Hallo zusammen,

ich habe mir gestern wohl einen Trojaner eingefangen :-(. Den ich leider nicht mehr so einfach los werde. Kurz nach dem Anmelden unter Windows 7 erscheint ein Bildschrim das ich 100euro bezahlen soll und mich diverser Straftaten schuldig gemacht habe. Alles in einem sehr schlechten Deutsch geschrieben, so dass gleich klar war das es sich um einen Trojaner handel muss.
Ich hab mich bei euch schon schlau gemacht und OTL durchlaufen lassen bzw. ich habe auch MalewareBytes durch laufen lassen.

Wie werde ich das ding wieder los? Ich wäre über eure hilfe echt Dankbar.

Hier ist das OTL file:

OTL logfile created on: 16.08.2012 15:08:42 - Run 6
OTL by OldTimer - Version 3.2.57.0     Folder = C:\Users\carsten\Desktop
 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,87 Gb Total Physical Memory | 1,95 Gb Available Physical Memory | 67,83% Memory free
5,74 Gb Paging File | 4,92 Gb Available in Paging File | 85,86% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 74,52 Gb Total Space | 4,77 Gb Free Space | 6,40% Space Free | Partition Type: NTFS
Drive D: | 73,06 Gb Total Space | 22,45 Gb Free Space | 30,73% Space Free | Partition Type: NTFS
 
Computer Name: CARSTEN-PC | User Name: carsten | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.08.16 11:03:18 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\carsten\Desktop\OTL.exe
PRC - [2012.07.03 13:46:42 | 000,973,488 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbam.exe
PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2009.10.24 00:40:16 | 000,046,512 | ---- | M] () -- C:\Programme\OpenAfs\Client\Program\afs_shl_ext_1033.dll
MOD - [2008.03.30 16:22:42 | 000,070,144 | ---- | M] () -- C:\Programme\PSPad editor\PSPadShell.dll
MOD - [2002.05.14 19:22:34 | 000,122,880 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Disabled | Stopped] -- C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)
SRV - [2012.07.18 08:25:39 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.07.05 18:41:46 | 003,048,136 | ---- | M] (Skype Technologies S.A.) [Auto | Stopped] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2012.05.08 11:01:59 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.08 11:01:58 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.04.04 07:53:50 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.02.29 08:50:48 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2011.11.14 01:03:59 | 001,045,256 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011.08.07 16:44:54 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2010.07.29 07:05:38 | 000,296,808 | ---- | M] (Nuance Communications, Inc.) [Auto | Stopped] -- C:\Programme\Common Files\Nuance\dgnsvc.exe -- (DragonSvc)
SRV - [2010.02.19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Programme\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2010.01.20 01:53:14 | 000,241,664 | ---- | M] (Tanuki Software, Ltd.) [On_Demand | Stopped] -- C:\Programme\GeoServer 2.0.1\wrapper.exe -- (GeoServer 2.0.1)
SRV - [2009.10.24 00:32:18 | 000,651,184 | ---- | M] (OpenAFS Project) [Auto | Stopped] -- C:\Programme\OpenAfs\Client\Program\afsd_service.exe -- (TransarcAFSDaemon)
SRV - [2009.09.28 15:41:12 | 000,024,645 | ---- | M] (Apache Software Foundation) [Auto | Stopped] -- D:\Programme\QGIS\apache\bin\httpd.exe -- (ApacheOSGeo4WWebServer)
SRV - [2009.09.08 09:48:55 | 000,066,048 | ---- | M] (PostgreSQL Global Development Group) [Auto | Stopped] -- C:\Program Files\PostgreSQL\8.4\bin\pg_ctl.exe -- (postgresql-8.4)
SRV - [2009.07.21 04:04:00 | 000,047,128 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Microsoft SQL Server\100\Shared\sqladhlp.exe -- (MSSQLServerADHelper100)
SRV - [2009.07.14 03:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009.03.30 04:25:26 | 043,010,392 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe -- (MSSQL$SQLEXPRESS)
SRV - [2009.03.30 04:23:32 | 000,254,808 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe -- (SQLBrowser)
SRV - [2009.03.30 04:23:24 | 000,366,936 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE -- (SQLAgent$SQLEXPRESS)
SRV - [2008.07.10 03:49:44 | 000,098,840 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter)
SRV - [2007.08.24 06:59:20 | 000,068,464 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Microsoft Office\Office12\GrooveAuditService.exe -- (Microsoft Office Groove Audit Service)
SRV - [2007.08.24 03:19:12 | 000,443,776 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2007.03.20 17:41:24 | 000,153,792 | ---- | M] (Adobe Systems Incorporated) [Disabled | Stopped] -- C:\Programme\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe -- (Adobe Version Cue CS3)
SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\VBoxNetFlt.sys -- (VBoxNetFlt)
DRV - [2012.08.16 14:46:31 | 000,040,776 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2012.05.08 11:01:59 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.08 11:01:59 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.12.15 16:00:00 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011.11.04 14:42:02 | 000,104,752 | ---- | M] (Oracle Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VBoxNetAdp.sys -- (VBoxNetAdp)
DRV - [2011.08.17 10:56:32 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2011.08.17 10:56:30 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2011.08.17 10:56:26 | 000,023,168 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2011.08.17 10:56:22 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2010.11.20 14:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010.11.20 14:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010.11.20 14:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.11.20 11:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010.11.20 11:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010.11.20 11:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.11.22 21:11:11 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot | Stopped] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2009.09.21 17:58:28 | 001,218,048 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2009.07.14 01:53:36 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\loop.sys -- (msloop)
DRV - [2009.05.14 09:48:04 | 000,762,232 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\UDXTTM6010.sys -- (UDXTTM6010)
DRV - [2009.03.30 04:09:28 | 000,239,336 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\System32\drivers\RsFx0103.sys -- (RsFx0103)
DRV - [2008.08.28 17:17:38 | 000,131,856 | ---- | M] (Deterministic Networks, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\dne2000.sys -- (DNE)
DRV - [2007.01.18 19:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CVirtA.sys -- (CVirtA)
DRV - [2006.11.14 17:35:20 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2005.12.22 17:02:22 | 000,051,840 | ---- | M] (REDC) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2005.11.16 20:28:32 | 000,028,928 | ---- | M] (REDC) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2776682
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.searchqu.com/413
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 7F A4 FB 08 BF 82 CB 01  [binary data]
IE - HKCU\..\URLSearchHook: {51a86bb3-6602-4c85-92a5-130ee4864f13} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
IE - HKCU\..\SearchScopes\{052A1970-A861-4835-A805-C198CA0EF5D3}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=TRL2&o=15902&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=TW&apn_dtid=YYYYYYYYDE&apn_uid=54FB0585-3FB0-4CBB-AC73-7CE0167B8628&apn_sauid=857E0342-93AA-4641-9B6E-26C66AF693B6
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2776682
IE - HKCU\..\SearchScopes\{DC52F059-EF38-4ACC-8431-6D5765822AA9}: "URL" = hxxp://www.google.de/search?q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Search Results"
FF - prefs.js..browser.search.defaultthis.engineName: "BrotherSoft Extreme Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2776682&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Search Results"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "about:blank"
FF - prefs.js..keyword.URL: "hxxp://dts.search-results.com/sr?src=ffb&appid=0&systemid=413&sr=0&q="
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.07.18 08:25:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.05.14 14:50:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2012.06.18 20:49:22 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2012.05.14 14:50:33 | 000,000,000 | ---D | M]
 
[2012.07.02 18:38:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\carsten\AppData\Roaming\mozilla\Extensions
[2010.04.25 08:12:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\carsten\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2010.07.01 08:28:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\carsten\AppData\Roaming\mozilla\Extensions\{ee53ece0-255c-4cc6-8a7e-81a8b6e5ba2c}
[2012.08.04 01:13:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\carsten\AppData\Roaming\mozilla\Firefox\Profiles\fu92pvm9.default\extensions
[2012.08.01 07:40:37 | 000,000,000 | ---D | M] (ColorZilla) -- C:\Users\carsten\AppData\Roaming\mozilla\Firefox\Profiles\fu92pvm9.default\extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326}
[2012.07.02 13:33:42 | 000,000,000 | ---D | M] (WOT) -- C:\Users\carsten\AppData\Roaming\mozilla\Firefox\Profiles\fu92pvm9.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2012.05.18 09:14:41 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\carsten\AppData\Roaming\mozilla\Firefox\Profiles\fu92pvm9.default\extensions\ich@maltegoetz.de
[2011.09.21 09:27:32 | 000,002,396 | ---- | M] () -- C:\Users\carsten\AppData\Roaming\Mozilla\Firefox\Profiles\fu92pvm9.default\searchplugins\askcom.xml
[2012.07.02 18:38:55 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.07.20 08:54:10 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.05.05 12:36:18 | 000,097,315 | ---- | M] () (No name found) -- C:\USERS\CARSTEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FU92PVM9.DEFAULT\EXTENSIONS\{0E10F3D7-07F6-4F12-97B9-9B27E07139A5}.XPI
[2012.05.23 11:34:10 | 000,072,936 | ---- | M] () (No name found) -- C:\USERS\CARSTEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\FU92PVM9.DEFAULT\EXTENSIONS\PIXELZOOMER@MATTHIASSCHUETZ.COM.XPI
[2012.07.18 08:25:40 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.04.13 21:14:22 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2012.06.07 17:40:20 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.06.07 17:40:19 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.06.07 17:40:19 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.07 17:40:19 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.07 17:40:19 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.07 17:40:19 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - homepage: hxxp://www.google.com/
CHR - default_search_provider: Search Results (Enabled)
CHR - default_search_provider: search_url = hxxp://dts.search-results.com/sr?src=crb&appid=0&systemid=413&sr=0&q={searchTerms}
CHR - default_search_provider: suggest_url = 
CHR - homepage: hxxp://www.google.com/
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\21.0.1180.79\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\21.0.1180.79\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\21.0.1180.79\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\carsten\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll
CHR - plugin: Skype Toolbars (Enabled) = C:\Users\carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\npSkypeChromePlugin.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: Java Deployment Toolkit 6.0.310.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U31 (Enabled) = C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files\Microsoft Silverlight\4.0.60310.0\npctrl.dll
CHR - Extension: YouTube = C:\Users\carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Skype Click to Call = C:\Users\carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.1.0.10441_0\
CHR - Extension: Google Mail = C:\Users\carsten\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2010.10.28 20:33:04 | 000,000,844 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 10.254.254.253	AFS
O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll ()
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\WIA6EB~1\Datamngr\ToolBar\searchqudtx.dll File not found
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll ()
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\WIA6EB~1\Datamngr\ToolBar\searchqudtx.dll File not found
O3 - HKLM\..\Toolbar: (TerraTec Home Cinema) - {AD6E6555-FB2C-47D4-8339-3E2965509877} - C:\Programme\TerraTec\TerraTec Home Cinema\ThcDeskBand.dll (TerraTec Electronic GmbH)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5.5ServiceManager] "C:\Program Files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin File not found
O4 - HKLM..\Run: [AdobeCS6ServiceManager] C:\Program Files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [DNS7reminder] D:\Programme\Dragon\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [SwitchBoard] C:\Programme\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [WPDShServiceObj] C:\Users\carsten\AppData\Local\Microsoft\Windows\1915\WPDShServiceObj.exe ()
O4 - HKCU..\Run: [ISUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation)
O4 - HKCU..\Run: [Remote Control Editor] C:\Program Files\Common Files\TerraTec\Remote\TTTvRc.exe (Elgato Systems)
O4 - Startup: C:\Users\carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\carsten\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: An vorhandenes PDF anfügen - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 130.149.7.7 193.174.75.142
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{79474E48-9F6B-47B4-9609-0ECAFE1DDA2F}: DhcpNameServer = 130.149.7.7 193.174.75.142
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - Winlogon\Notify\AfsLogon: DllName - (C:\Program Files\OpenAFS\Client\Program\afslogon.dll) - C:\Programme\OpenAfs\Client\Program\afslogon.dll (OpenAFS Project)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{e88a7161-d79a-11de-899f-002318f1034d}\Shell - "" = AutoRun
O33 - MountPoints2\{e88a7161-d79a-11de-899f-002318f1034d}\Shell\AutoRun\command - "" = G:\SETUP.EXE
O33 - MountPoints2\{e88a7161-d79a-11de-899f-002318f1034d}\Shell\configure\command - "" = G:\SETUP.EXE
O33 - MountPoints2\{e88a7161-d79a-11de-899f-002318f1034d}\Shell\install\command - "" = G:\SETUP.EXE
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.16 14:42:26 | 000,000,000 | ---D | C] -- C:\Users\carsten\AppData\Roaming\hellomoto
[2012.08.16 12:13:07 | 000,000,000 | ---D | C] -- C:\Users\carsten\AppData\Roaming\Malwarebytes
[2012.08.16 12:12:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.08.16 12:12:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.16 12:12:54 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.08.16 12:12:54 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.08.16 11:13:35 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Users\carsten\Desktop\OTL.exe
[2012.08.15 16:32:42 | 000,031,584 | ---- | C] (TuneUp Software) -- C:\Windows\System32\TURegOpt.exe
[2012.08.15 16:32:38 | 000,021,344 | ---- | C] (TuneUp Software) -- C:\Windows\System32\authuitu.dll
[2012.08.15 16:31:39 | 000,000,000 | ---D | C] -- C:\ProgramData\TuneUp Software
[2012.08.15 16:31:11 | 000,327,749 | ---- | C] (RealNetworks, Inc.) -- C:\Windows\System32\drvc.dll
[2012.08.15 16:31:06 | 000,000,000 | -HSD | C] -- C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936}
[2012.08.14 16:34:21 | 000,000,000 | ---D | C] -- C:\Users\carsten\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2012.08.14 16:24:49 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Adobe
[2012.08.08 16:28:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2012.07.24 16:45:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\sixteen tons entertainment
[2012.07.24 16:36:59 | 000,000,000 | ---D | C] -- C:\Program Files\sixteen tons entertainment
[2012.04.11 19:26:05 | 000,250,544 | ---- | C] (KeyWorks Software) -- C:\Program Files\Common Files\keyhelp.ocx
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.08.16 14:44:26 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.16 14:44:05 | 2309,890,048 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.16 14:41:46 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.08.16 12:12:55 | 000,001,067 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.16 11:12:34 | 000,761,938 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.08.16 11:12:34 | 000,717,256 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.08.16 11:12:34 | 000,172,324 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.08.16 11:12:34 | 000,145,278 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.08.16 11:06:55 | 000,013,808 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.16 11:06:55 | 000,013,808 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.16 11:03:18 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\carsten\Desktop\OTL.exe
[2012.08.16 10:17:11 | 000,003,424 | ---- | M] () -- C:\bootsqm.dat
[2012.08.15 16:14:01 | 000,001,100 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.08.14 22:48:31 | 004,146,600 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.08.14 16:22:03 | 000,001,488 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Application Manager.lnk
[2012.08.07 20:43:40 | 000,138,992 | ---- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2012.08.07 20:43:30 | 000,281,152 | ---- | M] () -- C:\Windows\System32\PnkBstrB.xtr
[2012.08.07 20:42:32 | 000,214,504 | ---- | M] () -- C:\Windows\System32\PnkBstrB.ex0
[2012.07.25 09:24:21 | 002,106,067 | ---- | M] () -- C:\Users\carsten\Desktop\Phyto79n09_913.pdf
[2012.07.25 09:17:18 | 001,187,489 | ---- | M] () -- C:\Users\carsten\Desktop\hess-10-277-2006.pdf
[2012.07.18 14:27:21 | 001,232,885 | ---- | M] () -- C:\Users\carsten\Desktop\ISO19115_GermanTranslation_GDIDE.pdf
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.08.16 12:12:55 | 000,001,067 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.16 10:17:11 | 000,003,424 | ---- | C] () -- C:\bootsqm.dat
[2012.08.14 16:29:58 | 000,000,852 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Captivate 6 (32 Bit).lnk
[2012.08.14 16:27:28 | 000,000,852 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Media Encoder CS6.lnk
[2012.08.14 16:25:38 | 000,000,967 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Help.lnk
[2012.08.14 16:24:25 | 000,001,448 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Captivate Reviewer 6.lnk
[2012.08.14 16:24:18 | 000,001,279 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Captivate Quiz Results Analyzer 6.0.lnk
[2012.08.14 16:22:03 | 000,001,500 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Application Manager.lnk
[2012.08.14 16:22:03 | 000,001,488 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Application Manager.lnk
[2012.07.25 09:24:21 | 002,106,067 | ---- | C] () -- C:\Users\carsten\Desktop\Phyto79n09_913.pdf
[2012.07.25 09:17:06 | 001,187,489 | ---- | C] () -- C:\Users\carsten\Desktop\hess-10-277-2006.pdf
[2012.07.18 14:27:21 | 001,232,885 | ---- | C] () -- C:\Users\carsten\Desktop\ISO19115_GermanTranslation_GDIDE.pdf
[2012.07.13 08:39:11 | 000,000,145 | ---- | C] () -- C:\Users\carsten\.java.policy
[2012.04.19 10:05:39 | 000,191,424 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat
[2012.04.10 09:18:43 | 000,000,017 | ---- | C] () -- C:\Users\carsten\AppData\Local\resmon.resmoncfg
[2012.01.16 16:20:20 | 000,180,224 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2011.12.21 14:30:16 | 000,009,216 | ---- | C] () -- C:\Users\carsten\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.12.19 14:10:57 | 000,002,154 | ---- | C] () -- C:\Users\carsten\AppData\Roaming\SAS7_000.DAT
[2011.12.09 16:31:52 | 000,032,256 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2011.11.25 22:12:49 | 000,017,408 | ---- | C] () -- C:\Users\carsten\AppData\Local\WebpageIcons.db
[2011.11.21 19:02:07 | 000,003,395 | ---- | C] () -- C:\Users\carsten\.ganttproject
[2011.06.08 08:26:30 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2011.05.17 16:42:13 | 000,000,000 | ---- | C] () -- C:\Users\carsten\.octave_hist
[2011.02.22 13:09:54 | 000,000,335 | ---- | C] () -- C:\Users\carsten\AppData\Local\Perfmon.PerfmonCfg
[2011.02.21 12:15:04 | 000,011,192 | ---- | C] () -- C:\Users\carsten\gsview32.ini
[2011.02.21 12:14:15 | 000,000,043 | ---- | C] () -- C:\Windows\gswin32.ini
[2011.02.11 18:40:40 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll
[2010.10.15 14:23:56 | 000,163,840 | ---- | C] () -- C:\Windows\j3dcore-ogl.dll
[2010.10.15 14:23:56 | 000,049,152 | ---- | C] () -- C:\Windows\j3dcore-ogl-chk.dll
[2010.10.15 14:23:56 | 000,040,960 | ---- | C] () -- C:\Windows\j3dcore-ogl-cg.dll
[2010.10.15 14:23:55 | 000,823,296 | ---- | C] () -- C:\Windows\j3dcore-d3d.dll
[2010.08.25 19:30:02 | 000,439,308 | ---- | C] () -- C:\Windows\System32\igcompkrng500.bin
[2010.08.25 19:30:00 | 000,982,240 | ---- | C] () -- C:\Windows\System32\igkrng500.bin
[2010.08.25 19:30:00 | 000,092,356 | ---- | C] () -- C:\Windows\System32\igfcg500m.bin
[2010.08.25 18:57:00 | 000,000,151 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config
[2010.03.09 20:43:37 | 000,000,053 | ---- | C] () -- C:\Users\carsten\DIR.bat
[2010.02.20 09:31:50 | 000,000,016 | ---- | C] () -- C:\Users\carsten\.javafx_ping_sent
[2010.02.20 09:31:48 | 000,000,000 | ---- | C] () -- C:\Users\carsten\.javafx_eula_accepted
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 242 bytes -> C:\ProgramData\TEMP:0FF263E8

< End of report >
         

und hier der code von Maleware:

Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.16.07

Windows 7 Service Pack 1 x86 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 9.0.8112.16421
carsten :: CARSTEN-PC [Administrator]

16.08.2012 12:34:42
mbam-log-2012-08-16 (12-34-42).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|H:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 932855
Laufzeit: 2 Stunde(n), 3 Minute(n), 2 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 6
C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\adbbpci20019.mexw32 (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\adbbpci20023.mexw32 (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\encadapci1710.mexw32 (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\carsten\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WM7B7BQZ\WORLD_21_target_5830[1].exe (PUP.Adware.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
D:\Programme\QGIS\apache\bin\ab.exe (Trojan.Swrort) -> Erfolgreich gelöscht und in Quarantäne gestellt.
D:\TU_Bln\qtoctave-0.7.2\octave\libexec\octave\packages\image-1.0.4\i686-pc-msdosmsvc-api-v32\bwfill.oct (Trojan.Dropper) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
         

und hier noch mal das Extra File von OTL:

OTL Extras logfile created on: 16.08.2012 15:08:42 - Run 6
OTL by OldTimer - Version 3.2.57.0     Folder = C:\Users\carsten\Desktop
 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,87 Gb Total Physical Memory | 1,95 Gb Available Physical Memory | 67,83% Memory free
5,74 Gb Paging File | 4,92 Gb Available in Paging File | 85,86% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 74,52 Gb Total Space | 4,77 Gb Free Space | 6,40% Space Free | Partition Type: NTFS
Drive D: | 73,06 Gb Total Space | 22,45 Gb Free Space | 30,73% Space Free | Partition Type: NTFS
 
Computer Name: CARSTEN-PC | User Name: carsten | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files\Adobe\Adobe Bridge CS5.1\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~1\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0BE79F6E-4F56-41B7-9326-FD26ED262FC5}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | 
"{151DE165-E3AB-4FAC-9F5C-7731B9ECC84C}" = lport=50901 | protocol=6 | dir=in | name=adobe version cue cs3 server | 
"{245E18C9-6225-4519-AE2E-33FB3F5A1EC6}" = lport=3704 | protocol=6 | dir=in | name=adobe version cue cs3 server | 
"{300723BD-C818-4902-8ED0-3C613997B1FD}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{3641B8E2-69B6-4E15-9A8D-20C52F33A81D}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{38D26CFE-83F0-4B53-B16B-EDFEC6D0E9B9}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{442C8F07-89B5-43AD-9E45-CDEA81E14D0B}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{49C351FB-7765-42A7-BDEE-E37070DCD87F}" = rport=4444 | protocol=6 | dir=out | name=kerberos_kfw_port_4444 | 
"{563F2621-B91F-4C5B-8BB7-65FD24BED993}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{6F6EB06E-99DB-4B92-B4AA-C939990586BD}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{7DEE509A-556B-4C83-A2D9-6A3EC657A149}" = lport=51001 | protocol=6 | dir=in | name=dragon smart phone server | 
"{8766E5D5-5327-4916-8FDB-461471512BC1}" = lport=50900 | protocol=6 | dir=in | name=adobe version cue cs3 server | 
"{92DC0556-CDF0-4B27-9145-FB683EB61E87}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{97D018D5-1821-46F9-A5F8-07E944E34C36}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{9A2E1941-A1C1-43DE-B6B9-95074DA3DE35}" = lport=3703 | protocol=6 | dir=in | name=adobe version cue cs3 server | 
"{9B69D52C-F0FB-4F28-AE21-93D2D4794CCC}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{9C6FACFB-72AE-43A0-BF57-D1E62F506FAB}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{A73D6B29-64FF-47CD-9CA8-39775DE0D8B5}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{A9BD3EE4-2DED-472B-9A3F-BF7ABFBB82A2}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{AA4B8BDE-6CEC-4D72-870E-291D8A22A6CE}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{AAD67BE3-FC69-4BB2-8D9B-8A899A9A8285}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{BB96D5AA-2E4D-48D2-B5BA-F3E7BAC562DA}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{CAFB00AE-44C7-4EC9-AE7B-A333886CF6B6}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{DA7942A1-11F1-4FA5-A2B4-237291479756}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{DDE85C1E-204C-4B36-BEC8-61DE9DBA120E}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{DF55EC12-35EF-4A40-9B18-1764BB0E90C6}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{F5EDAF5E-21BB-4899-9384-770758E509B4}" = lport=7001 | protocol=17 | dir=in | name=afs cachemanager callback (udp) | 
"{FDB51434-56B9-48E0-855B-AD71D632DFF3}" = rport=88 | protocol=6 | dir=out | name=kerberos_kfw_port_88 | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00073C91-CB7D-4718-A2A9-ABD8677D1579}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{0092D901-B396-4845-93F1-85FB5BD58210}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{010F4EAE-8A0C-478F-A504-21191237A9F0}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{01A44A92-B044-43DA-A9D8-5CA9CDD2A984}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{020A10E8-8BD1-4EB3-895A-82B651B0AD33}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{021A5765-5CE1-4B4B-B20A-77D08FC476A6}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{0291C868-DF80-4E95-B699-73C02191CFA8}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{02F877D3-0F1D-4488-96EC-945285538ED6}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{0321F4C0-1355-4CC0-887C-251F7D2EFBD1}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{03229062-C945-4855-896C-EA5D98F922F6}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{04773E4D-4515-4B65-85EC-1DEE458BD1BC}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{050D4CBB-F878-4971-93FB-6C3C55BCD117}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{0723CDD3-983E-4ADD-9329-9CDD43394E97}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{074992FF-6190-491D-8545-11A9677B81C3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{07A6E725-1967-448A-92DF-3C3EBDC37274}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{07BCADB0-CC55-464E-B7ED-BAD3D72D0E16}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{07BE69AD-A106-4650-AF80-4446230A4696}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{081390A1-E026-45D5-9A9D-F338F0403B67}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{085FB270-C6B7-48D6-A272-80456EA2FEC3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{087AB5AB-9B3A-42E4-8B35-5F45A71D2423}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{0ABD1F7D-FF67-43D6-8456-EA1A29A04024}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{0AC3334D-4C55-410B-A833-DA982081A778}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{0B268931-17F1-4E26-8853-5D6E270F6AE0}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{0B3CA493-7284-4FE3-A94B-CEC2FD5C5437}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{0B7F8802-F03A-4F91-AE4C-7DFD2BD1811E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{0C03610B-CC57-476E-8EC4-ACD68E52C7EE}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{0C2CF6F3-8F71-42C0-8292-39966F9CB161}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{0C56926A-929D-43D1-A2BA-C5EAA57190B1}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{0CB5891F-EA3F-4AFB-BC6D-184C4DCA3AA8}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{0CE7BACF-3B92-4571-B502-4A859F7DD4F2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{0D6EB264-77FF-4F18-8CCD-FC9076ABA95D}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{0E0DCC6C-8A03-405A-B4F4-62849E7930AF}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{0EEF4DDF-A888-4DE4-97C2-02AAAD9D5AC8}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{0F843757-A91B-48C2-BB79-88666BA6A54F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{10491C68-111D-44E5-977A-A7D6678B1D2B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{10523072-916D-42F4-A8EB-F6458D8F3E4E}" = protocol=17 | dir=in | app=c:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe | 
"{10CFB783-8EAC-4E66-AD13-001395D600BF}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{115D747F-303E-4460-B94C-F86E2B5DF72F}" = protocol=17 | dir=in | app=c:\program files\terratec\terratec home cinema\insttool.exe | 
"{116DDB32-39B7-4F73-804B-517FF07A66BE}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{11844E1C-C3AE-4CD1-BE15-78356E9AB0FD}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{1247124D-CD9F-4D56-ABBA-250B8BD4AE1E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{12B05EAA-336E-4656-9995-26246BAAE051}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{13289003-A77F-4DA5-AED2-4B449CADEC57}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{13544916-23D3-46E1-9903-D1DD2AC176A1}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{13735054-5F9C-44AC-AFFA-AF4615A6ECB9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{14AB7120-61F9-4A99-AF95-3820CCAC20B1}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{14DD90F7-462D-4A27-8C7F-545B2F2A32DB}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{14F7955C-21BD-4814-BB72-5669B3C2D286}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{1667F851-E9FD-4001-BEA4-7960A476BDEB}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{178E5891-71FC-4368-B266-087B0E315FF1}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{1861D4AB-9D9B-41D9-8B9E-F5F8F10F2D18}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{18832A63-1EE5-419D-BB59-7EAB49B4D4C9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{19D73ECC-1291-4466-8FD4-FB29C0E8C4E9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{1A302DE2-DC3C-43BF-8589-73209875F53E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{1AB83654-1E17-403C-AA06-44A409A8082C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{1AD71164-B182-4690-8C67-07296DC6EAA2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{1B2DA5CA-BC25-4B40-89FB-655DD7187CB9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{1B3BCC18-DA7A-4076-976D-80B76109D35A}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{1B4EBF40-9223-4CEC-9AF9-4F3A8CE1E1EB}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{1CDAC3B2-B6F3-4581-AFF3-AD34E940697D}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{1CF914B0-9742-4CC7-A4FB-7F881A6B8DD2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{1D01F969-9B7E-4051-B1B7-7648D23168A2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{1D1CC178-CEC6-4D90-B071-9DFE6122AE8F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{1DB6622C-1DEA-4FF8-93F9-D4190B8DAB51}" = protocol=6 | dir=in | app=c:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe | 
"{1EBD00CB-7E1F-4AB5-B55B-0DF826783658}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{1EE50953-0365-477C-A5C1-3D7AE5381BC9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{1F15D247-7104-4EFE-8515-2CF377324214}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
"{1F54184D-B846-4A3B-94E6-B0395AADECF2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{1FBFDAE6-7A91-4077-AE37-EA3404BAAC6B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{1FD8BFB5-88E8-4D8F-B990-A8CADA1E4AD9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{202F0DB8-CA13-4105-A5A1-8BAC7FE54834}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{205FB509-215B-4C14-B3CF-1C24EADF32AE}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{20CEE26D-4554-4F90-82DD-ED8CC88DF0E4}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{21F74583-576D-4C90-9807-73D3C362DD8D}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{2200187D-5090-419E-BC2C-F6927D1A524C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{2237DD64-B8C8-456C-8E9F-146F462096ED}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{230B01C9-B8AC-43EA-9CAD-291470F5A7B2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{2317AB24-EEBA-4123-BFA3-E09BDD8CDCDC}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{2361B0C8-91F6-44CA-BBC4-F5F538AEBA80}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{2369914C-461E-4BE4-A7C7-75B384021B2B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{237C3E0F-1A60-477B-AF2F-7E992EB06E82}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{2410B495-68D9-453D-9B19-C42033B74F16}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{2459209E-E5EE-4898-BDB5-B7103A2761F2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{24D2438B-3680-4AB8-A014-93AE58B60E13}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{25185F60-5C16-4953-A28E-32933A937DD3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{25823DDE-A1E4-49A7-BEA0-5958E753E92F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{2673FE90-8930-45DD-8FDE-98D03E3D7B48}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{26773089-403B-4752-A79E-8B1F81BF1EFE}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{2729E71D-709E-4012-9A64-005DB1A3E650}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{2753D773-1D7A-48A6-8458-E480CB3459B2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{276CAEBC-CFC8-4C3B-965D-F773DCF4F76B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{28B47848-5C1F-48AC-8BAF-6D439665DBD5}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{29E5F80A-8665-4565-A03B-1352092DA43E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{2A0353BB-B1E8-4B64-AC4A-82761846B7C2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{2B0A8F63-FC23-4006-AD94-ED692A432191}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{2C1F017A-60A4-4F81-90D1-50A7877CDF21}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{2C3DB7AA-FBF3-45D4-A855-4BC97C4BAC78}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{2CF83789-CD77-411F-A1F8-DD61CD510313}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{2D7F1A30-B2EF-40DC-BB40-0E11B1FEBB83}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{2EEFFE62-32B0-40BE-B3C9-944EA735C30B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{2F01FD26-FFA0-4E7F-BFD8-00F920823277}" = protocol=6 | dir=in | app=c:\users\carsten\appdata\roaming\dropbox\bin\dropbox.exe | 
"{2FAADFD7-5E75-4A0C-8DDC-F032802E1426}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{2FEE0222-BFBC-48EE-8CB9-75E9A5792F58}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{30F97E9F-B06F-4111-A845-F521150076DF}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{31271B91-78E0-48AC-9B65-6E32F38EBA12}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{31C758D7-6A42-40EA-A067-B5F3B8A7BC94}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{31E20EED-67D4-4054-83AD-785C690D48BE}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{32C71CB4-D657-4316-A997-4037723E3A93}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{32CF9907-F10D-4721-890A-13C560220131}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{3315086F-71CE-417F-AF14-79F5C3990C20}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{3323C5E7-6A4C-403D-8232-55A218225F5B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{3330BD36-2613-48A0-BFEF-5FEFD47AE917}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{34CA7C9D-28BC-4780-90FD-EDA0A3E10A4F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{34E60564-3FBE-481F-8CE4-C92118BE9E99}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{359EC70F-1376-4B62-AD39-2A4103899262}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{35B1521D-8100-4970-8668-8516403F694C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{3603C07E-0461-418D-BC1D-BC56D5712E2C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{360B8395-5B74-4FAA-A9A4-177AA8D8973A}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{3670A926-794F-447C-8188-6E1CE50072AE}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | 
"{3677190F-3BCC-4028-A616-7BE72B26E2EF}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{36E2DFA7-9CE9-4DEE-9603-D60BA36AE193}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{3793685B-8D5E-4C79-A5B6-AD114E4BCA48}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{379B4A10-93C8-405B-927F-BAC6253AA12B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{39068D82-7566-4D52-B1DC-BE9B669FE19A}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{39258AC0-DA55-4026-A3E8-B733B3B3F8DD}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{397168B6-DEC7-4EEC-AA77-5719C2A4B8ED}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{39DD025E-08DC-4C93-AE77-C74DC430A128}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{3A17C4F3-8AFA-46C0-810A-11B5923442FD}" = dir=in | app=c:\program files\skype\plugin manager\skypepm.exe | 
"{3AE63AE8-B1C1-4AD0-AE0A-2157AD6CE21E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{3AFA0E54-B053-4B48-845D-CA24768B0EB4}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{3B38B1B9-3B4D-456C-AC1A-6280C6F9566C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{3B5446F9-71F3-4105-943B-EECD6467B273}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{3BD78F8B-1A1E-4B18-92B5-65F5D650787E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{3CBF163D-0974-4B1F-AC62-F001D9CC94E9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{3D470704-50A1-4744-8DBD-60512CE4C05B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{3E16B3AC-2AA4-4FAD-BD0E-A4C3790BF4CC}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{3E2DEC77-B42D-4A3E-9B85-0E1B9E3E574A}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{3E32AEFA-4B54-4152-B66C-7F6D704F82BB}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{3E517F24-A348-4D1F-AE58-7B90574A28ED}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{3E8C5827-CCE7-4B72-9C16-189CE04BEE5E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{3E9B5F48-77BD-43A7-9FBD-654669653E3B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{3F6F770E-6FE3-4C91-9467-2488ED51C7BB}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{3FD7A248-D514-47DD-BCF7-DDC1AF43C738}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{409A623A-F283-45B4-896E-383B86730B78}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{41BA679E-6C2B-4822-BB1B-E95188C59F67}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{41C5B88B-D47C-47A8-A9DA-FD2336B776AF}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{41F3A4C0-471E-4C87-8613-88F401809EA7}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{41F81EE7-E735-4428-9B84-FB92E9F6BCCF}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{42E27330-00F3-48F4-8F64-77740C0CD0CA}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{42EBDFF8-5FCA-4A2E-AE85-67FD3470F36F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{4328821A-538B-477C-8522-2D2D2E6A142C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{43631F86-61FA-4B7B-908A-C43E6249FE17}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{436DD3F7-E6CE-4242-9B48-A482F187ACE2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{43E01F85-90DD-41C2-85F8-4867DD93A226}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{441DE15F-3461-4551-AC70-81FD487308DA}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{446E8B02-579F-4B9C-8FD1-C0422195ADC8}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{44EA3D7A-0251-49BC-84B2-82E82C500C9C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{45D3734F-BB4F-4238-A901-F64EEF6B94A5}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{461E6F3A-35DE-4CCB-9482-3800D0984A56}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{465B358D-7912-45AA-9FF3-BAF3DA9E82A3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{4744B642-B6F4-4A85-AE56-6AEAD5CA864B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{474E0FE6-89CC-473E-A164-33C301B51185}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{4769EA4F-7B49-4515-BB2B-91439ABFE9D6}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{47F8C834-528F-4470-8BAF-838D409A5EDE}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{4872B4CE-3475-4CB5-ACED-C56D0CAB1A33}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{490C5671-DADA-45E9-8207-1DED42DCFCD4}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{490E6871-BA5D-4E83-AECF-C1E8656B1F57}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{49D9701B-0B2F-49E1-B73E-A33264DFE27E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{4A3F004D-16E3-406E-A3B4-52CC6D3EBC57}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{4A7D6813-8CED-45FF-8C7D-1A1370EB3722}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{4A95976A-42CF-44C2-B2AE-56C82638CB4F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{4ACD73D1-5A06-4AD8-A93A-E190B66F40ED}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{4BFAFD4A-1DBD-447B-8F6A-C6F25A88A7FF}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{4C8DE3F8-46E8-4339-9929-86C990A2BBBE}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{4CB31B8A-C792-4A62-93BD-525F4E40836F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{4D50B8F7-A66A-4542-A473-3995F0412F85}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{4D9DA9A4-ADAC-49D6-B501-4AEA0D63847D}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{4DF69027-6F42-4EA1-9C27-1F084D2E7C33}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{4FE171AD-1FC1-4304-B2D3-18AF66597163}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{4FF052A5-252A-4E9A-B71E-41F7723258C2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{50212F77-2BA6-4ADB-BA6B-9C7EAFE6F349}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{505C120D-F83B-4A7A-A620-FCC1EDAED385}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{50897EFD-F653-4B1F-9466-192534D641DF}" = protocol=6 | dir=in | app=d:\programme\agrar simulator 2012 demo\farm2012.demo.dll | 
"{50DB2239-5578-4156-9E63-31E8CD2FC8DF}" = protocol=6 | dir=in | app=c:\program files\tilemill\node.exe | 
"{520043C2-5A14-4C2B-9DC8-D8C9D2EF4C56}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{527014CD-D897-4044-8E63-8E34B40A3150}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{52BCB8D2-5DB1-4AAF-8473-B5348D7B2A9E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{52EDDD89-A048-4385-A385-53CD52493EE7}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{53031205-F007-44ED-A5FC-9C26F2C5D718}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{5339AD33-4D03-4033-8ECD-538A8CE426CD}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{533F51CA-A24C-43FE-9E3D-7AB25CB137CB}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{5344A09E-2338-4293-A7F0-56130F0691D5}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{535089C8-3130-41E8-A03D-C3B16324F5E5}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{5371D73C-D28A-413E-92DB-513ED63D1AFB}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{5382A9A6-243F-487B-A5D1-7B4DA93EC3F9}" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe | 
"{539CD4F8-1488-4279-98EC-9F15590C5BCA}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{53D2C861-9A3D-4823-8C71-6319F7D6053B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{549E3BDB-FFDC-40CD-938F-E6D9F5D03275}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{54B30390-0CBC-4AEC-8694-1FAA342202F0}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{552BBDCA-E3F7-429C-A881-DE56199A2AA2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{56A00C8C-5760-49CF-9158-D636B1E3A203}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{56EE5D8E-76B1-4AF5-9B2A-A40DD62334B9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{571EAA3D-4E93-40D0-9CB5-61D99FFB66BE}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{58151BBE-CCB8-4A96-83CA-6B38086F89D3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{58B44053-E567-4845-9345-3AB7D98B5C56}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{59708A9C-01F4-4186-9EC9-11ADE1B51259}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{5C1C5766-7792-4F50-938B-81627F984DD3}" = protocol=17 | dir=in | app=c:\program files\terratec\terratec home cinema\tvtvsetup\tvtv_wizard.exe | 
"{5C4BB9C1-894E-4B24-A2C2-492C6902EC49}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{5CB19829-43CD-4F46-83F5-58529E313C94}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{5D0AFB70-8C74-437A-8D54-7AB48698960B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{5D4DC383-0A73-4038-BCA2-E16ECB290CCB}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{5DDB7D86-0918-4007-9618-7DEA125763BA}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{5F30B2E7-E734-4C95-BF72-27D487303397}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{5FAE6494-76AB-430D-AE50-9828F1E6CC95}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{60370904-EF1D-4F4A-A61F-92D6441060E9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{608CA30D-155C-4BEB-9932-A0A43C24C901}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{60B4D5AA-35AE-4CB0-915F-E43BFEE77F28}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{60E944B1-DFC6-4E92-9BB4-435AAB992C46}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{60EE3022-7335-47BE-A27B-D72B800A2616}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{611AB346-B73E-45D1-ACEA-40C3AE17F0E1}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{61BF681D-38ED-4338-92D1-D2F5DC45BE42}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{61CEABC5-4443-49C8-B313-562A40FB0A94}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{61F23778-D62E-4F75-9D86-88F9B8FFC8F0}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{61FB4293-EEFF-49DB-ABAB-1F9A2349F9B7}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{62B61E0D-71CF-4628-A103-D208B273E8C4}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{6341AD44-229F-45AF-A021-2EE253FEE7D9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{63AFBF14-1F73-4AB0-BEB2-37F4471E44B9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{649D0B3E-AFCB-484D-815C-6AF92C0E611C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{64CAAE2B-59D5-496E-B609-956BFD51424A}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{64D32761-C406-4FF4-9390-16FF060C4494}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{64DAB154-A45B-40B6-A780-8FBA0914C3A9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{654ABEC2-E1EA-48BF-ABEB-9C1BA88FD91E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{65CF868E-AA26-444F-B599-69072034A0E1}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{664B82F7-97E9-4F1B-83D8-DCBCB660578C}" = protocol=17 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe | 
"{66B95A61-45C4-4296-AFFF-1D0F55AF439C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{6739C213-4439-482B-B83F-E8A0E4DCB0BA}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{67A6A76D-B193-4CDC-B5E7-DE0065C1BFA7}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{686D0415-1306-43DE-9631-5429E52C3787}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{688E1341-8345-4292-8EE5-AA1DB8272A35}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{68E1B7B8-197A-44D0-8BFC-45B3683D651C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{695F9CB6-E9AA-4745-83FC-CCA8643555EA}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{69634630-F595-42A7-85D6-12A9F37B7F36}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{69891945-5D99-42A1-BD3F-66F2DE518259}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{6A035B64-930E-44BA-B88C-30D5CD0B2D3B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{6A3139B3-811C-43D4-8373-84E1A4DA8159}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{6A790C29-A9C5-4485-B28E-76F323B76426}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{6B233E9A-94CB-4772-A37E-BAB9761D29EB}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{6B46F3A1-CCEA-4A35-8A88-E14FCA565DCB}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{6BAB76C5-3FE8-42D1-9501-D14846FAC277}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{6BF0B9AE-7278-4633-81C3-D96535F329C8}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{6DE6C455-47F0-42FC-B089-A5374BE5F8B4}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{6EBE9657-68B9-4613-A691-FE04C499EC2F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{6EFD9897-C439-4322-8969-378F54689AB4}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{6F0BE1B6-F3D7-4981-BD39-0857F81AEC43}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{6F13B060-CA86-4BCB-B948-303ED985FA2C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{6F9917C8-3EE9-4374-9A45-9E512E24E85B}" = protocol=6 | dir=in | app=d:\programme\agrar simulator 2012 demo\iupdate.dll | 
"{7006A87A-484C-4300-BF27-073F81CBA153}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{7007FDDC-DDE7-457E-8133-BABD2DF2EE2E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{7014F10A-54B3-4105-934D-44F5C423A4FF}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{70251A2F-ED80-4701-81B2-DAB92D677D42}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{70A9336D-55A7-42AD-8903-F69775095926}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{70D236E8-0BF4-47A7-8D3D-6240F8079005}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{70EA28F2-1185-4519-ADDC-80C36905F8B3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{71061702-D8C3-41D4-A570-59A6337FA9B3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{7181AEA7-744C-47D4-8DDF-8F85046298DA}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{72C26BDE-53D2-48B1-82BA-DFA60AEC03E3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{72FD36B4-B746-497F-8934-DD7B6B22D017}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
"{731F4CA1-5488-4DE4-85BE-9EC42DDAA351}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{748B5BA6-1A3B-4C54-83FE-4C5DB45395B6}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{749390F0-1FE2-4E3C-A287-4B31276117EB}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{7520FB70-F939-47F2-AC50-7E83BEFF0C7D}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{753077B6-1276-4C3B-9666-74616A8A7226}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{7537F03A-63C5-4982-8928-622825865FF9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{75BE37ED-CB72-4502-9CC6-9106E409F698}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{764D663E-5DFB-496D-B6D0-9CD66E6B3E00}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{7669754B-A8F8-4CFE-BECA-50E7C096FE46}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{769B6010-6C04-4763-B2E4-A688962EFA20}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{76D588D7-5FE3-4A62-BB96-1F6B18FCA52F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{76DEA07D-F931-49A7-8B92-474DBF74FB8B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{77546DB8-5A8C-44E2-B7C0-35A85C33E551}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{781579D4-55C4-4195-AEA2-2A1574254F5E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{7849F325-48A8-4C4C-AF9B-F582D7911624}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{793620DB-10D6-4EF7-8E76-B49E61940688}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{79A70EDE-7E1F-4E45-B823-2544801F511D}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{79E9F88E-6D77-4837-88CB-CC5EBD51EC0A}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{7ABF3803-12EE-4C7C-B317-05A30D3F34FA}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{7B105F02-B9DB-4F17-A256-6D56A4B218F8}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{7B81ED68-AEBE-492C-A1C9-A414ED7DF73F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{7C205968-9A99-4B9B-8159-DD0A08C31D57}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{7C5AE1A4-78C4-40A5-8BEB-FB1CD7995F06}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{7C5F0AE7-3662-48E2-9921-654845252CE7}" = protocol=17 | dir=in | app=d:\programme\agrar simulator 2012 demo\iupdate.dll | 
"{7C63D1A3-E860-4457-83B4-C6C02F9A24AC}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{7CE26A03-2DD2-41F5-9A7B-8AF36C7E6078}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{7D73C0FD-05A5-4F05-BBA9-D42E9A982AAF}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{7E27E977-32CB-452B-8586-49B26EB1E091}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{7E9E400E-D046-49BD-987B-2D42B950C331}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{7EA9475D-4FB9-4408-BA16-752382563B8D}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{7EC659CE-CBE4-447A-932F-B6080D3432F4}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{7F050571-CC9F-4ACE-93DC-B4C874F903B3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{7FA3FBDB-76A4-4094-82E8-452FF6E94F69}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{80D03BBE-8FAE-4171-ACE7-5792CC437ED3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{80F6F979-18E3-4EDE-8E94-C8CC0730461E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{80FEF3B4-BE74-44C7-AFDC-C6C118F2F498}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{811C972C-300C-484A-A02D-DFB2C0F56449}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{81321408-BECA-47F3-9F6C-B2EE7899FA43}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{82AA1CB1-8725-4A9A-99AF-397E6E7D2678}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{82E25A96-47BE-49FF-A408-51704A94B751}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{8306313A-61E6-40B2-902A-0AF4810B7E5E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{832A0991-65AB-44DA-A667-64F04706A749}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{83D38C1F-A648-4559-ADEA-B56E74CD9CD5}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{842C9500-AB43-459F-A127-05C38BA91452}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{842CC579-C48C-40A3-911D-A4911DD8AD32}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{8468C3B4-88A5-4C4B-BA5F-6C29D2437C91}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{84715D86-CA38-4B56-90BA-925940C8E72B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{848FB16E-4695-4EE7-871C-6850C202316E}" = protocol=17 | dir=in | app=c:\program files\terratec\terratec home cinema\cinergydvr.exe | 
"{84C684D2-AD99-478B-AE02-8F4F627C9884}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{852901BE-5A6E-4613-8ED2-5306A34593D2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{85431BB3-1A1F-45F5-8909-A319F5E0106F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{85910296-FC0A-457B-A5FE-F4338B63DAEC}" = protocol=17 | dir=in | app=d:\programme\agrar simulator 2012 demo\farm2012.demo.dll | 
"{85C6E374-7BE7-47FF-A8B9-D6D643BFBB72}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{862B3701-D233-4F54-9746-ABB1F256F873}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{8652564A-B511-421F-9676-A9F2048523CF}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{8706FE45-1226-4B91-92E9-835C7FA4C7B0}" = protocol=6 | dir=in | app=c:\program files\ea games\battlefield 2\bf2.exe | 
"{87528B18-F522-4CB1-94FB-196167F5ABE5}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{88460555-8AF5-4DF0-8864-3CDC9171A79E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{8A7210B5-DB99-49EB-A57C-AE390ECE09E7}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{8A83E129-1306-47E6-B631-55F343126430}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{8BEC4B03-7F1D-4E11-A663-B87BA54CFFFB}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{8C3F6B76-9185-4AB0-A652-6CAD50FC1D37}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{8C6AF04F-ABAE-4180-9AF1-B05B97DB1C9F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{8CBB6326-748A-4443-B023-3268904AA8FF}" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe | 
"{8D1440BA-F35B-41D6-AFA1-453D6E518407}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{8E4B914B-6BD8-4EBA-8835-083664E99BFB}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{8E83E2BC-0973-47FE-96CB-010B0E277249}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{8F34A70E-A79D-4029-9D76-81D324949880}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{8F5DCCC7-E642-49A9-8BBC-B96A0B7477BC}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{8FED866E-AF00-4BCD-AAE0-188D2768D243}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{8FFFBBF4-3E05-4E38-BE6C-51B0685658E4}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{90B04948-CEF3-4F0C-959B-FC510B498D2F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{90C1F016-1F0D-47FC-9EBE-6BC34EC39E50}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{90DC1EAF-8CCE-41B5-AC76-92519EBD8163}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{90E9DA22-89BD-4B5A-9826-1BC7295831C1}" = protocol=17 | dir=in | app=c:\program files\tilemill\node.exe | 
"{911F5402-8DBE-45B0-94B0-FE89C8AC6F87}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{916C5B60-97FD-46FC-9D34-804C6A1CB19F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{91F0F667-B194-4189-BCA4-C945C4AB9AE3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{929496BF-7ECE-4F97-83CC-2862217F501D}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{92F485B2-7583-424A-A85D-FA6B2BA5B256}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{930CF09B-27BC-4000-B503-97082BDC4813}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{93254A05-3C22-4799-9B98-41AF88331326}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{935EBCF1-BCAB-4869-9E91-499FD6C7C080}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{9365BD26-E5CC-48EB-8F62-50056826885B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{93E43897-BD4E-4043-B601-5E7074B04754}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{93F29706-36EE-4588-8E09-22DE6970020D}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{942C49C0-3E39-4943-8CBC-43FB461772A4}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{944157C3-788A-41B0-8907-6384406AE9A3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{9443A748-E3AD-49A0-9DED-268EBCE76C1C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{94819E5E-2FC6-48DD-B32A-C25D0E373BAF}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{94C7452C-1A33-4C09-BFA8-B4A654670EAB}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{950CE195-F88D-4F9C-93BD-0FFFF95C6F07}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{955F6878-B790-45A1-9987-90A34C0B8D31}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{95D14036-F438-462F-8688-F0FAF516DDAE}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{964A1433-6BF3-47CB-A69E-6DAD7BB2B551}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{96C73D7B-F877-42FE-8641-E3C6D869FC31}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{978F3422-FBE5-4C29-99E0-7BDFB7A74425}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{97BB9138-BC83-470A-ADF9-AE76B2D5052D}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{97F7B9FB-0033-4A28-A4A2-5A6E0E86D09F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{990669F6-8074-4671-A33C-1EC4A53B27A7}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{991A3527-F193-43A5-A2B8-090D0D1CC810}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{991C90D0-5097-4F74-B936-6DB60204A9FE}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{99C3F1CD-9B3C-4D94-A324-460F0147AE0F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{9AFE3712-B44C-4BD9-BEE0-D6A413FEB406}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{9B998963-E881-4D6B-ACB7-1422F06350F3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{9D049925-891F-4E24-AD98-83C0D566DE01}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{9D8AE833-F8C9-448A-BDB6-5619A517EE42}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{9D8BBFFB-DBD4-4346-AF9E-A0441D8B8E6A}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{9E6BD770-3DAB-430A-82FA-DBC917262330}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{9E842D83-DD04-4BD2-966B-C9158C911C26}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{9EF7983E-E696-423D-A309-E623121989BC}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{9F7BC82C-132F-4C69-B6E0-8B87FF6CA7B9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{9FE03900-ACD2-4E0C-9583-02948AB0F7A0}" = protocol=17 | dir=in | app=c:\program files\ea games\battlefield 2\bf2.exe | 
"{A021DAAA-BC63-4111-A1F1-3122B450D335}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{A38590B0-C8BD-4103-9777-34B341CF122A}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{A3E2A092-B707-4CAB-9434-3BFC785E9B5D}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{A4BFDE45-7972-4FB3-835B-CE7B58566652}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{A502CE7D-729E-4045-B1B0-54DF6F58E38C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{A51C6024-C936-4284-A5C2-D9AB5D183D02}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{A5A95BC6-EAF4-49BB-BB5C-63A54200F2B3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{A5D05197-9CDC-435E-9012-3CFFF4ADDC8B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{A5E7812F-8312-4A4C-8E2A-F938F420ABF6}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{A6073D44-309E-4B0B-887E-3E230A240FF3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{A666A381-2067-4FB6-AA3D-4A50A27778A3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{A6681566-B2A6-4A0F-A202-62364A562CB5}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{A7C28EBC-0454-4627-BA9A-EA6780BBF95C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{A83C2E13-2086-4E6E-AEC3-F28DEAFDFC62}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{A854C414-B6BE-49D3-BE99-2DE832C011F1}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{A8E6CAB2-4357-47C4-BC59-5898C24D673E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{A920DD06-2BCA-45B0-A995-78DF08EBABAA}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{A92B9E2B-4E17-4B81-98CC-B5AB5C155712}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{AB69D2F1-2399-4F66-BB9C-F93874EE3CB0}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{AB6D86FA-F43E-4830-BC33-B5AC00206191}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{AC32E0D1-C728-407D-8346-095A4D7138A2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{AC8ED734-7D78-48FF-83DB-FA4B86290CBE}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{ACA8391F-AAF5-43AF-AD9B-DA3511F2E0C5}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{ACEFF282-C816-4EE4-8B17-66B83CFDBC95}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{AD4A5D0B-9439-426C-9385-8C8270AF987F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{AD67DEA5-EF6D-47F6-89BE-8CBAD40B1923}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{AD7B1F4C-327A-4657-A360-AFD3F10892FA}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{ADBCAACA-0BA1-4BED-B4D0-9EED617F8C74}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{ADE3776E-C101-40F3-8069-EC639B5840B9}" = protocol=17 | dir=in | app=c:\program files\common files\adobe\adobe version cue cs3\server\bin\versioncuecs3.exe | 
"{AE5C9137-1C91-40E8-8EE3-34E12FF764F3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{AEACC984-8FF0-4E4C-94AC-3E03AA160C92}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{AF1E94EA-CE76-4EE8-A7E9-04086577E159}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{AF351268-665F-4619-99DA-329605D650A9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{B0EB3F6A-F0EB-496C-B475-08CE7A5B4854}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{B11D3D9D-D9F7-4497-AC84-6B6ECD312061}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{B11D4CCD-CFAA-4DE4-9059-9C5A0730C9A1}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{B1AE6A42-F972-448F-A8F4-A27BAB1FB85A}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{B2455D40-B5DD-4013-9A96-9F2F728B9586}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{B32D434F-3AB8-4D24-892D-9299384925D2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{B345B9A6-C423-47DB-912F-CC5DF1C95DCD}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{B358F310-E3BF-480F-9840-8BCCD4BF76AC}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{B498F1C8-7D15-494F-8F1C-35140893E954}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{B4AB60D1-6137-435A-8B55-C36D2FC0DCC2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{B62707DD-D9EB-4914-81EC-040AC84B3B65}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{B702D506-1E89-4B10-812A-F5FF21C8CC5F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{B72F9079-68B1-4A7A-93D5-68FC7FF8D0A5}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{B7786B66-005E-42C2-B89B-1420750CB400}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{B7CB3DC8-3E8C-4A48-9242-E56AF3C414CC}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{B8132370-AE54-4B62-845E-DBA538355FC6}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{B8287072-1B0B-4CB0-90CF-3547687D2D28}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{B85CA89A-67ED-4F03-98B0-DA770B183B6E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{BA992890-57D1-43E9-AD09-1AC0305357CA}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{BB1C035C-CF6C-4444-9A76-C20FA962F78B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{BC29478D-3A20-40D4-8D5B-8F35FC338369}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{BDFFFF7C-F50B-4871-970E-E4BF5B6FBCC9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{BE220CBA-8BEA-483F-BA00-AEF136A47EC8}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{BE578DF8-EE4D-42A9-85D2-989255EC152C}" = protocol=6 | dir=out | app=system | 
"{BEA43256-D9CC-412F-A78B-0A963B49F2F0}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{BF898A4B-B2E5-428A-A2D9-AA1FF62EDE43}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{BFB2FE9A-37F9-4298-BA3F-F09B1E2D17C0}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{C01E85DD-622E-4151-ADBC-839D1D1A0999}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{C0FB9605-8296-4523-9028-CD67DECEBF3C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{C1F22338-F7F6-4F9F-92D3-5B983017BF03}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{C286FB99-E5AA-457D-8B7F-14091D1677B9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{C2A2690F-D193-48B7-9E47-88AFA8B53456}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{C2FC7397-62A7-451A-96A0-B84468EEC733}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{C3457064-B314-4314-8630-F684637E84A5}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{C34C1BD2-C265-4CB4-8F85-BC10A37500A9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{C383271F-9B3D-4C1E-BF29-8FD7637A9C23}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{C3BF26A9-A7F9-4104-9E9F-230990BF31D3}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{C4956C7C-79BC-4769-ADF0-CE27A2380513}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{C52A08BD-E6A0-455A-97DE-018A64D8DAC5}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{C60C30BA-20CA-44BC-878B-EE0AB341453C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{C6188543-144E-4205-B58E-6482887AA9B0}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{C62448B8-AC9A-499B-9A6C-7D2CD58A57ED}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{C627809F-BF7A-456B-9DA0-D366F10A0187}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{C70DBE0C-CCB8-4059-B111-F4446B9EE859}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{C7DDD98F-855C-49E7-83E8-492B52E910A4}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{C8AB0D21-BDBF-4FAE-B873-5E1AAF87CBE3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{C8BD63D8-918B-474A-9521-0DAFB71F7806}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{C965F72B-4B0A-44EB-A0BE-2B037A239904}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{C982AC27-048A-41E9-A0A1-F47CC60BBFB5}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{C9960C75-D52A-4AC4-8AD5-716D5023FFCB}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{CB0E7918-36D9-440D-8654-764F23E71714}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{CB1418EE-98BE-4243-805D-4E1692275947}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{CC29879E-1FBC-4C6C-8770-B2473B833C42}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{CC2E8C81-AF59-4A63-8322-02610CC40862}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{CE14596D-57C6-4E43-804E-35906CD1BFD8}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{CE4B392B-FC82-4626-8A11-140ED34E2862}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{CF371DBD-C72D-47CE-ACDF-5A039FD6FF91}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{CF47A3F1-1704-42D5-941E-2AE6D3F75A97}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{CFA3AE16-F5F0-495C-81DB-1B3EAE08F2ED}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{CFE6B8DF-4C7C-4CAF-8CF5-05F0B5FEC18F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{D05E6BCF-0CC5-4E8D-A760-1F23A062B929}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{D08F5756-186C-4D77-BE02-CC38C91F932F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{D118F5E4-EEE4-4472-B24D-EC90DF6D17C4}" = protocol=17 | dir=in | app=c:\users\carsten\appdata\roaming\dropbox\bin\dropbox.exe | 
"{D1AE0B68-26A4-4B11-BBCF-45F56F75C899}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{D2277F4F-7C56-492B-AE30-4A09D2A4952D}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{D2354D7E-E6C3-4E0C-9D5B-6C69E5261306}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{D2A0D8FA-8A5C-4EC4-B07A-DD7F41EBEEA6}" = protocol=6 | dir=in | app=c:\program files\terratec\terratec home cinema\tvtvsetup\tvtv_wizard.exe | 
"{D2B6D14C-8D5B-42FA-AC55-D995E1A200B4}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{D2F96714-2796-45FD-BC2C-5D9674DC46CC}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{D2FF4E60-3D8E-4646-81BC-E595B328ED35}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{D307F811-EFD2-46C7-8AFE-AE828DEF5946}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{D32FD9FF-7399-4DA1-B5BF-B7BA3D11922A}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{D3D76EB3-FE61-4352-A6E9-6FEE85215BFF}" = protocol=17 | dir=in | app=c:\program files\ea games\battlefield 2\bf2.exe | 
"{D49CE6A2-8F78-4BEB-9D04-D66D33FED8C4}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{D4B5CCE8-76C4-4BAC-AD51-419A622013C3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{D575B8DF-583D-43F5-86CB-EE54DD7DBF42}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{D602B071-08AC-4761-BE17-BB7E6518CA55}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{D62AA31F-D363-43E1-9B3B-18B319D9120D}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{D650673D-B1E5-4B81-83F5-D612452D70E9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{D6EB8EF4-EAB5-4ABC-93B1-FCFC9DD01B71}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{D715B5FB-C23F-478F-9355-EABF2371EEBF}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{D71B2C01-4FBF-47A3-88D2-6EE2E2763A9E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{D7371409-D977-4F6A-97C6-63FF1D9A5E06}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{D871649B-17B3-4789-BA64-CDCEBF6182B4}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{D8A15B93-32F9-46AD-B03F-134ADFE51088}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{D94F1B7F-E185-46E7-AB1B-222F909F7D06}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{D9D5F35B-E2CE-4B30-89CE-8C3889EE6DF2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{DADC8824-DA1B-45BC-A3F2-145B12981B03}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{DAF452D5-1AF2-4CAD-8930-BC847896A286}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{DCB56131-9097-49E4-BA74-BE7AB46854F3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{DD404265-77A1-413E-A282-33F79897B752}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{DE1A144F-C2B0-4D2B-A064-73B3D3047D2B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{DE5AB2B4-0119-4F06-B425-1C0C7CC3EA3E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{DE77DCBE-F7BC-4F5A-86CA-B029496BE220}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{E07A4D98-D3B7-456A-8C8B-5CCC77CAE930}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{E0A0BC2A-CBE6-4181-AFD9-CA94E03D816D}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{E0CA1F3A-F89E-4C2B-A3ED-C0B40607947B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{E12130C0-71AC-475C-9066-4FE255EC673B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{E121B6BE-D61F-4E97-AE6B-1C5C8B1CA5A3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{E1501CE3-4E11-408A-AE53-3539DE1F9D10}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{E1709211-EB32-4C5F-A4F5-CD6F72B710D7}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{E18FE890-5591-4E3E-8053-BF33DFB4BB73}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{E1B0FD9E-4156-42CC-B0E2-D42032FF78B2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{E202D273-EDFE-405F-883B-3BDD30BD7DDA}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{E29FF8FC-E2C8-4ECD-AB3B-0D01D34AA07E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{E2CEA6FE-946C-4FBD-81FE-0130E5190BB5}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{E3425A12-4113-4841-BBCC-D40DD850F42B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{E4181E7F-7E87-4B5A-8047-610195EFBFDB}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{E4A83016-F959-4F62-8C42-88ADFDB622BC}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{E4F4D0EC-CE0B-471E-8E83-EE3F7D3806C4}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{E57C1E32-2FB8-4E97-993B-4EA08DC97C31}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{E58C83DA-486C-4A17-9D4B-E21BC991F58E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{E5935DCC-093D-405A-A076-4BF0503C3E4C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{E5A2575F-DE25-4011-B3B3-6C1C0E39FF2C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{E614A749-876A-4DA8-B26A-C036CF964220}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{E6408CCC-A341-4977-9A79-473F666A91A0}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{E74878DB-6A89-4134-A603-E6A575D19138}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{E774939D-C1C0-4A61-B5FE-43F8C6D91FEE}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{E7EB987F-D943-4664-890D-7115D9BA8F69}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{E8E2019D-145A-4C9C-AA81-279B448672A4}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{E9172935-BF76-4BFB-BCD1-61DECC43CB22}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{E95AE148-AE38-42C3-A546-B53412B45032}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{E9651A9F-9B69-407C-82BC-AA9E66C3A7BF}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{EA0B4F79-BA9B-4F6D-A6BE-2984CC2D9BB2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{EA4A9063-22CA-4801-AD6D-CF166B15DB7E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{EAA7105E-468D-43D7-9E4C-B57E5C7377B3}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{EB1EE1F2-D7F7-47FC-AB9F-1BBE3C39173A}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{EB8E4C2A-442A-4099-867E-276E068CA124}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{EBC11C9E-E395-4B3A-A3AB-725FEB56C110}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{EC7C7024-A0B7-40F6-821C-E6F590FEB449}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{ED7A4F5D-4F97-4C88-B28E-B910F29343EC}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{EDB3A2F0-EB07-470C-8E1F-0DD985C3430F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{EE4CBE28-E8D0-4825-891D-767874A0093D}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{EF71F5FB-1266-41A4-B11B-21DE218596B5}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{F093DA13-2B2F-4723-ACCE-B1A7C9348E0A}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{F11C49EB-B3AF-492A-A8E4-E2E11F04E5EA}" = protocol=6 | dir=in | app=c:\program files\terratec\terratec home cinema\insttool.exe | 
"{F42014B8-7603-4C3E-A285-465A6C4ADB88}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{F59C960D-FA62-4A08-8A59-4E84BE93F26F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{F5AF916A-DBA1-4B18-B696-41948FEF2574}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{F5D3089F-1AC5-4CEF-8AE6-A4B4A3DCE589}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{F64062F7-ECEF-4185-B6C0-1C47A27806AC}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{F71F5E17-865F-4033-84DA-3DC92E27B458}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{F8319095-EB26-43BB-8626-E3A98EBDCD3A}" = protocol=6 | dir=in | app=c:\program files\terratec\terratec home cinema\cinergydvr.exe | 
"{F966BB24-4D50-48FA-939E-ED7462AC6226}" = protocol=6 | dir=in | app=c:\program files\common files\adobe\adobe version cue cs3\server\bin\versioncuecs3.exe | 
"{F9DBDF3F-37E5-45CE-9ABA-74AF65B4F57A}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{FA640B5B-1573-4AC7-97B6-039662C93964}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{FA7AF63B-51B0-4C34-8F57-253D52DFA50C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{FA7DBD1B-4C84-4223-B2FE-02917AD0656A}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{FB6A0A89-EF94-45CF-BE64-77877B6A86A6}" = protocol=6 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe | 
"{FBD5194D-C7E3-455A-AC27-8C2FFF866DD8}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{FBD68EF7-A8A2-49DD-9D67-E745C2AE4B60}" = protocol=6 | dir=in | app=c:\program files\ea games\battlefield 2\bf2.exe | 
"{FBEE7D36-103C-45D2-ADD0-9BC7F2E81C03}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{FC6A3A0E-62A7-491F-8AA6-12384F23FA2C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{FD9F1527-FF4C-49C1-8D80-584504595BC6}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{FE0B9D25-F25E-4CB2-A342-025CFD7947A5}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{FE68BC3F-3717-4CEE-A56B-79614F2C497A}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{FE722561-9588-442D-81CD-A9AE63C8F4C8}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{FE93471A-5C3E-4BB0-B324-E49F0481275B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{FF061A5B-4944-43E9-B058-44ADA4259AB9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{FF28B4D3-2E40-42AC-AF13-0E5EDCD18476}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{FFC14A71-2BAA-40A6-9945-D482763B449C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"TCP Query User{0577BA6E-76CC-4656-AF9D-93064F9867B1}C:\program files\matlab\r2009a\bin\win32\matlab.exe" = protocol=6 | dir=in | app=c:\program files\matlab\r2009a\bin\win32\matlab.exe | 
"TCP Query User{0872A3F5-C8B7-4423-9072-BF0A948151BF}C:\program files\trillian\trillian.exe" = protocol=6 | dir=in | app=c:\program files\trillian\trillian.exe | 
"TCP Query User{2AF89F94-B666-4AE9-9C1C-47A1064ED860}C:\users\carsten\downloads\eclipse\eclipse.exe" = protocol=6 | dir=in | app=c:\users\carsten\downloads\eclipse\eclipse.exe | 
"TCP Query User{2E1ADD7B-17C3-4502-AB68-D55BAD188956}C:\program files\trillian\trillian.exe" = protocol=6 | dir=in | app=c:\program files\trillian\trillian.exe | 
"TCP Query User{30AE629D-6004-4FD0-B375-6B025DA846F9}D:\programme\qgis\apache\bin\httpd.exe" = protocol=6 | dir=in | app=d:\programme\qgis\apache\bin\httpd.exe | 
"TCP Query User{346CFAB1-E207-4F8F-BBDA-7AFD110F8CB7}C:\program files\eclipse\eclipse\eclipse.exe" = protocol=6 | dir=in | app=c:\program files\eclipse\eclipse\eclipse.exe | 
"TCP Query User{43D6A2D4-08D0-4FB6-AC9F-625384A59799}C:\program files\maple 13\jre\bin\maple.exe" = protocol=6 | dir=in | app=c:\program files\maple 13\jre\bin\maple.exe | 
"TCP Query User{46CE30E7-496D-4DD4-B7CD-3524549666A7}C:\program files\mozilla firefox\plugin-container.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\plugin-container.exe | 
"TCP Query User{47CC628B-628E-43C6-A026-73F4178D6D29}D:\programme\easyeclipse-for-python-1.3.1\eclipse.exe" = protocol=6 | dir=in | app=d:\programme\easyeclipse-for-python-1.3.1\eclipse.exe | 
"TCP Query User{5F734838-765E-414A-BAC9-2A6828AA574A}C:\windows\system32\dpnsvr.exe" = protocol=6 | dir=in | app=c:\windows\system32\dpnsvr.exe | 
"TCP Query User{7438D4A4-07EB-4916-BAAF-06CDA8699AD4}C:\program files\battlestations midway\battlestationsmidway.exe" = protocol=6 | dir=in | app=c:\program files\battlestations midway\battlestationsmidway.exe | 
"TCP Query User{974BFF2C-0C4A-42AF-AF97-B60003EDFD6E}C:\program files\anno 1701\anno1701.exe" = protocol=6 | dir=in | app=c:\program files\anno 1701\anno1701.exe | 
"TCP Query User{A2664FEC-D325-43C9-98F5-CA90C72A5E09}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
"TCP Query User{C5678C7E-394F-4AD8-9BF6-C47C5DC068D8}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"TCP Query User{DBF37E00-A1F9-4795-86F2-9A18ABB4E1DB}C:\program files\yworks\yed\yed.exe" = protocol=6 | dir=in | app=c:\program files\yworks\yed\yed.exe | 
"TCP Query User{FD22686B-35BE-4E89-AFD9-F223701C6426}C:\users\carsten\appdata\local\temp\cprogram filesopera\operaupgrader.exe" = protocol=6 | dir=in | app=c:\users\carsten\appdata\local\temp\cprogram filesopera\operaupgrader.exe | 
"UDP Query User{1A7628D4-91D9-4782-86D7-40C6691D8FD1}C:\program files\eclipse\eclipse\eclipse.exe" = protocol=17 | dir=in | app=c:\program files\eclipse\eclipse\eclipse.exe | 
"UDP Query User{512FA40B-5427-47AD-897F-49009D56721B}C:\program files\battlestations midway\battlestationsmidway.exe" = protocol=17 | dir=in | app=c:\program files\battlestations midway\battlestationsmidway.exe | 
"UDP Query User{56F2771E-BFEB-49EC-B152-B906BEBE0B72}C:\program files\maple 13\jre\bin\maple.exe" = protocol=17 | dir=in | app=c:\program files\maple 13\jre\bin\maple.exe | 
"UDP Query User{59B7B527-6354-499F-B2EE-BEE88663F46E}C:\users\carsten\appdata\local\temp\cprogram filesopera\operaupgrader.exe" = protocol=17 | dir=in | app=c:\users\carsten\appdata\local\temp\cprogram filesopera\operaupgrader.exe | 
"UDP Query User{65893783-F441-4496-BDAB-0E92552AF65D}C:\program files\trillian\trillian.exe" = protocol=17 | dir=in | app=c:\program files\trillian\trillian.exe | 
"UDP Query User{70A03400-1CF9-40A0-B507-90C101D8E5A2}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
"UDP Query User{730F95D3-CE77-4BE9-9E33-5579BDCA440A}C:\windows\system32\dpnsvr.exe" = protocol=17 | dir=in | app=c:\windows\system32\dpnsvr.exe | 
"UDP Query User{77214824-C813-44CD-A2C9-C4C844DADFBE}D:\programme\easyeclipse-for-python-1.3.1\eclipse.exe" = protocol=17 | dir=in | app=d:\programme\easyeclipse-for-python-1.3.1\eclipse.exe | 
"UDP Query User{99AD4B4D-B2FD-4206-9D8B-726025AC2621}C:\program files\matlab\r2009a\bin\win32\matlab.exe" = protocol=17 | dir=in | app=c:\program files\matlab\r2009a\bin\win32\matlab.exe | 
"UDP Query User{AE3056C6-768D-4CE0-AAE0-628B12194218}D:\programme\qgis\apache\bin\httpd.exe" = protocol=17 | dir=in | app=d:\programme\qgis\apache\bin\httpd.exe | 
"UDP Query User{C5FB7293-720A-4CD1-8725-61FB48490318}C:\program files\yworks\yed\yed.exe" = protocol=17 | dir=in | app=c:\program files\yworks\yed\yed.exe | 
"UDP Query User{D2A38F17-F958-4567-8BDF-545464A504F7}C:\program files\anno 1701\anno1701.exe" = protocol=17 | dir=in | app=c:\program files\anno 1701\anno1701.exe | 
"UDP Query User{E432F8B8-27BD-4734-BAA6-C87FA52D776E}C:\users\carsten\downloads\eclipse\eclipse.exe" = protocol=17 | dir=in | app=c:\users\carsten\downloads\eclipse\eclipse.exe | 
"UDP Query User{E48C04E2-DCCD-4FF6-BC6E-6E8C5ABB8D7B}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"UDP Query User{F3763447-C801-4CEA-BFD0-83846CBA63E8}C:\program files\mozilla firefox\plugin-container.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\plugin-container.exe | 
"UDP Query User{FC0D5E61-58DB-4CEB-9535-8BC110B22C16}C:\program files\trillian\trillian.exe" = protocol=17 | dir=in | app=c:\program files\trillian\trillian.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00000407-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Premium
"{00F93853-D9D3-4795-A89E-84CCBA0205C9}" = Microsoft IntelliPoint 8.0
"{0125D081-30D0-4A97-82A8-C28D444B6256}" = Microsoft SQL Server Compact 3.5 SP2 DEU
"{0224CACC-994D-45F8-B973-D65056EA9C2F}" = Adobe XMP DVA Panels CS3
"{0327FA9D-975C-448C-A086-577D57BB25B8}" = Adobe Soundbooth CS3 Codecs
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{03A4C6A1-26E9-4DDB-81D9-B332E5BB10AD}" = Microsoft Sync Framework SDK v1.0 SP1 de
"{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}" = Battlefield 2(TM)
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{07DB09F4-6C67-1014-9331-B8E5223E6C5D}" = FME Desktop 2012 SP1 (Build 12224 - win32)
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{0F37D969-1260-419E-B308-EF7D29ABDE20}" = Web Deployment Tool
"{140F65D8-D07A-36CC-91C5-54DEC8140C43}" = Adobe Captivate Reviewer
"{141E87B2-0D67-433D-BE6E-69D0211B20EA}" = Kerberos for Windows
"{14962706-0C85-4135-B7F2-13A519FF3C6B}_is1" = OGG Video Converter v5.42 build 2436
"{150493B7-B59F-C677-F3AD-67C7E97CAAAF}" = Adobe Help Viewer 2
"{15F02176-0D12-4FAF-B2CD-2767C7781427}" = Google SketchUp 8
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{1803A630-3C38-4D2B-9B9A-0CB37243539C}" = Microsoft ASP.NET MVC 2
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{193EAFD0-1BAF-4FB4-B18F-79D5D6A4B285}" = Adobe After Effects CS3 Presets
"{1C4551A6-4743-4093-91E4-1477CD655043}" = NVIDIA PhysX
"{1D328E11-3B0C-388C-835D-C9C20E8C7734}" = Microsoft Help Viewer 1.0 Language Pack - DEU
"{1D58229F-C505-45CA-8223-F35F3A34B963}" = Adobe Version Cue CS3 Server
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20B1B020-DEAE-48D1-9960-D4C3185D758B}" = Phase 5 HTML-Editor
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{28E82311-8616-11E1-BEB0-B8AC6F97B88E}" = Google Earth
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{2B6F6771-46DA-4DEB-B738-E809A81B17F7}" = Adobe Setup
"{31C3C6EA-E991-405F-A3AA-2C070CCCC47C}" = Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools - DEU
"{32364CEA-7855-4A3C-B674-53D8E9B97936}" = TuneUp Utilities 2012
"{32A3A4F4-B792-11D6-A78A-00B0D0160160}" = Java(TM) SE Development Kit 6 Update 16
"{32A9C5B3-D166-4C6D-A11E-A54473150000}" = Java 3D 1.5.2
"{33AE9E89-47C9-4A0D-9E9D-BDD6966A3804}" = Microsoft SQL Server 2008 RsFx Driver
"{3BB19A2B-B9C5-3872-8FDF-3047CC9F9841}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x86)
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{40416836-56CC-4C0E-A6AF-5C34BADCE483}" = Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools
"{411E0CC3-587A-468C-B461-95FAFD05E4DE}" = Adobe InDesign CS3
"{4723f199-fa64-4233-8e6e-9fccc95a18ee}" = Python 2.6.5
"{477415F5-93DA-46AA-85C5-640047825995}" = Microsoft SQL Server 2008 Database Engine Shared
"{47C39E4A-28F2-33B1-B9B7-97F24E52D917}" = Microsoft Help Viewer 1.0
"{485ACF57-F364-440A-8496-E1E81C8FA1AA}" = Adobe Premiere Pro CS3 Third Party Content
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A5A427F-BA39-4BF0-9999-9A47FBE60C9F}" = Visual C++ 9.0 Runtime for Dragon NaturallySpeaking
"{4A6F34E2-09E5-4616-B227-4A26A488A6F9}" = Microsoft SQL Server 2008 Common Files
"{4AA5B8A5-BEEF-4AD8-B11D-4443A042EA4F}" = Adobe Dreamweaver CS3
"{4AF2248C-B3DF-46FB-9596-87F5DB193689}" = Microsoft SQL Server 2008 Browser
"{4F44B5AE-82A6-4A8A-A3E3-E24D489728E3}" = Microsoft SQL Server 2008 Native Client
"{50D4CB89-AF34-4978-96DC-C3034062E901}" = Battlefield 2: Special Forces
"{50F102CA-4BE2-41A9-9810-5BB05EB91B9A}" = Adobe Premiere Pro CS3 Functional Content
"{51722911-C391-4118-97BF-B50100D2AB15}_is1" = Gephi 0.8
"{5242B252-01BB-4F2E-BBF4-5C01BC3B6619}" = Microsoft SQL Server 2008 R2 Data-Tier Application Project
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{54B2EAD9-A110-43F7-B010-2859A1BD2AFE}" = Adobe Encore CS3
"{58DCEEE5-532E-44F4-B1D7-A146EF9E9FDA}" = Adobe Premiere Pro CS3
"{5A08C9D1-37AD-4A8D-90D3-33F92C578AA5}" = Microsoft SQL Server System CLR Types
"{5aa47dba-b584-4d47-a626-76e53f010201}" = JavaFX(TM) 1.2 SDK
"{5BD39911-A12F-4562-98BA-A6E03E3370B1}" = Microsoft SQL Server 2008 Database Engine Services
"{5E152D08-572A-3375-8FDE-DAD1EFB379BA}" = Microsoft Report Viewer Redistributable 2008
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{616C6F39-4CE1-3434-A665-2F6A04C09A7F}" = Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{63B9BAB5-F36A-4A3B-9E5C-68A7F212BFB9}" = TerraTec Home Cinema
"{64665955-E1A1-4A8B-BFFA-673A95318909}" = ArcGIS Desktop 10
"{65FBA21B-7F80-4E4E-B275-0958D2648F94}_is1" = Java-Editor 9.14
"{681F4E9F-34E0-36BD-BF2C-100554E403A5}" = Microsoft Visual F# 2.0 Runtime Language Pack - DEU
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6A86554B-8928-30E4-A53C-D7337689134D}" = Microsoft Visual C++ 2010  x86 Runtime - 10.0.30319
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6B708481-748A-4EB4-97C1-CD386244FF77}" = Adobe MotionPicture Color Files
"{6BBAA81D-6A7E-43AD-8889-2F002DCAAFDD}" = AHV content for Acrobat and Flash
"{6CDEAD7E-F8D8-37F7-AB6F-1E22716E30F3}" = Microsoft Visual Studio Macro Tools
"{6D172D0A-B9F1-4046-AFAB-8599288545BF}" = Safari
"{6E93D44A-870D-823C-F0B2-09D96E8DE87B}" = Adobe Captivate Reviewer 1.0
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{729A3000-BC8A-3B74-BA5D-5068FE12D70C}" = Microsoft Visual F# 2.0 Runtime
"{73B5D990-04EA-4751-B10F-5534770B91F2}" = Adobe Color EU Recommended Settings
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7ACFB90E-8FD0-4397-AD3A-5195412623A3}" = Adobe Help Viewer CS3
"{7B4D193B-D76D-308B-8B12-5D9BB1CBCE6C}" = Microsoft Visual Basic Power Packs 3.0
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{7FC7AD70-1DF3-4B84-9AA2-4FB680F45572}_is1" = Hex-Editor MX
"{845A8DB9-8802-4FD3-9FE3-938A6C46A2EC}" = Adobe Video Profiles
"{85262A06-2D8C-4BC1-B6ED-5A705D09CFFC}" = Apache HTTP Server 2.2.15
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C640345-AF96-4ABA-A697-97D2A0B8C6DB}" = Adobe Flash CS3
"{8D1E61D1-1395-4E97-997F-D002DB3A5074}" = OpenOffice.org 3.2
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{2AB528A5-BB1B-4EBE-8E51-AD0C4CD33CA9}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{3EC77D26-799B-4CD8-914F-C1565E796173}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{430971B1-C31E-45DA-81E0-72C095BAB72C}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{58FC5E37-DD28-4D4A-A549-125744C6763C}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{BEE75E01-DD3F-4D5F-B96C-609E6538D419}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{888B9AC7-8F5C-456B-A27A-157A6C310E52}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{91F54E1D-804A-46D8-A56C-53EA9C4B3177}" = Microsoft Silverlight 3 SDK - Deutsch
"{926C96FB-9D0A-4504-8000-C6D3A4A3118E}" = Java DB 10.4.2.1
"{929F5BFC-60F0-34EC-A50B-2001AAC03D56}" = Microsoft Team Foundation Server 2010 Object Model - DEU
"{92C5C058-E941-47C3-B7E8-38A79C605969}" = Microsoft SQL Server 2008 R2 Transact-SQL Language Service
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{935CD2F3-D5EF-F7DE-1FB7-9BC05B75833A}" = Adobe Captivate Quiz Results Analyzer
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{951B0F30-9F1A-4BF6-B3DA-99EB0E917B1C}" = FARO LS 1.1.406.58
"{9802B19D-04B3-7D0A-B76B-8B3C2931D8BD}" = Adobe Captivate Quiz Results Analyzer
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9AA2D735-3375-42D4-9A61-3FFEF82599D6}" = Unterstützungsdateien für Microsoft SQL Server 2008-Setup 
"{9C3B8582-A72A-4835-8903-877A834407BB}" = Microsoft SQL Server 2008 R2-Datenebenenanwendungs-Framework
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{9F21636C-AF0F-11E1-A68F-DB94DA02BCD2}" = Adobe Captivate 6 (32 Bit)
"{A106D33E-6B43-42C0-9BFC-D03303261FA7}" = Microsoft SQL Server 2008 R2 Management Objects
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
"{A6B23EFA-6590-482C-A11F-5ACE1B91F5B9}" = Adobe Soundbooth CS3
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A83279FD-CA4B-4206-9535-90974DE76654}" = Apple Application Support
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA13414C-F583-4125-B8C9-62912FE27E9E}" = EPD-7.2-2
"{ABBACAD2-4DAF-490E-932B-E330B33FCF98}" = Softi FreeOCR
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-1033-F400-7760-000000000003}" = Adobe Acrobat 8 Professional - English, Français, Deutsch
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{ACE28263-76A4-4BF5-B6F4-8BD719595969}" = Microsoft SQL Server Database Publishing Wizard 1.4
"{AD5BB69E-E6C9-42BE-BC50-76AA550EB37F}" = OpenAFS for Windows
"{AF37176A-78CA-545B-34EF-8B6A21514DD1}" = Adobe Help Manager
"{B001064C-D061-4BAE-9031-416A838D5536}" = Adobe Flash Player 10 ActiveX
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B5153233-9AEE-4CD4-9D2C-4FAAC870DBE2}" = Microsoft SQL Server 2008 Database Engine Services
"{B671CBFD-4109-4D35-9252-3062D3CCB7B2}" = Adobe SING CS3
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B6D38690-755E-4F40-A35A-23F8BC2B86AC}" = Microsoft_VC90_MFCLOC_x86
"{B73CFB12-C814-4638-AFFD-7E3AAFAF0B4E}" = Adobe BridgeTalk Plugin CS3
"{B7E38540-E355-3503-AFD7-635B2F2F76E1}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974
"{B8B7A4D8-80E1-4DAE-BD33-7FD535BA3931}" = Adobe Encore CS3 Codecs
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{BC4AE628-81A4-4FC6-863A-7A9BA2E2531F}" = Nokia Connectivity Cable Driver
"{BCEDD813-269C-4D8F-A4BA-01FDC66254D3}" = Adobe Flash Video Encoder
"{BE5F3842-8309-4754-92D5-83E02E6077A3}" = Adobe Extension Manager CS3
"{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2
"{C4901881-CA4A-48BD-BD48-C4CA87C1DD7C}" = Adobe Captivate 4
"{C5BD220A-EFE8-48A5-B70E-9503D535FACE}" = Adobe WAS CS3
"{C8D7A672-F697-4572-AC62-C856053A8DBC}" = Adobe Illustrator CS3
"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{C965F01C-76EA-4BD7-973E-46236AE312D7}" = Sql Server Customer Experience Improvement Program
"{C9D456FD-C25B-49DE-AA71-6B76D6550B23}" = Adobe Fireworks CS3
"{CE026CFE-73FE-4FED-9D5F-2C8D4DB512B0}" = TuneUp Utilities Language Pack (de-DE)
"{CFCB8616-A5D1-4281-80E8-389F685BFAE2}" = Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 DEU
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{D074DC76-F6C9-440E-A1D0-1DE958417FDB}" = Microsoft SQL Server VSS Writer
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{D3C605D8-3A5E-4BAD-965D-2C61441BF2AC}" = Adobe Photoshop CS3
"{D5A31AB1-345D-47C7-A87B-036A669F6DF1}" = Adobe XMP Panels CS3
"{D6A6CFAD-CD86-482B-90D1-6FCC4E252ACD}" = Microsoft Sync Services for ADO.NET v2.0 SP1 (x86) de
"{D7B96D96-D9F4-40B7-B913-3D50BDD87C6F}" = Suite Shared Configuration CS4
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DA896917-C1DA-45B2-B4D2-68162F16C0DD}" = Adobe Creative Suite 3 Master Collection
"{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}" = Adobe Color Common Settings
"{DB0AF767-7CC7-4E4D-B6BE-A200F20A2FB1}" = Microsoft Sync Framework Runtime v1.0 SP1 (x86) de
"{DBE8431C-CF9A-38C3-B42D-28B6FCE1EA3B}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{DE0A6C3C-81A2-644C-D9E5-7A2E3C744EBC}" = Adobe Captivate - SWF to HTML5 Converter
"{DFFDDCF5-CB32-4354-8823-1B9E68025953}" = Adobe Setup
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E4E9CBC9-1CF5-48E3-AF6F-1AB44A856346}" = Microsoft ASP.NET MVC 2 - DEU
"{E59113EB-0285-4BFD-A37A-B79EAC6B8F4B}" = Microsoft SQL Server Compact 3.5 SP1 English
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{E6FA148F-1E7D-4A42-A9A2-7DFABC2C6A2B}" = SportTracks 2.1
"{E95E230C-0AAA-4221-9AB4-0A2D5BC33F18}" = Gaia 3
"{EA7B3CC4-366D-4CF6-8350-FD7A7034116E}" = Adobe InDesign CS3 Icon Handler
"{EAF7B35C-DCBE-4032-9ABF-C35C43D07124}" = Microsoft Sync Framework Services v1.0 SP1 (x86) de
"{EB0202F7-016A-410C-ADE4-40F848CCC661}" = Adobe After Effects CS3
"{EC66418E-DAA2-36D5-809E-40BEC94E622A}" = Microsoft Visual Studio Macro Tools - DEU Language Pack
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.8
"{EFFA53BC-8C04-2E21-3D90-A13B1697B0CA}" = Dragon NaturallySpeaking 11
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F3494AB6-6900-41C6-AF57-823626827ED8}" = Microsoft SQL Server 2008 Database Engine Shared
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F9FAC696-2E48-497D-B820-C9A65DA630DF}" = Adobe eLearning Suite 2.5
"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR
"{FF29A7E2-FF40-4D07-B7E4-2093DE59E10A}" = Adobe Color NA Extra Settings
"{FF3E2850-BD2E-4B56-A89D-21E588D518E0}" = Adobe Contribute CS3
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{FF6F95A4-E59B-45C8-BEA8-0BDC8D9CAB51}" = Microsoft SQL Server 2008 Common Files
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe SVG Viewer" = Adobe SVG Viewer 3.0
"Adobe_1e92effc954e788ad49a56b24f4bcf1" = Adobe Captivate 4
"Adobe_67a7fb1e97aa14ee9ef0950eb6fd757" = Adobe Creative Suite 3 Master Collection hinzufügen oder entfernen
"AdobeCaptivateReviewer2.5.D22673E681B55698FF9C7ED1AC2C76EECFF3CF3F.1" = Adobe Captivate Reviewer
"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.9
"ArcGIS Desktop 10" = ArcGIS Desktop 10
"Avira AntiVir Desktop" = Avira Free Antivirus
"Bytescout Lossless Video Codec_is1" = Bytescout Lossless Video Codec 1.00.187 (FREEWARE)
"BytescoutLosslessCodec" = Bytescout Lossless Codec
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Help Manager
"CPSWFTOHTMLConverter" = Adobe Captivate - SWF to HTML5 Converter
"Dev-C++" = Dev-C++ 5 beta 9 release (4.9.9.2)
"DivX Setup.divx.com" = DivX-Setup
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Free FLV Converter_is1" = Free FLV Converter V 7.4.0
"FreeCommander_is1" = FreeCommander 2009.02a
"GameSpy Arcade" = GameSpy Arcade
"GanttProject" = GanttProject
"GDAL-py2.6" = Python 2.6 GDAL-1.6.1
"GeoServer 2.0.1" = GeoServer 2.0.1
"Google Chrome" = Google Chrome
"GPL Ghostscript 8.71" = GPL Ghostscript 8.71
"GSview 4.9" = GSview 4.9
"hotpot_is1" = HotPotatoes v 6.3.0.4
"IrfanView" = IrfanView (remove only)
"JGeoPro_is1" = 9.11.24x
"Kalender-Excel_is1" = Kalender-Excel 8.6.1
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"MatlabR2009a" = MATLAB R2009a
"MediaConverter" = MediaConverter 1.2.8
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0
"Microsoft Help Viewer 1.0 Language Pack - DEU" = Microsoft Help Viewer 1.0 Language Pack - DEU
"Microsoft Report Viewer Redistributable 2008" = Microsoft Report Viewer Redistributable 2008
"Microsoft SQL Server 10" = Microsoft SQL Server 2008
"Microsoft SQL Server 10 Release" = Microsoft SQL Server 2008
"Microsoft Team Foundation Server 2010 Object Model - DEU" = Microsoft Team Foundation Server 2010-Objektmodell - DEU
"Microsoft Visual Studio 2010 Tools for Office Runtime (x86)" = Microsoft Visual Studio 2010 Tools for Office Runtime (x86)
"Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU" = Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x86) Language Pack - DEU
"Microsoft Visual Studio Macro Tools" = Microsoft Visual Studio Macro Tools
"Microsoft Visual Studio Macro Tools - DEU Language Pack" = Microsoft Visual Studio Macro Tools - DEU Language Pack
"Miro Video Converter" = Miro Video Converter
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"Mozilla Thunderbird 14.0 (x86 de)" = Mozilla Thunderbird 14.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Next ESA SAR Toolbox 4B-1.0" = Next ESA SAR Toolbox
"numpy-py2.6" = Python 2.6 numpy-1.6.1
"Open Jump (PIROL Edition)" = Open Jump (PIROL Edition)
"OpenCV" = Open Source Computer Vision Library
"OpenJUMP" = OpenJUMP 1.3
"Opera 11.64.1403" = Opera 11.64
"pgJDBC 8.4-701-1" = pgJDBC 8.4-701
"PIL-py2.6" = Python 2.6 PIL-1.1.7
"PostGIS 1.4 for PostgreSQL 8.4" = PostGIS 1.4.0 for PostgreSQL 8.4 (remove only)
"PostgreSQL 8.4" = PostgreSQL 8.4
"PSPad editor_is1" = PSPad editor
"psqlODBC 08.04.0100-1" = psqlODBC 08.04.0100
"QuizResultsAnalyzer.C0CA58D26EB27EF0DDD094CE3C4337F3360F5EE2.1" = Adobe Captivate Quiz Results Analyzer
"QuizResultsAnalyzer1.5.D22673E681B55698FF9C7ED1AC2C76EECFF3CF3F.1" = Adobe Captivate Quiz Results Analyzer
"R for Windows 2.12.0_is1" = R for Windows 2.12.0
"scipy-py2.6" = Python 2.6 scipy-0.10.1
"Synovel Spicebird (0.8)" = Synovel Spicebird (0.8)
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"TileMill" = TileMill 0.9.0
"Tinn-R_is1" = Tinn-R 2.3.7.1
"Trillian" = Trillian
"VLC media player" = VLC media player 1.0.2
"VP Suite 5.3" = VP Suite 5.3
"Winamp" = Winamp
"WinRAR archiver" = WinRAR archiver
"WinZip" = WinZip
"WirelessMon_is1" = WirelessMon V4.0
"yEd Graph Editor 3.4.2" = yEd Graph Editor 3.4.2
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Game Organizer" = EasyBits GO
"Google Chrome" = Google Chrome
"STANLY Track EDDH" = STANLY Track EDDH
"yEd Graph Editor" = yEd Graph Editor
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 15.08.2012 17:54:40 | Computer Name = carsten-PC | Source = AFS Client | ID = 4130
Description = OpenAFS Stopping due to error (afsd_service.c:1276): can't find root
 volume in root cell.
 
Error - 16.08.2012 03:40:08 | Computer Name = carsten-PC | Source = AFS Client | ID = 4130
Description = OpenAFS Stopping due to error (afsd_service.c:1276): can't find root
 volume in root cell.
 
Error - 16.08.2012 03:54:07 | Computer Name = carsten-PC | Source = AFS Client | ID = 4130
Description = OpenAFS Stopping due to error (afsd_service.c:1276): can't find root
 volume in root cell.
 
Error - 16.08.2012 03:56:47 | Computer Name = carsten-PC | Source = AFS Client | ID = 4130
Description = OpenAFS Stopping due to error (afsd_service.c:1276): can't find root
 volume in root cell.
 
Error - 16.08.2012 04:18:35 | Computer Name = carsten-PC | Source = AFS Client | ID = 4130
Description = OpenAFS Stopping due to error (afsd_service.c:1276): can't find root
 volume in root cell.
 
Error - 16.08.2012 04:20:16 | Computer Name = carsten-PC | Source = AFS Client | ID = 4130
Description = OpenAFS Stopping due to error (afsd_service.c:1276): can't find root
 volume in root cell.
 
Error - 16.08.2012 04:59:49 | Computer Name = carsten-PC | Source = AFS Client | ID = 4130
Description = OpenAFS Stopping due to error (afsd_service.c:1276): can't find root
 volume in root cell.
 
Error - 16.08.2012 05:05:09 | Computer Name = carsten-PC | Source = AFS Client | ID = 4130
Description = OpenAFS Stopping due to error (afsd_service.c:1276): can't find root
 volume in root cell.
 
Error - 16.08.2012 05:08:48 | Computer Name = carsten-PC | Source = AFS Client | ID = 4130
Description = OpenAFS Stopping due to error (afsd_service.c:1276): can't find root
 volume in root cell.
 
Error - 16.08.2012 08:42:14 | Computer Name = carsten-PC | Source = AFS Client | ID = 4130
Description = OpenAFS Stopping due to error (afsd_service.c:1276): can't find root
 volume in root cell.
 
[ OSession Events ]
Error - 27.07.2010 08:52:06 | Computer Name = carsten-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6211.1000, Microsoft Office Version: 12.0.6215.1000. This session lasted 2055
 seconds with 900 seconds of active time.  This session ended with a crash.
 
Error - 05.07.2012 07:16:18 | Computer Name = carsten-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6211.1000, Microsoft Office Version: 12.0.6215.1000. This session lasted 6309
 seconds with 660 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 16.08.2012 09:06:20 | Computer Name = carsten-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 16.08.2012 09:09:56 | Computer Name = carsten-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 16.08.2012 09:09:56 | Computer Name = carsten-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 16.08.2012 09:09:56 | Computer Name = carsten-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 16.08.2012 09:13:28 | Computer Name = carsten-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 16.08.2012 09:13:28 | Computer Name = carsten-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 16.08.2012 09:13:28 | Computer Name = carsten-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 16.08.2012 09:17:02 | Computer Name = carsten-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 16.08.2012 09:17:02 | Computer Name = carsten-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 16.08.2012 09:17:02 | Computer Name = carsten-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
 
< End of report >
         

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

• Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
• Starte die OTL.exe.
  Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
• Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:

:OTL
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC 
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}: "URL" = http://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms} 
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2776682 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.searchqu.com/413 
IE - HKCU\..\URLSearchHook: {51a86bb3-6602-4c85-92a5-130ee4864f13} - No CLSID value found 
IE - HKCU\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} 
IE - HKCU\..\SearchScopes\{052A1970-A861-4835-A805-C198CA0EF5D3}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=TRL2&o=15902&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=TW&apn_dtid=YYYYYYYYDE&apn_uid=54FB0585-3FB0-4CBB-AC73-7CE0167B8628&apn_sauid=857E0342-93AA-4641-9B6E-26C66AF693B6 
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC 
IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}: "URL" = http://dts.search-results.com/sr?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms} 
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2776682 
IE - HKCU\..\SearchScopes\{DC52F059-EF38-4ACC-8431-6D5765822AA9}: "URL" = http://www.google.de/search?q={searchTerms} 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
FF - prefs.js..browser.search.defaultengine: "Ask.com" 
FF - prefs.js..browser.search.defaultenginename: "Search Results" 
FF - prefs.js..browser.search.defaultthis.engineName: "BrotherSoft Extreme Customized Web Search" 
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2776682&SearchSource=3&q={searchTerms}" 
FF - prefs.js..browser.search.order.1: "Search Results" 
FF - prefs.js..browser.search.selectedEngine: "Google" 
FF - prefs.js..browser.search.useDBForOrder: true 
FF - prefs.js..browser.startup.homepage: "about:blank" 
FF - prefs.js..keyword.URL: "http://dts.search-results.com/sr?src=ffb&appid=0&systemid=413&sr=0&q=" 
FF - user.js - File not found 
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found 
O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\WIA6EB~1\Datamngr\ToolBar\searchqudtx.dll File not found 
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\WIA6EB~1\Datamngr\ToolBar\searchqudtx.dll File not found 
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. 
O4 - HKLM..\Run: [AdobeCS5.5ServiceManager] "C:\Program Files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin File not found 
O4 - HKLM..\Run: [WPDShServiceObj] C:\Users\carsten\AppData\Local\Microsoft\Windows\1915\WPDShServiceObj.exe () 
O4 - Startup: C:\Users\carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\carsten\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) 
O4 - Startup: C:\Users\carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) 
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) 
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) 
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) 
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 
O32 - HKLM CDRom: AutoRun - 1 
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] 
O33 - MountPoints2\{e88a7161-d79a-11de-899f-002318f1034d}\Shell - "" = AutoRun 
O33 - MountPoints2\{e88a7161-d79a-11de-899f-002318f1034d}\Shell\AutoRun\command - "" = G:\SETUP.EXE 
[2012.08.15 16:31:06 | 000,000,000 | -HSD | C] -- C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936} 

[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] 

@Alternate Data Stream - 242 bytes -> C:\ProgramData\Temp:0FF263E8 
[2011.09.21 09:27:32 | 000,002,396 | ---- | M] () -- C:\Users\carsten\AppData\Roaming\Mozilla\Firefox\Profiles\fu92pvm9.default\searchplugins\askcom.xml 
[2012.08.16 14:42:26 | 000,000,000 | ---D | C] -- C:\Users\carsten\AppData\Roaming\hellomoto 
[2012.08.16 14:41:46 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job 
[2012.08.15 16:14:01 | 000,001,100 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job 
:Files

ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
         

• Schließe alle Programme.
• Klicke auf den Fix Button.
• Wenn OTL einen Neustart verlangt, bitte zulassen.
• Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
  Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

Danke für die Hilfe. In der Zwischen Zeit habe ich mit der Kaspersiky Resuce CD bzw. mit dem speziellen Trojaner Kaspersky Notfall-CD 10 herunterladen Programm enige Trojaner löschen können. hxxp://support.kaspersky.com/de/faq/?qid=207621612 Das klappte alles ohne Problem nach der guten Beschreibung. Jetzt ist auch mein Bildschrim nicht mehr gesperrt. Ich habe danach noch ein paar mal anti-viren- und maleware programme rüber laufen lassen, die bis dato nicht gefunden haben. Kann ich das gegeben Script auch jetzt noch Problem los ausführen lassen um sicher zu gehen das wirklich alles schädliche teile gelöscht werden oder kann es dadurch nun zu problemen mit meinem Betriebssystem kommen?

Vielen Dank für die Hilfe

Fuehre den Fix aus.

Dein System ist weder sauber noch abgesichert.

So hier ist mal das Log-File. Eine kleine frage was genau hat der Code eigentlich so gemacht den ich ausgeführt habe?

All processes killed
========== OTL ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{51a86bb3-6602-4c85-92a5-130ee4864f13} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{51a86bb3-6602-4c85-92a5-130ee4864f13}\ not found.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{052A1970-A861-4835-A805-C198CA0EF5D3}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{052A1970-A861-4835-A805-C198CA0EF5D3}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DC52F059-EF38-4ACC-8431-6D5765822AA9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DC52F059-EF38-4ACC-8431-6D5765822AA9}\ not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
Prefs.js: "Ask.com" removed from browser.search.defaultengine
Prefs.js: "Search Results" removed from browser.search.defaultenginename
Prefs.js: "BrotherSoft Extreme Customized Web Search" removed from browser.search.defaultthis.engineName
Prefs.js: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2776682&SearchSource=3&q={searchTerms}" removed from browser.search.defaulturl
Prefs.js: "Search Results" removed from browser.search.order.1
Prefs.js: "Google" removed from browser.search.selectedEngine
Prefs.js: true removed from browser.search.useDBForOrder
Prefs.js: "about:blank" removed from browser.startup.homepage
Prefs.js: "hxxp://dts.search-results.com/sr?src=ffb&appid=0&systemid=413&sr=0&q=" removed from keyword.URL
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@microsoft.com/GENUINE\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99079a25-328f-4bd4-be04-00955acaa0a7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{99079a25-328f-4bd4-be04-00955acaa0a7} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\10 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeCS5.5ServiceManager deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\WPDShServiceObj not found.
File C:\Users\carsten\AppData\Local\Microsoft\Windows\1915\WPDShServiceObj.exe not found.
C:\Users\carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk moved successfully.
C:\Users\carsten\AppData\Roaming\Dropbox\bin\Dropbox.exe moved successfully.
C:\Users\carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk moved successfully.
C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLUA deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\PromptOnSecureDesktop deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_USERS\.DEFAULT\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-676213429-3020436486-3576442665-1003\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-676213429-3020436486-3576442665-1003\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
C:\Windows\Downloaded Program Files\gp.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e88a7161-d79a-11de-899f-002318f1034d}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e88a7161-d79a-11de-899f-002318f1034d}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e88a7161-d79a-11de-899f-002318f1034d}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e88a7161-d79a-11de-899f-002318f1034d}\ not found.
File G:\SETUP.EXE not found.
C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936} folder moved successfully.
C:\Windows\System32\ConduitEngine.tmp deleted successfully.
ADS C:\ProgramData\Temp:0FF263E8 deleted successfully.
C:\Users\carsten\AppData\Roaming\Mozilla\Firefox\Profiles\fu92pvm9.default\searchplugins\askcom.xml moved successfully.
C:\Users\carsten\AppData\Roaming\hellomoto folder moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job moved successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\carsten\Desktop\cmd.bat deleted successfully.
C:\Users\carsten\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: carsten
->Temp folder emptied: 6840442607 bytes
->Temporary Internet Files folder emptied: 393575576 bytes
->Java cache emptied: 110919978 bytes
->FireFox cache emptied: 545377113 bytes
->Google Chrome cache emptied: 200401202 bytes
->Apple Safari cache emptied: 2790400 bytes
->Opera cache emptied: 21075115 bytes
->Flash cache emptied: 3148406 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56475 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Katrin
 
User: postgres
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 455995665 bytes
RecycleBin emptied: 7045752 bytes
 
Total Files Cleaned = 8.183,00 mb
 
 
OTL by OldTimer - Version 3.2.57.0 log created on 08202012_092718

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
         

Sehr gut!

Wie laeuft der Rechner?

1. Schritt

Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktualisiere die Datenbank!
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".

danach:

2. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Starte die adwcleaner.exe mit einem Doppelklick.
• Klicke auf Search.
• Nach Ende des Suchlaufs öffnet sich eine Textdatei.
• Poste mir den Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

Hallo t'john,

hier ist mal das Log-file des AdwCleaner:

# AdwCleaner v1.801 - Logfile created 08/21/2012 at 13:44:53
# Updated 14/08/2012 by Xplode
# Operating system : Windows 7 Professional Service Pack 1 (32 bits)
# User : carsten - CARSTEN-PC
# Boot Mode : Normal
# Running from : C:\Users\carsten\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****

Folder Found : C:\Users\carsten\AppData\Local\Conduit
Folder Found : C:\Users\carsten\AppData\LocalLow\searchquband
Folder Found : C:\Users\carsten\AppData\Roaming\OpenCandy
Folder Found : C:\Users\carsten\AppData\Roaming\Mozilla\Firefox\Profiles\fu92pvm9.default\Conduit
Folder Found : C:\Users\carsten\AppData\Roaming\Mozilla\Firefox\Profiles\fu92pvm9.default\ConduitCommon
Folder Found : C:\ProgramData\boost_interprocess

***** [Registry] *****
[*] Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT2776682
Key Found : HKCU\Software\AppDataLow\Software\searchqutoolbar
Key Found : HKCU\Software\DataMngr
Key Found : HKCU\Software\Headlight
Key Found : HKCU\Software\Softonic
Key Found : HKLM\SOFTWARE\Classes\Conduit.Engine
Key Found : HKLM\SOFTWARE\Conduit
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS

***** [Registre - GUID] *****

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]

***** [Internet Browsers] *****

#NAME?

[OK] Registry is clean.

#NAME?

Profile name : default 
File : C:\Users\carsten\AppData\Roaming\Mozilla\Firefox\Profiles\fu92pvm9.default\prefs.js

"Found : user_pref(""CT2776682..clientLogIsEnabled"", true);"
"Found : user_pref(""CT2776682..clientLogServiceUrl"", ""hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]"
"Found : user_pref(""CT2776682..uninstallLogServiceUrl"", ""hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]"
"Found : user_pref(""CT2776682.AboutPrivacyUrl"", ""hxxp://www.conduit.com/privacy/Default.aspx"");"
"Found : user_pref(""CT2776682.BrowserCompStateIsOpen_129453492929819378"", true);"
"Found : user_pref(""CT2776682.BrowserCompStateIsOpen_129512039755754602"", true);"
"Found : user_pref(""CT2776682.CT2776682"", ""CT2776682"");"
"Found : user_pref(""CT2776682.CurrentServerDate"", ""26-6-2011"");"
"Found : user_pref(""CT2776682.DialogsGetterLastCheckTime"", ""Sun Jun 26 2011 12:10:34 GMT+0200"");"
"Found : user_pref(""CT2776682.DownloadReferralCookieData"", """");"
"Found : user_pref(""CT2776682.EMailNotifierPollDate"", ""Sun Jun 26 2011 14:44:50 GMT+0200"");"
"Found : user_pref(""CT2776682.FirstServerDate"", ""20-6-2011"");"
"Found : user_pref(""CT2776682.FirstTime"", true);"
"Found : user_pref(""CT2776682.FirstTimeFF3"", true);"
"Found : user_pref(""CT2776682.FixPageNotFoundErrors"", true);"
"Found : user_pref(""CT2776682.GroupingServerCheckInterval"", 1440);"
"Found : user_pref(""CT2776682.GroupingServiceUrl"", ""hxxp://grouping.services.conduit.com/"");"
"Found : user_pref(""CT2776682.HasUserGlobalKeys"", true);"
"Found : user_pref(""CT2776682.HomePageProtectorEnabled"", true);"
"Found : user_pref(""CT2776682.Initialize"", true);"
"Found : user_pref(""CT2776682.InitializeCommonPrefs"", true);"
"Found : user_pref(""CT2776682.InstallationAndCookieDataSentCount"", 3);"
"Found : user_pref(""CT2776682.InstalledDate"", ""Mon Jun 20 2011 19:14:30 GMT+0200"");"
"Found : user_pref(""CT2776682.InvalidateCache"", false);"
"Found : user_pref(""CT2776682.IsAlertDBUpdated"", true);"
"Found : user_pref(""CT2776682.IsGrouping"", false);"
"Found : user_pref(""CT2776682.IsMulticommunity"", false);"
"Found : user_pref(""CT2776682.IsOpenThankYouPage"", true);"
"Found : user_pref(""CT2776682.IsOpenUninstallPage"", true);"
"Found : user_pref(""CT2776682.LanguagePackReloadIntervalMM"", 1440);"
"Found : user_pref(""CT2776682.LanguagePackServiceUrl"", ""hxxp://translation.users.conduit.com/Translation.ashx[...]"
"Found : user_pref(""CT2776682.LastLogin_3.3.3.2"", ""Sat Jun 25 2011 22:37:39 GMT+0200"");"
"Found : user_pref(""CT2776682.LastLogin_3.5.0.12"", ""Sun Jun 26 2011 12:10:34 GMT+0200"");"
"Found : user_pref(""CT2776682.LatestVersion"", ""3.3.3.2"");"
"Found : user_pref(""CT2776682.MyStuffEnabledAtInstallation"", true);"
"Found : user_pref(""CT2776682.RadioIsPodcast"", false);"
"Found : user_pref(""CT2776682.RadioLastCheckTime"", ""Sun Jun 26 2011 12:10:34 GMT+0200"");"
"Found : user_pref(""CT2776682.RadioLastUpdateIPServer"", ""3"");"
"Found : user_pref(""CT2776682.RadioLastUpdateServer"", ""3"");"
"Found : user_pref(""CT2776682.RadioMediaID"", ""9962"");"
"Found : user_pref(""CT2776682.RadioMediaType"", ""Media Player"");"
"Found : user_pref(""CT2776682.RadioMenuSelectedID"", ""EBRadioMenu_CT27766829962"");"
"Found : user_pref(""CT2776682.RadioShrinkedFromSetup"", false);"
"Found : user_pref(""CT2776682.RadioStationName"", ""California%20Rock"");"
"Found : user_pref(""CT2776682.RadioStationURL"", ""hxxp://feedlive.net/california.asx"");"
"Found : user_pref(""CT2776682.SHRINK_TOOLBAR"", 1);"
"Found : user_pref(""CT2776682.SavedHomepage"", ""chrome://branding/locale/browserconfig.properties"");"
"Found : user_pref(""CT2776682.SearchEngineBeforeUnload"", ""chrome://browser-region/locale/region.properties"");"
"Found : user_pref(""CT2776682.SearchFromAddressBarIsInit"", true);"
"Found : user_pref(""CT2776682.SearchFromAddressBarUrl"", ""hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT277[...]"
"Found : user_pref(""CT2776682.SearchInNewTabEnabled"", true);"
"Found : user_pref(""CT2776682.SearchInNewTabIntervalMM"", 1440);"
"Found : user_pref(""CT2776682.SearchInNewTabLastCheckTime"", ""Sun Jun 26 2011 12:10:35 GMT+0200"");"
"Found : user_pref(""CT2776682.SearchInNewTabServiceUrl"", ""hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]"
"Found : user_pref(""CT2776682.SearchInNewTabUsageUrl"", ""hxxp://Usage.Hosting.conduit-services.com/UsageServic[...]"
"Found : user_pref(""CT2776682.SearchProtectorEnabled"", false);"
"Found : user_pref(""CT2776682.SearchProtectorToolbarDisabled"", false);"
"Found : user_pref(""CT2776682.ServiceMapLastCheckTime"", ""Sun Jun 26 2011 12:10:34 GMT+0200"");"
"Found : user_pref(""CT2776682.SettingsLastCheckTime"", ""Sun Jun 26 2011 14:48:15 GMT+0200"");"
"Found : user_pref(""CT2776682.ThirdPartyComponentsInterval"", 504);"
"Found : user_pref(""CT2776682.ThirdPartyComponentsLastCheck"", ""Mon Jun 20 2011 19:14:08 GMT+0200"");"
"Found : user_pref(""CT2776682.ThirdPartyComponentsLastUpdate"", ""1246786978"");"
"Found : user_pref(""CT2776682.ToolbarShrinkedFromSetup"", false);"
"Found : user_pref(""CT2776682.TrusteLinkUrl"", ""hxxp://trust.conduit.com/CT2776682"");"
"Found : user_pref(""CT2776682.TrustedApiDomains"", ""conduit.com,conduit-hosting.com,conduit-services.com,OurTo[...]"
"Found : user_pref(""CT2776682.UserID"", ""UN65183768113337236"");"
"Found : user_pref(""CT2776682.ValidationData_Search"", 0);"
"Found : user_pref(""CT2776682.ValidationData_Toolbar"", 2);"
"Found : user_pref(""CT2776682.WeatherNetwork"", """");"
"Found : user_pref(""CT2776682.WeatherPollDate"", ""Sun Jun 26 2011 14:40:51 GMT+0200"");"
"Found : user_pref(""CT2776682.WeatherUnit"", ""C"");"
"Found : user_pref(""CT2776682.approveUntrustedApps"", true);"
"Found : user_pref(""CT2776682.backendstorage.2776682a129520874668948567000000paramsgk0"", ""7B22757064617465526[...]"
"Found : user_pref(""CT2776682.backendstorage.rssapp2776682a129520874668948567000000cat0"", ""253542253742253232[...]"
"Found : user_pref(""CT2776682.backendstorage.rssapp2776682a129520874668948567000000embeddedversion"", ""312E312[...]"
"Found : user_pref(""CT2776682.backendstorage.rssapp2776682a129520874668948567000000feedsobj"", ""25374225323263[...]"
"Found : user_pref(""CT2776682.backendstorage.rssapp2776682a129520874668948567000000lastreporttime"", ""31333039[...]"
"Found : user_pref(""CT2776682.backendstorage.rssapp2776682a129520874668948567000000newfeeds"", ""6E657746656564[...]"
"Found : user_pref(""CT2776682.backendstorage.rssapp2776682a129520874668948567000000readitemsarr"", ""2537422532[...]"
"Found : user_pref(""CT2776682.components.1000034"", true);"
"Found : user_pref(""CT2776682.components.1000234"", true);"
"Found : user_pref(""CT2776682.generalConfigFromLogin"", ""{\""SocialDomains\"":\""social.conduit.com;apps.conduit.[...]"
"Found : user_pref(""CT2776682.globalFirstTimeInfoLastCheckTime"", ""Sun Jun 26 2011 12:10:35 GMT+0200"");"
"Found : user_pref(""CT2776682.homepageProtectorEnableByLogin"", true);"
"Found : user_pref(""CT2776682.initDone"", true);"
"Found : user_pref(""CT2776682.isAppTrackingManagerOn"", true);"
"Found : user_pref(""CT2776682.isFirstRadioInstallation"", false);"
"Found : user_pref(""CT2776682.myStuffEnabled"", true);"
"Found : user_pref(""CT2776682.myStuffPublihserMinWidth"", 400);"
"Found : user_pref(""CT2776682.myStuffSearchUrl"", ""hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]"
"Found : user_pref(""CT2776682.myStuffServiceIntervalMM"", 1440);"
"Found : user_pref(""CT2776682.myStuffServiceUrl"", ""hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]"
"Found : user_pref(""CT2776682.oldAppsList"", ""129288498392881552,129288498393350308,111,129512039755754602,129[...]"
"Found : user_pref(""CT2776682.searchProtectorDialogDelayInSec"", 10);"
"Found : user_pref(""CT2776682.searchProtectorEnableByLogin"", true);"
"Found : user_pref(""CT2776682.testingCtid"", """");"
"Found : user_pref(""CT2776682.toolbarAppMetaDataLastCheckTime"", ""Sun Jun 26 2011 12:10:34 GMT+0200"");"
"Found : user_pref(""CT2776682.toolbarContextMenuLastCheckTime"", ""Mon Jun 20 2011 19:14:13 GMT+0200"");"
"Found : user_pref(""CT2776682.usagesFlag"", 2);"
"Found : user_pref(""CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/909619/905414/DE"", ""\""0\"""")[...]"
"Found : user_pref(""CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2776682"", [...]"
"Found : user_pref(""CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]"
"Found : user_pref(""CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]"
"Found : user_pref(""CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]"
"Found : user_pref(""CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]"
"Found : user_pref(""CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg"", ""\[...]"
"Found : user_pref(""CommunityToolbar.ETag.hxxp://dynamicdialogs.engine.conduit-services.com/DLG.pkg?ver=3.3.3[...]"
"Found : user_pref(""CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.3.[...]"
"Found : user_pref(""CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.5.[...]"
"Found : user_pref(""CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2776682"",[...]"
"Found : user_pref(""CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=3/13/20[...]"
"Found : user_pref(""CommunityToolbar.ETag.hxxp://settings.toolbar.search.conduit.com/root/CT2776682/CT2776682[...]"
"Found : user_pref(""CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Mint/equalizer_dea[...]"
"Found : user_pref(""CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Mint/minimize.gif""[...]"
"Found : user_pref(""CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Mint/play.gif"", ""\[...]"
"Found : user_pref(""CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Mint/stop.gif"", ""\[...]"
"Found : user_pref(""CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Mint/vol.gif"", ""\""[...]"
"Found : user_pref(""CommunityToolbar.EngineOwner"", """");"
"Found : user_pref(""CommunityToolbar.EngineOwnerGuid"", ""{51a86bb3-6602-4c85-92a5-130ee4864f13}"");"
"Found : user_pref(""CommunityToolbar.EngineOwnerToolbarId"", ""brothersoft_extreme"");"
"Found : user_pref(""CommunityToolbar.IsEngineShown"", true);"
"Found : user_pref(""CommunityToolbar.IsMyStuffImportedToEngine"", true);"
"Found : user_pref(""CommunityToolbar.LatestLibsPath"", ""file:///C:\\Users\\carsten\\AppData\\Roaming\\Mozilla\[...]"
"Found : user_pref(""CommunityToolbar.LatestToolbarVersionInstalled"", ""3.5.0.12"");"
"Found : user_pref(""CommunityToolbar.OriginalEngineOwner"", ""CT2776682"");"
"Found : user_pref(""CommunityToolbar.OriginalEngineOwnerGuid"", ""{51a86bb3-6602-4c85-92a5-130ee4864f13}"");"
"Found : user_pref(""CommunityToolbar.OriginalEngineOwnerToolbarId"", ""brothersoft_extreme"");"
"Found : user_pref(""CommunityToolbar.SearchFromAddressBarSavedUrl"", """");"
"Found : user_pref(""CommunityToolbar.ToolbarsList"", ""CT2776682"");"
"Found : user_pref(""CommunityToolbar.ToolbarsList2"", ""CT2776682"");"
"Found : user_pref(""CommunityToolbar.alert.alertDialogsGetterLastCheckTime"", ""Mon Jun 20 2011 19:14:14 GMT+02[...]"
"Found : user_pref(""CommunityToolbar.alert.alertEnabled"", true);"
"Found : user_pref(""CommunityToolbar.alert.alertInfoInterval"", 1440);"
"Found : user_pref(""CommunityToolbar.alert.alertInfoLastCheckTime"", ""Wed Jun 22 2011 12:48:04 GMT+0200"");"
"Found : user_pref(""CommunityToolbar.alert.clientsServerUrl"", ""hxxp://alert.client.conduit.com"");"
"Found : user_pref(""CommunityToolbar.alert.locale"", ""en"");"
"Found : user_pref(""CommunityToolbar.alert.loginIntervalMin"", 1440);"
"Found : user_pref(""CommunityToolbar.alert.loginLastCheckTime"", ""Sat Jun 25 2011 10:08:37 GMT+0200"");"
"Found : user_pref(""CommunityToolbar.alert.loginLastUpdateTime"", ""1305622559"");"
"Found : user_pref(""CommunityToolbar.alert.messageShowTimeSec"", 20);"
"Found : user_pref(""CommunityToolbar.alert.servicesServerUrl"", ""hxxp://alert.services.conduit.com"");"
"Found : user_pref(""CommunityToolbar.alert.showTrayIcon"", false);"
"Found : user_pref(""CommunityToolbar.alert.userCloseIntervalMin"", 300);"
"Found : user_pref(""CommunityToolbar.alert.userId"", ""139d80af-bde5-4d68-992f-928b84384b57"");"
"Found : user_pref(""CommunityToolbar.globalUserId"", ""6012f355-28d8-440d-bc2b-f9c4a3df57af"");"
"Found : user_pref(""CommunityToolbar.isAlertUrlAddedToFeedItemTable"", true);"
"Found : user_pref(""CommunityToolbar.isClickActionAddedToFeedItemTable"", true);"
"Found : user_pref(""CommunityToolbar.keywordURLSelectedCTID"", ""CT2776682"");"
"Found : user_pref(""CommunityToolbar.killedEngine"", true);"
"Found : user_pref(""CommunityToolbar.notifications.alertDialogsGetterLastCheckTime"", ""Sun Jun 26 2011 12:10:3[...]"
"Found : user_pref(""CommunityToolbar.notifications.alertEnabled"", true);"
"Found : user_pref(""CommunityToolbar.notifications.clientsServerUrl"", ""hxxp://alert.client.conduit.com"");"
"Found : user_pref(""CommunityToolbar.notifications.locale"", ""en"");"
"Found : user_pref(""CommunityToolbar.notifications.loginIntervalMin"", 1440);"
"Found : user_pref(""CommunityToolbar.notifications.loginLastCheckTime"", ""Sun Jun 26 2011 12:10:35 GMT+0200"");"
"Found : user_pref(""CommunityToolbar.notifications.loginLastUpdateTime"", ""1305622559"");"
"Found : user_pref(""CommunityToolbar.notifications.messageShowTimeSec"", 20);"
"Found : user_pref(""CommunityToolbar.notifications.servicesServerUrl"", ""hxxp://alert.services.conduit.com"");"
"Found : user_pref(""CommunityToolbar.notifications.showTrayIcon"", false);"
"Found : user_pref(""CommunityToolbar.notifications.userCloseIntervalMin"", 300);"
"Found : user_pref(""CommunityToolbar.notifications.userId"", ""8ae005b1-5a00-44be-8741-46e65778213c"");"
"Found : user_pref(""CommunityToolbar.undefined"", """");"

#NAME?

File : C:\Users\carsten\AppData\Local\Google\Chrome\User Data\Default\Preferences

"Found :       ""name"": ""Search Results"","
"Found :       ""search_url"": ""hxxp://dts.search-results.com/sr?src=crb&appid=0&systemid=413&sr=0&q={searchTer[...]"

#NAME?

File : C:\Users\carsten\AppData\Roaming\Opera\Opera\operaprefs.ini

Found : Home URL=hxxp://www.searchqu.com/413

*************************

AdwCleaner[R1].txt - [16011 octets] - [21/08/2012 13:44:54]

########## EOF - C:\AdwCleaner[R1].txt - [16140 octets] ##########
         

Besten Gruß

Carsten

Bitte das Malwarebytes Logfile posten!
(Reiter Logberichte)

und Hier das Log File von Malewarebytes:

Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.21.07

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
carsten :: CARSTEN-PC [Administrator]

21.08.2012 13:50:36
mbam-log-2012-08-21 (13-50-36).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 910079
Laufzeit: 3 Stunde(n), 3 Minute(n), 54 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
         

MFG

der Carsten

Sehr gut!

• Schließe alle offenen Programme und Browser.
• Starte die adwcleaner.exe mit einem Doppelklick.
• Klicke auf Delete.
• Bestätige jeweils mit Ok.
• Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
• Poste mir den Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

danach:


Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html

Hier erstmal das Protokoll von adwcleaner:

# AdwCleaner v1.801 - Logfile created 08/22/2012 at 09:22:09
# Updated 14/08/2012 by Xplode
# Operating system : Windows 7 Professional Service Pack 1 (32 bits)
# User : carsten - CARSTEN-PC
# Boot Mode : Normal
# Running from : C:\Users\carsten\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Folder Deleted : C:\Users\carsten\AppData\Local\Conduit
Folder Deleted : C:\Users\carsten\AppData\LocalLow\searchquband
Folder Deleted : C:\Users\carsten\AppData\Roaming\OpenCandy
Folder Deleted : C:\Users\carsten\AppData\Roaming\Mozilla\Firefox\Profiles\fu92pvm9.default\Conduit
Folder Deleted : C:\Users\carsten\AppData\Roaming\Mozilla\Firefox\Profiles\fu92pvm9.default\ConduitCommon
Folder Deleted : C:\ProgramData\boost_interprocess

***** [Registry] *****
[*] Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2776682
Key Deleted : HKCU\Software\AppDataLow\Software\searchqutoolbar
Key Deleted : HKCU\Software\DataMngr
Key Deleted : HKCU\Software\Headlight
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKLM\SOFTWARE\Classes\Conduit.Engine
Key Deleted : HKLM\SOFTWARE\Conduit
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS

***** [Registre - GUID] *****

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]

***** [Internet Browsers] *****

#NAME?

[OK] Registry is clean.

#NAME?

Profile name : default 
File : C:\Users\carsten\AppData\Roaming\Mozilla\Firefox\Profiles\fu92pvm9.default\prefs.js

Deleted : user_pref("CT2776682..clientLogIsEnabled", true);
Deleted : user_pref("CT2776682..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]
Deleted : user_pref("CT2776682..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]
Deleted : user_pref("CT2776682.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Deleted : user_pref("CT2776682.BrowserCompStateIsOpen_129453492929819378", true);
Deleted : user_pref("CT2776682.BrowserCompStateIsOpen_129512039755754602", true);
Deleted : user_pref("CT2776682.CT2776682", "CT2776682");
Deleted : user_pref("CT2776682.CurrentServerDate", "26-6-2011");
Deleted : user_pref("CT2776682.DialogsGetterLastCheckTime", "Sun Jun 26 2011 12:10:34 GMT+0200");
Deleted : user_pref("CT2776682.DownloadReferralCookieData", "");
Deleted : user_pref("CT2776682.EMailNotifierPollDate", "Sun Jun 26 2011 14:44:50 GMT+0200");
Deleted : user_pref("CT2776682.FirstServerDate", "20-6-2011");
Deleted : user_pref("CT2776682.FirstTime", true);
Deleted : user_pref("CT2776682.FirstTimeFF3", true);
Deleted : user_pref("CT2776682.FixPageNotFoundErrors", true);
Deleted : user_pref("CT2776682.GroupingServerCheckInterval", 1440);
Deleted : user_pref("CT2776682.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Deleted : user_pref("CT2776682.HasUserGlobalKeys", true);
Deleted : user_pref("CT2776682.HomePageProtectorEnabled", true);
Deleted : user_pref("CT2776682.Initialize", true);
Deleted : user_pref("CT2776682.InitializeCommonPrefs", true);
Deleted : user_pref("CT2776682.InstallationAndCookieDataSentCount", 3);
Deleted : user_pref("CT2776682.InstalledDate", "Mon Jun 20 2011 19:14:30 GMT+0200");
Deleted : user_pref("CT2776682.InvalidateCache", false);
Deleted : user_pref("CT2776682.IsAlertDBUpdated", true);
Deleted : user_pref("CT2776682.IsGrouping", false);
Deleted : user_pref("CT2776682.IsMulticommunity", false);
Deleted : user_pref("CT2776682.IsOpenThankYouPage", true);
Deleted : user_pref("CT2776682.IsOpenUninstallPage", true);
Deleted : user_pref("CT2776682.LanguagePackReloadIntervalMM", 1440);
Deleted : user_pref("CT2776682.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Deleted : user_pref("CT2776682.LastLogin_3.3.3.2", "Sat Jun 25 2011 22:37:39 GMT+0200");
Deleted : user_pref("CT2776682.LastLogin_3.5.0.12", "Sun Jun 26 2011 12:10:34 GMT+0200");
Deleted : user_pref("CT2776682.LatestVersion", "3.3.3.2");
Deleted : user_pref("CT2776682.MyStuffEnabledAtInstallation", true);
Deleted : user_pref("CT2776682.RadioIsPodcast", false);
Deleted : user_pref("CT2776682.RadioLastCheckTime", "Sun Jun 26 2011 12:10:34 GMT+0200");
Deleted : user_pref("CT2776682.RadioLastUpdateIPServer", "3");
Deleted : user_pref("CT2776682.RadioLastUpdateServer", "3");
Deleted : user_pref("CT2776682.RadioMediaID", "9962");
Deleted : user_pref("CT2776682.RadioMediaType", "Media Player");
Deleted : user_pref("CT2776682.RadioMenuSelectedID", "EBRadioMenu_CT27766829962");
Deleted : user_pref("CT2776682.RadioShrinkedFromSetup", false);
Deleted : user_pref("CT2776682.RadioStationName", "California%20Rock");
Deleted : user_pref("CT2776682.RadioStationURL", "hxxp://feedlive.net/california.asx");
Deleted : user_pref("CT2776682.SHRINK_TOOLBAR", 1);
Deleted : user_pref("CT2776682.SavedHomepage", "chrome://branding/locale/browserconfig.properties");
Deleted : user_pref("CT2776682.SearchEngineBeforeUnload", "chrome://browser-region/locale/region.properties");
Deleted : user_pref("CT2776682.SearchFromAddressBarIsInit", true);
Deleted : user_pref("CT2776682.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT277[...]
Deleted : user_pref("CT2776682.SearchInNewTabEnabled", true);
Deleted : user_pref("CT2776682.SearchInNewTabIntervalMM", 1440);
Deleted : user_pref("CT2776682.SearchInNewTabLastCheckTime", "Sun Jun 26 2011 12:10:35 GMT+0200");
Deleted : user_pref("CT2776682.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
Deleted : user_pref("CT2776682.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageServic[...]
Deleted : user_pref("CT2776682.SearchProtectorEnabled", false);
Deleted : user_pref("CT2776682.SearchProtectorToolbarDisabled", false);
Deleted : user_pref("CT2776682.ServiceMapLastCheckTime", "Sun Jun 26 2011 12:10:34 GMT+0200");
Deleted : user_pref("CT2776682.SettingsLastCheckTime", "Sun Jun 26 2011 14:48:15 GMT+0200");
Deleted : user_pref("CT2776682.ThirdPartyComponentsInterval", 504);
Deleted : user_pref("CT2776682.ThirdPartyComponentsLastCheck", "Mon Jun 20 2011 19:14:08 GMT+0200");
Deleted : user_pref("CT2776682.ThirdPartyComponentsLastUpdate", "1246786978");
Deleted : user_pref("CT2776682.ToolbarShrinkedFromSetup", false);
Deleted : user_pref("CT2776682.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2776682");
Deleted : user_pref("CT2776682.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,OurTo[...]
Deleted : user_pref("CT2776682.UserID", "UN65183768113337236");
Deleted : user_pref("CT2776682.ValidationData_Search", 0);
Deleted : user_pref("CT2776682.ValidationData_Toolbar", 2);
Deleted : user_pref("CT2776682.WeatherNetwork", "");
Deleted : user_pref("CT2776682.WeatherPollDate", "Sun Jun 26 2011 14:40:51 GMT+0200");
Deleted : user_pref("CT2776682.WeatherUnit", "C");
Deleted : user_pref("CT2776682.approveUntrustedApps", true);
Deleted : user_pref("CT2776682.backendstorage.2776682a129520874668948567000000paramsgk0", "7B22757064617465526[...]
Deleted : user_pref("CT2776682.backendstorage.rssapp2776682a129520874668948567000000cat0", "253542253742253232[...]
Deleted : user_pref("CT2776682.backendstorage.rssapp2776682a129520874668948567000000embeddedversion", "312E312[...]
Deleted : user_pref("CT2776682.backendstorage.rssapp2776682a129520874668948567000000feedsobj", "25374225323263[...]
Deleted : user_pref("CT2776682.backendstorage.rssapp2776682a129520874668948567000000lastreporttime", "31333039[...]
Deleted : user_pref("CT2776682.backendstorage.rssapp2776682a129520874668948567000000newfeeds", "6E657746656564[...]
Deleted : user_pref("CT2776682.backendstorage.rssapp2776682a129520874668948567000000readitemsarr", "2537422532[...]
Deleted : user_pref("CT2776682.components.1000034", true);
Deleted : user_pref("CT2776682.components.1000234", true);
Deleted : user_pref("CT2776682.generalConfigFromLogin", "{\"SocialDomains\":\"social.conduit.com;apps.conduit.[...]
Deleted : user_pref("CT2776682.globalFirstTimeInfoLastCheckTime", "Sun Jun 26 2011 12:10:35 GMT+0200");
Deleted : user_pref("CT2776682.homepageProtectorEnableByLogin", true);
Deleted : user_pref("CT2776682.initDone", true);
Deleted : user_pref("CT2776682.isAppTrackingManagerOn", true);
Deleted : user_pref("CT2776682.isFirstRadioInstallation", false);
Deleted : user_pref("CT2776682.myStuffEnabled", true);
Deleted : user_pref("CT2776682.myStuffPublihserMinWidth", 400);
Deleted : user_pref("CT2776682.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
Deleted : user_pref("CT2776682.myStuffServiceIntervalMM", 1440);
Deleted : user_pref("CT2776682.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Deleted : user_pref("CT2776682.oldAppsList", "129288498392881552,129288498393350308,111,129512039755754602,129[...]
Deleted : user_pref("CT2776682.searchProtectorDialogDelayInSec", 10);
Deleted : user_pref("CT2776682.searchProtectorEnableByLogin", true);
Deleted : user_pref("CT2776682.testingCtid", "");
Deleted : user_pref("CT2776682.toolbarAppMetaDataLastCheckTime", "Sun Jun 26 2011 12:10:34 GMT+0200");
Deleted : user_pref("CT2776682.toolbarContextMenuLastCheckTime", "Mon Jun 20 2011 19:14:13 GMT+0200");
Deleted : user_pref("CT2776682.usagesFlag", 2);
Deleted : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/909619/905414/DE", "\"0\"")[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2776682", [...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.engine.conduit-services.com/DLG.pkg?ver=3.3.3[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.3.[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.5.[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2776682",[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=3/13/20[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.search.conduit.com/root/CT2776682/CT2776682[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Mint/equalizer_dea[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Mint/minimize.gif"[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Mint/play.gif", "\[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Mint/stop.gif", "\[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Mint/vol.gif", "\"[...]
Deleted : user_pref("CommunityToolbar.EngineOwner", "");
Deleted : user_pref("CommunityToolbar.EngineOwnerGuid", "{51a86bb3-6602-4c85-92a5-130ee4864f13}");
Deleted : user_pref("CommunityToolbar.EngineOwnerToolbarId", "brothersoft_extreme");
Deleted : user_pref("CommunityToolbar.IsEngineShown", true);
Deleted : user_pref("CommunityToolbar.IsMyStuffImportedToEngine", true);
Deleted : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\carsten\\AppData\\Roaming\\Mozilla\[...]
Deleted : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.5.0.12");
Deleted : user_pref("CommunityToolbar.OriginalEngineOwner", "CT2776682");
Deleted : user_pref("CommunityToolbar.OriginalEngineOwnerGuid", "{51a86bb3-6602-4c85-92a5-130ee4864f13}");
Deleted : user_pref("CommunityToolbar.OriginalEngineOwnerToolbarId", "brothersoft_extreme");
Deleted : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "");
Deleted : user_pref("CommunityToolbar.ToolbarsList", "CT2776682");
Deleted : user_pref("CommunityToolbar.ToolbarsList2", "CT2776682");
Deleted : user_pref("CommunityToolbar.alert.alertDialogsGetterLastCheckTime", "Mon Jun 20 2011 19:14:14 GMT+02[...]
Deleted : user_pref("CommunityToolbar.alert.alertEnabled", true);
Deleted : user_pref("CommunityToolbar.alert.alertInfoInterval", 1440);
Deleted : user_pref("CommunityToolbar.alert.alertInfoLastCheckTime", "Wed Jun 22 2011 12:48:04 GMT+0200");
Deleted : user_pref("CommunityToolbar.alert.clientsServerUrl", "hxxp://alert.client.conduit.com");
Deleted : user_pref("CommunityToolbar.alert.locale", "en");
Deleted : user_pref("CommunityToolbar.alert.loginIntervalMin", 1440);
Deleted : user_pref("CommunityToolbar.alert.loginLastCheckTime", "Sat Jun 25 2011 10:08:37 GMT+0200");
Deleted : user_pref("CommunityToolbar.alert.loginLastUpdateTime", "1305622559");
Deleted : user_pref("CommunityToolbar.alert.messageShowTimeSec", 20);
Deleted : user_pref("CommunityToolbar.alert.servicesServerUrl", "hxxp://alert.services.conduit.com");
Deleted : user_pref("CommunityToolbar.alert.showTrayIcon", false);
Deleted : user_pref("CommunityToolbar.alert.userCloseIntervalMin", 300);
Deleted : user_pref("CommunityToolbar.alert.userId", "139d80af-bde5-4d68-992f-928b84384b57");
Deleted : user_pref("CommunityToolbar.globalUserId", "6012f355-28d8-440d-bc2b-f9c4a3df57af");
Deleted : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);
Deleted : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);
Deleted : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2776682");
Deleted : user_pref("CommunityToolbar.killedEngine", true);
Deleted : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Sun Jun 26 2011 12:10:3[...]
Deleted : user_pref("CommunityToolbar.notifications.alertEnabled", true);
Deleted : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com");
Deleted : user_pref("CommunityToolbar.notifications.locale", "en");
Deleted : user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440);
Deleted : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Sun Jun 26 2011 12:10:35 GMT+0200");
Deleted : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1305622559");
Deleted : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20);
Deleted : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com");
Deleted : user_pref("CommunityToolbar.notifications.showTrayIcon", false);
Deleted : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300);
Deleted : user_pref("CommunityToolbar.notifications.userId", "8ae005b1-5a00-44be-8741-46e65778213c");
Deleted : user_pref("CommunityToolbar.undefined", "");

#NAME?

File : C:\Users\carsten\AppData\Local\Google\Chrome\User Data\Default\Preferences

Deleted :       "name": "Search Results",
Deleted :       "search_url": "hxxp://dts.search-results.com/sr?src=crb&appid=0&systemid=413&sr=0&q={searchTer[...]

#NAME?

File : C:\Users\carsten\AppData\Roaming\Opera\Opera\operaprefs.ini

Deleted : Home URL=hxxp://www.searchqu.com/413

*************************

AdwCleaner[R1].txt - [16142 octets] - [21/08/2012 13:44:54]
AdwCleaner[S1].txt - [16442 octets] - [22/08/2012 09:22:09]

########## EOF - C:\AdwCleaner[S1].txt - [16571 octets] ##########
         

Rest folgt später

MFG

Carsten

so und jetzt das Protokoll von Emsisoft:

Emsisoft Anti-Malware - Version 6.6
Letztes Update: 22.08.2012 09:42:32

Scan Einstellungen:

Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\, D:\
Archiv Scan: An
ADS Scan: An

Scan Beginn:	22.08.2012 09:43:14

c:\program files\gamespy arcade 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\cstrike\frontline 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\halflife 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\halflife\action 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\cstrike 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\halflife\frontline 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\halflife\gearbox 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\halflife\tfc 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\aq2 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\battle 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\chaosdm 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\duel 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\freeze 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\gloom 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\gxmod 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\halflife\firearms 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\jail 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\kots 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\lfiredm 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\lithium2 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\lmctf 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\pball 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\q2comp 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\halflife\cstrike 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\ra2 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\requiem 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\sconfig 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\tourney 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\wf 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\wod 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake3 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake3\alliance 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake3\beryllium 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake3\excessive 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake3\instagib 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake3\jailbreak 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake3\matchmod 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake3\osp 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake3\q3comp 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake3\q3f 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake3\q3ut2 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake3\requiem 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake3\rocketarena3 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake3\wfa 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\tribes 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\tribes\arena 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\tribes\ch 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\tribes\ctf 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\tribes\ctfb 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\tribes\ctfplus 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\tribes\dd 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\holywars 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\tribes\duel 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\tribes\fr 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\tribes\mt 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\tribes\open cal 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\tribes\rpg 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\tribes\tac 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\ut 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\ut\excessive 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\ut\rocketarena 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\ut\swat 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\images 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\tribes\dm 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\images\portraits 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\profiles 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\profiles\(default) 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\services 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\services\_common 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\services\_demospy 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\services\_fplanet 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\services\_gnews 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\services\_gspyder 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\services\_news 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\services\_support 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\skins 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\skins\(default3) 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\sounds 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\sounds\(default) 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\sounds\classic 	gefunden: Trace.File.gamespy arcade!E1
c:\users\carsten\appdata\roaming\microsoft\windows\start menu\programs\gamespy arcade 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\images\icons 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\addins 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\qpong 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\dat.bmp 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\arcres.dll 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\4dca9208.dat 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\def_banner.gif 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\def_banner.html 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\def_bannerbg.jpg 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\def_loading.gif 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\def_logo.jpg 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\aphex.exe 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\def_news.html 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\fpupdate.exe 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\gamespy arcade - debug.lnk 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\gamespy arcade help.url 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\gamespy arcade website.url 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\gamespy arcade.lnk 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\gamespy.com gaming's homepage.url 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\gsapak.exe 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\gslan.dll 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\gsws.dll 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\install.log 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\pw32.dll 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\readme.html 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\register gamespy arcade.url 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\rptcrash.exe 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\services\_news\rsrc.dir 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\services\_news\service_tab.psd 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\services\_news\service_tab+.tga 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\services\_support\rsrc.dir 	gefunden: Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\services\_support\service_tab.psd 	gefunden: Trace.File.gamespy arcade!E1
Value: hkey_current_user\software\gamespy\gamespy arcade --> instdir 	gefunden: Trace.Registry.gamespy arcade!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\gamespy arcade --> uninstallstring 	gefunden: Trace.Registry.gamespy arcade!E1
c:\program files\gamespy arcade\ws_default.html 	gefunden: Trace.File.gamespy arcade!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\gamespy arcade --> displayname 	gefunden: Trace.Registry.gamespy arcade!E1
C:\Users\carsten\workspace\HelloWorld\Debug\HelloWorld.exe 	gefunden: Trojan.Win32.Menti!E2
C:\Users\carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CodeBlocks\test.exe 	gefunden: Trojan.Win32.Webprefix!E2
C:\Program Files\OpenCV2.1\CMakeFiles\CompilerIdCXX\a.exe 	gefunden: Trojan-Spy.Win32.Small!E2
C:\Program Files\OpenCV2.1\CMakeFiles\CompilerIdC\a.exe 	gefunden: Trojan-Spy.Win32.Small!E2
C:\Program Files\OpenCV\CMakeFiles\CompilerIdCXX\a.exe 	gefunden: Trojan-Spy.Win32.Small!E2
C:\Program Files\OpenCV\CMakeFiles\CompilerIdC\a.exe 	gefunden: Trojan-Spy.Win32.Small!E2
C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\adcbdas16jrexp.mexw32 	gefunden: Trojan.Win32.Agent!E2
C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\adkmdas1800hr.mexw32 	gefunden: Trojan.Win32.Agent!E2
C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\adbbpci20098.mexw32 	gefunden: Trojan.Win32.Agent!E2
C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\adgesada1.mexw32 	gefunden: Trojan.Win32.Agent!E2
C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\adrtddm6420.mexw32 	gefunden: Trojan.Win32.Agent!E2
C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\adrtddm6430.mexw32 	gefunden: Trojan.Win32.Agent!E2
C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\dabbpci20003.mexw32 	gefunden: Trojan.Win32.Agent!E2
C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\dicbpdiso16.mexw32 	gefunden: Trojan.Win32.Agent!E2
C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\docbpdiso16.mexw32 	gefunden: Trojan.Win32.Agent!E2
C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\donipctio10.mexw32 	gefunden: Trojan.Win32.Agent!E2
C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\encadpa1700.mexw32 	gefunden: Trojan.Win32.Agent!E2
C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\rs232_send.mexw32 	gefunden: Trojan.Win32.Agent!E2
C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\rs232_sendrec.mexw32 	gefunden: Trojan.Win32.Agent!E2
C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\scblock.mexw32 	gefunden: Trojan.Win32.Agent!E2
C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\xpcregstack.mexw32 	gefunden: Trojan.Win32.Agent!E2
C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\rs232_rec.mexw32 	gefunden: Trojan.Win32.Agent.BNWVMWL!E1

Gescannt	1145340
Gefunden	141

Scan Ende:	22.08.2012 14:28:58
Scan Zeit:	4:45:44

C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\rs232_rec.mexw32	Quarantäne Trojan.Win32.Agent.BNWVMWL!E1
C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\adcbdas16jrexp.mexw32	Quarantäne Trojan.Win32.Agent!E2
C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\adkmdas1800hr.mexw32	Quarantäne Trojan.Win32.Agent!E2
C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\adbbpci20098.mexw32	Quarantäne Trojan.Win32.Agent!E2
C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\adgesada1.mexw32	Quarantäne Trojan.Win32.Agent!E2
C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\adrtddm6420.mexw32	Quarantäne Trojan.Win32.Agent!E2
C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\adrtddm6430.mexw32	Quarantäne Trojan.Win32.Agent!E2
C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\dabbpci20003.mexw32	Quarantäne Trojan.Win32.Agent!E2
C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\dicbpdiso16.mexw32	Quarantäne Trojan.Win32.Agent!E2
C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\docbpdiso16.mexw32	Quarantäne Trojan.Win32.Agent!E2
C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\donipctio10.mexw32	Quarantäne Trojan.Win32.Agent!E2
C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\encadpa1700.mexw32	Quarantäne Trojan.Win32.Agent!E2
C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\rs232_send.mexw32	Quarantäne Trojan.Win32.Agent!E2
C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\rs232_sendrec.mexw32	Quarantäne Trojan.Win32.Agent!E2
C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\scblock.mexw32	Quarantäne Trojan.Win32.Agent!E2
C:\Program Files\MATLAB\R2009a\toolbox\rtw\targets\xpc\target\build\xpcblocks\xpcregstack.mexw32	Quarantäne Trojan.Win32.Agent!E2
C:\Program Files\OpenCV2.1\CMakeFiles\CompilerIdCXX\a.exe	Quarantäne Trojan-Spy.Win32.Small!E2
C:\Program Files\OpenCV2.1\CMakeFiles\CompilerIdC\a.exe	Quarantäne Trojan-Spy.Win32.Small!E2
C:\Program Files\OpenCV\CMakeFiles\CompilerIdCXX\a.exe	Quarantäne Trojan-Spy.Win32.Small!E2
C:\Program Files\OpenCV\CMakeFiles\CompilerIdC\a.exe	Quarantäne Trojan-Spy.Win32.Small!E2
C:\Users\carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CodeBlocks\test.exe	Quarantäne Trojan.Win32.Webprefix!E2
C:\Users\carsten\workspace\HelloWorld\Debug\HelloWorld.exe	Quarantäne Trojan.Win32.Menti!E2
Value: hkey_current_user\software\gamespy\gamespy arcade --> instdir	Quarantäne Trace.Registry.gamespy arcade!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\gamespy arcade --> uninstallstring	Quarantäne Trace.Registry.gamespy arcade!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\gamespy arcade --> displayname	Quarantäne Trace.Registry.gamespy arcade!E1
c:\program files\gamespy arcade	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\cstrike\frontline	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\halflife	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\halflife\action	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\cstrike	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\halflife\frontline	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\halflife\gearbox	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\halflife\tfc	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\aq2	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\battle	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\chaosdm	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\duel	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\freeze	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\gloom	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\gxmod	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\halflife\firearms	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\jail	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\kots	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\lfiredm	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\lithium2	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\lmctf	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\pball	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\q2comp	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\halflife\cstrike	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\ra2	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\requiem	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\sconfig	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\tourney	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\wf	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\wod	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake3	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake3\alliance	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake3\beryllium	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake3\excessive	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake3\instagib	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake3\jailbreak	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake3\matchmod	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake3\osp	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake3\q3comp	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake3\q3f	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake3\q3ut2	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake3\requiem	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake3\rocketarena3	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake3\wfa	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\tribes	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\tribes\arena	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\tribes\ch	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\tribes\ctf	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\tribes\ctfb	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\tribes\ctfplus	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\tribes\dd	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\holywars	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\tribes\duel	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\tribes\fr	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\tribes\mt	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\tribes\open cal	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\tribes\rpg	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\tribes\tac	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\ut	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\ut\excessive	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\ut\rocketarena	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\ut\swat	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\images	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\tribes\dm	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\images\portraits	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\profiles	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\profiles\(default)	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\services	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\services\_common	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\services\_demospy	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\services\_fplanet	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\services\_gnews	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\services\_gspyder	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\services\_news	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\services\_support	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\skins	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\skins\(default3)	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\sounds	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\sounds\(default)	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\sounds\classic	Quarantäne Trace.File.gamespy arcade!E1
c:\users\carsten\appdata\roaming\microsoft\windows\start menu\programs\gamespy arcade	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\images\icons	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\addins	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\custom\quake2\qpong	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\dat.bmp	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\arcres.dll	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\4dca9208.dat	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\def_banner.gif	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\def_banner.html	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\def_bannerbg.jpg	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\def_loading.gif	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\def_logo.jpg	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\aphex.exe	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\def_news.html	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\fpupdate.exe	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\gamespy arcade - debug.lnk	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\gamespy arcade help.url	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\gamespy arcade website.url	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\gamespy arcade.lnk	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\gamespy.com gaming's homepage.url	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\gsapak.exe	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\gslan.dll	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\gsws.dll	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\install.log	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\pw32.dll	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\readme.html	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\register gamespy arcade.url	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\rptcrash.exe	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\services\_news\rsrc.dir	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\services\_news\service_tab.psd	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\services\_news\service_tab+.tga	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\services\_support\rsrc.dir	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\services\_support\service_tab.psd	Quarantäne Trace.File.gamespy arcade!E1
c:\program files\gamespy arcade\ws_default.html	Quarantäne Trace.File.gamespy arcade!E1

Quarantäne	141
         

MFG Carsten

Sehr gut!


Deinstalliere:
Emsisoft Anti-Malware


ESET Online Scanner

Vorbereitung

• Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an.
• Bitte während des Online-Scans Anti-Virus-Programm und Firewall deaktivieren.
• Vista/Win7-User: Bitte den Browser unbedingt als Administrator starten.

Los geht's

• Lade und starte Eset Smartinstaller
• Haken setzen bei YES, I accept the Terms of Use.
• Klick auf Start.
• Haken setzen bei Remove found threads und Scan archives.
• Klick auf Start.
• Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Finish drücken.
• Browser schließen.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (manchmal auch C:\Programme\Eset\log.txt) suchen und mit Deinem Editor öffnen.
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Und hier das Log File von Eset:

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=f994b6908cb966448d807891dababaa7
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-08-23 03:10:35
# local_time=2012-08-23 05:10:35 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 16936872 16936872 0 0
# compatibility_mode=5893 16776573 100 94 305 97341066 0 0
# compatibility_mode=8192 67108863 100 0 107 107 0 0
# scanned=906047
# found=3
# cleaned=3
# scan_time=24760
C:\Program Files\SearchCore for Browsers\SearchCore for Browsers\IEBHO.dll	a variant of Win32/Toolbar.SearchSuite application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
G:\Backup_BIGUSB\Backup_BIGUSB_2012_01_13\BIG_USB\USB_backup_10_01_2012\SoftonicDownloader_fuer_audio-video-converter.exe	Win32/SoftonicDownloader application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
G:\Backup_BIGUSB\Backup_BIGUSB_2012_01_16\SoftonicDownloader_fuer_audio-video-converter.exe	Win32/SoftonicDownloader application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
         

MFG

carsten

Java aktualisieren

Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.

• Downloade dir bitte die neueste Java-Version von hier
• Speichere die jxpiinstall.exe
• Schließe alle laufenden Programme. Speziell deinen Browser.
• Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 6 ) herunter laden.
• Wenn die Installation beendet wurde
  Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
• Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.

Nach dem Neustart

• Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
• Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
• Klicke auf Dateien löschen....
• Gehe sicher das überall ein Hacken gesetzt ist und klicke OK.
• Klicke erneut OK.

Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html

Danach poste (kopieren und einfuegen) mir, was du hier angezeigt bekommst: PluginCheck