Unregelmäßige Selbstneustarts

OTL logfile created on: 31.08.2012 12:02:15 - Run 1
OTL by OldTimer - Version 3.2.59.1     Folder = C:\Users\Donald\Desktop
 Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,50 Gb Total Physical Memory | 2,47 Gb Available Physical Memory | 70,50% Memory free
7,00 Gb Paging File | 5,77 Gb Available in Paging File | 82,52% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 98,47 Gb Total Space | 51,66 Gb Free Space | 52,46% Space Free | Partition Type: NTFS
Drive D: | 146,48 Gb Total Space | 142,49 Gb Free Space | 97,27% Space Free | Partition Type: NTFS
Drive E: | 220,70 Gb Total Space | 207,53 Gb Free Space | 94,03% Space Free | Partition Type: NTFS
Drive H: | 232,88 Gb Total Space | 27,50 Gb Free Space | 11,81% Space Free | Partition Type: NTFS
 
Computer Name: DONALD-PC | User Name: Donald | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.08.31 12:00:28 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Users\Donald\Desktop\OTL.exe
PRC - [2012.08.18 11:07:36 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.06.26 19:31:46 | 001,184,312 | ---- | M] (GlavSoft LLC.) -- C:\Programme\TightVNC\tvnserver.exe
PRC - [2012.05.09 17:58:10 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.09 17:58:09 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.09 17:58:09 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012.03.23 14:25:24 | 000,087,040 | ---- | M] () -- C:\Programme\HTC\Internet Pass-Through\PassThruSvr.exe
PRC - [2012.03.01 01:59:00 | 002,348,352 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
PRC - [2012.02.29 22:58:46 | 000,857,408 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\Display\nvxdsync.exe
PRC - [2012.02.29 22:58:36 | 001,820,480 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\Display\nvtray.exe
PRC - [2012.02.19 10:00:46 | 000,775,968 | ---- | M] (Broadcom Corporation.) -- C:\Programme\WIDCOMM\Bluetooth Software\btwdins.exe
PRC - [2012.02.15 00:55:29 | 000,034,728 | ---- | M] (Arainia Solutions) -- C:\Programme\Gizmo\gservice.exe
PRC - [2012.01.08 15:32:56 | 000,105,160 | ---- | M] () -- C:\Programme\Rainmeter\Rainmeter.exe
PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.12.14 09:25:08 | 000,112,920 | ---- | M] (Logitech, Inc.) -- C:\Programme\Logitech\ScrollApp\KhalScroll.exe
PRC - [2011.10.07 11:40:42 | 001,387,288 | ---- | M] (Logitech, Inc.) -- C:\Programme\Logitech\SetPointP\SetPoint.exe
PRC - [2011.09.27 21:05:24 | 000,149,784 | ---- | M] (Logitech, Inc.) -- C:\Programme\Common Files\Logishrd\KHAL3\KHALMNPR.exe
PRC - [2011.06.24 06:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.12.20 19:10:14 | 000,352,256 | ---- | M] (Realtime Soft Ltd) -- C:\Programme\UltraMon\UltraMonTaskbar.exe
PRC - [2010.12.20 19:09:52 | 000,505,856 | ---- | M] (Realtime Soft Ltd) -- C:\Programme\UltraMon\UltraMon.exe
PRC - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2010.11.20 14:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2007.05.31 09:21:28 | 000,648,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\WindowsMobile\wmdcBase.exe
PRC - [2007.02.02 18:26:44 | 000,283,136 | ---- | M] (AVM Berlin) -- C:\Programme\avmwlanstick\FRITZWLANMini.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.02.15 00:55:29 | 000,059,304 | ---- | M] () -- C:\Programme\Gizmo\gshell.dll
MOD - [2012.01.09 20:44:20 | 000,166,912 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
MOD - [2012.01.08 15:32:56 | 000,567,496 | ---- | M] () -- C:\Programme\Rainmeter\Rainmeter.dll
MOD - [2012.01.08 15:32:56 | 000,105,160 | ---- | M] () -- C:\Programme\Rainmeter\Rainmeter.exe
MOD - [2012.01.08 15:30:20 | 000,023,040 | ---- | M] () -- C:\Programme\Rainmeter\Plugins\RecycleManager.dll
MOD - [2012.01.08 15:30:18 | 000,143,360 | ---- | M] () -- C:\Programme\Rainmeter\Plugins\WebParser.dll
MOD - [2011.10.07 11:41:16 | 000,879,896 | ---- | M] () -- C:\Programme\Logitech\SetPointP\Macros\MacroCore.dll
MOD - [2011.03.17 00:11:16 | 004,297,568 | ---- | M] () -- C:\Programme\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
 
 
========== Services (SafeList) ==========
 
SRV - [2012.07.20 22:38:05 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.07.15 17:50:15 | 004,419,392 | ---- | M] () [Auto | Running] -- c:\program files\common files\akamai/netsession_win_4f7fccd.dll -- (Akamai)
SRV - [2012.06.26 19:31:46 | 001,184,312 | ---- | M] (GlavSoft LLC.) [Auto | Running] -- C:\Programme\TightVNC\tvnserver.exe -- (tvnserver)
SRV - [2012.05.09 17:58:10 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.09 17:58:09 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.03.23 14:25:24 | 000,087,040 | ---- | M] () [Auto | Running] -- C:\Programme\HTC\Internet Pass-Through\PassThruSvr.exe -- (PassThru Service)
SRV - [2012.03.01 01:59:00 | 002,348,352 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012.02.19 10:00:46 | 000,775,968 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Programme\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)
SRV - [2012.02.15 00:55:29 | 000,034,728 | ---- | M] (Arainia Solutions) [Auto | Running] -- C:\Programme\Gizmo\gservice.exe -- (Gizmo Central)
SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.09.27 21:03:28 | 000,295,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2011.06.12 11:15:00 | 031,125,880 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)
SRV - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2010.02.19 14:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Programme\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2010.01.09 22:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2010.01.09 22:18:00 | 000,149,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.05.31 09:21:24 | 000,379,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007.05.31 09:21:18 | 000,183,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
SRV - [2003.04.18 20:06:26 | 000,008,192 | ---- | M] () [Auto | Stopped] -- C:\Windows\System32\srvany.exe -- (KMService)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\rdvgkmd.sys -- (VGPU)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\tsusbhub.sys -- (tsusbhub)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\synth3dvsc.sys -- (Synth3dVsc)
DRV - [2012.08.31 11:53:59 | 000,054,016 | ---- | M] () [Kernel | Boot | Unknown] -- C:\Windows\System32\drivers\jmgbgyuu.sys -- (dcdosp)
DRV - [2012.06.29 20:39:02 | 000,004,608 | ---- | M] (RealVNC Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vncmirror.sys -- (vncmirror)
DRV - [2012.05.09 17:58:10 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.09 17:58:10 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012.03.01 01:59:00 | 010,819,392 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2012.02.15 00:55:29 | 000,025,488 | ---- | M] (Arainia Solutions LLC) [Kernel | System | Running] -- C:\Windows\System32\drivers\gizmodrv.sys -- (GizmoDrv)
DRV - [2011.12.15 16:00:00 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011.09.02 08:31:28 | 000,039,192 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2011.09.02 08:31:28 | 000,030,360 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LUsbFilt.sys -- (LUsbFilt)
DRV - [2011.09.02 08:31:20 | 000,041,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2011.04.12 21:29:40 | 000,006,144 | ---- | M] (Phoenix Technologies Ltd.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\SGDrv.sys -- (SGDrv)
DRV - [2010.11.20 14:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010.11.20 14:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010.11.20 14:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.11.20 12:21:14 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV - [2010.11.20 11:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010.11.20 11:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010.11.20 11:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010.10.29 23:11:08 | 000,197,224 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV - [2010.06.23 11:24:56 | 000,023,040 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\htcnprot.sys -- (htcnprot)
DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010.03.22 18:29:08 | 000,018,944 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2010.03.04 18:26:56 | 000,296,936 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmf6232.sys -- (NVNET)
DRV - [2009.10.26 23:54:24 | 000,025,088 | ---- | M] (HTC, Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ANDROIDUSB.sys -- (HTCAND32)
DRV - [2009.08.21 22:24:03 | 000,066,592 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)
DRV - [2009.07.14 02:18:07 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV - [2009.07.14 02:14:49 | 000,020,480 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDScan.sys -- (WSDScan)
DRV - [2009.07.14 00:02:52 | 000,347,264 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvm62x32.sys -- (NVENETFD)
DRV - [2008.11.14 03:11:30 | 000,017,184 | ---- | M] (Realtime Soft Ltd) [Kernel | Auto | Running] -- C:\Programme\Common Files\Realtime Soft\UltraMonMirrorDrv\x32\UltraMonUtility.sys -- (UltraMonUtility)
DRV - [2007.01.26 02:00:00 | 000,265,088 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\fwlanusb.sys -- (FWLANUSB)
DRV - [2007.01.26 02:00:00 | 000,004,352 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\avmeject.sys -- (avmeject)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.babylon.com/?babsrc=HP_ss&affID=101365&mntrId=14e69262000000000000001f3f038f3d
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/web/{searchTerms}?babsrc=SP_ss&affID=101365&mntrId=14e69262000000000000001f3f038f3d
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = hxxp://isearch.avg.com/search?cid={60081444-930C-4271-945D-8EE6CB31388F}&mid=a3e40530bea247d096c1d1445ee5ada6-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=en&ds=ins13&pr=sa&d=2012-04-17 17:10:48&v=10.2.0.3&sap=dsp&q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;<local>
 
========== FireFox ==========
 
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.3.1: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.3.1: C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\facebook.com/fbDesktopPlugin: C:\Users\Donald\AppData\Local\Facebook\Messenger\2.1.4590.0\npFbDesktopPlugin.dll (Facebook, Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{5D3F3872-91E9-4d59-AD9F-AA174A3145DD}: C:\Program Files\Logitech\ScrollApp\LogiSmoothFirefoxExt [2012.02.15 01:05:52 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.03.19 23:09:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.07.20 22:38:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.05.20 15:00:55 | 000,000,000 | ---D | M]
 
[2012.02.15 00:48:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Donald\AppData\Roaming\mozilla\Extensions
[2012.08.28 20:51:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Donald\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Donald\extensions
[2012.06.26 22:04:31 | 000,000,000 | ---D | M] (FEBE) -- C:\Users\Donald\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Donald\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}
[2012.03.30 10:04:23 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Donald\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Donald\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012.02.15 00:51:40 | 000,000,000 | ---D | M] (20-20 3D Viewer - IKEA) -- C:\Users\Donald\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Donald\extensions\2020Player_IKEA@2020Technologies.com
[2012.03.10 14:24:28 | 000,000,000 | ---D | M] (Browser Companion Helper) -- C:\Users\Donald\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Donald\extensions\bbrs_002@blabbers.com
[2012.05.17 11:43:31 | 000,000,000 | ---D | M] ("FRITZ!Box AddOn") -- C:\Users\Donald\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Donald\extensions\fb_add_on@avm.de
[2012.05.19 12:44:27 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\Donald\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Donald\extensions\ich@maltegoetz.de
[2012.03.10 14:24:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Donald\AppData\Roaming\mozilla\Firefox\Profiles\k2asmm9i.default\extensions
[2012.02.15 00:50:32 | 000,000,000 | ---D | M] (FEBE) -- C:\Users\Donald\AppData\Roaming\mozilla\Firefox\Profiles\k2asmm9i.default\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}
[2012.02.15 00:57:40 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Donald\AppData\Roaming\mozilla\Firefox\Profiles\k2asmm9i.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2012.03.10 14:24:28 | 000,000,000 | ---D | M] (Browser Companion Helper) -- C:\Users\Donald\AppData\Roaming\mozilla\Firefox\Profiles\k2asmm9i.default\extensions\bbrs_002@blabbers.com
[2012.03.10 14:24:17 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.03.10 14:24:19 | 000,000,000 | ---D | M] (Babylon) -- C:\Programme\Mozilla Firefox\extensions\ffxtlbr@babylon.com
[2012.07.20 22:38:05 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.02.08 19:36:16 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.04.17 17:10:44 | 000,003,749 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012.03.10 14:24:17 | 000,002,288 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2012.02.08 19:21:19 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.02.08 19:36:16 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.08 19:36:16 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.02.08 19:36:16 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.08 19:36:16 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: hxxp://www.google.com
CHR - Extension: YouTube = C:\Users\Donald\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2_0\
CHR - Extension: Google-Suche = C:\Users\Donald\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.14_0\
CHR - Extension: Logitech Scroll App = C:\Users\Donald\AppData\Local\Google\Chrome\User Data\Default\Extensions\geooogfhpjdpeiphckpbgkhpbeobcaoi\3.0.31_0\
CHR - Extension: Google Mail = C:\Users\Donald\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.3_0\
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Logitech Scroll App) - {E11DB59D-5008-42ff-9069-535843BC0BE1} - C:\Programme\Logitech\ScrollApp\LogiSmooth.dll (Logitech, Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [AVMWlanClient] C:\Programme\avmwlanstick\FRITZWLANMini.exe (AVM Berlin)
O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Driver Genius]  File not found
O4 - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4 - HKLM..\Run: [LogiScrollApp] C:\Programme\Logitech\ScrollApp\KhalScroll.exe (Logitech, Inc.)
O4 - HKLM..\Run: [Windows Mobile-based device management] C:\Windows\WindowsMobile\wmdcBase.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware  (cleanup)] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SoftwareSASGeneration = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Programme\ICQ7.7\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Programme\ICQ7.7\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 10.3.1)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{67DE1C44-243D-45F7-A638-C662805A00EA}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Programme\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{64d439ec-575b-11e1-8554-000d18014455}\Shell - "" = AutoRun
O33 - MountPoints2\{64d439ec-575b-11e1-8554-000d18014455}\Shell\AutoRun\command - "" = I:\pushinst.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.31 12:00:24 | 000,598,528 | ---- | C] (OldTimer Tools) -- C:\Users\Donald\Desktop\OTL.exe
[2012.08.31 11:47:27 | 000,000,000 | ---D | C] -- C:\Users\Donald\AppData\Roaming\Malwarebytes
[2012.08.31 11:47:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.08.31 11:47:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.31 11:47:18 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.08.31 11:47:18 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.08.22 17:01:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2012.08.18 11:10:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
 
========== Files - Modified Within 30 Days ==========
 
[2012.08.31 12:00:28 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Users\Donald\Desktop\OTL.exe
[2012.08.31 11:59:19 | 000,000,000 | ---- | M] () -- C:\Users\Donald\defogger_reenable
[2012.08.31 11:58:18 | 000,014,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.31 11:58:18 | 000,014,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.31 11:53:59 | 000,054,016 | ---- | M] () -- C:\Windows\System32\drivers\jmgbgyuu.sys
[2012.08.31 11:53:15 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.31 11:47:19 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.31 11:45:59 | 000,816,466 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.08.31 11:45:59 | 000,688,858 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.08.31 11:45:59 | 000,185,070 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.08.31 11:45:59 | 000,154,194 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.08.31 11:41:36 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.08.31 11:41:21 | 2817,974,272 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.31 11:37:58 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.08.31 10:45:01 | 000,001,142 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1542967910-1392352476-3196196125-1000UA.job
[2012.08.31 10:45:00 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1542967910-1392352476-3196196125-1000Core.job
[2012.08.29 18:10:27 | 000,074,528 | ---- | M] () -- C:\Users\Donald\Desktop\IMAG0760.jpg
[2012.08.25 11:52:16 | 100,596,726 | ---- | M] () -- C:\Users\Donald\Desktop\Dennis und Tina.mp4
[2012.08.18 18:08:03 | 003,791,784 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
 
========== Files Created - No Company Name ==========
 
[2012.08.31 11:59:19 | 000,000,000 | ---- | C] () -- C:\Users\Donald\defogger_reenable
[2012.08.31 11:53:59 | 000,054,016 | ---- | C] () -- C:\Windows\System32\drivers\jmgbgyuu.sys
[2012.08.31 11:47:19 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.29 18:10:24 | 000,074,528 | ---- | C] () -- C:\Users\Donald\Desktop\IMAG0760.jpg
[2012.08.25 11:46:53 | 100,596,726 | ---- | C] () -- C:\Users\Donald\Desktop\Dennis und Tina.mp4
[2012.05.22 22:17:03 | 000,272,629 | ---- | C] () -- C:\Windows\System32\drivers\RTAIODAT.DAT
[2012.05.14 20:11:37 | 000,000,001 | R--- | C] () -- C:\Users\Donald\serverport
[2012.04.19 20:03:26 | 000,010,084 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2012.04.19 19:11:59 | 002,515,790 | ---- | C] () -- C:\Windows\System32\nvcoproc.bin
[2012.04.14 22:14:50 | 000,000,132 | ---- | C] () -- C:\Users\Donald\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2012.04.12 18:14:52 | 000,000,017 | ---- | C] () -- C:\Users\Donald\AppData\Local\resmon.resmoncfg
[2012.03.19 23:20:21 | 000,175,616 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2012.03.19 22:54:52 | 000,057,344 | ---- | C] () -- C:\Windows\System32\MMTray2k.exe
[2012.03.19 14:18:49 | 000,008,192 | ---- | C] () -- C:\Windows\System32\srvany.exe
[2012.03.12 20:15:54 | 000,100,712 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat
[2012.02.29 13:26:56 | 000,416,064 | ---- | C] () -- C:\Windows\System32\nvStreaming.exe
[2012.02.27 21:47:53 | 000,410,942 | ---- | C] () -- C:\Windows\adb.exe
[2012.02.27 21:47:53 | 000,401,408 | ---- | C] () -- C:\Windows\wget.exe
[2012.02.27 21:47:53 | 000,356,009 | ---- | C] () -- C:\Windows\fastboot.exe
[2012.02.27 21:47:53 | 000,063,488 | ---- | C] () -- C:\Windows\md5sum.exe
[2012.02.21 14:55:13 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe
[2012.02.21 14:54:04 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2012.02.15 00:30:58 | 000,097,360 | ---- | C] () -- C:\Windows\System32\drivers\Fwusb1b.bin
 
========== LOP Check ==========
 
[2012.08.31 11:53:59 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\advantage
[2012.08.31 11:37:46 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\AIMP3
[2012.04.19 14:51:23 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Audacity
[2012.03.10 14:24:15 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Babylon
[2012.03.24 21:33:13 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\DeepBurner
[2012.02.20 00:45:14 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\DVDVideoSoft
[2012.02.15 00:56:03 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Gizmo
[2012.06.04 23:11:49 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\HTC
[2012.06.04 23:13:36 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\HTC.388BC06ACDAB6261375BCE37FBA2E023C0D7EE34.1
[2012.06.05 16:46:54 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\ICQ
[2012.02.15 00:57:45 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\ICQ Search
[2012.04.17 17:00:18 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Iggels
[2012.02.15 01:12:57 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\JAM Software
[2012.02.15 01:04:28 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Leadertech
[2012.04.29 20:21:38 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\LolClient
[2012.06.05 17:25:16 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\LolClient2
[2012.04.19 17:28:29 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\MotionDSP
[2012.08.04 14:43:30 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Mp3tag
[2012.03.19 22:56:57 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\MPEG Streamclip
[2012.02.16 13:27:22 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\OpenOffice.org
[2012.02.15 01:00:21 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\PhotoFiltre
[2012.02.15 01:11:54 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Publish Providers
[2012.07.21 20:01:59 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Rainmeter
[2012.02.15 01:11:52 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Sony
[2012.03.19 22:20:21 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\Sony Creative Software
[2012.06.28 16:30:46 | 000,000,000 | ---D | M] -- C:\Users\Donald\AppData\Roaming\TS3Client
[2012.08.31 10:45:00 | 000,001,120 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1542967910-1392352476-3196196125-1000Core.job
[2012.08.31 10:45:01 | 000,001,142 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1542967910-1392352476-3196196125-1000UA.job
[2012.08.02 13:53:41 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:890CC2F3

< End of report >
         

OTL Extras logfile created on: 31.08.2012 12:02:15 - Run 1
OTL by OldTimer - Version 3.2.59.1     Folder = C:\Users\Donald\Desktop
 Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,50 Gb Total Physical Memory | 2,47 Gb Available Physical Memory | 70,50% Memory free
7,00 Gb Paging File | 5,77 Gb Available in Paging File | 82,52% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 98,47 Gb Total Space | 51,66 Gb Free Space | 52,46% Space Free | Partition Type: NTFS
Drive D: | 146,48 Gb Total Space | 142,49 Gb Free Space | 97,27% Space Free | Partition Type: NTFS
Drive E: | 220,70 Gb Total Space | 207,53 Gb Free Space | 94,03% Space Free | Partition Type: NTFS
Drive H: | 232,88 Gb Total Space | 27,50 Gb Free Space | 11,81% Space Free | Partition Type: NTFS
 
Computer Name: DONALD-PC | User Name: Donald | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- Reg Error: Key error.
htmlfile [opennew] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- Reg Error: Key error.
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Key error.
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{05B4679E-160A-4CF9-8528-39CFFA737B45}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{1A0AE7CE-19D5-49F5-92C2-5474769EB0E5}" = lport=445 | protocol=6 | dir=in | app=system | 
"{1F906761-7FB9-4A0A-9D4D-987D97932E05}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{2F739048-FA79-463E-A3B4-E38CC696B370}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{372BE223-964B-459A-8FBA-1076F2F47C6F}" = lport=138 | protocol=17 | dir=in | app=system | 
"{46A7B373-8B5D-4E53-928A-CF9F7437315B}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{59B873C4-7815-4729-9428-682A88A8858C}" = rport=138 | protocol=17 | dir=out | app=system | 
"{5C0B8B30-BCCF-4B45-954B-AEDCA0D0D6CF}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{63FA8AC7-2CFF-4382-9BB4-C1047905CB75}" = lport=137 | protocol=17 | dir=in | app=system | 
"{679B0CD1-4D1F-49D4-8249-8836E788DCC4}" = rport=445 | protocol=6 | dir=out | app=system | 
"{808E4FB6-718C-43A7-AC4D-384F8835560E}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{940A5955-2D3F-491E-A7F4-BF839D59F33E}" = lport=49187 | protocol=6 | dir=in | name=akamai netsession interface | 
"{96FF0D97-0156-493F-B137-B8FD6C1255BD}" = rport=137 | protocol=17 | dir=out | app=system | 
"{A60698E5-36EC-408E-9519-DB04940B2B72}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{B2C9E517-0EEE-419C-B5CE-2B4A166F2C37}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{B4A014D7-C116-4F8E-995B-B8775574263C}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{B6F5939C-FEDB-404E-BA3E-FC9C02953AF2}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{C633FF9D-B6D5-4D42-9582-E96542F2B2EC}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{DD254589-D57C-4924-9AB9-A002D1A7FF92}" = rport=139 | protocol=6 | dir=out | app=system | 
"{E0FC532C-B7EA-499E-AE64-4B1E7105476F}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{ED87F123-1C4E-409D-B776-584A44F12FE5}" = lport=139 | protocol=6 | dir=in | app=system | 
"{F3B6327D-2329-44EF-977B-4498EFDEC9E2}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface | 
"{F6BA0D23-D978-477B-949C-EA678DB9CD88}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{FB77B627-E36B-4EFA-8FDC-A98092DF1C18}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office14\outlook.exe | 
"{FCBCAE83-CEC5-4C17-9443-1E0952F14FE6}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01FBD268-CC62-4EBE-8C3B-E0E4BC9938AF}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{02B73728-8C1D-4571-82D7-9FC81AB1DF38}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{03D7934F-9EB1-4771-BD07-F8DA22AE47C6}" = protocol=17 | dir=in | app=e:\diablo iii\diablo iii.exe | 
"{091376CB-C851-47FF-A690-53B51A409846}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{0DA849DD-6287-45E4-A902-C329E05786CD}" = dir=in | app=c:\program files\itunes\itunes.exe | 
"{0FA86B1A-0CD1-41CD-9E75-E0E6B80554E6}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{143C1AB7-6FD6-43B3-92D3-51ADA98DDCCF}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{1A66B0E3-3408-4CB7-8709-40B56D4B1FD5}" = protocol=17 | dir=in | app=c:\users\donald\appdata\local\akamai\netsession_win.exe | 
"{253ABB93-7699-417B-AE6D-EF433ECA3FCE}" = protocol=6 | dir=in | app=e:\diablo iii\diablo iii.exe | 
"{27BF481F-8B49-40B7-8043-C563416E5D84}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe | 
"{2ADE1679-1F05-423E-B6E3-466D8C0A6E66}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe | 
"{346B0FD6-FEEB-4E8B-92E7-CE2D6017BB33}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{365295A4-3336-43D2-8B9C-C417DA273872}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{390A5ED2-C0F5-450A-A313-3B85AB5726B1}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{3A90ADDE-5116-4F61-9DF2-B4FAAB70B3F9}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | 
"{3CA78A19-DA35-4B4D-B0C8-66F3AB6DCA75}" = protocol=17 | dir=in | app=c:\windows\explorer.exe | 
"{3DAAB908-5ECB-4007-96A6-B1C5896F9EF5}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{44530DE9-8B70-4A93-A6E8-3AEAF0DFC0C7}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{46A9CD94-AC32-419B-A240-E20DB798BF15}" = protocol=6 | dir=in | app=c:\windows\explorer.exe | 
"{47D412D3-33A8-46CA-A7D9-80E33F9F6CC3}" = protocol=6 | dir=in | app=c:\windows\explorer.exe | 
"{4895D188-67B2-4DBA-B890-7E2D97A7CD6B}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{48CE8040-95B2-4765-B311-321FEDB7747B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{536A0C16-A2FF-41AC-A6EC-B415ECA1C6AA}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{5539893F-32A1-4D9A-AF5A-1031B3517A02}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{5A9BE58F-AE1D-48BA-83E5-EDF5B873DB6B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{5D0E45DC-2736-4B0F-9FBA-09A71A03648B}" = protocol=6 | dir=out | app=system | 
"{5EB23132-7FB5-400A-B114-B19865C7CAA4}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{5F51373B-6873-45DB-83D1-B612D9E74206}" = protocol=6 | dir=in | app=c:\program files\icq7.7\icq.exe | 
"{605B05C3-F7F7-4720-8763-5FAB73EBBB7D}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1225\agent.exe | 
"{62443F57-3543-4B5D-8BB4-A4D1E183606A}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{6CB9D98F-7AAD-46F5-AFE8-CA8AA0883C6D}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{72A0B933-1026-4E5A-94DB-ABE949E48D8E}" = dir=in | app=c:\program files\tightvnc\tvnserver.exe | 
"{7670B3CB-8BD2-444D-A67C-C9CD69D01CF9}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{786ABF54-75E0-471F-8F69-8CA77F0A0D10}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{80038D74-9C98-42CB-9F7D-AB749AAA66FF}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{804ECD7F-7BEF-4F6E-BF5E-CB92AFF9304D}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{80D2462D-A50C-4EE9-8771-2FF2391A4AE9}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{88E40273-7361-4346-82C8-0131F11C354E}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{8FC382D7-BDF8-4101-B4AC-FF0B24B6AB93}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{90F17606-FEE4-4119-A278-B2B981DB8CF7}" = protocol=6 | dir=in | app=c:\program files\icq7.7\icq.exe | 
"{9D834F60-C8F0-41B4-A493-176F8AC568D9}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe | 
"{A776E01A-6B9F-428C-80E7-7D2AED6A2D90}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{B08E6FE8-333A-49BD-B743-8900570B7057}" = protocol=17 | dir=in | app=c:\program files\icq7.7\icq.exe | 
"{B32B3E12-503B-4FDC-B1DA-D70EC656D71E}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{C3952E04-E1ED-4537-BCB8-3ED8C0A680EF}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe | 
"{C98859CB-E030-4BEE-9ACF-D639ADC75038}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1225\agent.exe | 
"{D1C0517C-ECD9-4FC3-888B-FA621FC188A0}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{E4C5E179-DB3F-4CCF-B80A-57CAFC954CBA}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{E8B32D1C-7007-424B-B37F-5547AD2A4E19}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{EBB95719-8E44-470B-B90D-8EC520BCF692}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{EC254287-A461-4D21-84D4-F6CAC3561822}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{F0F50EB7-B68C-4944-9F0B-1F765DFD0583}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\groove.exe | 
"{F1126536-461D-4783-B713-1E4F717F3B0E}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\groove.exe | 
"{F307A223-1297-41BE-A1E4-6606E70B6AB2}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{F32286BA-C358-4838-8AB2-E455BC22EDE1}" = protocol=6 | dir=in | app=c:\users\donald\appdata\local\akamai\netsession_win.exe | 
"{F5D670D1-23D0-420A-B17D-7E41DFD3E2B9}" = protocol=17 | dir=in | app=c:\program files\icq7.7\icq.exe | 
"{F689D0D7-9E56-4B07-99D2-FDBE296B8AE4}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{FB11A7DA-2119-4F73-95AD-0DC13666A013}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{FB566BAE-2A56-42B4-802D-FE33FA022E71}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{FCE9C210-CF7C-492D-BF3E-35987E4E10BB}" = protocol=17 | dir=in | app=c:\windows\explorer.exe | 
"{FD6A300D-9057-47A2-853E-86ADC147DF45}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"TCP Query User{1C2F8AD0-DA94-4673-BB7E-1AF1600FAD5C}C:\program files\aimp3\aimp3.exe" = protocol=6 | dir=in | app=c:\program files\aimp3\aimp3.exe | 
"TCP Query User{214C4F91-DB3E-4B6F-A6B7-02AA247F2691}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 
"TCP Query User{712B58FA-C376-4B0D-9249-186DE5E82445}E:\spiele\warcraft iii\warcraft 1.24.4\war3.exe" = protocol=6 | dir=in | app=e:\spiele\warcraft iii\warcraft 1.24.4\war3.exe | 
"TCP Query User{9CD8C4A5-5E56-4B14-A420-3E978B148572}C:\users\donald\appdata\local\akamai\netsession_win.exe" = protocol=6 | dir=in | app=c:\users\donald\appdata\local\akamai\netsession_win.exe | 
"UDP Query User{3A74DCF3-F118-4E83-A2E1-18C4C188E058}C:\program files\aimp3\aimp3.exe" = protocol=17 | dir=in | app=c:\program files\aimp3\aimp3.exe | 
"UDP Query User{9B74B858-66C8-4F1D-8932-A64233B71C7A}E:\spiele\warcraft iii\warcraft 1.24.4\war3.exe" = protocol=17 | dir=in | app=e:\spiele\warcraft iii\warcraft 1.24.4\war3.exe | 
"UDP Query User{D25D318D-DE63-4322-B201-41EECD80410E}C:\users\donald\appdata\local\akamai\netsession_win.exe" = protocol=17 | dir=in | app=c:\users\donald\appdata\local\akamai\netsession_win.exe | 
"UDP Query User{DB80A96F-4B28-46A5-B0F5-A4FF465C016E}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{1111706F-666A-4037-7777-203328764D10}" = JavaFX 2.0.3
"{122ADF8C-DDA1-480C-9936-C88F2825B265}" = Apple Application Support
"{12EE0B2A-84C6-494E-A7AC-6771E898F6A0}_is1" = HD2 Toolkit Version 4.2
"{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1ACD399C-7F26-43A6-9F16-3AB28F63FDC7}" = TightVNC
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{21AE04E8-EBF6-40DB-9AA9-B7A80C5D057D}" = mkv2vob
"{2222706F-666A-4037-7777-203328764D10}" = JavaFX 2.0.3 SDK
"{26A24AE4-039D-4CA4-87B4-2F83216022F0}" = Java(TM) 6 Update 22
"{26A24AE4-039D-4CA4-87B4-2F83216029FF}" = Java(TM) 6 Update 29
"{26A24AE4-039D-4CA4-87B4-2F83217003FF}" = Java(TM) 7 Update 3
"{2ADE2157-7A5E-122C-B51D-EB8A01B15943}" = DeepBurner v1.9.0.228
"{31A559C1-9E4D-423B-9DD3-34A6C5398752}" = HTC BMP USB Driver
"{32A3A4F4-B792-11D6-A78A-00B0D0170030}" = Java(TM) SE Development Kit 7 Update 3
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{42103338-9038-4D1B-9A5E-48C94F8EFF84}" = CWM-Toolkit [26.06.2011]
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{47FA2C44-D148-4DBC-AF60-B91934AA4842}" = Adobe AIR
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4F8477EA-40EE-4ABD-B3DC-F95E1AF8DE31}" = Spek
"{537056B7-32A4-4408-9B54-0341963C7C9C}" = UltraMon
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{6AD9F5F3-5BD0-4000-BD9C-B536CF86D988}" = iTunes
"{6D6664A9-3342-4948-9B7E-034EFE366F0F}" = HTC Driver Installer
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{77F665FD-3F60-4B0A-AE14-EC124B7A7FCE}" = ICQ7.7
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7BB5E925-A3DD-48C2-9A82-017AF5982FFE}" = Facebook Messenger 2.1.4590.0
"{8F1ADE4D-EFAC-4F5A-B346-23C2687FAF50}" = Apple Mobile Device Support
"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUS_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUS_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUS_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.PROPLUS_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.PROPLUS_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.PROPLUS_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A1439D4F-FD46-47F2-A1D3-FEE097C29A09}" = WIDCOMM Bluetooth Software
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB77DFDE-9949-4AEF-B180-BE322C3E65D0}" = HTC Sync
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 296.10
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 296.10
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 296.10
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 296.10
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.0213
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.7.11
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.2.24.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{BE78C655-F936-4ACE-B9B0-12F4287CBD1F}_is1" = MSI PLC Utility
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{D9D1A2FD-56B2-4F21-B959-745FE43CAB8C}" = Vegas Pro 9.0
"{DA909E62-3B45-4BA1-8B58-FCAEBA4BCEC9}" = NVIDIA PhysX
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{E7044E25-3038-4A76-9064-344AC038043E}" = Windows Mobile-Gerätecenter: Treiberupdate
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AIMP3" = AIMP3
"Akamai" = Akamai NetSession Interface Service
"Android SDK Tools" = Android SDK Tools
"Audacity_is1" = Audacity 2.0
"Avira AntiVir Desktop" = Avira Free Antivirus
"CCleaner" = CCleaner
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"Diablo III" = Diablo III
"DivX Setup" = DivX-Setup
"Driver Genius Professional Edition_is1" = Driver Genius Professional Edition
"EPSON BX320FW Series" = Druckerdeinstallation für EPSON BX320FW Series
"Gizmo Central" = Gizmo Central
"LAME_is1" = LAME v3.99.3 (for Windows)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Mp3tag" = Mp3tag v2.49b
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIA StereoUSB Driver" = NVIDIA 3D Vision Controller Driver
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"Rainmeter" = Rainmeter
"Sn1" = Logitech Scroll App 3.0
"sp6" = Logitech SetPoint 6.32
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"TreeSize Professional_is1" = TreeSize Professional V5.4.4
"VLC media player" = VLC media player 2.0.2
"vReveal" = vReveal
"WinRAR archiver" = WinRAR 4.10 (32-Bit)
"Zero Assumption Recovery_is1" = Zero Assumption Recovery Version 9
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Akamai" = Akamai NetSession Interface
"bb91a114638258b8" = Google Contact Sync
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 28.08.2012 11:53:52 | Computer Name = Donald-PC | Source = Windows Search Service | ID = 1019
Description = 
 
Error - 29.08.2012 10:22:35 | Computer Name = Donald-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
 werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
 ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
 DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
 und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
 
Error - 29.08.2012 10:22:35 | Computer Name = Donald-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
 werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
 ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
 DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
 und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
 
Error - 29.08.2012 10:22:35 | Computer Name = Donald-PC | Source = Microsoft-Windows-LoadPerf | ID = 3011
Description = Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren
 für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
 
Error - 29.08.2012 11:06:31 | Computer Name = Donald-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
 werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
 ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
 DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
 und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
 
Error - 29.08.2012 11:06:31 | Computer Name = Donald-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
 werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
 ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
 DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
 und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
 
Error - 29.08.2012 11:06:31 | Computer Name = Donald-PC | Source = Microsoft-Windows-LoadPerf | ID = 3011
Description = Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren
 für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
 
Error - 29.08.2012 12:09:03 | Computer Name = Donald-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
 werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
 ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
 DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
 und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
 
Error - 29.08.2012 12:09:03 | Computer Name = Donald-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
 werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
 ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
 DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
 und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
 
Error - 29.08.2012 12:09:03 | Computer Name = Donald-PC | Source = Microsoft-Windows-LoadPerf | ID = 3011
Description = Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren
 für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
 
[ System Events ]
Error - 27.07.2012 06:03:15 | Computer Name = Donald-PC | Source = DCOM | ID = 10016
Description = 
 
Error - 27.07.2012 13:03:21 | Computer Name = Donald-PC | Source = DCOM | ID = 10016
Description = 
 
Error - 29.07.2012 05:57:57 | Computer Name = Donald-PC | Source = DCOM | ID = 10010
Description = 
 
Error - 29.07.2012 05:58:08 | Computer Name = Donald-PC | Source = DCOM | ID = 10016
Description = 
 
Error - 29.07.2012 12:55:32 | Computer Name = Donald-PC | Source = DCOM | ID = 10016
Description = 
 
Error - 29.07.2012 13:25:01 | Computer Name = Donald-PC | Source = DCOM | ID = 10016
Description = 
 
Error - 29.07.2012 14:35:46 | Computer Name = Donald-PC | Source = DCOM | ID = 10016
Description = 
 
Error - 30.07.2012 13:47:04 | Computer Name = Donald-PC | Source = DCOM | ID = 10016
Description = 
 
Error - 31.07.2012 13:02:02 | Computer Name = Donald-PC | Source = DCOM | ID = 10016
Description = 
 
Error - 01.08.2012 10:51:49 | Computer Name = Donald-PC | Source = DCOM | ID = 10016
Description = 
 
 
< End of report >
         

GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-08-31 12:30:37
Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-3 Hitachi_HDP725050GLA360 rev.GM4OA5CA
Running: nu14vsoe.exe; Driver: C:\Users\Donald\AppData\Local\Temp\pwdirpow.sys


---- System - GMER 1.0.15 ----

SSDT            92C53BB6                                                                                          ZwCreateSection
SSDT            92C53BC0                                                                                          ZwRequestWaitReplyPort
SSDT            92C53BBB                                                                                          ZwSetContextThread
SSDT            92C53BC5                                                                                          ZwSetSecurityObject
SSDT            92C53BCA                                                                                          ZwSystemDebugControl
SSDT            92C53B57                                                                                          ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

.text           ntkrnlpa.exe!ZwRollbackEnlistment + 140D                                                          832893C9 1 Byte  [06]
.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                            832C2D52 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text           ntkrnlpa.exe!KeRemoveQueueEx + 11F7                                                               832C9EAC 4 Bytes  [B6, 3B, C5, 92]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1553                                                               832CA208 4 Bytes  [C0, 3B, C5, 92] {SAR BYTE [EBX], 0xc5; XCHG EDX, EAX}
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1597                                                               832CA24C 4 Bytes  [BB, 3B, C5, 92]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1613                                                               832CA2C8 4 Bytes  [C5, 3B, C5, 92]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1667                                                               832CA31C 4 Bytes  [CA, 3B, C5, 92] {RETF 0xc53b; XCHG EDX, EAX}
.text           ...                                                                                               

---- User code sections - GMER 1.0.15 ----

.text           C:\Program Files\Mozilla Firefox\firefox.exe[3944] ntdll.dll!LdrGetProcedureAddress + 26          77D82239 7 Bytes  JMP 5BF1B52A C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text           C:\Program Files\Mozilla Firefox\firefox.exe[3944] kernel32.dll!K32GetDeviceDriverBaseNameW + 5D  768993D6 7 Bytes  JMP 5C1CB6D2 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text           C:\Program Files\Mozilla Firefox\firefox.exe[3944] kernel32.dll!QueryPerformanceCounter + 13      7689C435 7 Bytes  JMP 5C1CB6F5 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text           C:\Program Files\Mozilla Firefox\firefox.exe[3944] GDI32.dll!GetViewportOrgEx + 26C               76CD884B 7 Bytes  JMP 5C1CB653 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume4                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

Device          \Driver\BTHUSB \Device\00000084                                                                   bthport.sys (Bluetooth-Bustreiber/Microsoft Corporation)
Device          \Driver\BTHUSB \Device\00000086                                                                   bthport.sys (Bluetooth-Bustreiber/Microsoft Corporation)
Device          \Driver\ACPI_HAL \Device\0000004d                                                                 halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg             HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\000d18014455                       
Reg             HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\000d18014455@d8b3778ad69b          0xCE 0xDA 0x42 0x9C ...
Reg             HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\000d18014455 (not active ControlSet)   
Reg             HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\000d18014455@d8b3778ad69b              0xCE 0xDA 0x42 0x9C ...

---- EOF - GMER 1.0.15 ----