}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\x64\3\lxdijswx.exe | 
"{BA925190-3136-4D5C-A76F-8C3A7F1952D0}" = protocol=6 | dir=in | app=e:\spiele\mass effect 2\masseffect2launcher.exe | 
"{BFCB27F5-A3EA-4D3D-92FE-60D6394BF454}" = protocol=17 | dir=in | app=c:\program files (x86)\lexmark 3500-4500 series\lxdiamon.exe | 
"{C149391F-A6BB-44E6-B344-AA60CF2E1C5A}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\x64\3\lxditime.exe | 
"{C25BEF75-0796-49E9-A0B3-50789187244F}" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\common\risen 2\system\risen2.exe | 
"{C66BDA40-8A83-4CF3-9323-E133CF7B5BC7}" = protocol=6 | dir=in | app=c:\users\master\desktop\qccc\diablo iii beta dede setup.exe | 
"{C6F595A3-9815-4EA8-9EC4-486E78CC86A6}" = protocol=6 | dir=in | app=e:\spiele\resident evil5\re5dx9.exe | 
"{CC9217AB-C2E0-4C53-9FB5-BDB5FE9250E3}" = protocol=17 | dir=in | app=e:\spiele\steam\steam.exe | 
"{D5C5595C-DB20-422A-BC5C-1B36FBE155A2}" = protocol=17 | dir=in | app=c:\windows\syswow64\lxdicoms.exe | 
"{ECD58252-8C27-4F43-9D5E-AD3255EA47E5}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\x64\3\lxdijswx.exe | 
"{F23FD362-6D2F-4A84-BDCA-5A9095A3A9CA}" = protocol=6 | dir=in | app=e:\spiele\starcraft ii\versions\base19132\sc2.exe | 
"{F2E051C1-BEFB-4602-B07E-E8B7724FA436}" = protocol=17 | dir=in | app=d:\arcsoft\totalmedia 3.5\totalmedia.exe | 
"{F629B751-DCA9-4203-8CD7-1F36E924A6AC}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.868\agent.exe | 
"{FB27B907-C149-434B-A14C-604A3C465C3B}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\x64\3\lxditime.exe | 
"TCP Query User{355485B2-9B0A-4E66-9443-DEAA90230876}E:\spiele\the witcher 2\bin\witcher2.exe" = protocol=6 | dir=in | app=e:\spiele\the witcher 2\bin\witcher2.exe | 
"TCP Query User{534B112F-D870-4452-8C4A-CE0C745166DF}E:\spiele\starcraft ii\versions\base21029\sc2.exe" = protocol=6 | dir=in | app=e:\spiele\starcraft ii\versions\base21029\sc2.exe | 
"TCP Query User{8C8C5708-3DFC-41CC-84DF-9DD3A834D97B}C:\users\master\appdata\roaming\konoe\okfao.exe" = protocol=6 | dir=in | app=c:\users\master\appdata\roaming\konoe\okfao.exe | 
"TCP Query User{97CC90B1-E40F-4F66-A9B8-B6A09ECF3A59}E:\spiele\steam\steamapps\common\star trek online\star trek online\live\gameclient.exe" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\common\star trek online\star trek online\live\gameclient.exe | 
"TCP Query User{9A2711F6-2C07-4641-8C90-F60122B355B2}D:\mozilla firefox\plugin-container.exe" = protocol=6 | dir=in | app=d:\mozilla firefox\plugin-container.exe | 
"TCP Query User{9BA52280-AD43-46F7-9A74-0C7006447207}D:\cambridgesoft\chemoffice2010\chemdraw\chemdraw.exe" = protocol=6 | dir=in | app=d:\cambridgesoft\chemoffice2010\chemdraw\chemdraw.exe | 
"TCP Query User{9E5C1C98-E3D3-4F4D-B02B-A45BD60B0900}D:\skype\phone\skype.exe" = protocol=6 | dir=in | app=d:\skype\phone\skype.exe | 
"TCP Query User{A0F004FB-66FD-498F-ADE5-AD9D1BD8C163}D:\chemdraw\chemdraw\chemdraw.exe" = protocol=6 | dir=in | app=d:\chemdraw\chemdraw\chemdraw.exe | 
"TCP Query User{B5ABF6C7-C9D3-47CF-BFAF-FD66934CCC92}E:\spiele\command & conquer generäle stunde null\game.dat" = protocol=6 | dir=in | app=e:\spiele\command & conquer generäle stunde null\game.dat | 
"TCP Query User{E427CEDA-A552-4AA9-BFC7-3906EA069EC0}E:\spiele\starcraft ii\starcraft ii.exe" = protocol=6 | dir=in | app=e:\spiele\starcraft ii\starcraft ii.exe | 
"TCP Query User{EA850501-9AC9-4A60-B322-71779E014B92}E:\spiele\starcraft ii\support\blizzarddownloader.exe" = protocol=6 | dir=in | app=e:\spiele\starcraft ii\support\blizzarddownloader.exe | 
"TCP Query User{F4B7E9CA-B10A-4E16-85F0-C60F8829BADD}E:\spiele\starcraft ii\versions\base19679\sc2.exe" = protocol=6 | dir=in | app=e:\spiele\starcraft ii\versions\base19679\sc2.exe | 
"TCP Query User{F6BC5C6C-E68E-4A17-8905-78FE51C54442}E:\spiele\steam\steamapps\nikita_schuetzek\team fortress 2\hl2.exe" = protocol=6 | dir=in | app=e:\spiele\steam\steamapps\nikita_schuetzek\team fortress 2\hl2.exe | 
"UDP Query User{023B5FFB-99AE-4488-B2CD-85CED065731B}D:\mozilla firefox\plugin-container.exe" = protocol=17 | dir=in | app=d:\mozilla firefox\plugin-container.exe | 
"UDP Query User{0B306CB7-B7A3-418D-8F4B-D09B004F47C6}E:\spiele\steam\steamapps\common\star trek online\star trek online\live\gameclient.exe" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\common\star trek online\star trek online\live\gameclient.exe | 
"UDP Query User{177BDC40-E5D6-44D8-BA10-FDE386D39BD7}D:\chemdraw\chemdraw\chemdraw.exe" = protocol=17 | dir=in | app=d:\chemdraw\chemdraw\chemdraw.exe | 
"UDP Query User{1A5ADA0D-E716-49FB-80FE-9EDC4415E38F}E:\spiele\starcraft ii\support\blizzarddownloader.exe" = protocol=17 | dir=in | app=e:\spiele\starcraft ii\support\blizzarddownloader.exe | 
"UDP Query User{4B7F00FE-7072-43FD-B491-968D176793ED}E:\spiele\the witcher 2\bin\witcher2.exe" = protocol=17 | dir=in | app=e:\spiele\the witcher 2\bin\witcher2.exe | 
"UDP Query User{59DD3190-8920-4FC2-8BAF-D6C7B3C9B272}D:\skype\phone\skype.exe" = protocol=17 | dir=in | app=d:\skype\phone\skype.exe | 
"UDP Query User{6FDECCE7-DFC0-4C23-BFB5-50966F4718DA}E:\spiele\steam\steamapps\nikita_schuetzek\team fortress 2\hl2.exe" = protocol=17 | dir=in | app=e:\spiele\steam\steamapps\nikita_schuetzek\team fortress 2\hl2.exe | 
"UDP Query User{7360DEE5-013B-4492-A758-5A264F602C64}E:\spiele\command & conquer generäle stunde null\game.dat" = protocol=17 | dir=in | app=e:\spiele\command & conquer generäle stunde null\game.dat | 
"UDP Query User{7ECBAC43-EE97-4CEC-B96B-3E6802F5EC6A}E:\spiele\starcraft ii\starcraft ii.exe" = protocol=17 | dir=in | app=e:\spiele\starcraft ii\starcraft ii.exe | 
"UDP Query User{81BDF8D6-B8A6-4D0E-B3C3-5139CC47A5C3}D:\cambridgesoft\chemoffice2010\chemdraw\chemdraw.exe" = protocol=17 | dir=in | app=d:\cambridgesoft\chemoffice2010\chemdraw\chemdraw.exe | 
"UDP Query User{A7852239-7B1A-4BF8-A2C2-BEB698DD263E}E:\spiele\starcraft ii\versions\base21029\sc2.exe" = protocol=17 | dir=in | app=e:\spiele\starcraft ii\versions\base21029\sc2.exe | 
"UDP Query User{ABBF8E70-41E4-4DE2-9258-C19E4E5A3B32}C:\users\master\appdata\roaming\konoe\okfao.exe" = protocol=17 | dir=in | app=c:\users\master\appdata\roaming\konoe\okfao.exe | 
"UDP Query User{DE8735FD-37A4-45A2-AA32-629A1278A310}E:\spiele\starcraft ii\versions\base19679\sc2.exe" = protocol=17 | dir=in | app=e:\spiele\starcraft ii\versions\base19679\sc2.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 296.10
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 296.10
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.0213
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.7.11
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Lexmark 3500-4500 Series" = Lexmark 3500-4500 Series
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{06F80017-8F98-4C94-B868-52358569FC32}" = Command & Conquer(TM) Generäle
"{08B3869E-D282-424C-9AFC-870E04A4BA14}" = Rockstar Games Social Club
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java(TM) 6 Update 33
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{48DEAAF2-8276-4BBD-B7B6-91E454938476}" = CambridgeSoft ChemDraw Ultra 12.0
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = CyberLink PowerDVD
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{74292F90-895A-4FC6-A692-9641532B1B63}" = ArcSoft TotalMedia 3.5
"{75D84EF7-0D8C-4e70-B3FA-7B42A5D4E0EB}" = Mass Effect 2
"{77F665FD-3F60-4B0A-AE14-EC124B7A7FCE}" = ICQ7.7
"{7FB413C8-3CAD-49F7-A67C-6EFEB4B04050}" = LogMeIn Hamachi
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{94F3D243-2006-4B2D-9160-C2A33F74BB84}" = Windows Media Center Edition MPEG Codec Plug-in
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{AC08BBA0-96B9-431A-A7D0-D8598E493775}" = RESIDENT EVIL 5
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{C3E9887A-23BA-4777-8080-191A5AFCAB74}" = Mumble 1.2.3
"{DA909E62-3B45-4BA1-8B58-FCAEBA4BCEC9}" = NVIDIA PhysX
"{E773E0B9-6ABE-4F9E-816C-56B2DD8613B9}" = CambridgeSoft Activation Client
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0A209B7-7F85-4BDD-8F1F-B98EEAD9E04B}" = The Witcher 2
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F2508213-9989-4E85-A078-72BE483917EF}" = Microsoft Games for Windows - LIVE Redistributable
"{F3E9C243-122E-4D6B-ACC1-E1FEC02F6CA1}" = Command and Conquer(TM) Generäle Die Stunde Null 
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"C&C - Zero Hour - Full Uncut Patch Final v.2.5" = C&C - Zero Hour - Full Uncut Patch Final v.2.5
"DAEMON Tools Lite" = DAEMON Tools Lite
"GenTool" = GenTool
"InstallShield_{06F80017-8F98-4C94-B868-52358569FC32}" = Command & Conquer(TM) Generäle
"InstallShield_{F3E9C243-122E-4D6B-ACC1-E1FEC02F6CA1}" = Command and Conquer(TM) Generäle Die Stunde Null 
"LogMeIn Hamachi" = LogMeIn Hamachi
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"MestReNova LITE" = MestReNova LITE 5.2.5-5780
"Mozilla Firefox 13.0.1 (x86 de)" = Mozilla Firefox 13.0.1 (x86 de)
"Steam App 40390" = Risen 2 - Dark Waters
"Steam App 72850" = The Elder Scrolls V: Skyrim
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"VLC media player" = VLC media player 1.1.11
"WinGimp-2.0_is1" = GIMP 2.6.12
"WinRAR archiver" = WinRAR 4.20 (32-Bit)
"XCC Utilities" = XCC Utilities 1.47
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-100361996-2776585883-543826973-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"GameRanger" = GameRanger
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 22.07.2012 12:50:30 | Computer Name = *** | Source = Application Hang | ID = 1002
Description = Programm TotalMedia.exe, Version 3.5.28.322 kann nicht mehr unter 
Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in
 der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem 
zu suchen.    Prozess-ID: 9a4    Startzeit: 01cd68213fb519ac    Endzeit: 4167    Anwendungspfad:
 D:\ArcSoft\TotalMedia 3.5\TotalMedia.exe    Berichts-ID: 53ec01cd-d41d-11e1-bc43-00241d76b849

 
Error - 26.07.2012 16:25:05 | Computer Name = *** | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: FlashPlayerPlugin_11_3_300_265.exe,
 Version: 11.3.300.265, Zeitstempel: 0x4febd5ac  Name des fehlerhaften Moduls: NPSWF32_11_3_300_265.dll,
 Version: 11.3.300.265, Zeitstempel: 0x4febd798  Ausnahmecode: 0xc0000005  Fehleroffset:
 0x001d4dae  ID des fehlerhaften Prozesses: 0x10e4  Startzeit der fehlerhaften Anwendung:
 0x01cd6b5a418e5d20  Pfad der fehlerhaften Anwendung: C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_265.exe
Pfad
 des fehlerhaften Moduls: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll
Berichtskennung:
 fc147d5c-d75f-11e1-be52-00241d76b849
 
Error - 28.07.2012 16:15:36 | Computer Name = *** | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: SndVol.exe, Version: 6.1.7601.17514,
 Zeitstempel: 0x4ce7aced  Name des fehlerhaften Moduls: SndVol.exe, Version: 6.1.7601.17514,
 Zeitstempel: 0x4ce7aced  Ausnahmecode: 0xc0000005  Fehleroffset: 0x000000000001d612
ID
 des fehlerhaften Prozesses: 0x12a0  Startzeit der fehlerhaften Anwendung: 0x01cd6cd3edaf779b
Pfad
 der fehlerhaften Anwendung: C:\Windows\system32\SndVol.exe  Pfad des fehlerhaften
 Moduls: C:\Windows\system32\SndVol.exe  Berichtskennung: fda4fdd0-d8f0-11e1-b0a3-00241d76b849
 
Error - 01.08.2012 15:26:13 | Computer Name = *** | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: 7zFM.exe, Version: 4.65.0.0, Zeitstempel:
 0x4987ee1a  Name des fehlerhaften Moduls: 7z.dll, Version: 4.65.0.0, Zeitstempel:
 0x4987efd0  Ausnahmecode: 0xc0000005  Fehleroffset: 0x000000000009a935  ID des fehlerhaften
 Prozesses: 0x12a0  Startzeit der fehlerhaften Anwendung: 0x01cd701b7c350215  Pfad der
 fehlerhaften Anwendung: D:\7-Zip\7zFM.exe  Pfad des fehlerhaften Moduls: D:\7-Zip\7z.dll
Berichtskennung:
 c148dc9e-dc0e-11e1-b812-00241d76b849
 
Error - 01.08.2012 15:26:38 | Computer Name = *** | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: 7zFM.exe, Version: 4.65.0.0, Zeitstempel:
 0x4987ee1a  Name des fehlerhaften Moduls: 7z.dll, Version: 4.65.0.0, Zeitstempel:
 0x4987efd0  Ausnahmecode: 0xc0000005  Fehleroffset: 0x000000000009a935  ID des fehlerhaften
 Prozesses: 0x1184  Startzeit der fehlerhaften Anwendung: 0x01cd701b8655ee0c  Pfad der
 fehlerhaften Anwendung: D:\7-Zip\7zFM.exe  Pfad des fehlerhaften Moduls: D:\7-Zip\7z.dll
Berichtskennung:
 cfd151e8-dc0e-11e1-b812-00241d76b849
 
Error - 01.08.2012 15:31:07 | Computer Name = *** | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: 7zFM.exe, Version: 4.65.0.0, Zeitstempel:
 0x4987ee1a  Name des fehlerhaften Moduls: 7z.dll, Version: 4.65.0.0, Zeitstempel:
 0x4987efd0  Ausnahmecode: 0xc0000005  Fehleroffset: 0x000000000009a935  ID des fehlerhaften
 Prozesses: 0xf04  Startzeit der fehlerhaften Anwendung: 0x01cd701ba23929a5  Pfad der
 fehlerhaften Anwendung: D:\7-Zip\7zFM.exe  Pfad des fehlerhaften Moduls: D:\7-Zip\7z.dll
Berichtskennung:
 705aa42b-dc0f-11e1-b812-00241d76b849
 
Error - 01.08.2012 15:36:29 | Computer Name = *** | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: 7zFM.exe, Version: 4.65.0.0, Zeitstempel:
 0x4987ee1a  Name des fehlerhaften Moduls: 7z.dll, Version: 4.65.0.0, Zeitstempel:
 0x4987efd0  Ausnahmecode: 0xc0000005  Fehleroffset: 0x000000000009a935  ID des fehlerhaften
 Prozesses: 0x68c  Startzeit der fehlerhaften Anwendung: 0x01cd701cee98bb68  Pfad der
 fehlerhaften Anwendung: D:\7-Zip\7zFM.exe  Pfad des fehlerhaften Moduls: D:\7-Zip\7z.dll
Berichtskennung:
 3041238f-dc10-11e1-b812-00241d76b849
 
Error - 01.08.2012 15:39:13 | Computer Name = *** | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: 7zFM.exe, Version: 4.65.0.0, Zeitstempel:
 0x4987ee1a  Name des fehlerhaften Moduls: 7z.dll, Version: 4.65.0.0, Zeitstempel:
 0x4987efd0  Ausnahmecode: 0xc0000005  Fehleroffset: 0x000000000009a935  ID des fehlerhaften
 Prozesses: 0xfb4  Startzeit der fehlerhaften Anwendung: 0x01cd701d4da46a5d  Pfad der
 fehlerhaften Anwendung: D:\7-Zip\7zFM.exe  Pfad des fehlerhaften Moduls: D:\7-Zip\7z.dll
Berichtskennung:
 920f583e-dc10-11e1-b812-00241d76b849
 
Error - 01.08.2012 16:09:35 | Computer Name = *** | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: 7zFM.exe, Version: 4.65.0.0, Zeitstempel:
 0x4987ee1a  Name des fehlerhaften Moduls: 7z.dll, Version: 4.65.0.0, Zeitstempel:
 0x4987efd0  Ausnahmecode: 0xc0000005  Fehleroffset: 0x000000000009a935  ID des fehlerhaften
 Prozesses: 0xdfc  Startzeit der fehlerhaften Anwendung: 0x01cd70218d124639  Pfad der
 fehlerhaften Anwendung: D:\7-Zip\7zFM.exe  Pfad des fehlerhaften Moduls: D:\7-Zip\7z.dll
Berichtskennung:
 d00d9927-dc14-11e1-b812-00241d76b849
 
Error - 02.08.2012 13:49:34 | Computer Name = *** | Source = Microsoft-Windows-CAPI2 | ID = 512
Description = Vom Kryptografiedienst konnte das VSS-Sicherungsobjekt "System Writer"
 nicht initialisiert werden.  Details: Could not query the status of the EventSystem
 service.  System Error: Der Computer wird heruntergefahren.  .
 
[ System Events ]
Error - 16.02.2012 07:59:19 | Computer Name = *** | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?16.?02.?2012 um 12:58:42 unerwartet heruntergefahren.
 
Error - 17.02.2012 14:06:21 | Computer Name = *** | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
 nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
 
Error - 22.02.2012 02:43:25 | Computer Name = *** | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
 nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
 
Error - 27.02.2012 10:40:49 | Computer Name = *** | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?27.?02.?2012 um 07:40:54 unerwartet heruntergefahren.
 
Error - 29.02.2012 12:42:35 | Computer Name = *** | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
 nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
 
Error - 02.03.2012 03:13:26 | Computer Name = *** | Source = Service Control Manager | ID = 7030
Description = Der Dienst "LogMeIn Hamachi Tunneling Engine" ist als interaktiver
 Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive
 Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
 
Error - 02.03.2012 03:13:28 | Computer Name = *** | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
 LogMeIn Hamachi Tunneling Engine erreicht.
 
Error - 02.03.2012 03:13:28 | Computer Name = *** | Source = Service Control Manager | ID = 7000
Description = Der Dienst "LogMeIn Hamachi Tunneling Engine" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%1053
 
Error - 02.03.2012 03:16:46 | Computer Name = *** | Source = DCOM | ID = 10010
Description = 
 
Error - 07.03.2012 07:24:02 | Computer Name = *** | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
 nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
 
 
< End of report >
         

OTL logfile created on: 03.08.2012 17:11:10 - Run 2
OTL by OldTimer - Version 3.2.55.0     Folder = C:\Users\***\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
8,00 Gb Total Physical Memory | 6,06 Gb Available Physical Memory | 75,73% Memory free
16,00 Gb Paging File | 14,24 Gb Available in Paging File | 89,04% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 70,00 Gb Total Space | 4,81 Gb Free Space | 6,87% Space Free | Partition Type: NTFS
Drive D: | 50,00 Gb Total Space | 37,14 Gb Free Space | 74,28% Space Free | Partition Type: NTFS
Drive E: | 345,66 Gb Total Space | 32,12 Gb Free Space | 9,29% Space Free | Partition Type: NTFS
Drive J: | 7,52 Gb Total Space | 6,92 Gb Free Space | 92,00% Space Free | Partition Type: FAT32
 
Computer Name: *** | User Name: *** | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\***\Desktop\OTL.exe (OldTimer Tools)
 
 
========== Modules (No Company Name) ==========
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV:64bit: - (lxdi_device) -- C:\Windows\SysNative\lxdicoms.exe ( )
SRV - (MBAMService) -- D:\Malwarebytes' Anti-Malwaree\mbamservice.exe (Malwarebytes Corporation)
SRV - (Hamachi2Svc) -- D:\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (SkypeUpdate) -- D:\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (!SASCORE) -- D:\antispyware\SASCore64.exe (SUPERAntiSpyware.com)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (ACDaemon) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (lxdi_device) -- C:\Windows\SysWOW64\lxdicoms.exe ( )
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (dtsoftbus01) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys (DT Soft Ltd)
DRV:64bit: - (IT9135BDA) -- C:\Windows\SysNative\drivers\IT9135BDA.sys (ITE                      )
DRV:64bit: - (atksgt) -- C:\Windows\SysNative\drivers\atksgt.sys ()
DRV:64bit: - (lirsgt) -- C:\Windows\SysNative\drivers\lirsgt.sys ()
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek Corporation                                            )
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (SASDIFSV) -- D:\antispyware\sasdifsv64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) -- D:\antispyware\saskutil64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - ({95808DC4-FA4A-4C74-92FE-5B863F82066B}) -- d:\PowerDVD\000.fcl (CyberLink Corp.)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-100361996-2776585883-543826973-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-100361996-2776585883-543826973-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-100361996-2776585883-543826973-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = EB 4E F4 61 E0 5A CD 01  [binary data]
IE - HKU\S-1-5-21-100361996-2776585883-543826973-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-100361996-2776585883-543826973-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-100361996-2776585883-543826973-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de"
FF - prefs.js..extensions.enabledItems: linkfilter@kaspersky.ru:9.0.0.736
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_265.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll ()
FF - HKLM\Software\MozillaPlugins\@cambridgesoft.com/Chem3D,version=12.0: D:\CambridgeSoft\ChemOffice2010\Chem3D\npChem3DPlugin.dll (CambridgeSoft Corp.)
FF - HKLM\Software\MozillaPlugins\@cambridgesoft.com/ChemDraw,version=12.0: D:\CambridgeSoft\ChemOffice2010\ChemDraw\npcdp32.dll (CambridgeSoft Corp.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_33: C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: d:\Mozilla Firefox\components [2012.06.24 21:29:15 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: d:\Mozilla Firefox\plugins [2012.07.14 19:28:26 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\***\AppData\Roaming\06014 [2012.03.17 17:28:25 | 000,000,000 | ---D | M]
 
[2011.08.31 14:25:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions
[2011.08.31 14:25:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\0dwzutj4.default\extensions
[2012.03.17 17:28:25 | 000,000,000 | ---D | M] (Java String Helper) -- C:\USERS\***\APPDATA\ROAMING\06014
[2012.07.14 19:28:28 | 000,000,000 | ---D | M] (Java Console) -- D:\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - D:\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O4:64bit: - HKLM..\Run: [lxdiamon] C:\Program Files (x86)\Lexmark 3500-4500 Series\lxdiamon.exe (Lexmark)
O4:64bit: - HKLM..\Run: [LXDICATS] C:\Windows\SysNative\spool\DRIVERS\x64\3\LXDItime.DLL (Lexmark International, Inc.)
O4:64bit: - HKLM..\Run: [lxdimon.exe] C:\Program Files (x86)\Lexmark 3500-4500 Series\lxdimon.exe ()
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [LanguageShortcut] d:\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] D:\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] D:\Malwarebytes' Anti-Malwaree\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [RemoteControl] d:\PowerDVD\PDVDServ.exe (Cyberlink Corp.)
O4 - HKLM..\Run: [StereoLinksInstall] "C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvstlink.exe" /install1 File not found
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-100361996-2776585883-543826973-1000..\Run: [DAEMON Tools Lite] D:\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKU\S-1-5-21-100361996-2776585883-543826973-1000..\Run: [ICQ] D:\ICQ7.7\ICQ.exe (ICQ, LLC.)
O4 - HKU\S-1-5-21-100361996-2776585883-543826973-1000..\Run: [renovator] C:\Users\***\AppData\Roaming\Skype\{C1F71566-9C26-42C4-B7FB-079A081220A8}\renovator.exe File not found
O4 - HKU\S-1-5-21-100361996-2776585883-543826973-1000..\Run: [RGSC] E:\Spiele\Rockstar Games Social Club\RGSCLauncher.exe /silent File not found
O4 - HKU\S-1-5-21-100361996-2776585883-543826973-1000..\Run: [spoolss] C:\Users\***\AppData\Local\Microsoft\Windows\1878\spoolss.exe ()
O4 - HKU\S-1-5-21-100361996-2776585883-543826973-1000..\Run: [SUPERAntiSpyware] D:\antispyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] D:\Malwarebytes' Anti-Malwaree\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware  (cleanup)] rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - D:\ICQ7.7\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - D:\ICQ7.7\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - D:\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - D:\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{73B94CB3-EC01-458C-A707-EE1D6D8CFFB4}: DhcpNameServer = 195.50.140.116 195.50.140.246
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - D:\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012.08.03 08:16:10 | 000,000,595 | ---- | M] () - J:\autorun.inf -- [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.03 16:22:19 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
[2012.08.03 15:23:22 | 000,597,504 | ---- | C] (OldTimer Tools) -- C:\Users\Master\Desktop\OTL.exe
[2012.08.03 15:22:39 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\Neuer Ordner (3)
[2012.08.02 20:35:25 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\ElevatedDiagnostics
[2012.08.02 18:05:03 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\hellomoto
[2012.08.01 22:11:11 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\WinRAR
[2012.08.01 22:11:11 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012.08.01 22:11:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012.08.01 22:10:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WinRAR
[2012.07.16 22:53:51 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StarCraft II
[2012.07.14 20:03:53 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Diagnostics
[2012.07.14 19:58:25 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\SPReview
[2012.07.14 19:47:10 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\EventProviders
[2012.07.14 19:28:26 | 000,476,976 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\npdeployJava1.dll
[2012.07.14 19:28:26 | 000,157,488 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe
[2012.07.14 19:28:26 | 000,149,296 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe
[2012.07.14 19:28:26 | 000,149,296 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe
[2012.07.14 19:28:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2012.07.11 22:15:00 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml3r.dll
[2012.07.11 22:15:00 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msxml3r.dll
[2012.07.11 22:14:55 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll
[2012.07.11 22:14:54 | 001,133,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdosys.dll
[2012.07.11 22:14:54 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cdosys.dll
[2012.07.11 19:01:32 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Waepfi
[2012.07.11 19:01:32 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Gawyca
[2012.07.06 15:21:15 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Oxlui
[2012.07.06 15:21:15 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Noelta
[2012.07.06 15:21:15 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Egbizi
[4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\***\AppData\Roaming\*.tmp files -> C:\Users\***\AppData\Roaming\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.08.03 17:02:23 | 001,613,340 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.08.03 17:02:23 | 000,696,832 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.08.03 17:02:23 | 000,652,150 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.08.03 17:02:23 | 000,148,128 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.08.03 17:02:23 | 000,121,082 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.08.03 16:23:21 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.03 16:23:13 | 2146,295,807 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.02 21:28:08 | 000,597,504 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
[2012.08.02 21:24:02 | 000,013,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.02 21:24:02 | 000,013,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.02 17:48:08 | 000,007,334 | ---- | M] () -- C:\Users\***\Desktop\Protokoll.odt
[2012.07.24 03:10:58 | 000,023,973 | ---- | M] () -- C:\Users\***\Desktop\regression bonbon.png
[2012.07.23 23:45:56 | 000,009,411 | ---- | M] () -- C:\Users\***\Desktop\strom spannung.png
[2012.07.15 10:12:18 | 000,440,352 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.07.14 20:03:02 | 000,175,616 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msclmd.dll
[2012.07.14 20:03:02 | 000,152,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msclmd.dll
[2012.07.14 19:28:19 | 000,476,976 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\npdeployJava1.dll
[2012.07.14 19:28:19 | 000,472,880 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\deployJava1.dll
[2012.07.14 19:28:19 | 000,157,488 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe
[2012.07.14 19:28:19 | 000,149,296 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe
[2012.07.14 19:28:19 | 000,149,296 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe
[2012.07.13 19:29:45 | 000,000,011 | ---- | M] () -- C:\Users\***\AppData\Roaming\urhtps.dat
[2012.07.12 21:09:14 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012.07.12 21:09:14 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012.07.05 21:00:27 | 004,503,728 | ---- | M] () -- C:\ProgramData\l_u0_0.pad
[4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\***\AppData\Roaming\*.tmp files -> C:\Users\***\AppData\Roaming\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.08.02 17:48:08 | 000,007,334 | ---- | C] () -- C:\Users\***\Desktop\Protokoll.odt
[2012.07.24 03:10:58 | 000,023,973 | ---- | C] () -- C:\Users\***\Desktop\regression bonbon.png
[2012.07.23 23:44:57 | 000,009,411 | ---- | C] () -- C:\Users\***\Desktop\strom spannung.png
[2012.07.13 19:29:45 | 000,000,011 | ---- | C] () -- C:\Users\***\AppData\Roaming\urhtps.dat
[2012.07.05 21:00:01 | 004,503,728 | ---- | C] () -- C:\ProgramData\l_u0_0.pad
[2012.06.26 23:09:54 | 000,563,636 | ---- | C] () -- C:\Users\***\178338_430054377026692_1002824151_o.jpg
[2012.06.26 23:09:54 | 000,212,303 | ---- | C] () -- C:\Users\***\457692_449718168380263_904093279_o.jpg
[2012.06.26 23:09:54 | 000,195,422 | ---- | C] () -- C:\Users\***\337853_329499093748888_2018450324_o.jpg
[2012.05.01 01:35:36 | 000,001,491 | ---- | C] () -- C:\Users\***\.recently-used.xbel
[2012.03.17 17:28:19 | 000,005,624 | ---- | C] () -- C:\Users\***\AppData\Roaming\BAcroIEHelpe.dll
[2012.03.17 17:28:15 | 000,000,016 | ---- | C] () -- C:\Users\***\AppData\Roaming\blckdom.res
[2012.03.12 18:45:06 | 001,590,298 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.02.09 20:05:44 | 000,416,064 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2011.12.23 18:31:53 | 000,000,995 | ---- | C] () -- C:\Windows\eReg.dat
[2011.11.06 20:51:03 | 000,000,000 | ---- | C] () -- C:\Windows\lgfwup.ini
[2011.10.30 18:59:50 | 000,000,039 | ---- | C] () -- C:\Users\***\AppData\Roaming\gnuplot_history
[2011.09.26 18:38:47 | 000,385,024 | ---- | C] () -- C:\Windows\SysWow64\lxdicomx.dll
[2011.09.26 18:38:47 | 000,356,352 | ---- | C] ( ) -- C:\Windows\SysWow64\lxdiinpa.dll
[2011.09.26 18:38:47 | 000,294,912 | ---- | C] () -- C:\Windows\SysWow64\lxdiinst.dll
[2011.09.26 18:38:46 | 000,614,400 | ---- | C] ( ) -- C:\Windows\SysWow64\lxdipmui.dll
[2011.09.26 18:38:46 | 000,339,968 | ---- | C] ( ) -- C:\Windows\SysWow64\lxdiiesc.dll
[2011.09.26 18:38:45 | 001,187,840 | ---- | C] ( ) -- C:\Windows\SysWow64\lxdiserv.dll
[2011.09.26 18:38:45 | 000,942,080 | ---- | C] ( ) -- C:\Windows\SysWow64\lxdiusb1.dll
[2011.09.26 18:38:44 | 000,671,744 | ---- | C] ( ) -- C:\Windows\SysWow64\lxdihbn3.dll
[2011.09.26 18:38:44 | 000,532,480 | ---- | C] ( ) -- C:\Windows\SysWow64\lxdilmpm.dll
[2011.09.26 18:38:44 | 000,320,432 | ---- | C] ( ) -- C:\Windows\SysWow64\lxdiih.exe
[2011.09.26 18:38:44 | 000,054,192 | ---- | C] ( ) -- C:\Windows\SysWow64\lxdippls.exe
[2011.09.26 18:38:44 | 000,053,248 | ---- | C] ( ) -- C:\Windows\SysWow64\lxdiprox.dll
[2011.09.26 18:38:44 | 000,053,248 | ---- | C] ( ) -- C:\Windows\SysWow64\lxdipplc.dll
[2011.09.26 18:38:43 | 000,761,856 | ---- | C] ( ) -- C:\Windows\SysWow64\lxdicomc.dll
[2011.09.26 18:38:43 | 000,517,040 | ---- | C] ( ) -- C:\Windows\SysWow64\lxdicoms.exe
[2011.09.26 18:38:43 | 000,360,448 | ---- | C] ( ) -- C:\Windows\SysWow64\lxdicomm.dll
[2011.09.26 18:38:43 | 000,340,912 | ---- | C] ( ) -- C:\Windows\SysWow64\lxdicfg.exe
[2011.04.09 18:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
 
========== LOP Check ==========
 
[2012.03.17 17:28:25 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\06014
[2012.04.17 19:48:10 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DAEMON Tools Lite
[2012.08.01 20:20:46 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Egbizi
[2012.05.01 20:35:12 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\GameRanger
[2012.08.02 19:49:29 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Gawyca
[2012.04.20 05:41:59 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\gtk-2.0
[2012.08.02 19:44:00 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\hellomoto
[2012.08.02 19:44:05 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ICQ
[2012.03.17 17:28:06 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\kock
[2012.02.29 04:31:05 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Konoe
[2011.09.26 18:41:28 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Lexmark Imaging Studio
[2012.03.10 23:33:14 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Mumble
[2012.07.06 15:21:15 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Noelta
[2012.01.27 17:17:13 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\OpenOffice.org
[2012.08.02 19:49:29 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Oxlui
[2012.03.04 18:57:45 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TeamViewer
[2012.04.26 22:01:04 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TS3Client
[2012.03.17 17:32:35 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\UAs
[2012.08.01 23:02:50 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Waepfi
[2012.02.29 04:10:19 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Wecyo
[2012.03.17 17:33:35 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\xmldm
[2012.06.04 10:54:27 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >