Suisa Trojaner (ogokv.exe Trojan.Cridex)

Teido · 15.08.2012, 17:30

Hallo miteinander

Ich habe mir vorgestern Abend einen Trojaner eingefangen der mich auffordert 75,-CHF, wegen angeblichen illegalen Raubkopien, zu bezahlen. Stinger, Avira und CCleaner mit denen ich sonst immer alles wegbekommen habe, hatten nichts gebracht, nach einem Neustart hatte der Trojaner sich erneut eingenistet.

Hier ein Screenshot von Avira:

Ich bin dann gestern abend auf dieses Board hier gestoßen und habe Malwarebytes installiert. Nach einem vollständigen Scan konnte ich auch Windows wieder ohne Probleme neustarten. Ich hätte das Teil aber gerne komplett weg und hoffe ihr könnt mir dabei helfen. Normalerweise würde ich bei so einem hartnäckigen einfach sicherheitshalber Windows neu installieren. Allerdings finde ich meinen CD-Key nicht mehr und auch das Tool Keyfinder kann ihn nicht mehr auslesen.

Ich weiß nicht ob es eine Rolle spielt aber ich habe einen Desktop-PC und Windows 7 Professional (64Bit). Otl habe ich auch schon auf dem Desktop.

Danke schonmal!

t'john · 15.08.2012, 22:32

Bitte das Malwarebytes Logfile posten!
(Reiter Logberichte)

1. Schritt

Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktualisiere die Datenbank!
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".

2. Schritt

Systemscan mit OTL (bebilderte Anleitung)

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden)- Doppelklick auf die OTL.exe

Vista und Win7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen

Wähle Scanne Alle Benuzer

Oben findest Du ein Kästchen mit Ausgabe. Wähle bitte Minimale Ausgabe

Unter Extra Registrierung, wähle bitte Benutze SafeList

Klicke nun auf Scan links oben

Wenn der Scan beendet wurde werden 2 Logfiles erstellt

Poste die Logfiles hier in den Thread.

Teido · 16.08.2012, 12:15

Hier ist die Logdatei von meinem ersten Scan

Code:

ATTFilter

 Malwarebytes Anti-Malware  (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.14.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
*** :: *** [Administrator]

Schutz: Aktiviert

14.08.2012 21:18:32
mbam-log-2012-08-14 (21-18-32).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|F:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 505769
Laufzeit: 2 Stunde(n), 9 Minute(n), 10 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 17
HKCR\CLSID\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Keine Aktion durchgeführt.
HKCR\TypeLib\{BB7256DD-EBA9-480B-8441-A00388C2BEC3} (PUP.VShareRedir) -> Keine Aktion durchgeführt.
HKCR\Interface\{3D782BB2-F2A5-11D3-BF4C-000000000000} (PUP.VShareRedir) -> Keine Aktion durchgeführt.
HKCR\MyNewsBarLauncher.IE5BarLauncherBHO.1 (PUP.VShareRedir) -> Keine Aktion durchgeführt.
HKCR\MyNewsBarLauncher.IE5BarLauncherBHO (PUP.VShareRedir) -> Keine Aktion durchgeführt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Keine Aktion durchgeführt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Keine Aktion durchgeführt.
HKCR\CLSID\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Keine Aktion durchgeführt.
HKCR\MyNewsBarLauncher.IE5BarLauncher.1 (PUP.VShareRedir) -> Keine Aktion durchgeführt.
HKCR\MyNewsBarLauncher.IE5BarLauncher (PUP.VShareRedir) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Keine Aktion durchgeführt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\fcn (Rogue.Residue) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\SolutionAV (Rogue.AntivirSolutionPro) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 9
HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser|{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Daten: ;áÃzÊ;XA³0öm»Áµ -> Keine Aktion durchgeführt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Daten: VShareTB -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Daten:  -> Keine Aktion durchgeführt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Daten:  -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Orygam (Trojan.Cridex) -> Daten: C:\Users\***e gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|B25ABAF43E1239 (Trojan.Agent.RNSGen) -> Daten: C:\ProgramData\B25ABAF43E1239\B25ABAF43E1239.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|B25ABAF43E6A67 (Trojan.Agent.RNSGen) -> Daten: C:\ProgramData\B25ABAF43E6A67\B25ABAF43E6A67.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings|ProxyServer (PUM.Bad.Proxy) -> Daten: http=127.0.0.1:5643 -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations|bak_Application (Hijacker.Application) -> Daten: hxxp://go.microsoft.com/fwlink/?LinkId=57426&Ext=%s -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 2
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (Hijack.StartPage) -> Bösartig: (hxxp://startsear.ch/?aff=1) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations|Application (Hijacker.Application) -> Bösartig: (hxxp://www.helpmeopen.com/?n=app&ext=%s) Gut: (hxxp://shell.windows.com/fileassoc/%04x/xml/redir.asp?Ext=%s) -> Erfolgreich ersetzt und in Quarantäne gestellt.

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 8
C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (PUP.VShareRedir) -> Keine Aktion durchgeführt.
C:\Users\***\AppData\Roaming\Geirvo\ogokv.exe (Trojan.Cridex) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Alcohol Soft\Alcohol 120\Langs\AX_RU.dll (Malware.Packer.GenX) -> Erfolgreich gelöscht und in Quarantäne gestellt.
F:\Programme Robbi\Brennen\Nero.7.Premium.Reloaded.7.9.6.0-deu.incl\Nero.7.Premium.Reloaded.7.9.6.0-deu.incl\keygen\nero 7 new keygen.exe (RiskWare.Tool.HCK) -> Erfolgreich gelöscht und in Quarantäne gestellt.
F:\Programme Robbi\Sonstiges\O & O Programme\O&O Komplettpaket 10in1\O&O CleverCache 6.1.2332 [German]\O&O CleverCache 6 Keygen.exe (Riskware.Tool.CK) -> Erfolgreich gelöscht und in Quarantäne gestellt.
F:\Programme Robbi\Sonstiges\O & O Programme\O&O Komplettpaket 10in1\O&O Defrag 10.0.1634 [German]\O&O Defrag 10.0.1634 Userkey.exe (Riskware.Tool.CK) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\B25ABAF43E1239\B25ABAF43E1239.exe (Trojan.Agent.RNSGen) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\B25ABAF43E6A67\B25ABAF43E6A67.exe (Trojan.Agent.RNSGen) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

Ich hatte da allerdings zu schnell weiter geklickt und nicht alle infizierten Funde ausgewählt. Hier die Logdatei vom heutigen Scan

Code:

ATTFilter

 Malwarebytes Anti-Malware  (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.16.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
*** :: *** [Administrator]

Schutz: Aktiviert

16.08.2012 10:21:34
mbam-log-2012-08-16 (10-21-34).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|F:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 509445
Laufzeit: 2 Stunde(n), 15 Minute(n), 2 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 15
HKCR\CLSID\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\TypeLib\{BB7256DD-EBA9-480B-8441-A00388C2BEC3} (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\Interface\{3D782BB2-F2A5-11D3-BF4C-000000000000} (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\MyNewsBarLauncher.IE5BarLauncherBHO.1 (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\MyNewsBarLauncher.IE5BarLauncherBHO (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\MyNewsBarLauncher.IE5BarLauncher.1 (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\MyNewsBarLauncher.IE5BarLauncher (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 4
HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser|{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Daten: ;áÃzÊ;XA³0öm»Áµ -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Daten: VShareTB -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Daten:  -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Daten:  -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (PUP.VShareRedir) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

Hier die Otl-logs

Code:

ATTFilter

OTL Extras logfile created on: 16.08.2012 12:53:12 - Run 1
OTL by OldTimer - Version 3.2.57.0     Folder = C:\Users\***\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 0,96 Gb Available Physical Memory | 23,98% Memory free
8,00 Gb Paging File | 4,27 Gb Available in Paging File | 53,44% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 48,83 Gb Total Space | 7,11 Gb Free Space | 14,56% Space Free | Partition Type: NTFS
Drive F: | 882,68 Gb Total Space | 6,90 Gb Free Space | 0,78% Space Free | Partition Type: NTFS
Drive I: | 3,09 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: *** | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
 
[HKEY_USERS\S-1-5-21-3175316596-3364050726-2863681098-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L"
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L"
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
"" = 
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files (x86)\Free Music Zilla\FMZilla.exe" = C:\Program Files (x86)\Free Music Zilla\FMZilla.exe:*:Enabled:FMZilla -- ()
"C:\Program Files (x86)\Free Music Zilla\FMZilla.exe" = C:\Program Files (x86)\Free Music Zilla\FMZilla.exe:*:Enabled:FMZilla -- ()
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1A60F074-E120-4851-9237-1F73FB109D7B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{2E99C78E-86AC-485B-887B-9EDB98A6A76A}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{34BFC7B6-A452-45CA-854A-D3540FF6DBE8}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{42184CB9-1F61-45D5-9025-671EA99F3053}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{4B2A7C31-A294-405A-9430-62D69C727924}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{4BBBBF9C-6A5F-443A-851C-B5B0907814C9}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{716CE448-72E8-460E-8F77-FD66F9A7FF59}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{9CA4BC85-7E44-4087-92E0-1C38E7AB1E7A}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{9EF0D713-529A-4740-A539-BA82373A664E}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{ADF04DF1-D1FE-45C1-8016-61CC938F64D4}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{AE95BBCC-5C4F-4A0E-812C-CF087383A5A1}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{B8290488-3CF5-451B-883E-97520C4EF857}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{D24CC76B-FF46-467A-BD72-D3E02061B671}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{DD9E5007-4A66-41C3-B25C-26EFFE82AD4D}" = lport=19540 | protocol=17 | dir=in | name=sxuptp | 
"{E5AD475B-ABCE-4A5E-B881-FBA2631F7EEC}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{F2665E12-0336-4977-95A5-653B7BE947D7}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{F37FD10A-4D4A-4112-9C7A-BD59EF232935}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{F3AB6503-8419-4183-8948-13EA05D5EAD1}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{FAC98983-2C4C-4CE9-9DA8-6FC5275CD69C}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{FE5E35B5-110C-4F3F-8EF0-079BB2514BE6}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{FE7D0E0F-CC7D-4996-B620-B424551B3803}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\outlook.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01EDD0F0-0AB1-4600-8ECF-85C4323EB119}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 
"{02EA47ED-23B7-4AB7-B66D-24E57F1008E4}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe | 
"{04F24148-B878-4986-A607-0AD2C4286F24}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{054B03FF-8F0D-471A-867A-9C2A61272848}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{088BF867-3402-496E-89F3-391AC5A582BA}" = protocol=6 | dir=in | app=f:\games\steam\steamapps\common\call of duty black ops\blackops.exe | 
"{09AD794C-69A5-4988-B401-5DD69BC340D4}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{0A61ACED-453F-40C8-B30A-CB38BB7B7242}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{0B11C22F-CB9A-4C0F-B618-517DDD5DE723}" = protocol=6 | dir=out | app=system | 
"{0BE40DC9-C36A-47F5-97D1-CDC084312FBD}" = protocol=6 | dir=in | app=f:\games\steam\steamapps\common\call of duty black ops\blackopsmp.exe | 
"{0D65B9CE-5E7B-4DA4-B821-15FC4B994958}" = protocol=17 | dir=in | app=f:\games\battlefield bad company 2\bfbc2updater.exe | 
"{17199640-30C3-4339-8A7F-D11651F4A2AE}" = protocol=6 | dir=in | app=c:\windows\syswow64\muzapp.exe | 
"{177EC22A-8F90-4D3D-9416-F2F7657E9BE0}" = dir=in | app=c:\program files (x86)\belkin\router setup and monitor\belkinsetup.exe | 
"{181FFFCD-C947-49EC-8B01-A052268150D0}" = protocol=17 | dir=in | app=f:\games\steam\steamapps\common\spiral knights\java_vm\bin\javaw.exe | 
"{1A935B51-C968-43D7-B221-DC65086769D1}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{1D87AFF9-385C-456F-83B8-82A2ABD5194F}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 
"{222B3F35-C379-4081-B489-6F659D92AF76}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{240CA842-4CD5-4C52-A36E-0FE5B3F6BA6F}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{2A6FCE52-0903-4039-BD80-9265BEB6F41F}" = protocol=17 | dir=in | app=c:\windows\syswow64\muzapp.exe | 
"{2CE13116-8539-4098-9C5D-9DDA4CC1C3BB}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{37ADB797-6A58-4D63-9A2A-4923C6924CF9}" = protocol=6 | dir=in | app=f:\games\bulletstorm\binaries\win32\shippingpc-stormgame.exe | 
"{3956A9C8-7A90-4B9E-B645-84F27C3A8B24}" = protocol=6 | dir=in | app=f:\games\steam\steamapps\common\battlefield bad company 2\bfbc2game.exe | 
"{3A5BB4B8-AC23-4B51-AEFE-1E24AB949F70}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{4481DFAB-C660-47D9-A4EC-F1C3F71C2FBA}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 
"{45D9C7A9-BD78-413F-9A69-88E0E43105AE}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe | 
"{478F447D-EE5F-4088-B9DE-2EFD4B69484A}" = protocol=6 | dir=in | app=f:\games\steam\steamapps\common\ava\reactor.exe | 
"{50C4AFF6-7E0C-4217-8860-B8C70FB315D4}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 
"{5A2FCC12-7541-4594-84E5-4E9C0AAD3F19}" = protocol=17 | dir=in | app=f:\games\steam\steamapps\common\left 4 dead 2\left4dead2.exe | 
"{5A4C756C-691E-4781-B3EE-39E3B803205E}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | 
"{5AC7F094-37BD-4350-B1FA-8E1F291A77E8}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 
"{5DF04280-FD7F-489C-BACB-E478942B7BEA}" = protocol=6 | dir=in | app=c:\program files (x86)\belkin\router setup and monitor\belkinsetup.exe | 
"{5EF12E02-F72B-43B0-BC4D-B1085F5E3DA6}" = protocol=17 | dir=in | app=f:\games\steam\steamapps\common\call of duty black ops\blackopsmp.exe | 
"{6000FB11-647B-4CC2-B285-1E46EFDB35F3}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe | 
"{61E63508-2F04-432C-8E29-128FE4358FB9}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{64A83C6E-7309-4207-93F8-D4AFE824D82A}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{64F01E91-5C1C-4E41-8A80-EE06E2F44173}" = protocol=6 | dir=in | app=f:\games\steam\steamapps\common\left 4 dead 2\left4dead2.exe | 
"{6CD61B21-44ED-4534-9EB6-74F4726E4486}" = protocol=6 | dir=in | app=f:\games\steam\steamapps\common\spiral knights\java_vm\bin\javaw.exe | 
"{717EC0B2-3095-4837-BD78-F19F467DDB29}" = protocol=6 | dir=in | app=f:\games\diablo iii\diablo iii.exe | 
"{7206FB72-5DC3-468C-A9B3-1C5F52989C0F}" = protocol=17 | dir=in | app=f:\games\steam\steamapps\common\call of duty black ops\blackopsmp.exe | 
"{73DD8554-38AF-42B2-9978-4BD79D2559C5}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{7BA8F979-CFB0-4A6B-A52B-3C89C1B64B25}" = protocol=17 | dir=in | app=f:\games\diablo iii\diablo iii.exe | 
"{7D66C264-4C79-455A-A7C0-9D1949D53EF9}" = protocol=6 | dir=in | app=f:\games\steam\steamapps\common\call of duty black ops\blackopsmp.exe | 
"{7DAAD198-9D1D-46E6-9425-014189310676}" = protocol=17 | dir=in | app=f:\games\steam\steamapps\common\battlefield bad company 2\support\ea help\electronic_arts_technical_support.htm | 
"{7E7B7495-058F-4DFC-90C5-D5D5EBEBA947}" = protocol=17 | dir=in | app=f:\games\bulletstorm\binaries\win32\shippingpc-stormgame.exe | 
"{98443751-CF1A-4920-BA78-51F165D75705}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe | 
"{98DB1F88-9FFB-4CE9-981F-22AE42FFB06F}" = protocol=17 | dir=in | app=c:\program files (x86)\belkin\router setup and monitor\belkinsetup.exe | 
"{9BCB7EF4-3086-4288-91A7-F68742D9A61E}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe | 
"{A2160F5B-E6E6-4336-8EA4-55A48190D4F9}" = protocol=58 | dir=out | name=@iphlpsvc.dll,-503 | 
"{A62C0D15-243B-4BAB-836D-555125B0D238}" = protocol=58 | dir=in | app=system | 
"{A8E93D3B-78EA-4A7E-A9D9-929C426C9B01}" = protocol=17 | dir=in | app=f:\games\steam\steamapps\common\call of duty black ops\blackops.exe | 
"{AA5526DC-19E8-4CA4-8365-4EDBA2E0DC1A}" = protocol=6 | dir=in | app=f:\games\battlefield bad company 2\bfbc2updater.exe | 
"{AF22518E-3BA9-472A-8E65-5AEA656A4800}" = protocol=6 | dir=in | app=c:\program files (x86)\belkin\router setup and monitor\belkinsetup.exe | 
"{AF394759-A788-4F82-A402-9CC0B186AC41}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | 
"{AFD7C342-534C-40D0-993D-77FC2F2E3AB3}" = protocol=17 | dir=in | app=f:\games\steam\steamapps\common\ava\reactor.exe | 
"{B23A70AB-3F39-485E-B243-E25FF2AE5A8F}" = protocol=17 | dir=in | app=c:\program files (x86)\belkin\router setup and monitor\belkinsetup.exe | 
"{B5A205C6-FA81-442D-8C9B-6A7AB972DCA0}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe | 
"{B693CA02-F4BE-41BD-AF67-DFDD29D64AA9}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{B87FA4C5-3B5C-4718-8788-880D6DEBD254}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe | 
"{B901D994-3933-40F6-A196-DF7EA664D961}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe | 
"{BA8E7DAE-B50F-48D3-9107-C15D0900BB8B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{BAD3AB99-4AEF-4175-890E-0DC3572EDB14}" = protocol=17 | dir=in | app=f:\games\steam\steam.exe | 
"{BC5B52A1-1B8A-4F33-A4D1-5B87E7B5F774}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{C4DB96A3-4A30-40CD-AD40-A0F6F6EE1400}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{CBAAA7EB-62CE-4DB0-B771-40DA61C9E492}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe | 
"{CC9AD55B-1CF0-404A-8EF4-BC3D5F6EFA8A}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe | 
"{D43B66FE-38E5-47B5-9A1D-680F257F597B}" = dir=in | app=c:\program files\belkin\belkin usb print and storage center\connect.exe | 
"{D49F2E5B-EF34-42A5-B7D3-A18ADFDED7F3}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 
"{D92B2243-3F61-4AC8-A3CD-8609EB3B9955}" = protocol=17 | dir=in | app=f:\games\steam\steamapps\common\battlefield bad company 2\bfbc2game.exe | 
"{E3EF1A18-FCAB-4612-836B-B0C2864F706E}" = protocol=6 | dir=in | app=f:\games\steam\steamapps\common\battlefield bad company 2\support\ea help\electronic_arts_technical_support.htm | 
"{EB19676A-463A-4B55-A70C-50A55E4F93FD}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{EDED9A15-97A1-4ED7-A650-1D7103F085C8}" = protocol=17 | dir=in | app=f:\games\steam\steamapps\common\left 4 dead\left4dead.exe | 
"{EE138C9A-ABED-41BB-9A56-C0AD7EFA2FDC}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe | 
"{F7C19B86-9E18-4EE3-AD88-2B37F663FB07}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{F825911D-3C66-42D5-90C6-B049995520E9}" = protocol=6 | dir=in | app=f:\games\steam\steamapps\common\left 4 dead\left4dead.exe | 
"{F989ED7D-E3EC-44CA-9A79-22454DFFFA1C}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{FC2D2484-395B-4A6F-99BE-51A19AC71B97}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe | 
"{FD18B7A9-CFB4-4D68-B1FE-A0BDA6923320}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{FE930C30-4172-4FED-926A-8B53225C90A5}" = protocol=6 | dir=in | app=f:\games\steam\steam.exe | 
"TCP Query User{00C5EBBF-A23D-4799-B166-116466B0E9C4}C:\program files (x86)\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files (x86)\google\google earth\plugin\geplugin.exe | 
"TCP Query User{0E8F410D-D444-48FB-A615-14C516E2E3CB}C:\program files (x86)\opera\opera.exe" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe | 
"TCP Query User{17E71AE1-8F99-49F4-8EC0-2085DEF5BEF7}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe | 
"TCP Query User{34A38373-496F-461C-8529-320E8E243507}C:\program files (x86)\logitech\vid hd\vid.exe" = protocol=6 | dir=in | app=c:\program files (x86)\logitech\vid hd\vid.exe | 
"TCP Query User{399CDC45-135A-4C21-ABD9-12FD6D0145E7}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe | 
"TCP Query User{3C17D5C7-399F-439D-8912-6C63725E98B7}C:\program files (x86)\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=c:\program files (x86)\videolan\vlc\vlc.exe | 
"TCP Query User{5524E24B-D9EF-44A1-A79A-5F7DF40CA196}F:\games\unreal tournament 2004\system\ut2004.exe" = protocol=6 | dir=in | app=f:\games\unreal tournament 2004\system\ut2004.exe | 
"TCP Query User{7DAC1E17-D2E3-4E0F-A68F-FA0C1D0AEC1B}C:\programdata\battle.net\agent\agent.1040\agent.exe" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe | 
"TCP Query User{972653FD-AD71-44A1-AD43-D06522CAADBC}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe | 
"TCP Query User{9786FD2A-DC64-4F9E-82A4-FD8AA17F8168}C:\program files (x86)\free music zilla\fmzilla.exe" = protocol=6 | dir=in | app=c:\program files (x86)\free music zilla\fmzilla.exe | 
"TCP Query User{C5E2749E-CBFE-4FC3-B53E-4D5A9259B6EB}F:\games\steam\steamapps\common\battlefield bad company 2\bfbc2game.exe" = protocol=6 | dir=in | app=f:\games\steam\steamapps\common\battlefield bad company 2\bfbc2game.exe | 
"TCP Query User{DCB793EC-552C-40B2-9904-F043CD840BED}C:\programdata\battle.net\agent\agent.998\agent.exe" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.998\agent.exe | 
"TCP Query User{EEF4B408-EDF1-48BE-AA65-A6D932CABDFC}C:\program files (x86)\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=c:\program files (x86)\videolan\vlc\vlc.exe | 
"UDP Query User{28D30AFF-0082-4F48-8DC0-D89ACB615607}C:\program files (x86)\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=c:\program files (x86)\videolan\vlc\vlc.exe | 
"UDP Query User{2B411D06-7F18-4F78-A185-E339E8184AA6}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe | 
"UDP Query User{33A9EC26-1255-471F-AAB3-9B599A8271A1}C:\program files (x86)\free music zilla\fmzilla.exe" = protocol=17 | dir=in | app=c:\program files (x86)\free music zilla\fmzilla.exe | 
"UDP Query User{39B7513B-5020-4F76-9EDE-AD27D806882E}C:\program files (x86)\logitech\vid hd\vid.exe" = protocol=17 | dir=in | app=c:\program files (x86)\logitech\vid hd\vid.exe | 
"UDP Query User{4201D8EB-1AC9-4D4B-85BA-58E929761090}F:\games\unreal tournament 2004\system\ut2004.exe" = protocol=17 | dir=in | app=f:\games\unreal tournament 2004\system\ut2004.exe | 
"UDP Query User{53B885D6-799D-482B-AD59-95CA6A8EF846}C:\programdata\battle.net\agent\agent.1040\agent.exe" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe | 
"UDP Query User{5A5DD033-7EBE-4957-B2E6-629EB90C9072}C:\program files (x86)\opera\opera.exe" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe | 
"UDP Query User{82EB4265-4F7A-4D23-913B-E546516D8DEA}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe | 
"UDP Query User{839F6AA4-60DB-4F04-9DE2-9374E9A010F7}C:\program files (x86)\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=c:\program files (x86)\videolan\vlc\vlc.exe | 
"UDP Query User{A0104269-7910-446B-8DDB-7D161BCF0757}C:\program files (x86)\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files (x86)\google\google earth\plugin\geplugin.exe | 
"UDP Query User{AAF09D00-E4E4-43C1-A684-B871F0E5A7AC}C:\programdata\battle.net\agent\agent.998\agent.exe" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.998\agent.exe | 
"UDP Query User{E68F5E49-E449-4BEC-AED6-87418F6E1D2F}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe | 
"UDP Query User{FD9637BA-CAD6-4521-9957-0579B0F46EA8}F:\games\steam\steamapps\common\battlefield bad company 2\bfbc2game.exe" = protocol=17 | dir=in | app=f:\games\steam\steamapps\common\battlefield bad company 2\bfbc2game.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{138A4072-9E64-46BD-B5F9-DB2BB395391F}" = LWS VideoEffects
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{47B188E2-2447-5C40-15B6-9D49DC90BF5B}" = ATI Catalyst Install Manager
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{5F143175-13D3-5AE8-5AE9-262C6D60F994}" = AMD Fuel
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A61B820-598D-05B2-5F8D-7388E15AE2DB}" = AMD Drag and Drop Transcoding
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{90AB246D-A0A0-29EA-199A-4B07841E0737}" = ATI AVIVO64 Codecs
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{98C8DF59-BE5F-4EC2-9B12-FD2A54928EDB}" = Microsoft IntelliType Pro 8.0
"{A9C6CA47-D937-D61D-4BD3-7CFAB7A5BA56}" = ATI Problem Report Wizard
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D7B6A47A-3DC9-64FE-BFD0-ED02F036D539}" = ccc-utility64
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319
"{DE1B48FB-0EA4-6E6F-5335-9095994CB7EB}" = WMV9/VC-1 Video Playback
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX 64-bit
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit
"Belkin USB Print and Storage Center" = Belkin USB Print and Storage Center
"CCleaner" = CCleaner
"CPUID HWMonitor_is1" = CPUID HWMonitor 1.15
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"WinRAR archiver" = WinRAR
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}" = Battlefield 2(TM)
"{08610298-29AE-445B-B37D-EFBE05802967}" = LWS Pictures And Video
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{15634701-BACE-4449-8B25-1567DA8C9FD3}" = CameraHelperMsi
"{1651216E-E7AD-4250-92A1-FB8ED61391C9}" = LWS Help_main
"{174A3B31-4C43-43DD-866F-73C9DB887B48}" = LWS Twitter
"{19A492A0-888F-44A0-9B21-D91700763F62}" = Catalyst Control Center - Branding
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F77C418-2C90-459C-BD33-B56A4182B9FA}" = System Requirements Lab CYRI
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{21DF0294-6B9D-4741-AB6F-B2ABFBD2387E}" = LWS YouTube Plugin
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{2934DCB0-F8EE-11E0-A4A5-B8AC6F97B88E}" = Google Earth Plug-in
"{2FFE93F0-BB72-4E52-8761-354D1AAA9387}" = Sony Ericsson PC Suite 6.011.00
"{32364CEA-7855-4A3C-B674-53D8E9B97936}" = TuneUp Utilities 2012
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{394DC0BC-5476-4260-B52C-BDE1BDEFA958}" = Unreal Tournament 2004
"{3AC8457C-0385-4BEA-A959-E095F05D6D67}" = Battlefield: Bad Company™ 2
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = erLT
"{45410935-3E72-472B-8C35-AB1000008200}" = Bulletstorm
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4C590030-7469-453E-8589-D15DA9D03F52}" = ANIWZCS2 Service
"{5F753314-628E-4C13-B8AE-BFA7FD514CBE}" = D-Link Wireless G DWL-G122_DWA-110
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6F76EC3C-34B1-436E-97FB-48C58D7BEDCD}" = LWS Gallery
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71E66D3F-A009-44AB-8784-75E2819BA4BA}" = LWS Motion Detection
"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2
"{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}" = Avanquest update
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{83C8FA3C-F4EA-46C4-8392-D3CE353738D6}" = LWS Launcher
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{8937D274-C281-42E4-8CDB-A0B2DF979189}" = LWS Webcam Software
"{8A809006-C25A-4A3A-9DAB-94659BCDB107}" = NVIDIA PhysX
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8E884205-E3A3-55F3-2EE2-0E39F8E6CCED}" = Catalyst Control Center Graphics Previews Common
"{8FB1B528-E260-451E-9B55-E9152F94B80B}" = Microsoft Games for Windows - LIVE Redistributable
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0407-1000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{9329BA0E-DD91-D33E-B73F-AA5179C53736}" = Catalyst Control Center
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D8B0949-7C47-476F-9F06-F900D3B078EA}" = Kaspersky Internet Security 2010
"{9DAEA76B-E50F-4272-A595-0124E826553D}" = LWS WLM Plugin
"{9FD6F1A8-5550-46AF-8509-271DF0E768B5}" = Dual-Core Optimizer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.3 - Deutsch
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{BD5D6437-94F6-C8F4-AF1B-B1658E0CB8F7}" = CCC Help English
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{CE026CFE-73FE-4FED-9D5F-2C8D4DB512B0}" = TuneUp Utilities Language Pack (de-DE)
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D40EB009-0499-459c-A8AF-C9C110766215}" = Logitech Webcam-Software
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}" = Full Tilt Poker
"{DFFCDB41-C2DA-47D6-96FF-03C05C0BEA22}" = resident evil 4
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E1BBBAC5-2857-4155-82A6-54492CE88620}" = Opera 9.64
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{EED027B7-0DB6-404B-8F45-6DFEE34A0441}" = LWS Video Mask Maker
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F38556C1-486C-C07B-4655-2F1BCF18C68A}" = Catalyst Control Center InstallProxy
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{F97E3841-CA9D-4964-9D64-26066241D26F}" = Microsoft Games for Windows - LIVE
"{FF167195-9EE4-46C0-8CD7-FBA3457E88AB}" = LWS Facebook
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Avira AntiVir Desktop" = Avira Free Antivirus
"Belkin Installationsprogramm und Router Monitor_is1" = Belkin Installationsprogramm und Router Monitor
"DAEMON Tools Lite" = DAEMON Tools Lite
"Diablo III" = Diablo III
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup" = DivX-Setup
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Everest Casino" = Everest Casino (Remove Only)
"Everest Poker" = Everest Poker (Remove Only)
"FirstloadIkarus" = Firstload Ikarus
"Free MP3 WMA OGG Converter_is1" = Free MP3 WMA OGG Converter 8.2.5
"Free Music Zilla_is1" = Free Music Zilla
"GFWL_{45410935-3E72-472B-8C35-AB1000008200}" = Bulletstorm
"Google Chrome" = Google Chrome
"ICQToolbar" = ICQ Toolbar
"InstallShield_{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch
"InstallShield_{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch
"InstallWIX_{9D8B0949-7C47-476F-9F06-F900D3B078EA}" = Kaspersky Internet Security 2010
"IrfanView" = IrfanView (remove only)
"Logitech Vid" = Logitech Vid HD
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"mIRC" = mIRC
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"PokerStars.net" = PokerStars.net
"PunkBusterSvc" = PunkBuster Services
"RealPlayer 15.0" = RealPlayer
"Serious Sam HD The First Encounter_is1" = Serious Sam HD The First Encounter
"Serious Sam The Second Encounter1.0.7" = Serious Sam The Second Encounter
"Shutter_is1" = Shutter
"sotqurw" = Favorit
"Steam App 102700" = Alliance of Valiant Arms
"Steam App 24960" = Battlefield: Bad Company 2
"Steam App 440" = Team Fortress 2
"Steam App 500" = Left 4 Dead
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"TIPP10_is1" = TIPP10 Version 2.1.0
"TmUnitedForever_is1" = TmUnitedForever
"TuneUp Utilities 2012" = TuneUp Utilities 2012
"TurboLaunch_is1" = TurboLaunch 5.1.1
"Usenet.nl_is1" = Usenet.nl
"Veetle TV" = Veetle TV 0.9.18
"Video Mover_is1" = Video Mover
"VLC media player" = VLC media player 1.1.11
"vShare.tv plugin" = vShare.tv plugin 1.3
"Winamp" = Winamp
"WinLiveSuite" = Windows Live Essentials
"World of Warcraft" = World of Warcraft
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-3175316596-3364050726-2863681098-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{79A765E1-C399-405B-85AF-466F52E918B0}" = Avira SearchFree Toolbar plus Web Protection Updater
"Facebook Plug-In" = Facebook Plug-In
"UnityWebPlayer" = Unity Web Player
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 12.08.2012 11:18:15 | Computer Name = *** | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 14.0.1.4577,
 Zeitstempel: 0x5000b729  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x07000008  ID des fehlerhaften
 Prozesses: 0xc8  Startzeit der fehlerhaften Anwendung: 0x01cd789db0bc0063  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\Mozilla Firefox\firefox.exe  Pfad 
des fehlerhaften Moduls: unknown  Berichtskennung: efeef284-e490-11e1-80a0-00251123cbab
 
Error - 12.08.2012 11:18:56 | Computer Name = *** | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 14.0.1.4577,
 Zeitstempel: 0x5000b729  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00fa0008  ID des fehlerhaften
 Prozesses: 0x11ec  Startzeit der fehlerhaften Anwendung: 0x01cd789dc8db9630  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\Mozilla Firefox\firefox.exe  Pfad 
des fehlerhaften Moduls: unknown  Berichtskennung: 07e10f06-e491-11e1-80a0-00251123cbab
 
Error - 12.08.2012 11:19:06 | Computer Name = *** | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 14.0.1.4577,
 Zeitstempel: 0x5000b729  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x02340008  ID des fehlerhaften
 Prozesses: 0x6a0  Startzeit der fehlerhaften Anwendung: 0x01cd789dcf16fbfd  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\Mozilla Firefox\firefox.exe  Pfad 
des fehlerhaften Moduls: unknown  Berichtskennung: 0de389ad-e491-11e1-80a0-00251123cbab
 
Error - 12.08.2012 11:37:44 | Computer Name = *** | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 14.0.1.4577,
 Zeitstempel: 0x5000b729  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00f50008  ID des fehlerhaften
 Prozesses: 0xc84  Startzeit der fehlerhaften Anwendung: 0x01cd78a06a0b5747  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\Mozilla Firefox\firefox.exe  Pfad 
des fehlerhaften Moduls: unknown  Berichtskennung: a864af18-e493-11e1-80a0-00251123cbab
 
Error - 12.08.2012 11:37:59 | Computer Name = *** | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 14.0.1.4577,
 Zeitstempel: 0x5000b729  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x003b0008  ID des fehlerhaften
 Prozesses: 0x540  Startzeit der fehlerhaften Anwendung: 0x01cd78a0735d9212  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\Mozilla Firefox\firefox.exe  Pfad 
des fehlerhaften Moduls: unknown  Berichtskennung: b12dd196-e493-11e1-80a0-00251123cbab
 
Error - 14.08.2012 02:38:30 | Computer Name = *** | Source = SideBySide | ID = 16842827
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files
 (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe". Fehler in Manifest-
 oder Richtliniendatei "C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe"
 in Zeile 2.  Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.
 
Error - 14.08.2012 14:55:10 | Computer Name = *** | Source = VSS | ID = 13
Description = 
 
Error - 14.08.2012 14:55:10 | Computer Name = *** | Source = VSS | ID = 8193
Description = 
 
Error - 14.08.2012 21:10:58 | Computer Name = *** | Source = SideBySide | ID = 16842827
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files
 (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe". Fehler in Manifest-
 oder Richtliniendatei "C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe"
 in Zeile 2.  Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.
 
Error - 15.08.2012 20:53:29 | Computer Name = *** | Source = SideBySide | ID = 16842827
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files
 (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe". Fehler in Manifest-
 oder Richtliniendatei "C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe"
 in Zeile 2.  Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.
 
[ System Events ]
Error - 16.08.2012 07:08:02 | Computer Name = *** | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name
 Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet 
wurde:   %%-2140993535
 
Error - 16.08.2012 07:08:02 | Computer Name = *** | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler
 beendet:   %%-2140993535
 
Error - 16.08.2012 07:08:02 | Computer Name = *** | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name
 Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet 
wurde:   %%-2140993535
 
Error - 16.08.2012 07:08:02 | Computer Name = *** | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler
 beendet:   %%-2140993535
 
Error - 16.08.2012 07:08:03 | Computer Name = *** | Source = PNRPSvc | ID = 102
Description = 
 
Error - 16.08.2012 07:08:03 | Computer Name = *** | Source = PNRPSvc | ID = 102
Description = 
 
Error - 16.08.2012 07:08:03 | Computer Name = *** | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name
 Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet 
wurde:   %%-2140993535
 
Error - 16.08.2012 07:08:03 | Computer Name = *** | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler
 beendet:   %%-2140993535
 
Error - 16.08.2012 07:08:03 | Computer Name = *** | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name
 Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet 
wurde:   %%-2140993535
 
Error - 16.08.2012 07:08:03 | Computer Name = *** | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler
 beendet:   %%-2140993535
 
 
< End of report >

Code:

ATTFilter

OTL Extras logfile created on: 16.08.2012 12:53:12 - Run 1
OTL by OldTimer - Version 3.2.57.0     Folder = C:\Users\***\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 0,96 Gb Available Physical Memory | 23,98% Memory free
8,00 Gb Paging File | 4,27 Gb Available in Paging File | 53,44% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 48,83 Gb Total Space | 7,11 Gb Free Space | 14,56% Space Free | Partition Type: NTFS
Drive F: | 882,68 Gb Total Space | 6,90 Gb Free Space | 0,78% Space Free | Partition Type: NTFS
Drive I: | 3,09 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: *** | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
 
[HKEY_USERS\S-1-5-21-3175316596-3364050726-2863681098-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L"
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L"
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
"" = 
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files (x86)\Free Music Zilla\FMZilla.exe" = C:\Program Files (x86)\Free Music Zilla\FMZilla.exe:*:Enabled:FMZilla -- ()
"C:\Program Files (x86)\Free Music Zilla\FMZilla.exe" = C:\Program Files (x86)\Free Music Zilla\FMZilla.exe:*:Enabled:FMZilla -- ()
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1A60F074-E120-4851-9237-1F73FB109D7B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{2E99C78E-86AC-485B-887B-9EDB98A6A76A}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{34BFC7B6-A452-45CA-854A-D3540FF6DBE8}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{42184CB9-1F61-45D5-9025-671EA99F3053}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{4B2A7C31-A294-405A-9430-62D69C727924}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{4BBBBF9C-6A5F-443A-851C-B5B0907814C9}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{716CE448-72E8-460E-8F77-FD66F9A7FF59}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{9CA4BC85-7E44-4087-92E0-1C38E7AB1E7A}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{9EF0D713-529A-4740-A539-BA82373A664E}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{ADF04DF1-D1FE-45C1-8016-61CC938F64D4}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{AE95BBCC-5C4F-4A0E-812C-CF087383A5A1}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{B8290488-3CF5-451B-883E-97520C4EF857}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{D24CC76B-FF46-467A-BD72-D3E02061B671}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{DD9E5007-4A66-41C3-B25C-26EFFE82AD4D}" = lport=19540 | protocol=17 | dir=in | name=sxuptp | 
"{E5AD475B-ABCE-4A5E-B881-FBA2631F7EEC}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{F2665E12-0336-4977-95A5-653B7BE947D7}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{F37FD10A-4D4A-4112-9C7A-BD59EF232935}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{F3AB6503-8419-4183-8948-13EA05D5EAD1}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{FAC98983-2C4C-4CE9-9DA8-6FC5275CD69C}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{FE5E35B5-110C-4F3F-8EF0-079BB2514BE6}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{FE7D0E0F-CC7D-4996-B620-B424551B3803}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\outlook.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01EDD0F0-0AB1-4600-8ECF-85C4323EB119}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 
"{02EA47ED-23B7-4AB7-B66D-24E57F1008E4}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe | 
"{04F24148-B878-4986-A607-0AD2C4286F24}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{054B03FF-8F0D-471A-867A-9C2A61272848}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{088BF867-3402-496E-89F3-391AC5A582BA}" = protocol=6 | dir=in | app=f:\games\steam\steamapps\common\call of duty black ops\blackops.exe | 
"{09AD794C-69A5-4988-B401-5DD69BC340D4}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{0A61ACED-453F-40C8-B30A-CB38BB7B7242}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{0B11C22F-CB9A-4C0F-B618-517DDD5DE723}" = protocol=6 | dir=out | app=system | 
"{0BE40DC9-C36A-47F5-97D1-CDC084312FBD}" = protocol=6 | dir=in | app=f:\games\steam\steamapps\common\call of duty black ops\blackopsmp.exe | 
"{0D65B9CE-5E7B-4DA4-B821-15FC4B994958}" = protocol=17 | dir=in | app=f:\games\battlefield bad company 2\bfbc2updater.exe | 
"{17199640-30C3-4339-8A7F-D11651F4A2AE}" = protocol=6 | dir=in | app=c:\windows\syswow64\muzapp.exe | 
"{177EC22A-8F90-4D3D-9416-F2F7657E9BE0}" = dir=in | app=c:\program files (x86)\belkin\router setup and monitor\belkinsetup.exe | 
"{181FFFCD-C947-49EC-8B01-A052268150D0}" = protocol=17 | dir=in | app=f:\games\steam\steamapps\common\spiral knights\java_vm\bin\javaw.exe | 
"{1A935B51-C968-43D7-B221-DC65086769D1}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{1D87AFF9-385C-456F-83B8-82A2ABD5194F}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 
"{222B3F35-C379-4081-B489-6F659D92AF76}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{240CA842-4CD5-4C52-A36E-0FE5B3F6BA6F}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{2A6FCE52-0903-4039-BD80-9265BEB6F41F}" = protocol=17 | dir=in | app=c:\windows\syswow64\muzapp.exe | 
"{2CE13116-8539-4098-9C5D-9DDA4CC1C3BB}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{37ADB797-6A58-4D63-9A2A-4923C6924CF9}" = protocol=6 | dir=in | app=f:\games\bulletstorm\binaries\win32\shippingpc-stormgame.exe | 
"{3956A9C8-7A90-4B9E-B645-84F27C3A8B24}" = protocol=6 | dir=in | app=f:\games\steam\steamapps\common\battlefield bad company 2\bfbc2game.exe | 
"{3A5BB4B8-AC23-4B51-AEFE-1E24AB949F70}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{4481DFAB-C660-47D9-A4EC-F1C3F71C2FBA}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 
"{45D9C7A9-BD78-413F-9A69-88E0E43105AE}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe | 
"{478F447D-EE5F-4088-B9DE-2EFD4B69484A}" = protocol=6 | dir=in | app=f:\games\steam\steamapps\common\ava\reactor.exe | 
"{50C4AFF6-7E0C-4217-8860-B8C70FB315D4}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 
"{5A2FCC12-7541-4594-84E5-4E9C0AAD3F19}" = protocol=17 | dir=in | app=f:\games\steam\steamapps\common\left 4 dead 2\left4dead2.exe | 
"{5A4C756C-691E-4781-B3EE-39E3B803205E}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | 
"{5AC7F094-37BD-4350-B1FA-8E1F291A77E8}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 
"{5DF04280-FD7F-489C-BACB-E478942B7BEA}" = protocol=6 | dir=in | app=c:\program files (x86)\belkin\router setup and monitor\belkinsetup.exe | 
"{5EF12E02-F72B-43B0-BC4D-B1085F5E3DA6}" = protocol=17 | dir=in | app=f:\games\steam\steamapps\common\call of duty black ops\blackopsmp.exe | 
"{6000FB11-647B-4CC2-B285-1E46EFDB35F3}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe | 
"{61E63508-2F04-432C-8E29-128FE4358FB9}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{64A83C6E-7309-4207-93F8-D4AFE824D82A}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{64F01E91-5C1C-4E41-8A80-EE06E2F44173}" = protocol=6 | dir=in | app=f:\games\steam\steamapps\common\left 4 dead 2\left4dead2.exe | 
"{6CD61B21-44ED-4534-9EB6-74F4726E4486}" = protocol=6 | dir=in | app=f:\games\steam\steamapps\common\spiral knights\java_vm\bin\javaw.exe | 
"{717EC0B2-3095-4837-BD78-F19F467DDB29}" = protocol=6 | dir=in | app=f:\games\diablo iii\diablo iii.exe | 
"{7206FB72-5DC3-468C-A9B3-1C5F52989C0F}" = protocol=17 | dir=in | app=f:\games\steam\steamapps\common\call of duty black ops\blackopsmp.exe | 
"{73DD8554-38AF-42B2-9978-4BD79D2559C5}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{7BA8F979-CFB0-4A6B-A52B-3C89C1B64B25}" = protocol=17 | dir=in | app=f:\games\diablo iii\diablo iii.exe | 
"{7D66C264-4C79-455A-A7C0-9D1949D53EF9}" = protocol=6 | dir=in | app=f:\games\steam\steamapps\common\call of duty black ops\blackopsmp.exe | 
"{7DAAD198-9D1D-46E6-9425-014189310676}" = protocol=17 | dir=in | app=f:\games\steam\steamapps\common\battlefield bad company 2\support\ea help\electronic_arts_technical_support.htm | 
"{7E7B7495-058F-4DFC-90C5-D5D5EBEBA947}" = protocol=17 | dir=in | app=f:\games\bulletstorm\binaries\win32\shippingpc-stormgame.exe | 
"{98443751-CF1A-4920-BA78-51F165D75705}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe | 
"{98DB1F88-9FFB-4CE9-981F-22AE42FFB06F}" = protocol=17 | dir=in | app=c:\program files (x86)\belkin\router setup and monitor\belkinsetup.exe | 
"{9BCB7EF4-3086-4288-91A7-F68742D9A61E}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe | 
"{A2160F5B-E6E6-4336-8EA4-55A48190D4F9}" = protocol=58 | dir=out | name=@iphlpsvc.dll,-503 | 
"{A62C0D15-243B-4BAB-836D-555125B0D238}" = protocol=58 | dir=in | app=system | 
"{A8E93D3B-78EA-4A7E-A9D9-929C426C9B01}" = protocol=17 | dir=in | app=f:\games\steam\steamapps\common\call of duty black ops\blackops.exe | 
"{AA5526DC-19E8-4CA4-8365-4EDBA2E0DC1A}" = protocol=6 | dir=in | app=f:\games\battlefield bad company 2\bfbc2updater.exe | 
"{AF22518E-3BA9-472A-8E65-5AEA656A4800}" = protocol=6 | dir=in | app=c:\program files (x86)\belkin\router setup and monitor\belkinsetup.exe | 
"{AF394759-A788-4F82-A402-9CC0B186AC41}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | 
"{AFD7C342-534C-40D0-993D-77FC2F2E3AB3}" = protocol=17 | dir=in | app=f:\games\steam\steamapps\common\ava\reactor.exe | 
"{B23A70AB-3F39-485E-B243-E25FF2AE5A8F}" = protocol=17 | dir=in | app=c:\program files (x86)\belkin\router setup and monitor\belkinsetup.exe | 
"{B5A205C6-FA81-442D-8C9B-6A7AB972DCA0}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe | 
"{B693CA02-F4BE-41BD-AF67-DFDD29D64AA9}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{B87FA4C5-3B5C-4718-8788-880D6DEBD254}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe | 
"{B901D994-3933-40F6-A196-DF7EA664D961}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe | 
"{BA8E7DAE-B50F-48D3-9107-C15D0900BB8B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{BAD3AB99-4AEF-4175-890E-0DC3572EDB14}" = protocol=17 | dir=in | app=f:\games\steam\steam.exe | 
"{BC5B52A1-1B8A-4F33-A4D1-5B87E7B5F774}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{C4DB96A3-4A30-40CD-AD40-A0F6F6EE1400}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{CBAAA7EB-62CE-4DB0-B771-40DA61C9E492}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe | 
"{CC9AD55B-1CF0-404A-8EF4-BC3D5F6EFA8A}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe | 
"{D43B66FE-38E5-47B5-9A1D-680F257F597B}" = dir=in | app=c:\program files\belkin\belkin usb print and storage center\connect.exe | 
"{D49F2E5B-EF34-42A5-B7D3-A18ADFDED7F3}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 
"{D92B2243-3F61-4AC8-A3CD-8609EB3B9955}" = protocol=17 | dir=in | app=f:\games\steam\steamapps\common\battlefield bad company 2\bfbc2game.exe | 
"{E3EF1A18-FCAB-4612-836B-B0C2864F706E}" = protocol=6 | dir=in | app=f:\games\steam\steamapps\common\battlefield bad company 2\support\ea help\electronic_arts_technical_support.htm | 
"{EB19676A-463A-4B55-A70C-50A55E4F93FD}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{EDED9A15-97A1-4ED7-A650-1D7103F085C8}" = protocol=17 | dir=in | app=f:\games\steam\steamapps\common\left 4 dead\left4dead.exe | 
"{EE138C9A-ABED-41BB-9A56-C0AD7EFA2FDC}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe | 
"{F7C19B86-9E18-4EE3-AD88-2B37F663FB07}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{F825911D-3C66-42D5-90C6-B049995520E9}" = protocol=6 | dir=in | app=f:\games\steam\steamapps\common\left 4 dead\left4dead.exe | 
"{F989ED7D-E3EC-44CA-9A79-22454DFFFA1C}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{FC2D2484-395B-4A6F-99BE-51A19AC71B97}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe | 
"{FD18B7A9-CFB4-4D68-B1FE-A0BDA6923320}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{FE930C30-4172-4FED-926A-8B53225C90A5}" = protocol=6 | dir=in | app=f:\games\steam\steam.exe | 
"TCP Query User{00C5EBBF-A23D-4799-B166-116466B0E9C4}C:\program files (x86)\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files (x86)\google\google earth\plugin\geplugin.exe | 
"TCP Query User{0E8F410D-D444-48FB-A615-14C516E2E3CB}C:\program files (x86)\opera\opera.exe" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe | 
"TCP Query User{17E71AE1-8F99-49F4-8EC0-2085DEF5BEF7}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe | 
"TCP Query User{34A38373-496F-461C-8529-320E8E243507}C:\program files (x86)\logitech\vid hd\vid.exe" = protocol=6 | dir=in | app=c:\program files (x86)\logitech\vid hd\vid.exe | 
"TCP Query User{399CDC45-135A-4C21-ABD9-12FD6D0145E7}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe | 
"TCP Query User{3C17D5C7-399F-439D-8912-6C63725E98B7}C:\program files (x86)\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=c:\program files (x86)\videolan\vlc\vlc.exe | 
"TCP Query User{5524E24B-D9EF-44A1-A79A-5F7DF40CA196}F:\games\unreal tournament 2004\system\ut2004.exe" = protocol=6 | dir=in | app=f:\games\unreal tournament 2004\system\ut2004.exe | 
"TCP Query User{7DAC1E17-D2E3-4E0F-A68F-FA0C1D0AEC1B}C:\programdata\battle.net\agent\agent.1040\agent.exe" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe | 
"TCP Query User{972653FD-AD71-44A1-AD43-D06522CAADBC}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe | 
"TCP Query User{9786FD2A-DC64-4F9E-82A4-FD8AA17F8168}C:\program files (x86)\free music zilla\fmzilla.exe" = protocol=6 | dir=in | app=c:\program files (x86)\free music zilla\fmzilla.exe | 
"TCP Query User{C5E2749E-CBFE-4FC3-B53E-4D5A9259B6EB}F:\games\steam\steamapps\common\battlefield bad company 2\bfbc2game.exe" = protocol=6 | dir=in | app=f:\games\steam\steamapps\common\battlefield bad company 2\bfbc2game.exe | 
"TCP Query User{DCB793EC-552C-40B2-9904-F043CD840BED}C:\programdata\battle.net\agent\agent.998\agent.exe" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.998\agent.exe | 
"TCP Query User{EEF4B408-EDF1-48BE-AA65-A6D932CABDFC}C:\program files (x86)\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=c:\program files (x86)\videolan\vlc\vlc.exe | 
"UDP Query User{28D30AFF-0082-4F48-8DC0-D89ACB615607}C:\program files (x86)\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=c:\program files (x86)\videolan\vlc\vlc.exe | 
"UDP Query User{2B411D06-7F18-4F78-A185-E339E8184AA6}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe | 
"UDP Query User{33A9EC26-1255-471F-AAB3-9B599A8271A1}C:\program files (x86)\free music zilla\fmzilla.exe" = protocol=17 | dir=in | app=c:\program files (x86)\free music zilla\fmzilla.exe | 
"UDP Query User{39B7513B-5020-4F76-9EDE-AD27D806882E}C:\program files (x86)\logitech\vid hd\vid.exe" = protocol=17 | dir=in | app=c:\program files (x86)\logitech\vid hd\vid.exe | 
"UDP Query User{4201D8EB-1AC9-4D4B-85BA-58E929761090}F:\games\unreal tournament 2004\system\ut2004.exe" = protocol=17 | dir=in | app=f:\games\unreal tournament 2004\system\ut2004.exe | 
"UDP Query User{53B885D6-799D-482B-AD59-95CA6A8EF846}C:\programdata\battle.net\agent\agent.1040\agent.exe" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe | 
"UDP Query User{5A5DD033-7EBE-4957-B2E6-629EB90C9072}C:\program files (x86)\opera\opera.exe" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe | 
"UDP Query User{82EB4265-4F7A-4D23-913B-E546516D8DEA}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe | 
"UDP Query User{839F6AA4-60DB-4F04-9DE2-9374E9A010F7}C:\program files (x86)\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=c:\program files (x86)\videolan\vlc\vlc.exe | 
"UDP Query User{A0104269-7910-446B-8DDB-7D161BCF0757}C:\program files (x86)\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files (x86)\google\google earth\plugin\geplugin.exe | 
"UDP Query User{AAF09D00-E4E4-43C1-A684-B871F0E5A7AC}C:\programdata\battle.net\agent\agent.998\agent.exe" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.998\agent.exe | 
"UDP Query User{E68F5E49-E449-4BEC-AED6-87418F6E1D2F}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe | 
"UDP Query User{FD9637BA-CAD6-4521-9957-0579B0F46EA8}F:\games\steam\steamapps\common\battlefield bad company 2\bfbc2game.exe" = protocol=17 | dir=in | app=f:\games\steam\steamapps\common\battlefield bad company 2\bfbc2game.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{138A4072-9E64-46BD-B5F9-DB2BB395391F}" = LWS VideoEffects
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{47B188E2-2447-5C40-15B6-9D49DC90BF5B}" = ATI Catalyst Install Manager
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{5F143175-13D3-5AE8-5AE9-262C6D60F994}" = AMD Fuel
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A61B820-598D-05B2-5F8D-7388E15AE2DB}" = AMD Drag and Drop Transcoding
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{90AB246D-A0A0-29EA-199A-4B07841E0737}" = ATI AVIVO64 Codecs
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{98C8DF59-BE5F-4EC2-9B12-FD2A54928EDB}" = Microsoft IntelliType Pro 8.0
"{A9C6CA47-D937-D61D-4BD3-7CFAB7A5BA56}" = ATI Problem Report Wizard
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D7B6A47A-3DC9-64FE-BFD0-ED02F036D539}" = ccc-utility64
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319
"{DE1B48FB-0EA4-6E6F-5335-9095994CB7EB}" = WMV9/VC-1 Video Playback
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX 64-bit
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit
"Belkin USB Print and Storage Center" = Belkin USB Print and Storage Center
"CCleaner" = CCleaner
"CPUID HWMonitor_is1" = CPUID HWMonitor 1.15
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"WinRAR archiver" = WinRAR
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}" = Battlefield 2(TM)
"{08610298-29AE-445B-B37D-EFBE05802967}" = LWS Pictures And Video
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{15634701-BACE-4449-8B25-1567DA8C9FD3}" = CameraHelperMsi
"{1651216E-E7AD-4250-92A1-FB8ED61391C9}" = LWS Help_main
"{174A3B31-4C43-43DD-866F-73C9DB887B48}" = LWS Twitter
"{19A492A0-888F-44A0-9B21-D91700763F62}" = Catalyst Control Center - Branding
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F77C418-2C90-459C-BD33-B56A4182B9FA}" = System Requirements Lab CYRI
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{21DF0294-6B9D-4741-AB6F-B2ABFBD2387E}" = LWS YouTube Plugin
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{2934DCB0-F8EE-11E0-A4A5-B8AC6F97B88E}" = Google Earth Plug-in
"{2FFE93F0-BB72-4E52-8761-354D1AAA9387}" = Sony Ericsson PC Suite 6.011.00
"{32364CEA-7855-4A3C-B674-53D8E9B97936}" = TuneUp Utilities 2012
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{394DC0BC-5476-4260-B52C-BDE1BDEFA958}" = Unreal Tournament 2004
"{3AC8457C-0385-4BEA-A959-E095F05D6D67}" = Battlefield: Bad Company™ 2
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = erLT
"{45410935-3E72-472B-8C35-AB1000008200}" = Bulletstorm
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4C590030-7469-453E-8589-D15DA9D03F52}" = ANIWZCS2 Service
"{5F753314-628E-4C13-B8AE-BFA7FD514CBE}" = D-Link Wireless G DWL-G122_DWA-110
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6F76EC3C-34B1-436E-97FB-48C58D7BEDCD}" = LWS Gallery
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71E66D3F-A009-44AB-8784-75E2819BA4BA}" = LWS Motion Detection
"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2
"{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}" = Avanquest update
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{83C8FA3C-F4EA-46C4-8392-D3CE353738D6}" = LWS Launcher
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{8937D274-C281-42E4-8CDB-A0B2DF979189}" = LWS Webcam Software
"{8A809006-C25A-4A3A-9DAB-94659BCDB107}" = NVIDIA PhysX
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8E884205-E3A3-55F3-2EE2-0E39F8E6CCED}" = Catalyst Control Center Graphics Previews Common
"{8FB1B528-E260-451E-9B55-E9152F94B80B}" = Microsoft Games for Windows - LIVE Redistributable
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0407-1000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{9329BA0E-DD91-D33E-B73F-AA5179C53736}" = Catalyst Control Center
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D8B0949-7C47-476F-9F06-F900D3B078EA}" = Kaspersky Internet Security 2010
"{9DAEA76B-E50F-4272-A595-0124E826553D}" = LWS WLM Plugin
"{9FD6F1A8-5550-46AF-8509-271DF0E768B5}" = Dual-Core Optimizer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.3 - Deutsch
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{BD5D6437-94F6-C8F4-AF1B-B1658E0CB8F7}" = CCC Help English
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{CE026CFE-73FE-4FED-9D5F-2C8D4DB512B0}" = TuneUp Utilities Language Pack (de-DE)
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D40EB009-0499-459c-A8AF-C9C110766215}" = Logitech Webcam-Software
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}" = Full Tilt Poker
"{DFFCDB41-C2DA-47D6-96FF-03C05C0BEA22}" = resident evil 4
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E1BBBAC5-2857-4155-82A6-54492CE88620}" = Opera 9.64
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{EED027B7-0DB6-404B-8F45-6DFEE34A0441}" = LWS Video Mask Maker
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F38556C1-486C-C07B-4655-2F1BCF18C68A}" = Catalyst Control Center InstallProxy
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{F97E3841-CA9D-4964-9D64-26066241D26F}" = Microsoft Games for Windows - LIVE
"{FF167195-9EE4-46C0-8CD7-FBA3457E88AB}" = LWS Facebook
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Avira AntiVir Desktop" = Avira Free Antivirus
"Belkin Installationsprogramm und Router Monitor_is1" = Belkin Installationsprogramm und Router Monitor
"DAEMON Tools Lite" = DAEMON Tools Lite
"Diablo III" = Diablo III
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup" = DivX-Setup
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Everest Casino" = Everest Casino (Remove Only)
"Everest Poker" = Everest Poker (Remove Only)
"FirstloadIkarus" = Firstload Ikarus
"Free MP3 WMA OGG Converter_is1" = Free MP3 WMA OGG Converter 8.2.5
"Free Music Zilla_is1" = Free Music Zilla
"GFWL_{45410935-3E72-472B-8C35-AB1000008200}" = Bulletstorm
"Google Chrome" = Google Chrome
"ICQToolbar" = ICQ Toolbar
"InstallShield_{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch
"InstallShield_{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch
"InstallWIX_{9D8B0949-7C47-476F-9F06-F900D3B078EA}" = Kaspersky Internet Security 2010
"IrfanView" = IrfanView (remove only)
"Logitech Vid" = Logitech Vid HD
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"mIRC" = mIRC
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"PokerStars.net" = PokerStars.net
"PunkBusterSvc" = PunkBuster Services
"RealPlayer 15.0" = RealPlayer
"Serious Sam HD The First Encounter_is1" = Serious Sam HD The First Encounter
"Serious Sam The Second Encounter1.0.7" = Serious Sam The Second Encounter
"Shutter_is1" = Shutter
"sotqurw" = Favorit
"Steam App 102700" = Alliance of Valiant Arms
"Steam App 24960" = Battlefield: Bad Company 2
"Steam App 440" = Team Fortress 2
"Steam App 500" = Left 4 Dead
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"TIPP10_is1" = TIPP10 Version 2.1.0
"TmUnitedForever_is1" = TmUnitedForever
"TuneUp Utilities 2012" = TuneUp Utilities 2012
"TurboLaunch_is1" = TurboLaunch 5.1.1
"Usenet.nl_is1" = Usenet.nl
"Veetle TV" = Veetle TV 0.9.18
"Video Mover_is1" = Video Mover
"VLC media player" = VLC media player 1.1.11
"vShare.tv plugin" = vShare.tv plugin 1.3
"Winamp" = Winamp
"WinLiveSuite" = Windows Live Essentials
"World of Warcraft" = World of Warcraft
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-3175316596-3364050726-2863681098-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{79A765E1-C399-405B-85AF-466F52E918B0}" = Avira SearchFree Toolbar plus Web Protection Updater
"Facebook Plug-In" = Facebook Plug-In
"UnityWebPlayer" = Unity Web Player
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 12.08.2012 11:18:15 | Computer Name = *** | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 14.0.1.4577,
 Zeitstempel: 0x5000b729  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x07000008  ID des fehlerhaften
 Prozesses: 0xc8  Startzeit der fehlerhaften Anwendung: 0x01cd789db0bc0063  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\Mozilla Firefox\firefox.exe  Pfad 
des fehlerhaften Moduls: unknown  Berichtskennung: efeef284-e490-11e1-80a0-00251123cbab
 
Error - 12.08.2012 11:18:56 | Computer Name = *** | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 14.0.1.4577,
 Zeitstempel: 0x5000b729  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00fa0008  ID des fehlerhaften
 Prozesses: 0x11ec  Startzeit der fehlerhaften Anwendung: 0x01cd789dc8db9630  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\Mozilla Firefox\firefox.exe  Pfad 
des fehlerhaften Moduls: unknown  Berichtskennung: 07e10f06-e491-11e1-80a0-00251123cbab
 
Error - 12.08.2012 11:19:06 | Computer Name = *** | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 14.0.1.4577,
 Zeitstempel: 0x5000b729  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x02340008  ID des fehlerhaften
 Prozesses: 0x6a0  Startzeit der fehlerhaften Anwendung: 0x01cd789dcf16fbfd  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\Mozilla Firefox\firefox.exe  Pfad 
des fehlerhaften Moduls: unknown  Berichtskennung: 0de389ad-e491-11e1-80a0-00251123cbab
 
Error - 12.08.2012 11:37:44 | Computer Name = *** | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 14.0.1.4577,
 Zeitstempel: 0x5000b729  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00f50008  ID des fehlerhaften
 Prozesses: 0xc84  Startzeit der fehlerhaften Anwendung: 0x01cd78a06a0b5747  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\Mozilla Firefox\firefox.exe  Pfad 
des fehlerhaften Moduls: unknown  Berichtskennung: a864af18-e493-11e1-80a0-00251123cbab
 
Error - 12.08.2012 11:37:59 | Computer Name = *** | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 14.0.1.4577,
 Zeitstempel: 0x5000b729  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x003b0008  ID des fehlerhaften
 Prozesses: 0x540  Startzeit der fehlerhaften Anwendung: 0x01cd78a0735d9212  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\Mozilla Firefox\firefox.exe  Pfad 
des fehlerhaften Moduls: unknown  Berichtskennung: b12dd196-e493-11e1-80a0-00251123cbab
 
Error - 14.08.2012 02:38:30 | Computer Name = *** | Source = SideBySide | ID = 16842827
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files
 (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe". Fehler in Manifest-
 oder Richtliniendatei "C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe"
 in Zeile 2.  Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.
 
Error - 14.08.2012 14:55:10 | Computer Name = *** | Source = VSS | ID = 13
Description = 
 
Error - 14.08.2012 14:55:10 | Computer Name = *** | Source = VSS | ID = 8193
Description = 
 
Error - 14.08.2012 21:10:58 | Computer Name = *** | Source = SideBySide | ID = 16842827
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files
 (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe". Fehler in Manifest-
 oder Richtliniendatei "C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe"
 in Zeile 2.  Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.
 
Error - 15.08.2012 20:53:29 | Computer Name = *** | Source = SideBySide | ID = 16842827
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files
 (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe". Fehler in Manifest-
 oder Richtliniendatei "C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe"
 in Zeile 2.  Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.
 
[ System Events ]
Error - 16.08.2012 07:08:02 | Computer Name = *** | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name
 Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet 
wurde:   %%-2140993535
 
Error - 16.08.2012 07:08:02 | Computer Name = *** | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler
 beendet:   %%-2140993535
 
Error - 16.08.2012 07:08:02 | Computer Name = *** | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name
 Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet 
wurde:   %%-2140993535
 
Error - 16.08.2012 07:08:02 | Computer Name = *** | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler
 beendet:   %%-2140993535
 
Error - 16.08.2012 07:08:03 | Computer Name = *** | Source = PNRPSvc | ID = 102
Description = 
 
Error - 16.08.2012 07:08:03 | Computer Name = *** | Source = PNRPSvc | ID = 102
Description = 
 
Error - 16.08.2012 07:08:03 | Computer Name = *** | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name
 Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet 
wurde:   %%-2140993535
 
Error - 16.08.2012 07:08:03 | Computer Name = *** | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler
 beendet:   %%-2140993535
 
Error - 16.08.2012 07:08:03 | Computer Name = *** | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name
 Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet 
wurde:   %%-2140993535
 
Error - 16.08.2012 07:08:03 | Computer Name = *** | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler
 beendet:   %%-2140993535
 
 
< End of report >

t'john · 16.08.2012, 12:23

Wo ist OTL.txt?

Teido · 16.08.2012, 12:43

Oh sorry, da hab ich wohl zweimal die selbe Datei gepostet

Code:

ATTFilter

OTL logfile created on: 16.08.2012 12:53:12 - Run 1
OTL by OldTimer - Version 3.2.57.0     Folder = C:\Users\Joogi\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 0,96 Gb Available Physical Memory | 23,98% Memory free
8,00 Gb Paging File | 4,27 Gb Available in Paging File | 53,44% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 48,83 Gb Total Space | 7,11 Gb Free Space | 14,56% Space Free | Partition Type: NTFS
Drive F: | 882,68 Gb Total Space | 6,90 Gb Free Space | 0,78% Space Free | Partition Type: NTFS
Drive I: | 3,09 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: JOOGI | User Name: Joogi | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Joogi\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Users\Joogi\Desktop\aglotze2\aglotze.dll ()
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
PRC - C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
PRC - C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
PRC - C:\Users\Joogi\Desktop\aglotze2\flv.exe ()
PRC - C:\Users\Joogi\Desktop\aglotze2\vlc.exe ()
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - C:\Users\Joogi\AppData\Local\Logitech® Webcam-Software\Logishrd\LU2.0\LogitechUpdate.exe (Logitech, Inc.)
PRC - C:\Users\Joogi\AppData\Local\Logitech® Webcam-Software\Logishrd\LU2.0\LULnchr.exe (Logitech, Inc.)
PRC - C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe (Affinegy, Inc.)
PRC - C:\Windows\SysWOW64\cmd.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe ()
PRC - C:\Program Files (x86)\D-Link\DWL-G122_DWA-110\AirGCFG.exe (D-Link Corp.)
PRC - C:\Program Files (x86)\ANI\ANIWZCS2 Service\WZCSLDR2.exe (Wireless Service)
PRC - C:\Windows\SysWOW64\ANIWConnService.exe ()
PRC - C:\Program Files (x86)\Winamp\winampa.exe ()
PRC - C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe ()
PRC - C:\Program Files (x86)\TurboLaunch\TurboLaunch.exe (Savard Software)
PRC - C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (Rocket Division Software)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Users\Joogi\Desktop\aglotze2\aglotze.dll ()
MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libty_plugin.dll ()
MOD - C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtGui4.dll ()
MOD - C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtXml4.dll ()
MOD - C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QJpeg4.dll ()
MOD - C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QGif4.dll ()
MOD - C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtCore4.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\flv.exe ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libvorbis_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libxml_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libtaglib_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libtheora_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libswscale_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libts_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libzip_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libwaveout_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libyuy2_i420_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libvout_wrapper_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libyuy2_i422_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libwav_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libvoc_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libtta_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libxa_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libyuvp_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libugly_resampler_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libtrivial_mixer_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libqt4_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libskins2_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libschroedinger_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libspeex_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libsap_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libreal_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libsmf_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libscaletempo_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\librawvid_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libstream_filter_rar_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libsimple_channel_mixer_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\librawdv_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libscale_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libstream_filter_record_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libspdif_mixer_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libmkv_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libmod_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libpng_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libmp4_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libmpgatofixed32_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libplaylist_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libmpc_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libogg_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libps_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libnuv_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libmono_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libmpeg_audio_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libpva_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libnsv_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libnsc_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libmpgv_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\liblibass_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\liblive555_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libgme_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\liblua_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libi420_rgb_sse2_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libi420_rgb_mmx_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libi420_rgb_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libi420_yuy2_sse2_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libhotkeys_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libi422_yuy2_sse2_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libi420_yuy2_mmx_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libi420_yuy2_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libi422_yuy2_mmx_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libi422_yuy2_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\liblpcm_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libmjpeg_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libmemcpymmxext_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libglobalhotkeys_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libi422_i420_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libgrey_yuv_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libfreetype_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libfaad_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libflac_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libfluidsynth_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libdvdnav_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libdshow_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libdtstofloat32_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libdirectx_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libdirect3d_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libflacsys_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libes_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libfilesystem_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libdts_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libfake_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libdtstospdif_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libdolby_surround_decoder_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libfloat32_mixer_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libdemux_cdg_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libdrawable_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libavcodec_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libavi_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libasf_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libblend_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libaout_directx_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libaraw_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libaudio_format_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libcdg_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libaiff_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libaes3_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libconverter_fixed_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libau_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\libvlccore.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\vlc.exe ()
MOD - C:\Users\Joogi\Desktop\aglotze2\libvlc.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\libaccess_bd_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\liba52tofloat32_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\liba52_plugin.dll ()
MOD - C:\Users\Joogi\Desktop\aglotze2\plugins\liba52tospdif_plugin.dll ()
MOD - C:\Windows\SysWOW64\wlanapp.dll ()
MOD - C:\Program Files (x86)\Winamp\winampa.exe ()
MOD - C:\Program Files (x86)\D-Link\DWL-G122_DWA-110\ANIOApi.dll ()
MOD - C:\Program Files (x86)\ANI\ANIWZCS2 Service\ANIOApi.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (Belkin Local Backup Service) -- C:\Program Files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe ()
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (AMD FUEL Service) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Advanced Micro Devices, Inc.)
SRV:64bit: - (Belkin Network USB Helper) -- C:\Program Files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe ()
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe (TuneUp Software)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirWebService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (UMVPFSrv) -- C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (AffinegyService) -- C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe (Affinegy, Inc.)
SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (AMD Reservation Manager) -- C:\Programme\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe (Advanced Micro Devices)
SRV - (ICQ Service) -- C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe ()
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (ANIWConnService) -- C:\Windows\SysWOW64\ANIWConnService.exe ()
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (AVP) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab)
SRV - (OMSI download service) -- C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe ()
SRV - (StarWindServiceAE) -- C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (Rocket Division Software)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (AODDriver4.0) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys File not found
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys (Duplex Secure Ltd.)
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (LVUVC64) -- C:\Windows\SysNative\drivers\lvuvc64.sys (Logitech Inc.)
DRV:64bit: - (LVRS64) -- C:\Windows\SysNative\drivers\lvrs64.sys (Logitech Inc.)
DRV:64bit: - (ssadmdm) -- C:\Windows\SysNative\drivers\ssadmdm.sys (MCCI Corporation)
DRV:64bit: - (ssadbus) -- C:\Windows\SysNative\drivers\ssadbus.sys (MCCI Corporation)
DRV:64bit: - (ssadserd) -- C:\Windows\SysNative\drivers\ssadserd.sys (MCCI Corporation)
DRV:64bit: - (ssadmdfl) -- C:\Windows\SysNative\drivers\ssadmdfl.sys (MCCI Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (androidusb) -- C:\Windows\SysNative\drivers\ssadadb.sys (Google Inc)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:64bit: - (amdiox64) -- C:\Windows\SysNative\drivers\amdiox64.sys (Advanced Micro Devices)
DRV:64bit: - (KLIF) -- C:\Windows\SysNative\drivers\klif.sys (Kaspersky Lab)
DRV:64bit: - (kl1) -- C:\Windows\SysNative\drivers\kl1.sys (Kaspersky Lab)
DRV:64bit: - (netr28ux) -- C:\Windows\SysNative\drivers\Dnetr28ux.sys (Ralink Technology Corp.)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (usb_rndisx) -- C:\Windows\SysNative\drivers\usb8023x.sys (Microsoft Corporation)
DRV:64bit: - (sxuptp) -- C:\Windows\SysNative\drivers\sxuptp.sys (silex technology, Inc.)
DRV:64bit: - (RTL8187B) -- C:\Windows\SysNative\drivers\RTL8187B.sys (Realtek Semiconductor Corporation                           )
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek Corporation                                            )
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (klmouflt) -- C:\Windows\SysNative\drivers\klmouflt.sys (Kaspersky Lab)
DRV:64bit: - (KLIM6) -- C:\Windows\SysNative\drivers\klim6.sys (Kaspersky Lab)
DRV:64bit: - (xusb21) -- C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation)
DRV:64bit: - (cpuz132) -- C:\Windows\SysNative\drivers\cpuz132_x64.sys (Windows (R) Codename Longhorn DDK provider)
DRV:64bit: - (anodlwf) -- C:\Windows\SysNative\drivers\anodlwfx.sys ()
DRV:64bit: - (KLBG) -- C:\Windows\SysNative\drivers\klbg.sys (Kaspersky Lab)
DRV:64bit: - (s0017unic) -- C:\Windows\SysNative\drivers\s0017unic.sys (MCCI Corporation)
DRV:64bit: - (s0017obex) -- C:\Windows\SysNative\drivers\s0017obex.sys (MCCI Corporation)
DRV:64bit: - (s0017nd5) -- C:\Windows\SysNative\drivers\s0017nd5.sys (MCCI Corporation)
DRV:64bit: - (s0017mdm) -- C:\Windows\SysNative\drivers\s0017mdm.sys (MCCI Corporation)
DRV:64bit: - (s0017mgmt) -- C:\Windows\SysNative\drivers\s0017mgmt.sys (MCCI Corporation)
DRV:64bit: - (s0017mdfl) -- C:\Windows\SysNative\drivers\s0017mdfl.sys (MCCI Corporation)
DRV:64bit: - (s0017bus) -- C:\Windows\SysNative\drivers\s0017bus.sys (MCCI Corporation)
DRV:64bit: - (s117unic) -- C:\Windows\SysNative\drivers\s117unic.sys (MCCI Corporation)
DRV:64bit: - (s117obex) -- C:\Windows\SysNative\drivers\s117obex.sys (MCCI Corporation)
DRV:64bit: - (s117nd5) -- C:\Windows\SysNative\drivers\s117nd5.sys (MCCI Corporation)
DRV:64bit: - (s117mdm) -- C:\Windows\SysNative\drivers\s117mdm.sys (MCCI Corporation)
DRV:64bit: - (s117mgmt) -- C:\Windows\SysNative\drivers\s117mgmt.sys (MCCI Corporation)
DRV:64bit: - (s117mdfl) -- C:\Windows\SysNative\drivers\s117mdfl.sys (MCCI Corporation)
DRV:64bit: - (s117bus) -- C:\Windows\SysNative\drivers\s117bus.sys (MCCI Corporation)
DRV - (TuneUpUtilitiesDrv) -- C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys (TuneUp Software)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
IE - HKLM\..\URLSearchHook:  - No CLSID value found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{57980D16-2A2F-4D97-A71C-3BBD8C2E5206}: "URL" = hxxp://startsear.ch/?aff=1&q={searchTerms}
 
 
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.avira.com/?l=dis&o=APN10396&gct=hp&dc=EU&locale=de_CH
IE - HKU\.DEFAULT\..\URLSearchHook:  - No CLSID value found
IE - HKU\.DEFAULT\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.avira.com/?l=dis&o=APN10396&gct=hp&dc=EU&locale=de_CH
IE - HKU\S-1-5-18\..\URLSearchHook:  - No CLSID value found
IE - HKU\S-1-5-18\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search-us.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
IE - HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://search-us.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
IE - HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C7 6D 7E E5 86 32 CB 01  [binary data]
IE - HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://search-us.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
IE - HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search-us.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
IE - HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\..\URLSearchHook: {f999a48b-1950-4d81-9971-79018f807b4b} - No CLSID value found
IE - HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\..\SearchScopes,DefaultScope = {57980D16-2A2F-4D97-A71C-3BBD8C2E5206}
IE - HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://search-us.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
IE - HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\..\SearchScopes\{57980D16-2A2F-4D97-A71C-3BBD8C2E5206}: "URL" = hxxp://startsear.ch/?aff=1&q={searchTerms}
IE - HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\..\SearchScopes\{74486B74-9434-4B1E-87CC-D2999F8D76F0}: "URL" = hxxp://www.google.de/search?q={searchTerms}
IE - HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/ig"
FF - prefs.js..keyword.URL: "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=AVR-3&o=APN10396&locale=de_CH&apn_uid=5c395e72-3a06-4158-8ddb-47f1834fe7a5&apn_ptnrs=%5EABU&apn_sauid=06E86C6A-1828-49A9-99D6-C1CDD5C0B18E&apn_dtid=%5EYYYYYY%5EYY%5ECH&&q="
FF - prefs.js..network.proxy.http: "85.25.160.126"
FF - prefs.js..network.proxy.http_port: 8080
FF - prefs.js..network.proxy.type: 4
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_235.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.4.53: c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.4.53: c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.4.53: c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.11: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.1: C:\Users\Joogi\AppData\Roaming\Facebook\npfbplugin_1_0_1.dll ( )
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Users\Joogi\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll ( )
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Joogi\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012.05.23 13:34:25 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.01.19 00:45:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012.05.23 13:34:25 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.18 17:43:41 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.06.21 22:06:38 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2010\THBExt [2009.12.14 19:59:04 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.18 17:43:41 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.06.21 22:06:38 | 000,000,000 | ---D | M]
 
[2009.12.14 20:16:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Joogi\AppData\Roaming\mozilla\Extensions
[2012.07.22 02:03:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Joogi\AppData\Roaming\mozilla\Firefox\Profiles\vj4xjtr1.default\extensions
[2011.06.30 09:03:28 | 000,000,000 | ---D | M] (All-in-One Gestures) -- C:\Users\Joogi\AppData\Roaming\mozilla\Firefox\Profiles\vj4xjtr1.default\extensions\{8b86149f-01fb-4842-9dd8-4d7eb02fd055}
[2009.12.15 06:35:04 | 000,000,000 | ---D | M] (Mouse Gestures Redox) -- C:\Users\Joogi\AppData\Roaming\mozilla\Firefox\Profiles\vj4xjtr1.default\extensions\{FFA36170-80B1-4535-B0E3-A4569E497DD0}
[2012.03.18 11:44:17 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2009.12.14 20:34:01 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Program Files (x86)\mozilla firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2011.11.20 18:58:19 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2009.12.14 23:11:14 | 000,000,000 | ---D | M] (Kaspersky URL Advisor) -- C:\Program Files (x86)\mozilla firefox\extensions\linkfilter@kaspersky.ru
[2012.05.23 13:34:25 | 000,000,000 | ---D | M] (RealPlayer Browser Record Plugin) -- C:\PROGRAMDATA\REAL\REALPLAYER\BROWSERRECORDPLUGIN\FIREFOX\EXT
[2011.12.09 09:55:35 | 000,061,705 | ---- | M] () (No name found) -- C:\USERS\JOOGI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\VJ4XJTR1.DEFAULT\EXTENSIONS\{B749FC7C-E949-447F-926C-3F4EED6ACCFE}.XPI
[2012.07.18 17:43:41 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.03.05 10:58:13 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2012.05.23 13:34:03 | 000,129,144 | ---- | M] (RealPlayer) -- C:\Program Files (x86)\mozilla firefox\plugins\nprpplugin.dll
[2011.06.09 13:41:48 | 000,081,920 | ---- | M] (vShare.tv ) -- C:\Program Files (x86)\mozilla firefox\plugins\npvsharetvplg.dll
[2012.06.18 10:20:57 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.06.18 10:20:57 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.06.18 10:20:57 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.18 10:20:57 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.18 10:20:57 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.18 10:20:57 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - homepage: hxxp://smartbar.linkury.com/
CHR - default_search_provider: Linkury Smartbar Search (Enabled)
CHR - default_search_provider: search_url = hxxp://search-us.linkury.com/results.htm?cx=partner-pub-7890126930977991:5731629158&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
CHR - default_search_provider: suggest_url = 
CHR - homepage: hxxp://smartbar.linkury.com/
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.75\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.75\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.75\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\Joogi\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll
CHR - plugin: vShare.tv plug-in (Enabled) = C:\Users\Joogi\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpionmjnkbpcdpcflammlgllecmejgjj\1.3_0\chvsharetvplg.dll
CHR - plugin: vShare.tv plug-in (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npvsharetvplg.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: Java Deployment Toolkit 6.0.310.5 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U31 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: DivX Player Netscape Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll
CHR - plugin: Windows Genuine Advantage (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npLegitCheckPlugin.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll
CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit)  (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\nprpjplug.dll
CHR - plugin: RealPlayer(tm) HTML5VideoShim Plug-In (32-bit)  (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\nprjplug.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: DivX Plus Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\5.0.61118.0\npctrl.dll
CHR - plugin: Veetle TV Player (Enabled) = C:\Program Files (x86)\Veetle\Player\npvlc.dll
CHR - plugin: Veetle TV Core (Enabled) = C:\Program Files (x86)\Veetle\plugins\npVeetle.dll
CHR - plugin: VLC Multimedia Plug-in (Enabled) = C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll
CHR - plugin: RealNetworks(tm) Chrome Background Extension Plug-In (32-bit)  (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
CHR - plugin: Unity Player (Enabled) = C:\Users\Joogi\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
CHR - plugin: Facebook Plugin (Enabled) = C:\Users\Joogi\AppData\Roaming\Facebook\npfbplugin_1_0_1.dll
CHR - plugin: Facebook Plugin (Enabled) = C:\Users\Joogi\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll
CHR - Extension: Avira Toolbar = C:\Users\Joogi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaangaohdajkgeopjhpbnlpkehbhmbj\7.15.4.24169_0\
CHR - Extension: YouTube = C:\Users\Joogi\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\Joogi\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\Joogi\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
CHR - Extension: vshare plugin = C:\Users\Joogi\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpionmjnkbpcdpcflammlgllecmejgjj\1.3_0\
CHR - Extension: Mehr Leistung und Videoformate f\u00FCr dein HTML5 \u003Cvideo\u003E = C:\Users\Joogi\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\
CHR - Extension: Google Mail = C:\Users\Joogi\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2010\x64\ievkbd.dll (Kaspersky Lab)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2010\x64\klwtbbho.dll (Kaspersky Lab)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll (Kaspersky Lab)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O4:64bit: - HKLM..\Run: [itype] C:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD)
O4 - HKLM..\Run: [ANIWZCS2Service] C:\Program Files (x86)\ANI\ANIWZCS2 Service\WZCSLDR2.exe (Wireless Service)
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [AVP] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab)
O4 - HKLM..\Run: [D-Link D-Link Wireless G DWL-G122_DWA-110] C:\Program Files (x86)\D-Link\DWL-G122_DWA-110\AirGCFG.exe (D-Link Corp.)
O4 - HKLM..\Run: [InstaLAN] C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe (Affinegy, Inc.)
O4 - HKLM..\Run: [LWS] C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files (x86)\Winamp\winampa.exe ()
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3175316596-3364050726-2863681098-1000..\Run: [AlcoholAutomount] C:\Program Files (x86)\Alcohol Soft\Alcohol 120\axcmd.exe (Alcohol Soft Development Team)
O4 - HKU\S-1-5-21-3175316596-3364050726-2863681098-1000..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware  (cleanup)] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll (Malwarebytes Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Joogi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explorer.lnk =  File not found
O4 - Startup: C:\Users\Joogi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurboLaunch.lnk = C:\Program Files (x86)\TurboLaunch\TurboLaunch.exe (Savard Software)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm ()
O8 - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm ()
O9:64bit: - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2010\x64\klwtbbho.dll (Kaspersky Lab)
O9:64bit: - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2010\x64\klwtbbho.dll (Kaspersky Lab)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000019 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.4.26.0.cab (SysInfo Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{08D21C52-59F4-4FC5-B9AA-86FAD71E9116}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5C584CCC-2D7C-4E63-B1B4-4273465C208A}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8E7F797B-83CD-49BF-B6E3-77F8ECA8820D}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~1\x64\sbhook64.dll) - C:\PROGRA~2\KASPER~1\KASPER~1\x64\sbhook64.dll (Kaspersky Lab)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~1\x64\kloehk.dll) - C:\PROGRA~2\KASPER~1\KASPER~1\x64\kloehk.dll (Kaspersky Lab)
O20 - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~1\mzvkbd3.dll) - C:\PROGRA~2\KASPER~1\KASPER~1\mzvkbd3.dll (Kaspersky Lab)
O20 - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~1\sbhook.dll) - C:\PROGRA~2\KASPER~1\KASPER~1\sbhook.dll (Kaspersky Lab)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20:64bit: - Winlogon\Notify\klogon: DllName - (%SystemRoot%\System32\klogon.dll) - C:\Windows\SysNative\klogon.dll (Kaspersky Lab)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.12.07 14:05:05 | 000,000,045 | R--- | M] () - I:\autorun.inf -- [ UDF ]
O33 - MountPoints2\{2c6b9fe8-fe6b-11de-817a-00251123cbab}\Shell - "" = AutoRun
O33 - MountPoints2\{2c6b9fe8-fe6b-11de-817a-00251123cbab}\Shell\AutoRun\command - "" = I:\launcher.exe -- [2007.01.11 13:08:10 | 001,847,296 | R--- | M] ()
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.16 03:05:48 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012.08.16 03:05:48 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012.08.16 03:05:46 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012.08.16 03:05:46 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012.08.16 03:05:45 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012.08.16 03:05:45 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012.08.16 03:05:45 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2012.08.16 03:05:45 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2012.08.16 03:05:44 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2012.08.16 03:05:44 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2012.08.16 03:05:44 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012.08.16 03:05:43 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2012.08.16 03:05:43 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012.08.15 17:51:18 | 000,503,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\srcore.dll
[2012.08.15 17:51:12 | 000,751,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll
[2012.08.15 17:51:11 | 000,492,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\win32spl.dll
[2012.08.15 17:51:11 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\splwow64.exe
[2012.08.15 17:51:08 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netapi32.dll
[2012.08.15 17:51:08 | 000,059,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\browcli.dll
[2012.08.15 17:51:08 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\browcli.dll
[2012.08.15 17:51:01 | 000,956,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\localspl.dll
[2012.08.14 21:16:22 | 000,000,000 | ---D | C] -- C:\Users\Joogi\AppData\Roaming\Malwarebytes
[2012.08.14 21:16:13 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.08.14 21:16:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.08.14 21:16:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.08.14 21:16:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.14 21:14:54 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Users\Joogi\Desktop\OTL.exe
[2012.08.14 21:14:32 | 010,063,000 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\Joogi\Desktop\mbam-setup.exe
[2012.08.14 13:34:20 | 000,000,000 | ---D | C] -- C:\Users\Joogi\Desktop\Keyfinder 2.0.8
[2012.08.14 13:04:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012.08.14 13:04:00 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012.08.14 12:58:53 | 003,907,920 | ---- | C] (Piriform Ltd) -- C:\Users\Joogi\Desktop\ccsetup321.exe
[2012.08.14 12:45:43 | 009,789,544 | ---- | C] (McAfee Inc.) -- C:\Users\Joogi\Desktop\stinger1020736.exe
[2012.08.13 20:53:04 | 000,000,000 | ---D | C] -- C:\ProgramData\B25ABAF43E6A67
[2012.08.13 20:52:42 | 000,000,000 | ---D | C] -- C:\ProgramData\B25ABAF43E1239
[2012.08.12 17:15:40 | 000,000,000 | ---D | C] -- C:\Users\Joogi\AppData\Roaming\Myoxu
[2012.08.12 17:15:40 | 000,000,000 | ---D | C] -- C:\Users\Joogi\AppData\Roaming\Geirvo
[2012.08.12 17:15:40 | 000,000,000 | ---D | C] -- C:\Users\Joogi\AppData\Roaming\Ekych
[2012.07.30 16:58:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CAPCOM
[2010.09.24 17:46:45 | 000,148,736 | ---- | C] (Avanquest Software) -- C:\ProgramData\hpe3E3A.dll
 
========== Files - Modified Within 30 Days ==========
 
[2012.08.16 10:03:04 | 000,003,284 | ---- | M] () -- C:\Windows\SysWow64\ANIWZCS{8E7F797B-83CD-49BF-B6E3-77F8ECA8820D}
[2012.08.16 10:03:04 | 000,003,284 | ---- | M] () -- C:\Users\Joogi\AppData\Roaming\ANIWZCS{8E7F797B-83CD-49BF-B6E3-77F8ECA8820D}
[2012.08.16 10:02:25 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.08.16 03:33:16 | 000,016,272 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.16 03:33:16 | 000,016,272 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.16 03:25:47 | 000,421,928 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.08.16 03:25:36 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.16 03:24:56 | 3220,676,608 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.16 03:23:48 | 000,058,972 | -H-- | M] () -- C:\Users\Joogi\AppData\Roaming\TurboLaunch_IconCache.dat
[2012.08.14 22:11:02 | 000,058,786 | ---- | M] () -- C:\Users\Joogi\Desktop\1.jpg
[2012.08.14 21:17:00 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.14 21:14:56 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Joogi\Desktop\OTL.exe
[2012.08.14 21:14:35 | 010,063,000 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\Joogi\Desktop\mbam-setup.exe
[2012.08.14 20:28:26 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.08.14 19:49:53 | 000,000,039 | RH-- | M] () -- C:\Users\Joogi\Desktop\stinger1020736.opt
[2012.08.14 13:48:55 | 000,016,200 | ---- | M] (McAfee, Inc.) -- C:\Windows\stinger.sys
[2012.08.14 13:22:49 | 000,082,626 | ---- | M] () -- C:\Users\Joogi\Documents\cc_20120814_132233.reg
[2012.08.14 13:08:50 | 000,381,689 | ---- | M] () -- C:\Users\Joogi\Desktop\Keyfinder_2.0.8.zip
[2012.08.14 13:04:02 | 000,000,822 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.08.14 13:00:32 | 003,907,920 | ---- | M] (Piriform Ltd) -- C:\Users\Joogi\Desktop\ccsetup321.exe
[2012.08.14 12:46:13 | 009,789,544 | ---- | M] (McAfee Inc.) -- C:\Users\Joogi\Desktop\stinger1020736.exe
[2012.08.14 12:45:09 | 000,000,047 | RH-- | M] () -- C:\Users\Joogi\Desktop\stinger684.opt
[2012.08.13 20:53:05 | 000,000,806 | ---- | M] () -- C:\Users\Joogi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explorer.lnk
[2012.08.13 13:01:02 | 000,002,028 | ---- | M] () -- C:\Users\Joogi\.swfinfo
[2012.08.01 18:34:34 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.08.01 18:34:34 | 000,654,150 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.08.01 18:34:34 | 000,616,032 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.08.01 18:34:34 | 000,130,022 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.08.01 18:34:34 | 000,106,412 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.07.30 17:07:57 | 000,000,671 | ---- | M] () -- C:\Users\Joogi\Desktop\Biohazard 4 Mouse Aim.lnk
[2012.07.30 15:56:37 | 000,062,157 | ---- | M] () -- C:\Users\Joogi\Desktop\MouseAim200.zip
[2012.07.30 13:53:05 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_xusb21_01007.Wdf
 
========== Files Created - No Company Name ==========
 
[2012.08.14 22:11:02 | 000,058,786 | ---- | C] () -- C:\Users\Joogi\Desktop\1.jpg
[2012.08.14 21:16:14 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.14 19:49:53 | 000,000,039 | RH-- | C] () -- C:\Users\Joogi\Desktop\stinger1020736.opt
[2012.08.14 13:22:37 | 000,082,626 | ---- | C] () -- C:\Users\Joogi\Documents\cc_20120814_132233.reg
[2012.08.14 13:08:09 | 000,381,689 | ---- | C] () -- C:\Users\Joogi\Desktop\Keyfinder_2.0.8.zip
[2012.08.14 13:04:02 | 000,000,822 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.08.13 20:52:42 | 000,000,806 | ---- | C] () -- C:\Users\Joogi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explorer.lnk
[2012.07.30 16:54:48 | 000,000,671 | ---- | C] () -- C:\Users\Joogi\Desktop\Biohazard 4 Mouse Aim.lnk
[2012.07.30 15:56:36 | 000,062,157 | ---- | C] () -- C:\Users\Joogi\Desktop\MouseAim200.zip
[2012.07.30 13:53:05 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_xusb21_01007.Wdf
[2012.02.29 22:47:36 | 000,002,028 | ---- | C] () -- C:\Users\Joogi\.swfinfo
[2012.01.18 07:44:00 | 010,920,984 | ---- | C] () -- C:\Windows\SysWow64\LogiDPP.dll
[2012.01.18 07:44:00 | 000,336,408 | ---- | C] () -- C:\Windows\SysWow64\DevManagerCore.dll
[2012.01.18 07:44:00 | 000,104,472 | ---- | C] () -- C:\Windows\SysWow64\LogiDPPApp.exe
[2012.01.11 20:39:40 | 000,002,048 | -HS- | C] () -- C:\Users\Joogi\AppData\Local\{9d7d76a5-668a-14b4-e7f3-6c6139cf80da}\@
[2011.10.01 19:44:34 | 000,000,533 | ---- | C] () -- C:\Windows\eReg.dat
[2011.09.16 11:54:44 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2011.09.16 11:54:44 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2011.09.16 11:54:44 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2011.09.16 11:54:44 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2011.08.13 06:31:22 | 000,000,000 | ---- | C] () -- C:\Users\Joogi\AppData\Local\{963B92CB-1E27-4C95-A1CA-BE562BF9AEAB}
[2011.07.04 05:39:41 | 000,280,736 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011.07.04 05:39:40 | 002,434,856 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_bc2.exe
[2011.07.04 05:39:40 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2011.06.20 03:15:36 | 000,007,590 | ---- | C] () -- C:\Users\Joogi\AppData\Local\Resmon.ResmonCfg
[2011.06.18 21:57:59 | 000,000,295 | ---- | C] () -- C:\Windows\game.ini
[2011.03.23 23:49:08 | 000,000,258 | ---- | C] () -- C:\Users\Joogi\AppData\Roaming\ANICONFIG_{8E7F797B-83CD-49BF-B6E3-77F8ECA8820D}.ini
[2011.03.23 23:42:49 | 000,003,284 | ---- | C] () -- C:\Users\Joogi\AppData\Roaming\ANIWZCS{8E7F797B-83CD-49BF-B6E3-77F8ECA8820D}
[2011.03.22 18:35:50 | 000,151,552 | ---- | C] () -- C:\Windows\SysWow64\ANIWConnService.exe
[2011.03.22 18:35:39 | 000,258,048 | ---- | C] () -- C:\Windows\SysWow64\wlanapp.dll
[2011.03.22 18:35:39 | 000,217,088 | ---- | C] () -- C:\Windows\SysWow64\aIPH.dll
[2011.03.22 18:35:39 | 000,049,152 | ---- | C] () -- C:\Windows\SysWow64\AQCKGen.dll
[2011.03.22 18:35:39 | 000,045,115 | ---- | C] () -- C:\Windows\SysWow64\ANICtl.dll
[2011.03.22 18:35:20 | 000,315,392 | ---- | C] () -- C:\Windows\SysWow64\ANIOApi.dll
[2011.03.22 18:34:51 | 000,302,080 | ---- | C] () -- C:\Windows\lwd.exe
[2011.03.22 18:34:50 | 000,733,184 | ---- | C] () -- C:\Windows\SysWow64\ANIOWPS.dll
[2011.03.22 18:34:50 | 000,237,568 | ---- | C] () -- C:\Windows\SysWow64\ANIWPS.exe
[2011.03.22 18:33:28 | 000,002,048 | ---- | C] () -- C:\Windows\SysWow64\rt73.bin
[2011.03.21 19:56:22 | 000,059,904 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll
[2011.01.13 05:03:18 | 000,003,155 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2010.07.04 01:45:25 | 000,003,584 | ---- | C] () -- C:\Users\Joogi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.06.08 18:05:29 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.04.20 21:09:16 | 000,000,091 | ---- | C] () -- C:\Users\Joogi\AppData\Local\timzg.bat
[2010.03.20 17:05:23 | 000,000,088 | ---- | C] () -- C:\Users\Joogi\AppData\Local\sotqurw.bat
[2009.12.14 23:28:30 | 000,058,972 | -H-- | C] () -- C:\Users\Joogi\AppData\Roaming\TurboLaunch_IconCache.dat
 
========== LOP Check ==========
 
[2012.06.22 12:29:46 | 000,000,000 | ---D | M] -- C:\Users\Joogi\AppData\Roaming\BitZipper
[2012.08.14 13:11:43 | 000,000,000 | ---D | M] -- C:\Users\Joogi\AppData\Roaming\DAEMON Tools Lite
[2012.07.09 17:56:26 | 000,000,000 | ---D | M] -- C:\Users\Joogi\AppData\Roaming\DVDVideoSoft
[2012.08.12 17:15:40 | 000,000,000 | ---D | M] -- C:\Users\Joogi\AppData\Roaming\Ekych
[2010.04.11 18:17:42 | 000,000,000 | ---D | M] -- C:\Users\Joogi\AppData\Roaming\Facebook
[2011.06.09 22:52:09 | 000,000,000 | ---D | M] -- C:\Users\Joogi\AppData\Roaming\FMZilla
[2011.10.05 17:41:41 | 000,000,000 | ---D | M] -- C:\Users\Joogi\AppData\Roaming\Free MP3 WMA OGG Converter
[2012.08.15 07:08:42 | 000,000,000 | ---D | M] -- C:\Users\Joogi\AppData\Roaming\Geirvo
[2012.01.29 21:00:25 | 000,000,000 | ---D | M] -- C:\Users\Joogi\AppData\Roaming\ICQ
[2010.07.04 01:33:32 | 000,000,000 | ---D | M] -- C:\Users\Joogi\AppData\Roaming\IrfanView
[2012.02.23 19:28:42 | 000,000,000 | ---D | M] -- C:\Users\Joogi\AppData\Roaming\Leadertech
[2011.08.02 02:58:01 | 000,000,000 | ---D | M] -- C:\Users\Joogi\AppData\Roaming\LucasArts
[2012.08.13 21:09:28 | 000,000,000 | ---D | M] -- C:\Users\Joogi\AppData\Roaming\Myoxu
[2012.07.09 17:51:26 | 000,000,000 | ---D | M] -- C:\Users\Joogi\AppData\Roaming\OpenCandy
[2010.03.21 18:42:57 | 000,000,000 | ---D | M] -- C:\Users\Joogi\AppData\Roaming\Opera
[2011.10.06 16:01:09 | 000,000,000 | ---D | M] -- C:\Users\Joogi\AppData\Roaming\Samsung
[2012.02.29 22:25:03 | 000,000,000 | ---D | M] -- C:\Users\Joogi\AppData\Roaming\SimpleTV V03
[2011.03.14 23:42:31 | 000,000,000 | ---D | M] -- C:\Users\Joogi\AppData\Roaming\TIPP10
[2012.07.09 17:52:14 | 000,000,000 | ---D | M] -- C:\Users\Joogi\AppData\Roaming\TuneUp Software
[2010.09.25 22:56:26 | 000,000,000 | ---D | M] -- C:\Users\Joogi\AppData\Roaming\Usenet.nl
[2010.09.09 20:15:44 | 000,000,000 | ---D | M] -- C:\Users\Joogi\AppData\Roaming\Verimount
[2012.08.14 20:55:41 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >

cosinus · 16.08.2012, 14:17

Code:

ATTFilter

F:\Programme Robbi\Brennen\Nero.7.Premium.Reloaded.7.9.6.0-deu.incl\Nero.7.Premium.Reloaded.7.9.6.0-deu.incl\keygen\nero 7 new keygen.exe (RiskWare.Tool.HCK) -> Erfolgreich gelöscht und in Quarantäne gestellt.
F:\Programme Robbi\Sonstiges\O & O Programme\O&O Komplettpaket 10in1\O&O CleverCache 6.1.2332 [German]\O&O CleverCache 6 Keygen.exe (Riskware.Tool.CK) -> Erfolgreich gelöscht und in Quarantäne gestellt.
F:\Programme Robbi\Sonstiges\O & O Programme\O&O Komplettpaket 10in1\O&O Defrag 10.0.1634 [German]\O&O Defrag 10.0.1634 Userkey.exe (Riskware.Tool.CK) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Teido · 16.08.2012, 22:12

Oh das habe ich schon eine gefühlte ewigkeit auf der Platte und nie benutzt. Ist gelöscht

t'john · 17.08.2012, 00:54

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
Starte die OTL.exe.
Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:

Code:

ATTFilter

:OTL
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC 
IE - HKLM\..\URLSearchHook: - No CLSID value found 
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ) 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC 
IE - HKLM\..\SearchScopes\{57980D16-2A2F-4D97-A71C-3BBD8C2E5206}: "URL" = http://startsear.ch/?aff=1&q={searchTerms} 
IE - HKU\.DEFAULT\..\URLSearchHook: - No CLSID value found 
IE - HKU\.DEFAULT\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ) 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\S-1-5-18\..\URLSearchHook: - No CLSID value found 
IE - HKU\S-1-5-18\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ) 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://search-us.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com 
IE - HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://search-us.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com 
IE - HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://search-us.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com 
IE - HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://search-us.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com 
IE - HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\..\URLSearchHook: {f999a48b-1950-4d81-9971-79018f807b4b} - No CLSID value found 
IE - HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\..\SearchScopes,DefaultScope = {57980D16-2A2F-4D97-A71C-3BBD8C2E5206} 
IE - HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://search-us.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com 
IE - HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC 
IE - HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\..\SearchScopes\{57980D16-2A2F-4D97-A71C-3BBD8C2E5206}: "URL" = http://startsear.ch/?aff=1&q={searchTerms} 
IE - HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = http://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd 
IE - HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\..\SearchScopes\{74486B74-9434-4B1E-87CC-D2999F8D76F0}: "URL" = http://www.google.de/search?q={searchTerms} 
IE - HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 
FF - prefs.js..browser.search.defaultengine: "Ask.com" 
FF - prefs.js..browser.search.defaultenginename: "Ask.com" 
FF - prefs.js..browser.search.order.1: "Ask.com" 
FF - prefs.js..browser.search.useDBForOrder: true 
FF - prefs.js..browser.startup.homepage: "http://www.google.de/ig" 
FF - prefs.js..keyword.URL: "http://websearch.ask.com/redirect?client=ff&src=kw&tb=AVR-3&o=APN10396&locale=de_CH&apn_uid=5c395e72-3a06-4158-8ddb-47f1834fe7a5&apn_ptnrs=%5EABU&apn_sauid=06E86C6A-1828-49A9-99D6-C1CDD5C0B18E&apn_dtid=%5EYYYYYY%5EYY%5ECH&&q=" 
FF - prefs.js..network.proxy.http: "85.25.160.126" 
FF - prefs.js..network.proxy.http_port: 8080 
FF - prefs.js..network.proxy.type: 4 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_235.dll File not found 
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found 
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll File not found 
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found 
CHR - default_search_provider: search_url = http://search-us.linkury.com/results.htm?cx=partner-pub-7890126930977991:5731629158&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com 
O2 - BHO: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) 
O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) 
O4 - HKLM..\Run: [] File not found 
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask) 
O4 - HKLM..\Run: [WinampAgent] C:\Program Files (x86)\Winamp\winampa.exe () 
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found 
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found 
O4 - Startup: C:\Users\Joogi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explorer.lnk = File not found 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) 
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) 
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) 
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) 
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 
O32 - HKLM CDRom: AutoRun - 1 
O32 - AutoRun File - [2006.12.07 14:05:05 | 000,000,045 | R--- | M] () - I:\autorun.inf -- [ UDF ] 
O33 - MountPoints2\{2c6b9fe8-fe6b-11de-817a-00251123cbab}\Shell - "" = AutoRun 
O33 - MountPoints2\{2c6b9fe8-fe6b-11de-817a-00251123cbab}\Shell\AutoRun\command - "" = I:\launcher.exe -- [2007.01.11 13:08:10 | 001,847,296 | R--- | M] () 
[2012.08.13 20:53:04 | 000,000,000 | ---D | C] -- C:\ProgramData\B25ABAF43E6A67 
[2012.08.13 20:52:42 | 000,000,000 | ---D | C] -- C:\ProgramData\B25ABAF43E1239 
[2012.08.16 10:03:04 | 000,003,284 | ---- | M] () -- C:\Windows\SysWow64\ANIWZCS{8E7F797B-83CD-49BF-B6E3-77F8ECA8820D} 
[2010.04.20 21:09:16 | 000,000,091 | ---- | C] () -- C:\Users\Joogi\AppData\Local\timzg.bat 
[2010.03.20 17:05:23 | 000,000,088 | ---- | C] () -- C:\Users\Joogi\AppData\Local\sotqurw.bat 
[2012.08.16 10:03:04 | 000,003,284 | ---- | M] () -- C:\Users\Joogi\AppData\Roaming\ANIWZCS{8E7F797B-83CD-49BF-B6E3-77F8ECA8820D} 
[2012.08.16 10:02:25 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job 
[2012.08.14 20:28:26 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job 
[2012.01.11 20:39:40 | 000,002,048 | -HS- | C] () -- C:\Users\Joogi\AppData\Local\{9d7d76a5-668a-14b4-e7f3-6c6139cf80da}\@ 
 
:Files

ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]

Schließe alle Programme.
Klicke auf den Fix Button.
Wenn OTL einen Neustart verlangt, bitte zulassen.
Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

Teido · 17.08.2012, 14:21

Code:

ATTFilter

All processes killed
========== OTL ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{855F3B16-6D32-4fe6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ deleted successfully.
C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll moved successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{57980D16-2A2F-4D97-A71C-3BBD8C2E5206}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{57980D16-2A2F-4D97-A71C-3BBD8C2E5206}\ not found.
Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\URLSearchHooks\\{855F3B16-6D32-4fe6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ not found.
File C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll not found.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\URLSearchHooks\\ not found.
Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\URLSearchHooks\\{855F3B16-6D32-4fe6-8A56-BBB695989046} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ not found.
File C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll not found.
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Bar| /E : value set successfully!
HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Page| /E : value set successfully!
HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\SOFTWARE\Microsoft\Internet Explorer\Search\\Default_Search_URL| /E : value set successfully!
HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\SOFTWARE\Microsoft\Internet Explorer\Search\\SearchAssistant| /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-3175316596-3364050726-2863681098-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{f999a48b-1950-4d81-9971-79018f807b4b} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f999a48b-1950-4d81-9971-79018f807b4b}\ not found.
HKEY_USERS\S-1-5-21-3175316596-3364050726-2863681098-1000\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-3175316596-3364050726-2863681098-1000\Software\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\ not found.
Registry key HKEY_USERS\S-1-5-21-3175316596-3364050726-2863681098-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_USERS\S-1-5-21-3175316596-3364050726-2863681098-1000\Software\Microsoft\Internet Explorer\SearchScopes\{57980D16-2A2F-4D97-A71C-3BBD8C2E5206}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{57980D16-2A2F-4D97-A71C-3BBD8C2E5206}\ not found.
Registry key HKEY_USERS\S-1-5-21-3175316596-3364050726-2863681098-1000\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ not found.
Registry key HKEY_USERS\S-1-5-21-3175316596-3364050726-2863681098-1000\Software\Microsoft\Internet Explorer\SearchScopes\{74486B74-9434-4B1E-87CC-D2999F8D76F0}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{74486B74-9434-4B1E-87CC-D2999F8D76F0}\ not found.
HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-21-3175316596-3364050726-2863681098-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
Prefs.js: "Ask.com" removed from browser.search.defaultengine
Prefs.js: "Ask.com" removed from browser.search.defaultenginename
Prefs.js: "Ask.com" removed from browser.search.order.1
Prefs.js: true removed from browser.search.useDBForOrder
Prefs.js: "hxxp://www.google.de/ig" removed from browser.startup.homepage
Prefs.js: "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=AVR-3&o=APN10396&locale=de_CH&apn_uid=5c395e72-3a06-4158-8ddb-47f1834fe7a5&apn_ptnrs=%5EABU&apn_sauid=06E86C6A-1828-49A9-99D6-C1CDD5C0B18E&apn_dtid=%5EYYYYYY%5EYY%5ECH&&q=" removed from keyword.URL
Prefs.js: "85.25.160.126" removed from network.proxy.http
Prefs.js: 8080 removed from network.proxy.http_port
Prefs.js: 4 removed from network.proxy.type
64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@adobe.com/FlashPlayer\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@microsoft.com/GENUINE\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@microsoft.com/GENUINE\ deleted successfully.
Use Chrome's Settings page to remove the default_search_provider items.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ApnUpdater deleted successfully.
C:\Program Files (x86)\Ask.com\Updater\Updater.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\WinampAgent deleted successfully.
C:\Program Files (x86)\Winamp\winampa.exe moved successfully.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
C:\Users\Joogi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explorer.lnk moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
C:\Windows\Downloaded Program Files\gp.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
File move failed. I:\autorun.inf scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2c6b9fe8-fe6b-11de-817a-00251123cbab}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2c6b9fe8-fe6b-11de-817a-00251123cbab}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2c6b9fe8-fe6b-11de-817a-00251123cbab}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2c6b9fe8-fe6b-11de-817a-00251123cbab}\ not found.
File move failed. I:\launcher.exe scheduled to be moved on reboot.
C:\ProgramData\B25ABAF43E6A67 folder moved successfully.
C:\ProgramData\B25ABAF43E1239 folder moved successfully.
C:\Windows\SysWOW64\ANIWZCS{8E7F797B-83CD-49BF-B6E3-77F8ECA8820D} moved successfully.
C:\Users\Joogi\AppData\Local\timzg.bat moved successfully.
C:\Users\Joogi\AppData\Local\sotqurw.bat moved successfully.
C:\Users\Joogi\AppData\Roaming\ANIWZCS{8E7F797B-83CD-49BF-B6E3-77F8ECA8820D} moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job moved successfully.
C:\Users\Joogi\AppData\Local\{9d7d76a5-668a-14b4-e7f3-6c6139cf80da}\@ moved successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\Joogi\Desktop\cmd.bat deleted successfully.
C:\Users\Joogi\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 389192 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Joogi
->Temp folder emptied: 4444527 bytes
->Temporary Internet Files folder emptied: 15405033 bytes
->Java cache emptied: 56483779 bytes
->FireFox cache emptied: 492866836 bytes
->Google Chrome cache emptied: 115102204 bytes
->Opera cache emptied: 662391 bytes
->Flash cache emptied: 1429 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 585339 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 85163 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 654,00 mb
 
 
OTL by OldTimer - Version 3.2.57.0 log created on 08172012_145235

Files\Folders moved on Reboot...
File\Folder I:\autorun.inf not found!
File\Folder I:\launcher.exe not found!
C:\Users\Joogi\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WI9JYZTB\01[1].jpg moved successfully.
C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WI9JYZTB\04[1].jpg moved successfully.
C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WI9JYZTB\04[2].jpg moved successfully.
C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WI9JYZTB\05[1].jpg moved successfully.
C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WI9JYZTB\09[1].jpg moved successfully.
C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PN3DV3V0\01[1].jpg moved successfully.
C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PN3DV3V0\01[2].jpg moved successfully.
C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PN3DV3V0\01[3].jpg moved successfully.
C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PN3DV3V0\04[1].jpg moved successfully.
C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PN3DV3V0\08[1].jpg moved successfully.
C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I3DDW5U2\02[1].jpg moved successfully.
C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I3DDW5U2\05[1].jpg moved successfully.
C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I3DDW5U2\13[1].jpg moved successfully.
C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I3DDW5U2\37[1].jpg moved successfully.
C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I3DDW5U2\48[1].jpg moved successfully.
C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0JEHMLCQ\02[1].jpg moved successfully.
C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0JEHMLCQ\03[1].jpg moved successfully.
C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0JEHMLCQ\04[1].jpg moved successfully.
C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0JEHMLCQ\04[2].jpg moved successfully.
C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0JEHMLCQ\19[1].jpg moved successfully.

PendingFileRenameOperations files...
File I:\autorun.inf not found!
File I:\launcher.exe not found!
File C:\Users\Joogi\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!
File C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WI9JYZTB\01[1].jpg not found!
File C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WI9JYZTB\04[1].jpg not found!
File C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WI9JYZTB\04[2].jpg not found!
File C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WI9JYZTB\05[1].jpg not found!
File C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WI9JYZTB\09[1].jpg not found!
File C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PN3DV3V0\01[1].jpg not found!
File C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PN3DV3V0\01[2].jpg not found!
File C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PN3DV3V0\01[3].jpg not found!
File C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PN3DV3V0\04[1].jpg not found!
File C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PN3DV3V0\08[1].jpg not found!
File C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I3DDW5U2\02[1].jpg not found!
File C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I3DDW5U2\05[1].jpg not found!
File C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I3DDW5U2\13[1].jpg not found!
File C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I3DDW5U2\37[1].jpg not found!
File C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I3DDW5U2\48[1].jpg not found!
File C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0JEHMLCQ\02[1].jpg not found!
File C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0JEHMLCQ\03[1].jpg not found!
File C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0JEHMLCQ\04[1].jpg not found!
File C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0JEHMLCQ\04[2].jpg not found!
File C:\Users\Joogi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0JEHMLCQ\19[1].jpg not found!

Registry entries deleted on Reboot...

t'john · 17.08.2012, 14:59

Sehr gut!

Wie laeuft der Rechner?

1. Schritt

Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktualisiere die Datenbank!
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".

danach:

2. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Search.
Nach Ende des Suchlaufs öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

Teido · 18.08.2012, 06:38

Top! Rechner läuft wieder wie vorher

Malwarebytes

Code:

ATTFilter

 Malwarebytes Anti-Malware  (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.17.08

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
*** :: *** [Administrator]

Schutz: Aktiviert

17.08.2012 23:51:20
mbam-log-2012-08-17 (23-51-20).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|F:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 506262
Laufzeit: 2 Stunde(n), 18 Minute(n), 11 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

AdwCleaner

Code:

ATTFilter

# AdwCleaner v1.801 - Logfile created 08/18/2012 at 07:16:45
# Updated 14/08/2012 by Xplode
# Operating system : Windows 7 Professional Service Pack 1 (64 bits)
# User : ***- ***
# Boot Mode : Normal
# Running from : C:\Users\Joogi\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****

Folder Found : C:\Users\Joogi\AppData\Local\APN
Folder Found : C:\Users\Joogi\AppData\Local\Conduit
Folder Found : C:\Users\Joogi\AppData\Local\OpenCandy
Folder Found : C:\Users\Joogi\AppData\LocalLow\AskToolbar
Folder Found : C:\Users\Joogi\AppData\LocalLow\boost_interprocess
Folder Found : C:\Users\Joogi\AppData\LocalLow\Conduit
Folder Found : C:\Users\Joogi\AppData\Roaming\OpenCandy
Folder Found : C:\Users\Joogi\AppData\Roaming\Mozilla\Firefox\Profiles\vj4xjtr1.default\Conduit
Folder Found : C:\Users\Joogi\AppData\Roaming\Mozilla\Firefox\Profiles\vj4xjtr1.default\ConduitCommon
Folder Found : C:\Program Files (x86)\Ask.com
Folder Found : C:\Program Files (x86)\vShare.tv plugin
Folder Found : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
File Found : C:\Program Files (x86)\Mozilla Firefox\Plugins\npvsharetvplg.dll

***** [Registry] *****

Key Found : HKCU\Software\APN
Key Found : HKCU\Software\Ask.com.tmp
Key Found : HKCU\Software\Conduit
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Found : HKCU\Software\Softonic
Key Found : HKCU\Software\StartSearch
Key Found : HKLM\SOFTWARE\APN
Key Found : HKLM\SOFTWARE\AskToolbar
Key Found : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Key Found : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Key Found : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Found : HKLM\SOFTWARE\Classes\LinkurySmartBar.DockingPanel
Key Found : HKLM\SOFTWARE\Classes\LinkurySmartBar.LinkurySmartBar
Key Found : HKLM\SOFTWARE\Conduit
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
[x64] Key Found : HKCU\Software\APN
[x64] Key Found : HKCU\Software\Ask.com.tmp
[x64] Key Found : HKCU\Software\Conduit
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
[x64] Key Found : HKCU\Software\Softonic
[x64] Key Found : HKCU\Software\StartSearch
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
[x64] Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
[x64] Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
[x64] Key Found : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
[x64] Key Found : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
[x64] Key Found : HKLM\SOFTWARE\Classes\LinkurySmartBar.DockingPanel
[x64] Key Found : HKLM\SOFTWARE\Classes\LinkurySmartBar.LinkurySmartBar
[x64] Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF

***** [Registre - GUID] *****

Key Found : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{A1B48071-416D-474E-A13B-BE5456E7FC31}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Found : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Key Found : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Key Found : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{79D60450-56C5-4A8C-9321-6D5BC2A81E5A}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{99C22A61-21BA-4F81-85FF-CDC9EB5DB10B}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A1B48071-416D-474E-A13B-BE5456E7FC31}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A1B48071-416D-474E-A13B-BE5456E7FC31}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
[x64] Key Found : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{3D782BB2-F2A5-11D3-BF4C-000000000000}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{79D60450-56C5-4A8C-9321-6D5BC2A81E5A}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{99C22A61-21BA-4F81-85FF-CDC9EB5DB10B}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A1B48071-416D-474E-A13B-BE5456E7FC31}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
[x64] Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Mozilla Firefox v14.0.1 (de)

Profile name : default 
File : C:\Users\Joogi\AppData\Roaming\Mozilla\Firefox\Profiles\vj4xjtr1.default\prefs.js

Found : user_pref("CT2438727.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);
Found : user_pref("CT2438727.DSInstall", false);
Found : user_pref("CT2438727.DialogsAlignMode", "LTR");
Found : user_pref("CT2438727.DialogsGetterLastCheckTime", "Wed Apr 18 2012 10:22:12 GMT+0200");
Found : user_pref("CT2438727.FirstTimeFF3", true);
Found : user_pref("CT2438727.HPInstall", false);
Found : user_pref("CT2438727.HasUserGlobalKeys", true);
Found : user_pref("CT2438727.Initialize", true);
Found : user_pref("CT2438727.InitializeCommonPrefs", true);
Found : user_pref("CT2438727.InstalledDate", "Wed Apr 18 2012 11:24:16 GMT+0200");
Found : user_pref("CT2438727.IsGrouping", false);
Found : user_pref("CT2438727.IsInitSetupIni", true);
Found : user_pref("CT2438727.IsMulticommunity", false);
Found : user_pref("CT2438727.IsOpenThankYouPage", true);
Found : user_pref("CT2438727.IsOpenUninstallPage", true);
Found : user_pref("CT2438727.LanguagePackLastCheckTime", "Wed Apr 18 2012 10:22:18 GMT+0200");
Found : user_pref("CT2438727.Locale", "en");
Found : user_pref("CT2438727.MCDetectTooltipHeight", "83");
Found : user_pref("CT2438727.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Found : user_pref("CT2438727.MCDetectTooltipWidth", "295");
Found : user_pref("CT2438727.MyStuffEnabledAtInstallation", false);
Found : user_pref("CT2438727.SearchCaption", "Zynga Customized Web Search");
Found : user_pref("CT2438727.SearchFromAddressBarIsInit", true);
Found : user_pref("CT2438727.SendProtectorDataViaLogin", true);
Found : user_pref("CT2438727.ServiceMapLastCheckTime", "Wed Apr 18 2012 10:22:08 GMT+0200");
Found : user_pref("CT2438727.SettingsLastCheckTime", "Wed Apr 18 2012 10:22:09 GMT+0200");
Found : user_pref("CT2438727.SettingsLastUpdate", "1326723880");
Found : user_pref("CT2438727.TBHomePageUrl", "hxxp://search.conduit.com/?ctid=CT2438727&SearchSource=13");
Found : user_pref("CT2438727.ToolbarShrinkedFromSetup", false);
Found : user_pref("CT2438727.Uninstall", true);
Found : user_pref("CT2438727.alertChannelId", "832836");
Found : user_pref("CT2438727.initDone", true);
Found : user_pref("CT2438727.navigateToUrlOnSearch", false);
Found : user_pref("CT2438727.revertSettingsEnabled", true);
Found : user_pref("CT2438727.testingCtid", "");
Found : user_pref("CT2438727.toolbarAppMetaDataLastCheckTime", "Wed Apr 18 2012 10:22:12 GMT+0200");
Found : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT2438727/CT2438727[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2438727", [...]
Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2438727",[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"c46[...]
Found : user_pref("CommunityToolbar.ToolbarsList", "CT2438727");
Found : user_pref("CommunityToolbar.ToolbarsList4", "CT2438727");
Found : user_pref("CommunityToolbar.originalHomepage", "hxxp://www.google.de/");
Found : user_pref("CommunityToolbar.originalSearchEngine", "chrome://browser-region/locale/region.properties[...]
Found : user_pref("extensions.asktb.ff-original-keyword-url", "");

-\\ Google Chrome v21.0.1180.79

File : C:\Users\Joogi\AppData\Local\Google\Chrome\User Data\Default\Preferences

Found :       "homepage": "hxxp://smartbar.linkury.com/",
Found :       "icon_url": "hxxp://www.linkury.com/favicon.ico",
Found :       "keyword": "search.linkury.com",
Found :       "name": "Linkury Smartbar Search",
Found :       "search_url": "hxxp://search-us.linkury.com/results.htm?cx=partner-pub-7890126930977991:573162[...]
Found :                "scriptable_host": [ "*://*.ask.com/", "*://*.bagsbuy.com/*", "*://*.childrenschorus.[...]
Found :                   "matches": [ "*://*.google.com/*", "*://*.ask.com/", "*://*.bagsbuy.com/*", "*://*[...]
Found :                "update_url": "hxxp://apnmedia.ask.com/media/toolbar/supertoolbar/chrome/manifest.php[...]
Found :                "description": "vshare.tv plugin",
Found :                "name": "vshare plugin",
Found :                   "path": "chvsharetvplg.dll",
Found :                "update_url": "hxxp://autoupdate.chromewebtb.conduit-services.com/?productId=CT273765[...]
Found :    "homepage": "hxxp://smartbar.linkury.com/",
Found :          "name": "vShare.tv plug-in",
Found :          "path": "C:\\Users\\Joogi\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\[...]
Found :          "name": "vShare.tv plug-in",
Found :          "path": "C:\\Program Files (x86)\\Mozilla Firefox\\plugins\\npvsharetvplg.dll",
Found :          "name": "vShare.tv plug-in"
Found :          "path": "C:\\Users\\Joogi\\AppData\\LocalLow\\Unity\\WebPlayer\\loader\\npUnity3D32.dll",

-\\ Opera v9.64.10487.0

File : C:\Users\Joogi\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [12721 octets] - [18/08/2012 07:16:45]

########## EOF - C:\AdwCleaner[R1].txt - [12850 octets] ##########

t'john · 18.08.2012, 14:44

Sehr gut!

Schließe alle offenen Programme und Browser.
Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Delete.
Bestätige jeweils mit Ok.
Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

danach:

Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html

Teido · 22.08.2012, 19:53

Ohh... ich dachte mein letzter Beitrag wurde nicht gepostet und hatte hier nochmal alles aufgelistet. Die Hitze macht mich fertig ^^ Ich mach jetzt noch die anderen Schritte

t'john · 22.08.2012, 22:12

alles klar.

Teido · 22.08.2012, 22:58

adwcleaner

Code:

ATTFilter

# AdwCleaner v1.801 - Logfile created 08/22/2012 at 21:02:50
# Updated 14/08/2012 by Xplode
# Operating system : Windows 7 Professional Service Pack 1 (64 bits)
# User : ***- ***
# Boot Mode : Normal
# Running from : C:\Users\***\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Folder Deleted : C:\Users\***\AppData\Local\APN
Folder Deleted : C:\Users\***\AppData\Local\Conduit
Folder Deleted : C:\Users\***\AppData\Local\OpenCandy
Folder Deleted : C:\Users\***\AppData\LocalLow\AskToolbar
Folder Deleted : C:\Users\***\AppData\LocalLow\boost_interprocess
Folder Deleted : C:\Users\***\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\***\AppData\Roaming\OpenCandy
Folder Deleted : C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\vj4xjtr1.default\Conduit
Folder Deleted : C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\vj4xjtr1.default\ConduitCommon
Folder Deleted : C:\Program Files (x86)\Ask.com
Folder Deleted : C:\Program Files (x86)\vShare.tv plugin
Folder Deleted : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
File Deleted : C:\Program Files (x86)\Mozilla Firefox\Plugins\npvsharetvplg.dll

***** [Registry] *****

Key Deleted : HKCU\Software\APN
Key Deleted : HKCU\Software\Ask.com.tmp
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKCU\Software\StartSearch
Key Deleted : HKLM\SOFTWARE\APN
Key Deleted : HKLM\SOFTWARE\AskToolbar
Key Deleted : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Key Deleted : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Key Deleted : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Deleted : HKLM\SOFTWARE\Classes\LinkurySmartBar.DockingPanel
Key Deleted : HKLM\SOFTWARE\Classes\LinkurySmartBar.LinkurySmartBar
Key Deleted : HKLM\SOFTWARE\Conduit
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
[x64] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF

***** [Registre - GUID] *****

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A1B48071-416D-474E-A13B-BE5456E7FC31}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{79D60450-56C5-4A8C-9321-6D5BC2A81E5A}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{99C22A61-21BA-4F81-85FF-CDC9EB5DB10B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A1B48071-416D-474E-A13B-BE5456E7FC31}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A1B48071-416D-474E-A13B-BE5456E7FC31}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
[x64] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3D782BB2-F2A5-11D3-BF4C-000000000000}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
[x64] Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Mozilla Firefox v14.0.1 (de)

Profile name : default 
File : C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\vj4xjtr1.default\prefs.js

C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\vj4xjtr1.default\user.js ... Deleted !

Deleted : user_pref("CT2438727.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);
Deleted : user_pref("CT2438727.DSInstall", false);
Deleted : user_pref("CT2438727.DialogsAlignMode", "LTR");
Deleted : user_pref("CT2438727.DialogsGetterLastCheckTime", "Wed Apr 18 2012 10:22:12 GMT+0200");
Deleted : user_pref("CT2438727.FirstTimeFF3", true);
Deleted : user_pref("CT2438727.HPInstall", false);
Deleted : user_pref("CT2438727.HasUserGlobalKeys", true);
Deleted : user_pref("CT2438727.Initialize", true);
Deleted : user_pref("CT2438727.InitializeCommonPrefs", true);
Deleted : user_pref("CT2438727.InstalledDate", "Wed Apr 18 2012 11:24:16 GMT+0200");
Deleted : user_pref("CT2438727.IsGrouping", false);
Deleted : user_pref("CT2438727.IsInitSetupIni", true);
Deleted : user_pref("CT2438727.IsMulticommunity", false);
Deleted : user_pref("CT2438727.IsOpenThankYouPage", true);
Deleted : user_pref("CT2438727.IsOpenUninstallPage", true);
Deleted : user_pref("CT2438727.LanguagePackLastCheckTime", "Wed Apr 18 2012 10:22:18 GMT+0200");
Deleted : user_pref("CT2438727.Locale", "en");
Deleted : user_pref("CT2438727.MCDetectTooltipHeight", "83");
Deleted : user_pref("CT2438727.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Deleted : user_pref("CT2438727.MCDetectTooltipWidth", "295");
Deleted : user_pref("CT2438727.MyStuffEnabledAtInstallation", false);
Deleted : user_pref("CT2438727.SearchCaption", "Zynga Customized Web Search");
Deleted : user_pref("CT2438727.SearchFromAddressBarIsInit", true);
Deleted : user_pref("CT2438727.SendProtectorDataViaLogin", true);
Deleted : user_pref("CT2438727.ServiceMapLastCheckTime", "Wed Apr 18 2012 10:22:08 GMT+0200");
Deleted : user_pref("CT2438727.SettingsLastCheckTime", "Wed Apr 18 2012 10:22:09 GMT+0200");
Deleted : user_pref("CT2438727.SettingsLastUpdate", "1326723880");
Deleted : user_pref("CT2438727.TBHomePageUrl", "hxxp://search.conduit.com/?ctid=CT2438727&SearchSource=13");
Deleted : user_pref("CT2438727.ToolbarShrinkedFromSetup", false);
Deleted : user_pref("CT2438727.Uninstall", true);
Deleted : user_pref("CT2438727.alertChannelId", "832836");
Deleted : user_pref("CT2438727.initDone", true);
Deleted : user_pref("CT2438727.navigateToUrlOnSearch", false);
Deleted : user_pref("CT2438727.revertSettingsEnabled", true);
Deleted : user_pref("CT2438727.testingCtid", "");
Deleted : user_pref("CT2438727.toolbarAppMetaDataLastCheckTime", "Wed Apr 18 2012 10:22:12 GMT+0200");
Deleted : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT2438727/CT2438727[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2438727", [...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2438727",[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"c46[...]
Deleted : user_pref("CommunityToolbar.ToolbarsList", "CT2438727");
Deleted : user_pref("CommunityToolbar.ToolbarsList4", "CT2438727");
Deleted : user_pref("CommunityToolbar.originalHomepage", "hxxp://www.google.de/");
Deleted : user_pref("CommunityToolbar.originalSearchEngine", "chrome://browser-region/locale/region.properties[...]
Deleted : user_pref("extensions.asktb.ff-original-keyword-url", "");

-\\ Google Chrome v21.0.1180.83

File : C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Preferences

Deleted :       "homepage": "hxxp://smartbar.linkury.com/",
Deleted :       "icon_url": "hxxp://www.linkury.com/favicon.ico",
Deleted :       "keyword": "search.linkury.com",
Deleted :       "name": "Linkury Smartbar Search",
Deleted :       "search_url": "hxxp://search-us.linkury.com/results.htm?cx=partner-pub-7890126930977991:573162[...]
Deleted :                "scriptable_host": [ "*://*.ask.com/", "*://*.bagsbuy.com/*", "*://*.childrenschorus.[...]
Deleted :                   "matches": [ "*://*.google.com/*", "*://*.ask.com/", "*://*.bagsbuy.com/*", "*://*[...]
Deleted :                "update_url": "hxxp://apnmedia.ask.com/media/toolbar/supertoolbar/chrome/manifest.php[...]
Deleted :                "description": "vshare.tv plugin",
Deleted :                "name": "vshare plugin",
Deleted :                   "path": "chvsharetvplg.dll",
Deleted :                "update_url": "hxxp://autoupdate.chromewebtb.conduit-services.com/?productId=CT273765[...]
Deleted :    "homepage": "hxxp://smartbar.linkury.com/",
Deleted :          "name": "vShare.tv plug-in",
Deleted :          "path": "C:\\Users\\***\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\[...]
Deleted :          "name": "vShare.tv plug-in",
Deleted :          "path": "C:\\Program Files (x86)\\Mozilla Firefox\\plugins\\npvsharetvplg.dll",
Deleted :          "name": "vShare.tv plug-in"
Deleted :          "path": "C:\\Users\\***\\AppData\\LocalLow\\Unity\\WebPlayer\\loader\\npUnity3D32.dll",

-\\ Opera v9.64.10487.0

File : C:\Users\***\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [12788 octets] - [18/08/2012 07:16:45]
AdwCleaner[R2].txt - [12395 octets] - [22/08/2012 20:31:15]
AdwCleaner[S1].txt - [10829 octets] - [22/08/2012 21:02:50]

########## EOF - C:\AdwCleaner[S1].txt - [10958 octets] ##########

Code:

ATTFilter

Emsisoft Anti-Malware - Version 6.6
Letztes Update: 22.08.2012 21:14:54

Scan Einstellungen:

Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\, F:\
Archiv Scan: An
ADS Scan: An

Scan Beginn:	22.08.2012 21:17:16

c:\microgaming 	gefunden: Trace.File.ruby fortune casino!E1
c:\microgaming\casino 	gefunden: Trace.File.ruby fortune casino!E1
c:\program files (x86)\everest poker\ 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\startup\ 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\mp-lobby\ 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\mp-poker\background\ 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\shared\shared\ 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\shared\shared\bitmaps\ 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\shared\shared\sounds\ 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\startup\en\ 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\startup\shared\ 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\startup\shared\icons\ 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\startup\shared\sounds\ 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\startup\shared\bitmaps\ 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\free mp3 wma ogg converter\ 	gefunden: Trace.File.freemp3wmaoggconverter!E1
c:\program files (x86)\free mp3 wma ogg converter\lib\ 	gefunden: Trace.File.freemp3wmaoggconverter!E1
c:\program files (x86)\free mp3 wma ogg converter\sounds\ 	gefunden: Trace.File.freemp3wmaoggconverter!E1
c:\users\***\appdata\roaming\free mp3 wma ogg converter\ 	gefunden: Trace.File.freemp3wmaoggconverter!E1
c:\program files (x86)\everest poker\data\ 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\shared\ 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\mp-poker\ 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\init.ini 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\gvnetwork.dll 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\gvsound.dll 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\gvmain.exe 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\log.dat 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\settings.ini 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\casino.exe 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\cstart.exe 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\everest poker.exe 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\gvcrt.dll 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\gvbase.dll 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\gvgfx-dib.dll 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\gvgfx.dll 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\mp-poker\background\default.gvt 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\shared\shared\bitmaps\check.art 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\mp-poker\shared.gvt 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\shared\shared\bitmaps\chips.art 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\shared\shared\bitmaps\btn_scroll.gvt 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\shared\shared\sounds\button.ogg 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\mp-lobby\shared.gvt 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\shared\shared\sounds\carddeal.ogg 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\shared\shared\sounds\cardflip.ogg 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\shared\shared\sounds\chipclick.ogg 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\startup\en\startup_strings.txt 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\startup\shared\icons\ep.ico 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\gvmain.dll 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\startup\shared\sounds\alert.ogg 	gefunden: Trace.File.everestpoker!E1
c:\program files (x86)\free mp3 wma ogg converter\unins000.dat 	gefunden: Trace.File.freemp3wmaoggconverter!E1
c:\program files (x86)\free mp3 wma ogg converter\unins000.exe 	gefunden: Trace.File.freemp3wmaoggconverter!E1
Value: hkey_current_user\software\grand virtual --> xd3c 	gefunden: Trace.Registry.casino treasure!E1
Key: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\everest poker 	gefunden: Trace.Registry.everestpoker!E1
Key: hkey_current_user\software\microgaming 	gefunden: Trace.Registry.casinoaction!E1
Key: hkey_current_user\software\microgaming\thumper 	gefunden: Trace.Registry.casinoaction!E1
Key: hkey_current_user\software\microgaming\thumper\casino 	gefunden: Trace.Registry.casinoaction!E1
Key: hkey_current_user\software\mgs\thumper\casino 	gefunden: Trace.Registry.casinoaction!E1
Key: hkey_current_user\software\grand virtual 	gefunden: Trace.Registry.everestpoker!E1
Key: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\free mp3 wma ogg converter_is1 	gefunden: Trace.Registry.freemp3wmaoggconverter!E1
c:\program files (x86)\free mp3 wma ogg converter\freemp3wmaconverter.exe 	gefunden: Trace.File.freemp3wmaoggconverter!E1
C:\Program Files (x86)\Everest Casino\gvmain.exe 	gefunden: Adware.Win32.EverestPoker!E1
C:\Program Files (x86)\Everest Casino\casino.exe 	gefunden: Adware.Win32.EverestPoker!E1
F:\Games\Serious Sam HD The First Encounter\Bin\SKIDROW.exe 	gefunden: Riskware.Hacktool.Skidrow!E2
F:\Backup 300\Studium\Mechatronik\F4\C++ Programme\bubblesortwerthebach.exe 	gefunden: Backdoor.Win32.Prorat!E2

Gescannt	760744
Gefunden	63

Scan Ende:	22.08.2012 23:42:40
Scan Zeit:	2:25:24

F:\Backup 300\Studium\Mechatronik\F4\C++ Programme\bubblesortwerthebach.exe	Quarantäne Backdoor.Win32.Prorat!E2
F:\Games\Serious Sam HD The First Encounter\Bin\SKIDROW.exe	Quarantäne Riskware.Hacktool.Skidrow!E2
C:\Program Files (x86)\Everest Casino\gvmain.exe	Quarantäne Adware.Win32.EverestPoker!E1
C:\Program Files (x86)\Everest Casino\casino.exe	Quarantäne Adware.Win32.EverestPoker!E1
Key: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\free mp3 wma ogg converter_is1	Quarantäne Trace.Registry.freemp3wmaoggconverter!E1
Key: hkey_current_user\software\microgaming	Quarantäne Trace.Registry.casinoaction!E1
Key: hkey_current_user\software\microgaming\thumper	Quarantäne Trace.Registry.casinoaction!E1
Key: hkey_current_user\software\microgaming\thumper\casino	Quarantäne Trace.Registry.casinoaction!E1
Key: hkey_current_user\software\mgs\thumper\casino	Quarantäne Trace.Registry.casinoaction!E1
Key: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\everest poker	Quarantäne Trace.Registry.everestpoker!E1
Key: hkey_current_user\software\grand virtual	Quarantäne Trace.Registry.everestpoker!E1
Value: hkey_current_user\software\grand virtual --> xd3c	Quarantäne Trace.Registry.casino treasure!E1
c:\program files (x86)\free mp3 wma ogg converter\	Quarantäne Trace.File.freemp3wmaoggconverter!E1
c:\program files (x86)\free mp3 wma ogg converter\lib\	Quarantäne Trace.File.freemp3wmaoggconverter!E1
c:\program files (x86)\free mp3 wma ogg converter\sounds\	Quarantäne Trace.File.freemp3wmaoggconverter!E1
c:\users\***\appdata\roaming\free mp3 wma ogg converter\	Quarantäne Trace.File.freemp3wmaoggconverter!E1
c:\program files (x86)\free mp3 wma ogg converter\unins000.dat	Quarantäne Trace.File.freemp3wmaoggconverter!E1
c:\program files (x86)\free mp3 wma ogg converter\unins000.exe	Quarantäne Trace.File.freemp3wmaoggconverter!E1
c:\program files (x86)\free mp3 wma ogg converter\freemp3wmaconverter.exe	Quarantäne Trace.File.freemp3wmaoggconverter!E1
c:\program files (x86)\everest poker\	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\startup\	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\mp-lobby\	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\mp-poker\background\	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\shared\shared\	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\shared\shared\bitmaps\	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\shared\shared\sounds\	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\startup\en\	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\startup\shared\	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\startup\shared\icons\	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\startup\shared\sounds\	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\startup\shared\bitmaps\	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\shared\	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\mp-poker\	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\init.ini	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\gvnetwork.dll	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\gvsound.dll	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\gvmain.exe	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\log.dat	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\settings.ini	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\casino.exe	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\cstart.exe	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\everest poker.exe	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\gvcrt.dll	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\gvbase.dll	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\gvgfx-dib.dll	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\gvgfx.dll	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\mp-poker\background\default.gvt	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\shared\shared\bitmaps\check.art	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\mp-poker\shared.gvt	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\shared\shared\bitmaps\chips.art	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\shared\shared\bitmaps\btn_scroll.gvt	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\shared\shared\sounds\button.ogg	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\mp-lobby\shared.gvt	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\shared\shared\sounds\carddeal.ogg	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\shared\shared\sounds\cardflip.ogg	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\shared\shared\sounds\chipclick.ogg	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\startup\en\startup_strings.txt	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\startup\shared\icons\ep.ico	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\gvmain.dll	Quarantäne Trace.File.everestpoker!E1
c:\program files (x86)\everest poker\data\startup\shared\sounds\alert.ogg	Quarantäne Trace.File.everestpoker!E1
c:\microgaming	Quarantäne Trace.File.ruby fortune casino!E1
c:\microgaming\casino	Quarantäne Trace.File.ruby fortune casino!E1

Quarantäne	63

16.08.2012, 12:23	#4
t'john /// Helfer-Team	Suisa Trojaner (ogokv.exe Trojan.Cridex) Wo ist OTL.txt? __________________ Mfg, t'john Das TB unterstützen

22.08.2012, 22:12	#14
t'john /// Helfer-Team	Suisa Trojaner (ogokv.exe Trojan.Cridex) alles klar. __________________ Mfg, t'john Das TB unterstützen

Suisa Trojaner (ogokv.exe Trojan.Cridex)

Plagegeister aller Art und deren Bekämpfung: Suisa Trojaner (ogokv.exe Trojan.Cridex)